package manifest audit derived

{
  "input": {
    "body": {
      "manifest": {
        "name": "@example/orders-api",
        "scripts": {
          "lint": "",
          "test": "node --test",
          "build": "tsc -p ."
        },
        "version": "2.1",
        "dependencies": {
          "zod": "3.23.8",
          "express": "^4.18.2",
          "left-pad": "*",
          "internal-utils": "git+ssh://git@github.com/example/internal-utils.git#main"
        },
        "devDependencies": {
          "zod": "3.23.8",
          "typescript": "~5.5.0"
        }
      },
      "require_fields": [
        "name",
        "version",
        "license",
        "repository"
      ]
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "name": "@example/orders-api",
      "limits": {
        "maxJobs": 200,
        "maxFindings": 500,
        "maxServices": 200,
        "maxResources": 2000,
        "maxVariables": 1000,
        "maxComponents": 5000,
        "maxDependencies": 5000
      },
      "passed": false,
      "license": null,
      "private": false,
      "version": "2.1",
      "complete": false,
      "findings": [
        {
          "code": "FIELD_MISSING",
          "field": "license",
          "detail": "license is required and absent or empty."
        },
        {
          "code": "FIELD_MISSING",
          "field": "repository",
          "detail": "repository is required and absent or empty."
        },
        {
          "code": "VERSION_NOT_SEMVER",
          "field": "version",
          "detail": "version is \"2.1\", which is not an exact semantic version, so nothing can order releases of this package reliably."
        }
      ],
      "conformant": false,
      "request_id": "example-request",
      "service_id": "package_manifest_audit",
      "assumptions": [
        "A wildcard or latest specifier accepts the next breaking release, which is reported whatever the package is.",
        "A git, file or workspace specifier is not pinned by a version, so its contents can change without the manifest changing."
      ],
      "limitations": [
        "Observable facts about the manifest supplied. No registry is contacted, no version is resolved, and nothing is installed.",
        "License is reported as a declared field. This is not a licence compatibility or compliance determination.",
        "conformant is true only when every declared rule was evaluated and none failed."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [
        "LICENSE_CHECK: license is absent and the package is not marked private, which is reported as a missing field rather than as a licensing conclusion."
      ],
      "script_count": 3,
      "finding_count": 8,
      "service_version": "1.0.0",
      "findings_by_code": {
        "EMPTY_SCRIPT": 1,
        "FIELD_MISSING": 2,
        "VERSION_NOT_SEMVER": 1,
        "ENGINES_NOT_DECLARED": 1,
        "UNBOUNDED_DEPENDENCY": 1,
        "NON_REGISTRY_DEPENDENCY": 1,
        "DEPENDENCY_IN_BOTH_GROUPS": 1
      },
      "dependency_counts": {
        "dependencies": 4,
        "devDependencies": 2,
        "peerDependencies": 0,
        "optionalDependencies": 0
      },
      "exactly_pinned_count": 2,
      "total_dependency_count": 6,
      "unbounded_dependencies": [
        {
          "name": "left-pad",
          "group": "dependencies",
          "specifier": "*"
        }
      ],
      "non_registry_dependencies": [
        {
          "name": "internal-utils",
          "group": "dependencies",
          "specifier": "git+ssh://git@github.com/example/internal-utils.git#main"
        }
      ]
    }
  }
}