@treeseed/sdk
Shared Treeseed SDK for content-backed and D1-backed object models.
51
Versions
AGPL-3.0-only
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
adrianwebb
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| license | copyleft-license:AGPL-3.0-only | AI (license): Intentional AGPL-3.0-only license choice; disclosed in package.json and appropriate for this SDK. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): All 8 new deps (ink, react, unified, remark-*, minisearch, github-slugger, mdast-util-to-string) are established, well-known packages consistent with adding CLI and markdown processing features to this SDK. | ai | |
| source-diff | large-new-source-files | AI (source-diff): 187 new source files consistent with esbuild bundling of 8 new runtime dependencies; SLSA provenance confirms CI/CD build integrity. | ai | |
| source-diff | source-size-tripled | AI (source-diff): 5.6x size increase explained by bundling of 8 new legitimate runtime deps (ink, react, unified, remark-*, etc.) via esbuild; no obfuscation signals present. | ai | |
| phantom-deps | phantom-dep:react | AI (phantom-deps): react is a peer/bundled dep for ink (CLI framework); indirect usage via build tooling is expected for this SDK. | ai | |
| dependencies | unvetted-dep:octokit | AI (dependencies): octokit is GitHub's official JavaScript SDK — a well-known, widely-used package. Unvetted status reflects registry state, not actual risk. | ai | |
| phantom-deps | phantom-dep:libsodium-wrappers | AI (phantom-deps): libsodium-wrappers is a standard cryptography library; phantom status consistent with conditional/platform-specific usage in SDK. | ai | |
| phantom-deps | phantom-dep:minisearch | AI (phantom-deps): minisearch is a legitimate full-text search library; phantom status consistent with bundled/tree-shaken SDK output. | ai | |
| dependencies | unvetted-dep:repomix | AI (dependencies): repomix is a legitimate, popular repo-packing utility. No malicious indicators; unvetted status is a registry artifact. | ai | |
| dependencies | unvetted-dep:mdast-util-to-string | AI (dependencies): mdast-util-to-string is part of the unified/remark ecosystem, widely used for Markdown processing. No risk indicators. | ai | |
| phantom-deps | phantom-dep:ink | AI (phantom-deps): ink is a React-based CLI framework; declared as dep and referenced in config, consistent with SDK build tooling patterns using esbuild bundling. | ai |
Versions (showing 51 of 100)
| Version | Deps | Published |
|---|---|---|
| 0.11.0 | 24 / 3 | |
| 0.10.28 | 24 / 3 | |
| 0.10.27 | 24 / 3 | |
| 0.10.26 | 24 / 3 | |
| 0.10.25 | 24 / 3 | |
| 0.10.24 | 24 / 3 | |
| 0.10.23 | 24 / 3 | |
| 0.10.22 | 24 / 3 | |
| 0.10.21 | 24 / 3 | |
| 0.10.20 | 24 / 3 | |
| 0.10.19 | 24 / 3 | |
| 0.10.18 | 24 / 3 | |
| 0.10.17 | 24 / 3 | |
| 0.10.16 | 24 / 3 | |
| 0.10.15 | 24 / 3 | |
| 0.10.14 | 24 / 3 | |
| 0.10.13 | 24 / 3 | |
| 0.10.12 | 24 / 3 | |
| 0.10.11 | 24 / 3 | |
| 0.10.10 | 24 / 3 | |
| 0.10.9 | 24 / 3 | |
| 0.10.8 | 24 / 3 | |
| 0.10.7 | 24 / 3 | |
| 0.10.6 | 23 / 3 | |
| 0.10.5 | 23 / 3 | |
| 0.9.0 | 22 / 3 | |
| 0.8.19 | 22 / 3 | |
| 0.8.18 | 22 / 3 | |
| 0.8.17 | 22 / 3 | |
| 0.8.16 | 22 / 3 | |
| 0.8.15 | 22 / 3 | |
| 0.8.14 | 22 / 3 | |
| 0.8.13 | 22 / 3 | |
| 0.8.12 | 22 / 3 | |
| 0.8.11 | 22 / 3 | |
| 0.8.10 | 22 / 3 | |
| 0.8.9 | 22 / 3 | |
| 0.8.8 | 22 / 3 | |
| 0.8.7 | 22 / 3 | |
| 0.8.6 | 22 / 3 | |
| 0.8.5 | 22 / 3 | |
| 0.8.4 | 22 / 3 | |
| 0.8.3 | 22 / 3 | |
| 0.8.2 | 22 / 3 | |
| 0.8.1 | 22 / 3 | |
| 0.8.0 | 22 / 3 | |
| 0.7.0 | 22 / 3 | |
| 0.6.51 | 22 / 3 | |
| 0.6.50 | 22 / 3 | |
| 0.6.49 | 22 / 3 | |
| 0.6.48 | 22 / 3 |