DPUse Development
Actions for managing DPUse projects.
Report a Vulnerability · Open an Issue
About DPUse
DPUse (Data Positioning & Use) is an in-browser application that positions your data for use through three core activities: sourcing, contextualising, and publishing.
Sourcing uses a library of Connectors to establish Connections to applications, databases, file stores, and curated datasets; these connections are subsequently used to configure structured Data Views from the underlying sources.
Contextualising extracts chronological events from those Data Views and maps them into comprehensive Context Models. This gives the DPUse Engine the structural framework needed to generate deterministic transactions, facts, or observations.
Publishing uses a library of Presenters to render standard Presentations immediately using the contextualised data; additionally, Cookbooks of Recipes let you build Data Apps using your preferred tools.
In addition, DPUse provides Tools used by the application, and you can use them to construct connectors and presenters.
Introduction
The package implements a common set of actions used to manage DPUse repositories. All actions are designed to be run from package.json scripts and assume that the project follows the standard DPUse directory structure and that it includes a config.json file in the root directory. See API Reference.
Usage
This package is available on npm. Install it with:
npm install @dpuse/dpuse-development
[!WARNING] This project is not designed for general use. It is custom built for the DPUse CI/CD process. You are welcome to clone and customise it for your own purposes, but you will need to adapt it to your own project structure and tooling.
To work on the source instead, clone this repository.
git clone https://github.com/dpuse/dpuse-development.git
cd dpuse-development
npm install
Requires Node.js 24 or later, npm 12 or later, and TypeScript 6.0.3 or later.
This repository manages itself using the actions it implements. See the scripts block in package.json for details.
API Reference
See API_REFERENCE.md for the complete API reference, including every exported action and type.
Dependency Licenses
[!WARNING] Dependency licenses are not documented here: @dpuse/dpuse-development is a development-only tool and is never part of a production release.
Bundle Analysis
This report is updated with each release, from the bundle the release builds, using Sonda, which analyses final source maps to reveal the actual effects of tree-shaking and minification rather than relying on pre-build estimates.
Note: Sonda's Vite reports currently exclude CSS files, since Vite does not generate source maps for CSS.
| Chunk/Module/File | Composition |
|---|---|
| dist/dpuse-development.es.js | 65.9 kB · gzip 21.0 kB · 63.4% of the build |
| src → documentDependencies.ts + 22 more | ██████████████████░░ 87.6% · 57.7 kB |
| ↳ documentDependencies.ts | ▒▒▒░░░░░░░░░░░░░░░░░ 17.3% · 11.4 kB |
| ↳ documentQualitySecurity.ts | ▒▒▒░░░░░░░░░░░░░░░░░ 15.1% · 9.9 kB |
| ↳ documentBundleSizes.ts | ▒▒▒░░░░░░░░░░░░░░░░░ 13.7% · 9.0 kB |
| ↳ checkConfigFiles.ts | ▒░░░░░░░░░░░░░░░░░░░ 5.7% · 3.8 kB |
| ↳ rustCrates.ts | ▒░░░░░░░░░░░░░░░░░░░ 5.2% · 3.4 kB |
| ↳ documentUsage.ts | ▒░░░░░░░░░░░░░░░░░░░ 4.1% · 2.7 kB |
| ↳ checkDependencies.ts | ▒░░░░░░░░░░░░░░░░░░░ 4.0% · 2.6 kB |
| ↳ cloudflare.ts | ▒░░░░░░░░░░░░░░░░░░░ 3.4% · 2.2 kB |
| ↳ documentOpening.ts | ▒░░░░░░░░░░░░░░░░░░░ 3.1% · 2.0 kB |
| ↳ auditDependencies.ts | ▒░░░░░░░░░░░░░░░░░░░ 3.0% · 2.0 kB |
| ↳ documentActions.ts | ▒░░░░░░░░░░░░░░░░░░░ 2.7% · 1.8 kB |
| ↳ documentContributingLicense.ts | ░░░░░░░░░░░░░░░░░░░░ 1.9% · 1.2 kB |
| ↳ publishProject.ts | ░░░░░░░░░░░░░░░░░░░░ 1.7% · 1.1 kB |
| ↳ releaseProject.ts | ░░░░░░░░░░░░░░░░░░░░ 1.4% · 972 B |
| ↳ testProject.ts | ░░░░░░░░░░░░░░░░░░░░ 1.2% · 799 B |
| ↳ 8 smaller files | ▒░░░░░░░░░░░░░░░░░░░ 4.3% · 2.8 kB |
| (inlined worker) | ░░░░░░░░░░░░░░░░░░░░ 0.0% · 17 B |
| (bundler output, whitespace & JSON) | ██░░░░░░░░░░░░░░░░░░ 12.4% · 8.2 kB |
| dist/utilities-BJfQ3vEr.js | 27.2 kB · gzip 7.3 kB · 26.1% of the build |
| @dpuse/dpuse-shared → dist/dpuse-shared.es.js | ███████████░░░░░░░░░ 54.7% · 14.9 kB |
| src → index.ts | ███████░░░░░░░░░░░░░ 32.7% · 8.9 kB |
| valibot → dist/index.mjs | ░░░░░░░░░░░░░░░░░░░░ 1.5% · 413 B |
| (bundler output, whitespace & JSON) | ██░░░░░░░░░░░░░░░░░░ 11.1% · 3.0 kB |
| dist/apiReference-aFk9cwH0.js | 8.4 kB · gzip 3.1 kB · 8.1% of the build |
| src → apiReference.ts | ███████████████████░ 95.3% · 8.0 kB |
| (bundler output, whitespace & JSON) | █░░░░░░░░░░░░░░░░░░░ 4.7% · 407 B |
| dist/vite.es.js | 2.5 kB · gzip 1.1 kB · 2.4% of the build |
| src → vite.ts | ██████████████████░░ 87.7% · 2.2 kB |
| (bundler output, whitespace & JSON) | ██░░░░░░░░░░░░░░░░░░ 12.3% · 314 B |
Bars show each row's share of its output file. ↳ rows are part of the row above.
- n more = the row also holds n more files from the same package or folder, each no larger than the one named. A package can appear under several output files, each holding different files, never the same file twice.
(inlined worker) = a Web Worker built separately and embedded in its output file as text. Where the build records what it contains, its rows list that; any few bytes over are the escaping needed to embed it.
(bundler output, whitespace & JSON) = bytes Sonda can't trace to a source file: whitespace (indentation and line breaks), code the bundler generates (region comments, the combined import/export lines, its small runtime helper and wrappers), and imported JSON such as config.json, which the bundler doesn't map. The JSON and the generated code are real bytes that ship; the whitespace mostly disappears once compressed.
Quality & Security
This section is updated each time npm run document is run. Settings come from the repository's workflow files and GitHub. Test coverage and the Fallow score are measured at the same time.
Testing
| Check | Status | What it does |
|---|---|---|
| Unit tests | ✅ On | Vitest runs the unit tests. Part of the CI workflow on every push and pull request to main. |
| Property-based tests | ✅ On | fast-check runs many random inputs per test to find edge cases, alongside the unit tests. Part of the CI workflow on every push and pull request to main. |
| Test coverage | ✅ On |  Vitest's V8 coverage measures the share of source lines the unit tests run. The target is 80%. |
Code Quality
| Check | Status | What it does |
|---|---|---|
| Code health | ✅ On |  Fallow finds unused code, duplication, complexity and dependency problems. |
| Code analysis | ✅ On | |
| Linting | ✅ On | ESLint checks the code for errors and style problems. Part of the CI workflow on every push and pull request to main. |
Security Analysis
| Check | Status | What it does |
|---|---|---|
| Push protection | ✅ On | GitHub push protection blocks pushes that contain credentials. |
| Static analysis | ✅ On |  CodeQL scans GitHub Actions and JavaScript/TypeScript for security vulnerabilities, using the extended security queries, on every push and pull request to main and weekly. |
| Secret scanning | ✅ On | GitHub secret scanning detects credentials, such as API keys and tokens, committed to the repository. |
Dependencies
| Check | Status | What it does |
|---|---|---|
| Vulnerability audit | ✅ On | npm audit fails when a shipped dependency has any known vulnerability, or a development dependency has a high or critical one. Part of the CI workflow on every push and pull request to main. |
| Supply chain risk | ✅ On | Socket flags malicious packages, typosquatting and suspicious behaviour that may not yet have a CVE. |
| Security alerts | ✅ On | Dependabot alerts when a dependency has a known vulnerability, using the GitHub Advisory Database. |
| Security updates | ❌ Off | Dependabot opens pull requests that update vulnerable dependencies. These are handled manually. |
| Version updates | ❌ Off | Dependabot opens pull requests for new dependency versions. These are handled manually. |
OpenSSF 🚧
This project is working towards the OpenSSF Best Practices Passing badge, a self-certification covering security policy, vulnerability reporting, build processes, code quality, and more. Currently the OpenSSF Scorecard provides an independent automated assessment of the project's security practices and is an ongoing area of improvement.
Reporting Vulnerabilities
Please do not open public GitHub issues for security vulnerabilities. Use GitHub private vulnerability reporting instead. See SECURITY.md for the full disclosure policy, contact details, and expected response times.
Contributing
This repository is maintained solely by its owner and does not, at present, accept external contributions into the canonical repo. Its source is published openly under the MIT License — every DPUse project is fully open source except DPUse Engine, which remains closed and proprietary.
For security vulnerabilities, see Reporting Vulnerabilities. For bugs, inconsistencies, or other feedback, open a GitHub issue — feedback is read, but responses and fixes are at the maintainer's discretion.
License
This project is licensed under the MIT License, permitting free use, modification, and distribution.
MIT © 2026 Jonathan Terrell