// permanent record of scan from 2026-09-21 · classified as library · stack: JavaScript · Node.js · ESM · AVA · xo · tsd
// permalink — this URL always shows scan 7dLh8apU from 2026-09-21, even if a newer public scan exists for this repo.
Nine dimensions
DevOps
42
CI matrix runs tests on push and PR but no package-lock.json is committed, so reproducible installs depend on npm's resolution at the moment of build.
Security
68
Zero runtime dependencies, no shipped-dependency advisories, a published security.md, and a permissive MIT license give a tiny attack surface.
Cost & infra
70
Permissive MIT license, no copyleft concerns, zero dependencies, and trivially small published payload keep distribution cost near zero.
QA & testing
30
test.js exists and CI runs ava + tsd + xo on every PR across Node 18 and 22, yet the test file uses non-standard naming that tooling counts as zero test files.
Performance
60
benchmark.js is committed for regression tracking and zero dependencies keep the hot path trivial.
Architecture
62
Single-responsibility export with proper ESM exports map, sideEffects flag, and types; nothing else is needed at this scale.
Code quality
58
Parsed source shows zero ESLint errors and no swallowed error handlers across index.js, but only a 29% sample was directly read, capping confidence.
Observability
50
As a pure type-check library, observability reduces to clear API docs and exported types, which are present but minimal.
Maintainability
68
Genuine README, MIT license, TypeScript declarations, declared node engine, and sideEffects:false show deliberate publishing hygiene.
Top findings (AI)
medium
No lockfile committed alongside the manifest
package.json declares devDependency ranges but no package-lock.json ships in the tree, so CI's `npm install` resolves a fresh tree each run and the package's own build reproducibility depends on npm registry timing.
medium
Test file does not follow a discoverable naming pattern
The header reports zero test files even though test.js exists at repo root. The file lacks the conventional `.test.js` suffix or `__tests__/` directory, meaning downstream tooling, coverage reporters, and CI dashboards that key off standard patterns will silently skip it.
medium
Only 29% of repository files were directly parsed for code review
Of the 14 files in the tree, only 4 JS/TS source files (125 lines) were analysed; the rest were unparsed. No defects were found in what was read, but benchmark.js, the type-test file, and other paths were not measured.
What this scan inspected
every file scanned for secrets — 14 in total, none skipped
3 dependencies from manifests only — no lockfile, transitive deps unchecked