@dpuse/dpuse-development 0.3.559 → 0.3.564

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/.gitignore_published +1 -1
  2. package/.gitignore_unpublished +1 -1
  3. package/README.md +61 -44
  4. package/dist/dpuse-development.es.js +3 -5
  5. package/dist/dpuse-development.es.js.map +1 -1
  6. package/package.json +3 -9
  7. package/eslint.config.ts +0 -73
  8. package/tsconfig.json +0 -34
  9. package/vite.config.ts +0 -56
  10. package/vitest.config.ts +0 -21
package/.gitignore_published CHANGED
@@ -1,4 +1,4 @@
1
- # Common git ignore configuration for PUBLISHED Data Positioning projects.
1
+ # Common git ignore configuration for PUBLISHED DPUse projects.
2
2
  .env
3
3
  .npmrc
4
4
  .wrangler
package/.gitignore_unpublished CHANGED
@@ -1,4 +1,4 @@
1
- # Common git ignore configuration for UNPUBLISHED Data Positioning projects.
1
+ # Common git ignore configuration for UNPUBLISHED DPUse projects.
2
2
  .env
3
3
  .npmrc
4
4
  .wrangler
package/README.md CHANGED
@@ -2,7 +2,8 @@
2
2
 
3
3
  [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](./LICENSE)
4
4
  [![npm version](https://img.shields.io/npm/v/@dpuse/dpuse-development.svg)](https://www.npmjs.com/package/@dpuse/dpuse-development)
5
- [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=dpuse_dpuse-development&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=dpuse_dpuse-development)
5
+ [![CodeQL](https://github.com/dpuse/dpuse-development/actions/workflows/codeql.yml/badge.svg)](https://github.com/dpuse/dpuse-development/actions/workflows/codeql.yml)[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=dpuse_dpuse-development&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=dpuse_dpuse-development)
6
+ [![CI](https://github.com/dpuse/dpuse-development/actions/workflows/ci.yml/badge.svg)](https://github.com/dpuse/dpuse-development/actions/workflows/ci.yml)
6
7
 
7
8
  <!-- SUMMARY_START -->
8
9
 
@@ -44,11 +45,11 @@ Plugin project groupings...
44
45
 
45
46
  Support projects...
46
47
 
47
- | Name | Description |
48
- | ----------- | ------------------------------------------------------------------------------------------ |
49
- | development | Package of actions used to support the development process, not deployed in its own right. |
50
- | kb | Knowledge content and deployment scripts. |
51
- | resources | Sample data and deployment scripts. |
48
+ | Name | Description |
49
+ | ----------- | ----------------------------------------- |
50
+ | development | This package. |
51
+ | kb | Knowledge content and deployment scripts. |
52
+ | resources | Sample data and deployment scripts. |
52
53
 
53
54
  ## Actions
54
55
 
@@ -105,70 +106,86 @@ Common resources (files) used across Data Positioning projects.
105
106
  | Markdown lint rules | [.markdownlint.json](.markdownlint.json) |
106
107
  | VS Code key bindings | [resources/vsCodeKeyBindings.json](resources/vsCodeKeyBindings.json) |
107
108
 
108
- ## Bundle Analysis Reports
109
-
110
- The Bundle Analysis Report provides a detailed breakdown of the bundle’s composition and module sizes, helping identify which modules contribute most to the final build. It is generated automatically on each release using the `npm` package [rollup-plugin-visualizer](https://www.npmjs.com/package/rollup-plugin-visualizer).
111
-
112
- [View the Bundle Analysis Report](https://dpuse.github.io/dpuse-development/bundle-analysis-reports/rollup-visualiser/index.html) created by the **rollup visualiser** plugin.
113
-
114
- [View the Bundle Analysis Report](https://dpuse.github.io/dpuse-development/bundle-analysis-reports/sonda/index.html) created by the **sonda** plugin.
115
-
116
- ## Dependency Check Report
117
-
118
- The OWASP Dependency Check Report identifies known vulnerabilities in project dependencies. It is generated automatically on each release using the `npm` package [owasp-dependency-check](https://dependency-check.github.io/DependencyCheck/index.html).
119
-
120
- [View the OWASP Dependency Check Report](https://dpuse.github.io/dpuse-development/dependency-check-reports/dependency-check-report.html)
121
-
122
109
  ## Dependency Licenses
123
110
 
124
- The following table lists the top-level production and peer dependencies. All of these dependencies—along with their transitive dependencies—have been recursively verified to use one of the following commercially friendly licenses: **BSD-2-Clause**, **CC0-1.0**, or **MIT**. Developers cloning this repository should independently verify all **development** and **optional** dependencies. This project supports development activities only. It is not used in production or distributed in any other form.
125
-
126
- We use the `npm` packages [license-report](https://www.npmjs.com/package/license-report), [license-report-check](https://www.npmjs.com/package/license-report-check), [license-report-recursive](https://www.npmjs.com/package/license-report-recursive) and [license-downloader](https://www.npmjs.com/package/license-downloader) to identify all dependency licenses and include copies of them. We do not use any unlicensed dependencies in either production or development.
111
+ License data is collected automatically on each release using [license-checker](https://github.com/RSeidelsohn/license-checker-rseidelsohn). The following table lists all production dependencies. These dependencies (including transitive ones) have been checked and confirmed to use Apache-2.0, BSD-3-Clause, CC0-1.0, or MIT — all permissive, commercially-friendly licenses. Developers cloning this repository should independently verify development dependencies; users of the uploaded library are covered by these checks.
127
112
 
128
113
  <!-- DEPENDENCY_LICENSES_START -->
129
114
 
130
- | Name | Version | License(s) | Document |
131
- | ----------------------------------------------------------------------- | :-----: | ---------- | --------------------------------------------------------------------- |
132
- | [@dpuse/dpuse-shared](https://github.com/data-positioning/dpuse-shared) | 0.3.675 | MIT | [LICENSE](licenses/downloads/@dpuse/dpuse-shared@0.3.675-LICENSE.txt) |
133
- | [acorn-typescript](https://github.com/TyrealHu/acorn-typescript) | 1.4.13 | MIT | [LICENSE](licenses/downloads/acorn-typescript@1.4.13-LICENSE.txt) |
134
- | [acorn-walk](https://github.com/acornjs/acorn) | 8.3.5 | MIT | [LICENSE](licenses/downloads/acorn-walk@8.3.5-LICENSE.txt) |
135
- | [acorn](https://github.com/acornjs/acorn) | 8.17.0 | MIT | [LICENSE](licenses/downloads/acorn@8.17.0-LICENSE.txt) |
136
- | [nanoid](https://github.com/ai/nanoid) | 5.1.15 | MIT | [LICENSE](licenses/downloads/nanoid@5.1.15-LICENSE.txt) |
137
- | [typescript](https://github.com/microsoft/TypeScript) | 6.0.3 | Apache-2.0 | [LICENSE](licenses/downloads/typescript@6.0.3-LICENSE.txt) |
138
- | [valibot](https://github.com/open-circle/valibot) | 1.4.1 | MIT | [LICENSE](licenses/downloads/valibot@1.4.1-LICENSE.txt) |
115
+ | Name | Version | License(s) | Document |
116
+ | ---------------------------------------------------------------- | :-----: | ---------- | --------------------------------------------------------------------- |
117
+ | [@dpuse/dpuse-shared](https://github.com/dpuse/dpuse-shared) | 0.3.689 | MIT | [LICENSE](licenses/downloads/@dpuse/dpuse-shared@0.3.689-LICENSE.txt) |
118
+ | [acorn-typescript](https://github.com/TyrealHu/acorn-typescript) | 1.4.13 | MIT | [LICENSE](licenses/downloads/acorn-typescript@1.4.13-LICENSE.txt) |
119
+ | [acorn-walk](https://github.com/acornjs/acorn) | 8.3.5 | MIT | [LICENSE](licenses/downloads/acorn-walk@8.3.5-LICENSE.txt) |
120
+ | [acorn](https://github.com/acornjs/acorn) | 8.17.0 | MIT | [LICENSE](licenses/downloads/acorn@8.17.0-LICENSE.txt) |
121
+ | [nanoid](https://github.com/ai/nanoid) | 5.1.16 | MIT | [LICENSE](licenses/downloads/nanoid@5.1.16-LICENSE.txt) |
122
+ | [typescript](https://github.com/microsoft/TypeScript) | 6.0.3 | Apache-2.0 | [LICENSE](licenses/downloads/typescript@6.0.3-LICENSE.txt) |
123
+ | [valibot](https://github.com/open-circle/valibot) | 1.4.1 | MIT | [LICENSE](licenses/downloads/valibot@1.4.1-LICENSE.txt) |
139
124
 
140
125
  <!-- DEPENDENCY_LICENSES_END -->
141
126
 
127
+ The dependency tree below lists every package in this project — direct and transitive — along with its installed version, release date, and update status. Packages flagged ❗ have a newer version available; ⚠️ indicates a package that hasn't been updated in the last 6 months or longer. Neither flag necessarily indicates a problem: we let new releases stabilise before upgrading, and some packages are simply mature and stable, requiring no active development.
128
+
142
129
  <!-- DEPENDENCY_TREE_START -->
143
130
 
144
- - **[@dpuse/dpuse-shared](https://github.com/data-positioning/dpuse-shared)** 0.3.675 — this month: 2026-06-23
131
+ - **[@dpuse/dpuse-shared](https://github.com/dpuse/dpuse-shared)** 0.3.689 — this month: 2026-06-26
145
132
  - **[acorn-typescript](https://github.com/TyrealHu/acorn-typescript)** 1.4.13 — 29 months ago: 2024-01-03 ⚠️
146
133
  - **[acorn](https://github.com/acornjs/acorn)** 8.17.0 — this month: 2026-06-11
147
134
  - **[acorn-walk](https://github.com/acornjs/acorn)** 8.3.5 — 4 months ago: 2026-02-19
148
135
  - **[acorn](https://github.com/acornjs/acorn)** 8.17.0 — this month: 2026-06-11
149
136
  - **[acorn](https://github.com/acornjs/acorn)** 8.17.0 — this month: 2026-06-11
150
- - **[nanoid](https://github.com/ai/nanoid)** 5.1.15 — this month: 2026-06-20
137
+ - **[nanoid](https://github.com/ai/nanoid)** 5.1.16 — this month: 2026-06-24
151
138
  - **[valibot](https://github.com/open-circle/valibot)** 1.4.1 — 1 month ago: 2026-05-24
152
139
  - **[typescript](https://github.com/microsoft/TypeScript)** 6.0.3 — 2 months ago: 2026-04-16
153
- <!-- DEPENDENCY_TREE_END -->
140
+ <!-- DEPENDENCY_TREE_END -->
141
+
142
+ ## Bundle Analysis
143
+
144
+ The Bundle Analysis Reports provide detailed breakdowns of the bundle's composition and module sizes, helping to identify which modules contribute most to the final build. Two complementary reports are generated automatically on each release:
145
+
146
+ - **[rollup-plugin-visualizer](https://github.com/btd/rollup-plugin-visualizer/tree/master)** — generates a static treemap/sunburst view based on pre-build module estimates, useful for a quick visual scan of overall bundle composition, including CSS assets.
147
+ - **[Sonda](https://sonda.dev/)** — analyses final source maps to capture the effects of tree-shaking and minification, rather than relying on pre-build estimates. This gives a more accurate picture of what's actually shipped, traces module-level dependencies, and shows the size of each module after tree-shaking and minification for more precise insight into what's driving bundle size. Note: Sonda's Vite reports currently exclude CSS files, since Vite does not generate source maps for CSS.
148
+
149
+ [View the rollup-plugin-visualizer Report](https://dpuse.github.io/dpuse-connector-file-store-emulator/bundle-analysis-reports/rollup-visualiser/index.html).
150
+
151
+ [View the Sonda Report](https://dpuse.github.io/dpuse-connector-file-store-emulator/bundle-analysis-reports/sonda/index.html).
152
+
153
+ ## Security & Quality
154
+
155
+ ### CodeQL
156
+
157
+ [CodeQL](https://github.com/dpuse/dpuse-development/security/code-scanning) static analysis runs on every push to `main` and on a weekly schedule, scanning TypeScript, JavaScript, Rust, and GitHub Actions workflow files for security vulnerabilities and coding errors.
158
+
159
+ ### SonarCloud
160
+
161
+ [SonarCloud](https://sonarcloud.io/summary/new_code?id=dpuse_dpuse_development) performs continuous code quality and security analysis on every push, detecting bugs, code smells, and security vulnerabilities in the TypeScript source.
162
+
163
+ ### Vulnerability Scanning
164
+
165
+ Two complementary tools continuously monitor dependencies for known vulnerabilities:
166
+
167
+ - **[GitHub Dependabot](https://docs.github.com/en/code-security/dependabot)** automatically raises pull requests to update vulnerable dependencies, drawing on the GitHub Advisory Database which combines NVD and npm-specific advisories.
168
+ - **npm audit** runs on every push to `main` via the CI workflow, failing the build if any high or critical severity vulnerabilities are detected.
169
+
170
+ ### Supply Chain Security
154
171
 
155
- Insert link to other document for detailed explanation. Only show messages if issues arise.
172
+ [Socket.dev](https://socket.dev) monitors all dependencies for supply chain risk — detecting malicious packages, dependency confusion, typosquatting, and suspicious behaviour that may not yet have a CVE.
156
173
 
157
- 1. **Installed** column:
174
+ ### Reporting Vulnerabilities
158
175
 
159
- The ⚠️ symbol indicates that the installed version does not match the latest available version.”.
176
+ Please do not open public GitHub issues for security vulnerabilities. Use [GitHub private vulnerability reporting](https://github.com/dpuse/dpuse-development/security/advisories/new) instead. See [SECURITY.md](./SECURITY.md) for the full disclosure policy, contact details, and expected response times.
160
177
 
161
- 1. **Latest Release** column:
178
+ ### OpenSSF 🚧
162
179
 
163
- The ⚠️ symbol indicates that the dependency has gone **more than 6 months** without an update but **no more than 12 months**.
180
+ [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/dpuse/dpuse-development/badge)](https://scorecard.dev/viewer/?uri=github.com/dpuse/dpuse-development)
164
181
 
165
- The ❗ symbol indicates a dependency that has gone **more than 12 months** without an update.
182
+ This project is working towards the [OpenSSF Best Practices](https://www.bestpractices.dev) Passing badge, a self-certification covering security policy, vulnerability reporting, build processes, code quality, and more. The [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/dpuse/dpuse-shared) provides an independent automated assessment of the project's security practices and is an ongoing area of improvement.
166
183
 
167
- If a dependency has no, or only a small number of, transitive dependencies, then it may not require frequent updates. The **Deps** column shows the number of transitive dependencies. Full details for these dependencies can be found in [licenses/licenseTree.json](licenses/licenseTree.json).
184
+ ## Contributing
168
185
 
169
- 1. **Document** column:
186
+ This repository is maintained solely by its owner and does not accept external contributions. It is part of a larger closed application suite and is published for informational and cloning purposes only.
170
187
 
171
- The “⚠️ No license file” message indicates a dependency that does not include a license file.
188
+ If you find a security vulnerability, see [Reporting Vulnerabilities](#reporting-vulnerabilities). For bugs, inconsistencies, or other feedback, you are welcome to [open a GitHub issue](https://github.com/dpuse/dpuse-development/issues) — feedback is read, but responses and fixes are at the maintainer's discretion.
172
189
 
173
190
  ## License
174
191
 
package/dist/dpuse-development.es.js CHANGED
@@ -5906,9 +5906,7 @@ async function qn() {
5906
5906
  var Jn = "<!-- DEPENDENCY_LICENSES_START -->", Yn = "<!-- DEPENDENCY_LICENSES_END -->", Xn = "<!-- DEPENDENCY_TREE_START -->", Zn = "<!-- DEPENDENCY_TREE_END -->";
5907
5907
  async function Qn(e = "MIT") {
5908
5908
  try {
5909
- G("Document Dependencies"), await An("1️⃣ Clear downloaded licenses", "licenses/downloads");
5910
- let t = await W("package.json"), n = `${t.name ?? ""}@${t.version ?? ""}`;
5911
- await Mn("2️⃣ Identify production licenses", "license-checker-rseidelsohn", [
5909
+ G("Document Dependencies"), await An("1️⃣ Clear downloaded licenses", "licenses/downloads"), await Mn("2️⃣ Identify production licenses", "license-checker-rseidelsohn", [
5912
5910
  "--production",
5913
5911
  "--json",
5914
5912
  "--files",
@@ -5916,9 +5914,9 @@ async function Qn(e = "MIT") {
5916
5914
  "--relativeModulePath",
5917
5915
  "--relativeLicensePath",
5918
5916
  "--onlyAllow",
5919
- `"${e}"`,
5917
+ e,
5920
5918
  "--excludePackages",
5921
- `"${n}"`,
5919
+ (await W("package.json")).name ?? "",
5922
5920
  "--out",
5923
5921
  "licenses/licenses.json"
5924
5922
  ]), await Pn("3️⃣ Identify transitive dependencies", "npm", [