andredezzy / infracraft

Не вдалося зібрати розв'язаний набір залежностей для цього звіту: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

Встановлення npm:@infracraft/gate@0.8.4 тягне 8 пакетів, прямих і транзитивних: 0 мають відомі сповіщення, з них 0 — прямі залежності.

Жодне відоме сповіщення не стосується оцінених залежностей.

Сповіщення означає, що версія, записана в графі залежностей, потрапляє в уражений діапазон. Досяжність не аналізується, а граф містить піниї розробки й тестування — знахідка може стосуватися інструментів, а не поставленого коду.

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 2115,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "JavaScript": 2901,
        "TypeScript": 795993
      },
      "pushed_at": "2026-07-19T00:43:30Z",
      "created_at": "2026-07-06T18:59:42Z",
      "owner_type": "User",
      "updated_at": "2026-07-19T00:42:37Z",
      "description": "Infrastructure crafting toolkit — Pulumi providers for Railway, Neon, Fly.io, and Vercel",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "TypeScript",
      "significant_languages": [
        "TypeScript"
      ]
    },
    "owner": {
      "blog": "https://andredezzy.com",
      "name": "André \"Dezzy\" Victor",
      "type": "User",
      "login": "andredezzy",
      "company": null,
      "location": "Brazil",
      "followers": 113,
      "avatar_url": "https://avatars.githubusercontent.com/u/38265368?v=4",
      "created_at": "2018-04-10T21:56:01Z",
      "is_verified": null,
      "public_repos": 72,
      "account_age_days": 3026
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "@infracraft/pulumi@3.0.0",
          "kind": "other",
          "published_at": "2026-07-19T00:43:31Z"
        },
        {
          "tag": "@infracraft/pulumi@2.9.0",
          "kind": "other",
          "published_at": "2026-07-08T17:05:43Z"
        },
        {
          "tag": "@infracraft/pulumi@2.8.0",
          "kind": "other",
          "published_at": "2026-07-08T13:54:33Z"
        },
        {
          "tag": "@infracraft/pulumi@2.7.0",
          "kind": "other",
          "published_at": "2026-07-06T19:44:52Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "7fe83c23994fc180e78506776550feaae80b0abf",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#4)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-19T00:42:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "230a28cd5b3ec50083033a8afaea87f9519ac9a4",
          "body": "Dependency-closure resolution is consumer domain knowledge, not library\nconcern. hash now accepts ordered path collections (directories and\nsingle files) with a base option labeling entries by relative path;\nidentically-fed collections reproduce hashApp's exact digests.",
          "is_bot": false,
          "headline": "feat(pulumi)!: generalize hash to path collections and drop hashApp",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-19T00:41:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "070663814ad8c49b58503f10fb332e9268bdb707",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#3)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-08T17:04:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b56a03c068faa8494e3f5ee54410a3b71c147437",
          "body": "`railway up`'s upload request intermittently fails at the transport level\n(\"error sending request for url …/up\"), creating no deployment and failing the\ndeploy (live incident). Retry it bounded (UPLOAD_ATTEMPTS × UPLOAD_BACKOFF_SECONDS)\n— only that transport error, so a flaky post-upload exit is lef\n[…]\n monitor and a deploy that actually started is never\nre-triggered. A POSIX `while` counter (no `seq` dependency) — a missing/failed\n`seq` would expand empty, skip the loop, and falsely report success.",
          "is_bot": false,
          "headline": "feat(railway): retry `railway up` on transient upload failures",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-08T17:03:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "61e37e33c058e7b61e62cc50916aa94b8ffc7eb7",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#2)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-08T13:53:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "28bdf8c8be674014f6c941934d524905811acf25",
          "body": "The deploy monitor detects a deployment stuck in INITIALIZING past a\nthreshold (default 5 min, `stuckInitializingMs`) without reaching BUILDING,\nredeploys from the same source onto a fresh build slot, cancels the wedged\ndeployment, and watches the new one — the recovery an operator would do by\nhand. Bounded by `maxRedeploys` (default 1); a transient redeploy failure\ndoes not consume the budget, so recovery survives a network blip.",
          "is_bot": false,
          "headline": "feat(railway): auto-recover deployments Railway wedges in INITIALIZING",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-08T13:39:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "166c795b29bbf8a4f10703fa789142c1593b14ca",
          "body": "…mi 2.7.1\n\nPackages that bundle their workspace dependencies (pulumi and gate inline\n@infracraft/sandbox) declared those siblings as devDependencies so the\nmonorepo could resolve them for the build — but that shipped an invalid\nworkspace:* specifier to the registry AND made the bundled package count\n[…]\nom the published\ntarball only (consumers never install a dependency's devDependencies),\nso published packages carry only real runtime deps. pulumi republished\nas 2.7.1 with a clean dependency surface.",
          "is_bot": false,
          "headline": "build: strip build-only devDependencies from published packages; pulu…",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-06T20:35:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f011838ca67f7a472ff3d6fd5a1c57fa3def99a3",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#1)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-06T19:44:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5572733a37b6bd13dda0a3be9685e67bbd916d0e",
          "body": "The bundling change removed it from dependencies, but the source still\nimports it for types — local workspace hoisting masked the missing\ndeclaration; CI's resolution did not. devDependencies keeps workspace/CI\ntype resolution working while staying absent from the published package.",
          "is_bot": false,
          "headline": "gate: declare bundled @infracraft/sandbox as a devDependency",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-06T19:27:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d63d32687d1b923c43e1cecc8f91f4f812da2aa7",
          "body": "Consumers now use namespace imports, matching pulumiverse/official\nproviders: import * as railway from '@infracraft/pulumi/railway' and\nnew railway.Project(...) — every platform-prefixed export (classes,\nArgs/Outputs/Options types, enums, clients, internal providers) drops\nits prefix inside its own \n[…]\nalified. Examples and fixtures use neutral\nnames throughout. Utility modules (sandbox, git-guard, hash, preflight)\nand their exports are unchanged. Ships as a minor per the pre-adoption\nsemver policy.",
          "is_bot": false,
          "headline": "refactor: adopt the official provider namespace pattern",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-06T19:26:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f8454baac8311b0df3265cd3c88e4c54763b6ba5",
          "body": null,
          "is_bot": false,
          "headline": "ci: leak gate — pattern from repository secret, paths-only reporting",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-06T18:56:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "67b32e8c1eefed8c614d6073c81375faaf65c220",
          "body": "Matches @infracraft/pulumi's bundling — gate now inlines sandbox's code\n(SandboxMode, deploy helpers) rather than declaring it as a runtime\ndependency, so gate is self-contained. 255 tests pass; dist is\nself-contained and clean.",
          "is_bot": false,
          "headline": "gate: bundle @infracraft/sandbox (drop runtime dep); 0.8.4",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-06T18:23:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7d232ad9ae6453f8c1c5689feac58e57e33f7f6a",
          "body": "…eset)",
          "is_bot": false,
          "headline": "chore: release @infracraft/pulumi 2.6.0 (consume agents-removal chang…",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-06T17:30:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "875e439f84d91c382acc7d45a0caf1d693ccf92b",
          "body": "The agent-hint block printed on every pulumi run to orient AI agents\nwithout repo context — but that reader doesn't exist (operating a stack\nrequires the repo, whose AGENTS.md/CLAUDE.md every agent loads), and the\nblock diluted the raw command output it sat in (Pulumi counted it as\ndiagnostics and offered Neo help for a clean run). Knowledge folded into\nthe consumer repos' agent instructions; module and its enum deleted.",
          "is_bot": false,
          "headline": "remove: @infracraft/pulumi/agents (hint block no longer earns its cost)",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-06T17:04:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "721bc3f6b47b6d53501ae49d4b3ff512b1fe44fc",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#39)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-06T16:55:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bbbe5a10fc815f4d8fa178d5adde43dbaf6a6531",
          "body": null,
          "is_bot": false,
          "headline": "changeset: carrier for the unpublished zero-ceremony guard content",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-06T16:53:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "17dea54f1637dbdb77142cb65682abc60b2e9885",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#38)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-06T16:52:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "568e68f430e0edbeac9c86becf405ec13fd3b42a",
          "body": null,
          "is_bot": false,
          "headline": "docs: restore provider reference specs (neutralized consumer references)",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-06T16:50:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9fc4e373410733f102d94ac57354af43b78a6915",
          "body": "- Provider constructors (Railway/Vercel/Fly/Neon) run the memoized\n  ensurePulumiVersionMatch() automatically — no explicit preflight call\n  needed in programs. Guard activates only under a real Pulumi run (the\n  engine env marker), so unit tests never couple to the host CLI; a\n  resolved major.mino\n[…]\numi/pulumi (3.243.0) had drifted from the CLI\n  (3.250.0) — now aligned.\n- All example names in comments, fixtures, and docs are neutral; dated\n  internal design documents removed from the repository.",
          "is_bot": false,
          "headline": "preflight: zero-ceremony version guard; neutral example names",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-06T16:49:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0b997b47c2d0ba95c19c3713c7d8c9de6cec11a2",
          "body": "…eads, state safety\n\nFrom a dual-lens final review (operational concerns + provider-canon\nprinciples), all findings adjudicated:\n- deploys REQUIRE a DeploySandbox in their own dependsOn or an explicit\n  allowUnsandboxed: true — silent working-tree deploys are now impossible\n  (the regression class t\n[…]\nr probes bare-UUID fallback ids before the 20-minute poll.\n- set-only Railway fields documented honestly (null-clearing unproven);\n  assorted check()/JSDoc/naming conformance from the principles lens.",
          "is_bot": false,
          "headline": "review: adjudicated concerns+principles wave — sandbox guard, drift r…",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-06T08:08:08Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b6a86ef5136b7ccca5b4bed68dbe71385a66158a",
          "body": "First live executions surfaced and fixed three test-side defects and\npinned new platform truths:\n- serviceCreate WITHOUT environmentId materializes instances in EVERY\n  environment (the 'only in its env' truth applies to env-scoped creates).\n- A branch with no read-write endpoint 404s role operation\n[…]\ned live: Neon adopt-or-create, in-place password rotation,\ncopy-on-write branch fork; Railway adopt-or-create, deployV2 image\ndeploy, unskip-rejection, env-scoped volume adoption, direct-env\ncreation.",
          "is_bot": false,
          "headline": "test(live): certify tier on real APIs; encode refined Railway truths",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-06T06:52:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "176c1ad81788269d414ed3df593c41a1f958b5f6",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#36)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-06T04:56:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d3ca345bc9311ec59dbbbeda7df73f27b34e210e",
          "body": "Highlights, all defect-class fixes from a full-source audit:\n- preflight: replace assertCloudflareTokenScopes with\n  assertCloudflareZoneAccess — /user/tokens/verify rejects account-owned\n  tokens (proven live: same token 200 on zone read, 401 on verify), and a\n  zone read proves the capability the \n[…]\nctResourceProvider exported + tested.\n- shared GraphQL not-found detector replaces three duplicated regexes.\n- vercel: stale @example fixed, unused client verbs removed, doc/naming\n  consistency pass.",
          "is_bot": false,
          "headline": "quality: audit-driven cleanup wave across providers and preflight",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-06T04:55:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6efaaee032d3779888913d04e532b6dfa69d255d",
          "body": "…ruths\n\nRuns the resource providers against real platform APIs behind\nINFRACRAFT_LIVE_TEST=1 + per-platform creds (skips clean otherwise;\nexcluded from the default suite). Covers adopt-or-create idempotency,\nnon-default-env instance materialization via patch-commit, deployV2,\nenvironmentUnskipService rejection, env-scoped volume adoption,\nin-place role password rotation, and copy-on-write branch forking —\nthe live-API-only truths mocked unit tests cannot catch.",
          "is_bot": false,
          "headline": "test: env-gated live integration tier encoding the Railway/Neon API t…",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-06T04:55:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "08d585a9b5fb36bbb42f3071d241b19d635fca70",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#35)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-06T03:01:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cde09728a5efd74b7258b8b991d1fcb44a358323",
          "body": "Two opt-in plan-time guards for failures this session hit mid-apply:\n- assertPulumiVersionMatch: the Pulumi CLI (Go engine) and @pulumi/pulumi\n  SDK (Node serializer) must agree — a skew caused intermittent\n  'Unexpected struct type' marshal failures on dynamic resources.\n- assertCloudflareTokenScop\n[…]\ncement isn't possible via the token alone — requiredPermissionGroups\n  is advisory. Catches invalid/disabled/expired tokens at plan time.\nBoth modeled on assertHostBinaries; opt-in (not auto-invoked).",
          "is_bot": false,
          "headline": "preflight: CLI/SDK version-match + Cloudflare token-active checks",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-06T03:00:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a763071f11ef5438ef7eb983c410ee9284555b14",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#34)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-06T02:38:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "552f2e8761658fb3387f133e30bbfbf886ad2053",
          "body": "The acme-alpha stack migrated Vercel CRUD to @pulumiverse/vercel\n(Project/ProjectDomain/ProjectEnvironmentVariables — native substrate,\nno dynamic-provider marshal bug). Delete infracraft's now-dead versions:\nVercelProject, VercelDomain, and the deploy-integrated env-var mechanism\n(env-applier/env-v\n[…]\nicial coverage). Also fix deploymentUrl to\nextract the https URL from stdout rather than the last line (which had\nbecome the vercel CLI's JSON closing brace). Minor, not major — no\nexternal users yet.",
          "is_bot": false,
          "headline": "vercel: remove resources superseded by the official provider",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-06T02:37:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4a62e6c7fc7aa953aac4810a135bcee8f2849ac4",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#33)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-05T22:13:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "80b0443a66860a9ca241da46150ea4c377917c48",
          "body": "The dynamic resource hit a Pulumi engine-internal marshal bug on\nclean-slate creates that no input shape avoids; VercelDeploy.variables\nis the mechanism (official resource-shaped modeling returns with the\nnative-provider graduation). Dead env-var-api exports pruned to\nmodule-private.",
          "is_bot": false,
          "headline": "vercel: remove VercelVariable (BREAKING) — no deprecated code",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T22:12:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4e1280881172b615cb7a00dc50c93a86dd484053",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#32)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-05T22:07:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "632e36835019c77ee0f3adbf1091bd9fd81689d8",
          "body": "…path\n\nVercelVariable hits a Pulumi engine-internal stateful bug — 'Unexpected\nstruct type' on clean-slate first creates, strictly alternating\npass/fail across identical runs, reproduced with plain-literal inputs\non matched CLI/SDK versions; four structural theories falsified by\nbisection. VercelDep\n[…]\ne the\ndeploy command via a Node bin (shared REST logic in env-var-api.ts,\nENV_CONFLICT-aware), with a payload digest in the triggers. The dynamic\nresource stays exported, deprecated with the evidence.",
          "is_bot": false,
          "headline": "vercel: deploy-integrated env vars, off the dynamic-provider marshal …",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T22:05:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "87c7bf8e10cc15910eabf6b29ef21b210a1f019e",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#31)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-05T21:13:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "11dc1c293eb527d7c0e6a6458741fbf30458d7fe",
          "body": "Railway's API rejects any healthcheckPath containing a hyphen with a\nbare 'Invalid input' — undocumented, isolated by a live probe matrix\n(every hyphen-free variant succeeds, every hyphenated one fails,\nindependent of deploy state, auth path, or timeout). check() now turns\nthe landmine into a plan-time failure with the full explanation.",
          "is_bot": false,
          "headline": "railway: reject hyphenated healthcheckPath at plan time",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T21:12:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d0431720fe1151486747f7f7d652c82b9f4e1ca0",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#30)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-05T20:51:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "358d4756e44d032dcc3f9d5e801f9bd21e10948c",
          "body": "Neon mutations are async operations; 423 means earlier ones are still\nsettling and the docs prescribe waiting for completion. A destroy\nimmediately followed by an up hit this deterministically (Attempt 3,\n17s in). Bounded probing — 5s interval, ~2 minutes — then loud failure.",
          "is_bot": false,
          "headline": "neon: wait out the 423 project-operations lock",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T20:50:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3dee28a06d3cef98297ed5d647afe27f19bea24c",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#29)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-05T20:40:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "16e1098b448c27723ec79edecde2f06a9a5abe01",
          "body": "envIds/contentHash placeholders next to an Output-valued map input\ndeterministically failed engine serialization ('Unexpected struct\ntype') on every create/update across three from-zero runs — the same\nclass as the project-token secret-placeholder incident. Both are\nstate-only bookkeeping with zero Output consumers; the unused\ncontentHash component output is removed.",
          "is_bot": false,
          "headline": "vercel: drop VercelVariable's undefined output placeholders",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T20:38:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d92e78f6df756cb44fcd61cf01b09e9f8d287bd9",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#28)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-05T20:16:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7f6dce4b30256f62f5f6696f90c98eca1621469d",
          "body": "Provider credentials move out of dynamic-resource inputs: providers take\ntokenEnvVar (Neon: apiKeyEnvVar) and resources resolve the value from\nthe plugin process environment at execution — removing the substrate for\npulumi/pulumi#16041 (secret Outputs in dynamic-provider inputs\nintermittently fail e\n[…]\nvices\nre-apply it after the provider-owned deploy (loud on failure); code\nservices get it applied by the deploy monitor at LIVE via IC_HC_*\nbindings (3 bounded attempts, then the deploy fails loudly).",
          "is_bot": false,
          "headline": "zero-fails wave: env-var-first credentials + never-drop healthcheck",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T20:15:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7e3d9f2ed2acb3df86eef40d98aa9dad4e71373c",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#27)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-05T18:39:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a851353afe72063795cef0a1beee746ed74e6186",
          "body": "A command that errored before emitting output left stdout undefined;\nthe trim call then masked the real failure with a TypeError.",
          "is_bot": false,
          "headline": "commands: guard deploymentUrl against undefined stdout",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T18:38:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "abb65866eab2bac5a4575d2f52b33ebad713ec7b",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#26)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-05T18:32:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0194e38d7dc25abacdfcb407a54ab26dbee53feb",
          "body": "environmentUnskipService is scoped to PR environments (rejected live\nwith 'Can only unskip services in PR environments'). Named environments\nmaterialize a skipped service through the staged-changes flow — an\nenvironmentPatchCommit keying the service in the config's services map,\nper Railway's manage-environments docs. Existence is still re-verified\nafterward; a missing instance stays a loud error.",
          "is_bot": false,
          "headline": "railway: materialize instances via config-patch commit, not unskip",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T18:31:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a96a8312982ccdc64de331b1b8d02e5038731c9d",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#25)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-05T18:24:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "04b439a72703f36603dd339124a7593fc278d4df",
          "body": "serviceCreate materializes an instance only in its own environment; in\nevery other environment the service is skipped — serviceInstanceUpdate\nreturns true while doing nothing and railway up fails UPLOAD_FAILED 404\n(live incident: first mesh deploy to production). The provider now\nprobes serviceInsta\n[…]\n afterward. Plus: ApiNotFoundError exported from provider\nsubpaths, full README sync (rotation handles, transport, check/stables,\nenv-scoped volumes, VercelDomain/VercelClient), stale JSDoc corrected.",
          "is_bot": false,
          "headline": "railway: ensure a service instance exists in the target environment",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T18:23:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6780edb09677ab47c3291651fb860aff358c1078",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#24)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-05T18:09:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3e25948e17d3587691d842f20b58c4cd4906635f",
          "body": "A failed railway up killed the deploy script AT the capture assignment\n— before the exit code was saved and the output re-emitted — leaving\nzero diagnostics (live production incident: first-ever mesh deploy to\nan environment with no service instance). if/else-guarded now; the\nCLI's real error always surfaces and the monitor still owns pass/fail.",
          "is_bot": false,
          "headline": "railway: guard the up-output capture against set -e",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T18:07:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3292259dcfc94a3120b8f7cd21da09c9c1cdf6b1",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#23)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-05T18:04:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6fd21b561563729b762a852773f6795cc44915d1",
          "body": "Volume lookup matched serviceId alone; services are project-level, so a\nnew stack adopted a sibling environment's volume (production adopted\nstaging's — live incident). Instances must match serviceId AND\nenvironmentId; no match → create + attach-deploy in the right env.\n\nDX wave: fly secret/certificate/ip + railway/vercel variable test\ncoverage (+73 tests), preflight host-binary doctor wired into the\nsandbox workspace, awk filter rejects pathological quote/newline paths.",
          "is_bot": false,
          "headline": "railway: environment-scoped volume adoption + DX hardening wave",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T18:03:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9016d05a703b1b314f0a0b25bd78c8fc98b3cf81",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#22)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-05T17:39:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ce8b9b73b7706e2dd36fd41cfd7f6e9787c20424",
          "body": "…n, naming audit doc-links\n\n- diff() declares identity outputs stable on in-place updates (SDK:\n  'properties that will not ever change') so dependents stop\n  phantom-replacing in previews — the RailwayService/RailwayVolume case\n- check() validates locally-decidable inputs with property-named\n  fail\n[…]\n name rule, sizeGb), guarding Pulumi's preview-unknown sentinel\n- every lossy arg-name deviation from the platform API now carries a\n  JSDoc line naming the API field it maps to (renames are breaking)",
          "is_bot": false,
          "headline": "canon tail: stables for preview fidelity, check() plan-time validatio…",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T17:38:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "de7983b6429d8077a06fe246f38efe81b2cc8730",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#21)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-05T17:00:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f9cedb2755f1385adc861b8ab66fe6fd701d7047",
          "body": "…, idempotent deletes, secret state\n\n- delete() treats already-gone as satisfied everywhere (unblocks the\n  rotation tombstone: create()'s stale-name cleanup racing the engine's\n  delete is now harmless)\n- read() returns blank id when the remote resource is gone (ReadResult\n  contract) so refresh re\n[…]\nr credentials explicitly secret-marked in dynamic state\n- README design-principles section (adopt-or-create IS the import\n  principle for dynamic providers — pulumi import is unimplemented\n  for them)",
          "is_bot": false,
          "headline": "align providers with official canon: resilient transport, drift reads…",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T16:59:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "97a12963de9d8b897e78c6c7b842748f6d95881d",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#20)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-05T16:14:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cd14a87de47bef1889e9b546d5bd5ee5a95a389e",
          "body": "Bumping tokenVersion replaces the token with create-before-delete —\nthe new token exists before the old is revoked, so rotation has no\ntokenless window (create() already cleans up stale same-name tokens).\nIdentity changes keep delete-first. The parent ComponentResource has no\ndiffable state, so target-replacing it was a silent no-op against\nRailway — rotation is now a declared input, not URN surgery.",
          "is_bot": false,
          "headline": "railway: tokenVersion rotation handle on RailwayProjectToken",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T16:13:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b4f595938a709677f7b539a49b98b2bf818b0e6d",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#19)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-05T15:58:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9775e5300c419c866552beed655a65021a5e020f",
          "body": null,
          "is_bot": false,
          "headline": "neon: silence unused update() id parameter",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T15:57:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d381f02dd01224dc1954d18c14da8e332537c8e2",
          "body": "Bumping passwordVersion resets the role's password through Neon's\nreset_password endpoint as an UPDATE — a replace would try to delete\nthe role, which Neon refuses for default roles and which would drop\ngrants for others. Consumers of the password output cascade normally.",
          "is_bot": false,
          "headline": "neon: in-place role password rotation via passwordVersion",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T15:56:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c275a0a5d4985912234680083f555b7f6807fa1b",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#18)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-05T15:51:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "797e7c31ab6c0b200c1a2d9162b3f3f7f2bb8090",
          "body": "A volume mounts only on the NEXT deployment; attach alone changes\nnothing for a running service (the dashboard redeploys after attach for\nthe same reason). Best-effort: services with no deployable source yet\nget their mount with their first real deploy.",
          "is_bot": false,
          "headline": "railway: redeploy service instance after attaching a new volume",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T15:50:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "52637587906c05721337b25e9967b111467dd483",
          "body": "ServiceCreateInput.source only configures the default environment's\ninstance; every other environment's instance is born with source=null,\nso deploy triggers no-op silently and private DNS never registers.\napplyInstanceConfig now carries source per instance, and the provider\nowns the deploy for image services via serviceInstanceDeployV2 on\ncreate and update (proven against the live API: environmentTriggersDeploy\nreturns success without creating anything for a never-deployed service).",
          "is_bot": false,
          "headline": "railway: converge image services in non-default environments",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T15:46:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2fd53a29a056da0699acee4907f7432e38629e65",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#17)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-05T07:48:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "367a1b7e0a9dc166d03e663ac3c61e3a9941de2a",
          "body": "The filter special-cased apps/* for the manifest carve-out, using the\npath prefix as a proxy for 'is a workspace member'. Excluding a member\noutside apps/ (infrastructure/) starved the sandboxed bun install of its\nmanifest and failed the build with 'Workspace not found'. The rule is\nnow uniform: drop the subtree, keep its own package.json — inert when\nthe directory is not a member.",
          "is_bot": false,
          "headline": "sandbox: keep excluded directories' package.json in the deploy copy",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T07:47:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c372ef49c65dc2a41eab21d308ec9c4b71d02840",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#16)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-05T07:12:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9829e7f146ac50335ab80c101b248fcf55c68cc3",
          "body": "pulumi-command embeds the executed command in its failure error and\nPulumi does not scrub secrets from provider diagnostics, so the inlined\nRAILWAY_TOKEN printed in plaintext whenever a deploy failed. The env map\nis no alternative: an unknown secret there fails preview, and the token\nis a resource output that is unknown on first preview. stdin is a scalar\ninput that may be unknown at preview (like create already is) and never\nappears in diagnostics.",
          "is_bot": false,
          "headline": "railway: pass deploy token via stdin, never in the command script",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T07:10:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "11ca639ad55ebb890de1686b1f62b08512f38cd7",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#15)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-05T00:45:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e2006e71156216b1602892259680fb3ce5f82fdc",
          "body": "verified live: verificationDnsHost/verificationToken sit on\nCustomDomain.status, as siblings of dnsRecords rather than inside it —\nRailway populates them independently, so a custom domain can show a\npropagated CNAME while still needing this TXT record for ownership\nverification before its certificate issues. verificationToken already\ncomes back pre-prefixed with railway-verify= (verified against the live\nAPI, not assumed) — composeVerificationTxtValue stays idempotent in case\nthat ever changes.",
          "is_bot": false,
          "headline": "railway: expose ownership-verification TXT record on RailwayDomain",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T00:43:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0f1bb921540f45a4ae6d9227f97e6b7c635195a9",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#14)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-05T00:09:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0aaaf341ee3c8046e00d54d38c01caa999fd1310",
          "body": "VercelDomain now fetches GET /v6/domains/{domain}/config and exposes the\ntop-ranked recommendedCNAME as cnameTarget, mirroring RailwayDomain's\noutput. Vercel's recommendation can vary by account/domain, so a static\nconstant was never really correct. Falls back to cname.vercel-dns.com\n(logged) only if Vercel returns no recommendation.\n\nVERCEL_CNAME_TARGET is no longer exported — zero external consumers ever\nexisted, and the dynamic value replaces its purpose.",
          "is_bot": false,
          "headline": "vercel: dynamic cnameTarget from Vercel's own domain config",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-05T00:06:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7883d6f97208b7c0abd17c1404ed6b61bdd378e4",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#13)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-04T23:25:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c4813b4729ff3511f55fd01bce3bda5cffc8fbfd",
          "body": "Custom domain DNS setup needed the actual CNAME target, not just the\ndomain's own FQDN. Extracted from Railway's traffic-routing DNS record;\nverified independently correct per domain when a service carries more\nthan one custom domain (adopt/delete already scope by exact domain name\nand domainId, so nothing here needed to change to be multi-safe).",
          "is_bot": false,
          "headline": "railway: expose cnameTarget on RailwayDomain",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-04T23:21:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "375bc6af5dd50785cdfc575170dca3739b8cecf8",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#12)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-04T23:09:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "904410e5ab8b5e63f715b08152c5864817fb142b",
          "body": "serviceCreate omitted environmentId, so a new service's first auto-deploy\nlanded in the project's default environment instead of the one it was\nactually created in. Add VercelDomain (adopt-or-create) alongside it —\nattaching a custom domain to a Vercel project had no resource yet.",
          "is_bot": false,
          "headline": "railway: scope serviceCreate to the target environment",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-07-04T23:06:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "90fccf596f20c88b3732a38abf4a5573838c722f",
          "body": null,
          "is_bot": false,
          "headline": "Sync every README with the shipped 0.8.0 surface",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T21:46:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "abd22a24dcc92c98519b81db1204cacb8b72c5d3",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#11)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-10T21:26:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "861c8325e9eb111e6fb3549907b05471b5d5091b",
          "body": null,
          "is_bot": false,
          "headline": "gate: pin --project staying native in deploy args",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T21:24:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ec183f8cd77ca4d7996d1e047e3704ed6134d416",
          "body": null,
          "is_bot": false,
          "headline": "gate: document --project targeting + changeset for 0.8.0",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T21:24:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e03995288e798c22f423f9915c1545d4945c59c2",
          "body": null,
          "is_bot": false,
          "headline": "gate: passthrough resolves --project targets into spawn env",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T21:24:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4b8e33cdb7c1ab59205f14d81e626239b3127227",
          "body": null,
          "is_bot": false,
          "headline": "gate: parser and router carry the passthrough target name",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T21:24:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d0a74e73a917318536f1547bc5400dea544b17d8",
          "body": "…k env vars",
          "is_bot": false,
          "headline": "gate: passthroughTarget capability — vercel resolves --project to lin…",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T21:24:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "878067e53bf5efd58c8e2752422a5b3ec315a623",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#10)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-10T20:21:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fb614f2e37b5e78356a75924ceffce4e2d6a2762",
          "body": null,
          "is_bot": false,
          "headline": "gate: auth commands honor the non-interactive guard; doc polish",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T20:18:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4fb7c0474f3b55dd461ef0feaff90664a25bd4c0",
          "body": null,
          "is_bot": false,
          "headline": "gate: changeset for 0.7.0 — universal native passthrough",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T20:18:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a92df79c33e8185cfb85c34394f3eee3d054203f",
          "body": null,
          "is_bot": false,
          "headline": "gate: README rewrite for the auth namespace and universal passthrough",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T20:18:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d37d2f77498fbd1efe0323faccca93f67acf239a",
          "body": "…Cli removed",
          "is_bot": false,
          "headline": "gate: own the dispatch — citty, command factories, layout, and deploy…",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T20:18:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b930e38bbec03aa6b291e043e288e7b7aad3317e",
          "body": null,
          "is_bot": false,
          "headline": "gate: CommandSpec literals, registry, and help renderer",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T20:16:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "41d67ced2982af74ddaf155758e5ccc2df815a2d",
          "body": "…nteractionMode preflight",
          "is_bot": false,
          "headline": "gate: deploy composes through nativeCli; region-aware deploy flags; I…",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T20:16:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c9d3acb2d9d2c9b1e262d4a0eb347750b025d54a",
          "body": null,
          "is_bot": false,
          "headline": "gate: passthrough command — account, session, stderr badge, exit code",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T20:16:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cb3568776fb71aa3a769b334f336b0c55ba86503",
          "body": null,
          "is_bot": false,
          "headline": "gate: passthrough runner with full TTY inherit",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T20:16:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e3290964e28e7c1aa23e0ee9685c85b12781bee5",
          "body": null,
          "is_bot": false,
          "headline": "gate: pure routeCommand with discriminated-union routes",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T20:16:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1c0c1926944d2d61314ff1cc417ce8b912253940",
          "body": null,
          "is_bot": false,
          "headline": "gate: region-aware splitGateFlags parser",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T20:16:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0717678dca66a204c4147251a43b61798d21ed47",
          "body": "…h paths",
          "is_bot": false,
          "headline": "gate: thread InteractionMode through account resolution; hardcode aut…",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T20:16:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "108be0ec7e20c110e0eccdd711759013e9229492",
          "body": "…n last resort",
          "is_bot": false,
          "headline": "gate: InteractionMode + non-interactive guard before the browser-logi…",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T20:16:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6933ae8ac2573be0996575782d333563d8ee1c9c",
          "body": "…tract",
          "is_bot": false,
          "headline": "gate: nativeCli injection point + deploy metadata on the provider con…",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T20:16:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "81949d26b3c51c82be0a74f4d64fad93d9c25513",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#9)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-10T16:58:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e77de3b5e51b54a6f7f4a86aa7162eadf35909d9",
          "body": null,
          "is_bot": false,
          "headline": "gate: say stub .git in the sandboxed-deploy log line",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T16:56:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1f3577c95ef4faf461b9be440aa6c67cf0adbae2",
          "body": null,
          "is_bot": false,
          "headline": "Reframe deploy-sandbox docs around working-tree isolation",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T16:49:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1851bcfdeca28ad6541b589c3f983015b1639543",
          "body": "Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Version packages (#8)",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-10T16:34:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5f855ff27929a1fe3468eade9a859beb56e6abb7",
          "body": null,
          "is_bot": false,
          "headline": "gate: document --create-project and quote the created target name",
          "author_name": "André \"Dezzy\" Victor",
          "author_login": "andredezzy",
          "committed_at": "2026-06-10T16:20:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 4,
      "commits_last_year": 262,
      "latest_release_at": "2026-07-19T00:43:31Z",
      "latest_release_tag": "@infracraft/pulumi@3.0.0",
      "releases_from_tags": false,
      "days_since_last_push": 5,
      "active_weeks_last_year": 5,
      "days_since_latest_release": 5,
      "mean_days_between_releases": 4.1
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 42,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "@infracraft/gate",
          "exists": true,
          "license": "MIT",
          "keywords": [],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@infracraft/gate",
          "is_deprecated": false,
          "latest_version": "0.8.4",
          "repository_url": "https://github.com/andredezzy/infracraft",
          "versions_count": 1,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 744,
          "first_published_at": "2026-06-09T22:16:42.796000Z",
          "latest_published_at": "2026-07-06T18:21:46.305000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 17
        },
        {
          "name": "@infracraft/pulumi",
          "exists": true,
          "license": "MIT",
          "keywords": [],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@infracraft/pulumi",
          "is_deprecated": false,
          "latest_version": "3.0.0",
          "repository_url": "https://github.com/andredezzy/infracraft",
          "versions_count": 4,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 6148,
          "first_published_at": "2026-05-27T04:09:09.673000Z",
          "latest_published_at": "2026-07-19T00:43:29.167000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        },
        {
          "name": "@infracraft/sandbox",
          "exists": true,
          "license": "MIT",
          "keywords": [],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@infracraft/sandbox",
          "is_deprecated": false,
          "latest_version": "0.2.1",
          "repository_url": "https://github.com/andredezzy/infracraft",
          "versions_count": 6,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 636,
          "first_published_at": "2026-06-09T22:16:42.092000Z",
          "latest_published_at": "2026-07-06T16:53:20.610000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 17
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 1,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": null,
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "packages/config-test/tsconfig.json",
        "packages/config-tsdown/tsconfig.json",
        "packages/gate/tsconfig.json",
        "packages/pulumi/tsconfig.json",
        "packages/sandbox/tsconfig.json"
      ],
      "toolchain_manifests": [],
      "largest_source_bytes": 25735,
      "source_files_sampled": 174,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": "published_package",
        "source": "osv",
        "findings": [],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 8,
        "malicious_count": 0,
        "assessed_package": "npm:@infracraft/gate@0.8.4",
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "npm"
      ],
      "dependencies": [
        {
          "name": "vitest",
          "manifest": "packages/config-test/package.json",
          "ecosystem": "npm",
          "version_constraint": "4.1.7"
        },
        {
          "name": "tsdown",
          "manifest": "packages/config-tsdown/package.json",
          "ecosystem": "npm",
          "version_constraint": "0.22.0"
        },
        {
          "name": "@clack/prompts",
          "manifest": "packages/gate/package.json",
          "ecosystem": "npm",
          "version_constraint": "1.5.1"
        },
        {
          "name": "picocolors",
          "manifest": "packages/gate/package.json",
          "ecosystem": "npm",
          "version_constraint": "1.1.1"
        },
        {
          "name": "yaml",
          "manifest": "packages/gate/package.json",
          "ecosystem": "npm",
          "version_constraint": "2.9.0"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 4,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "andredezzy",
          "commits": 220,
          "avatar_url": "https://avatars.githubusercontent.com/u/38265368?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "drift.yml",
        "leak-gate.yml",
        "release.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        "biome.json",
        "eslint.config.mjs"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 2,
            "reason": "1 out of 4 merged PRs checked by a CI test -- score normalized to 2",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/26 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 3,
            "reason": "project has 1 contributing companies or organizations -- score normalized to 3",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "19 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "7fe83c23994fc180e78506776550feaae80b0abf",
        "ran_at": "2026-07-24T13:23:39Z",
        "aggregate_score": 2.3,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-20T08:41:49Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-07-19T00:42:33Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/andredezzy/infracraft",
    "host": "github.com",
    "name": "infracraft",
    "owner": "andredezzy"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 57,
      "inputs": {
        "security": 38,
        "vitality": 75,
        "community": 34,
        "governance": 57,
        "engineering": 71
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 75,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 58,
            "inputs": {
              "commits_last_year": 262,
              "human_commit_share": 0.65,
              "days_since_last_push": 5,
              "active_weeks_last_year": 5
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 5 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "5/52 weeks with commits",
                "points": 3.5,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 5
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "262 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 262
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "releases_count": 4,
              "latest_release_tag": "@infracraft/pulumi@3.0.0",
              "releases_from_tags": false,
              "days_since_latest_release": 5,
              "mean_days_between_releases": 4.1
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "4 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 5 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~4.1 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 4.1
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 34,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 1,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "1 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 65,
            "inputs": {
              "packages": [
                "@infracraft/gate",
                "@infracraft/pulumi",
                "@infracraft/sandbox"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 7528
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "7,528 downloads/month across npm",
                "points": 51.7,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 7528,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 57,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 13,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "good",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 72,
            "inputs": {
              "merged_prs": 4,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "4/4 decided PRs merged",
                "points": 38.2,
                "status": "met",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 4,
                      "decided": 4
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/26 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 62,
            "inputs": {
              "followers": 113,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "andredezzy",
              "public_repos": 72,
              "account_age_days": 3026
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "113 followers of andredezzy",
                "points": 14.8,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 113,
                      "login": "andredezzy"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "72 public repos, account ~8 yr old",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 72
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 8
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "@infracraft/gate",
                "@infracraft/pulumi",
                "@infracraft/sandbox"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 5
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "3 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 3,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 5 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "6 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 6
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 71,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 68,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "4 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": "biome.json, eslint.config.mjs",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "biome.json, eslint.config.mjs"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "1 out of 4 merged PRs checked by a CI test -- score normalized to 2",
                "points": 4,
                "status": "partial",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "good",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 75,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 38,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "critical",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 23,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 2.3
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "1 out of 4 merged PRs checked by a CI test -- score normalized to 2",
                "points": 0.5,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/26 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 0.8,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "19 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:@infracraft/gate@0.8.4 runtime dependency closure — what installing the published package pulls in — 8 packages. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_published",
                "params": {
                  "package": "npm:@infracraft/gate@0.8.4",
                  "assessed": 8
                }
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 0,
              "affected_packages": 0,
              "assessed_packages": 8,
              "unassessed_packages": 0,
              "affected_by_severity": "none",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "no indirect dependency carries a known advisory",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "no_indirect_advisories",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 8,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 3
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 52,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.969,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "63 of 65 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 63,
                      "sampled": 65
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "at_risk",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 44,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [
                "packages/config-test/tsconfig.json",
                "packages/config-tsdown/tsconfig.json",
                "packages/gate/tsconfig.json",
                "packages/pulumi/tsconfig.json",
                "packages/sandbox/tsconfig.json"
              ],
              "agent_commit_share": 0,
              "toolchain_manifests": [],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": "biome.json, eslint.config.mjs",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "biome.json, eslint.config.mjs"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "packages/config-test/tsconfig.json, packages/config-tsdown/tsconfig.json, packages/gate/tsconfig.json, packages/pulumi/tsconfig.json, packages/sandbox/tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "packages/config-test/tsconfig.json, packages/config-tsdown/tsconfig.json, packages/gate/tsconfig.json, packages/pulumi/tsconfig.json, packages/sandbox/tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "TypeScript",
              "largest_source_bytes": 25735,
              "source_files_sampled": 174,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "TypeScript (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "TypeScript"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/174 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 174,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-24T13:23:46.705804Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/a/andredezzy/infracraft.svg",
  "full_name": "andredezzy/infracraft",
  "license_state": "standard",
  "license_spdx": "MIT"
}