Social networking technology created by Bluesky
This report summarizes scanner evidence for bluesky-social/atproto, a TypeScript project with 9,680 GitHub stars. SynthScan examined 447,238 lines of code across 3281 source files, recording 1575 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 31.5 (High pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 181 finding(s).
Are imports declared and package/API names verified? 1394 finding(s).
Are wrappers, guards, and repeated structures necessary? 100 finding(s).
Which changes need focused human review? 1575 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1575 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | .agents/skills/lex-schema/SKILL.md | 185 | const result = app.bsky.feed.post.keySchema.safeValidate(rkey) | CODE |
| CRITICAL | .agents/skills/lexification-client/SKILL.md | 67 | - const res = await ctx.suggestionsAgent.api.app.bsky.unspecced.getSuggestionsSkeleton( | CODE |
| CRITICAL | packages/lexicon-resolver/tests/lexicon.test.ts | 51 | const lex = await client.com.atproto.lexicon.schema.create( | CODE |
| CRITICAL | packages/lexicon-resolver/tests/lexicon.test.ts | 73 | await client.com.atproto.lexicon.schema.create( | CODE |
| CRITICAL | packages/lexicon-resolver/tests/lexicon.test.ts | 89 | await client.com.atproto.lexicon.schema.create( | CODE |
| CRITICAL | packages/lexicon-resolver/tests/lexicon.test.ts | 115 | await client.com.atproto.lexicon.schema.create( | CODE |
| CRITICAL | packages/lexicon-resolver/tests/lexicon.test.ts | 151 | await client.com.atproto.lexicon.schema.create( | CODE |
| CRITICAL | packages/lexicon-resolver/tests/lexicon.test.ts | 173 | await client.com.atproto.lexicon.schema.create( | CODE |
| CRITICAL | packages/lexicon-resolver/tests/lexicon.test.ts | 182 | const carolLex = await client.com.atproto.lexicon.schema.create( | CODE |
| CRITICAL | …ckages/ozone/tests/materialized-view-refresher.test.ts | 38 | await network.ozone.daemon.ctx.materializedViewRefresher.run() | CODE |
| CRITICAL | …ckages/ozone/tests/materialized-view-refresher.test.ts | 72 | await network.ozone.daemon.ctx.materializedViewRefresher.run() | CODE |
| CRITICAL | …ckages/ozone/tests/materialized-view-refresher.test.ts | 92 | await network.ozone.daemon.ctx.materializedViewRefresher.run() | CODE |
| CRITICAL | …ckages/ozone/tests/materialized-view-refresher.test.ts | 112 | await network.ozone.daemon.ctx.materializedViewRefresher.run() | CODE |
| CRITICAL | …ckages/ozone/tests/materialized-view-refresher.test.ts | 134 | await network.ozone.daemon.ctx.materializedViewRefresher.run() | CODE |
| CRITICAL | packages/ozone/tests/queues.test.ts | 752 | await network.ozone.daemon.ctx.queueRouter.routeReports() | CODE |
| CRITICAL | packages/ozone/tests/queues.test.ts | 778 | await network.ozone.daemon.ctx.queueRouter.routeReports() | CODE |
| CRITICAL | packages/ozone/tests/queues.test.ts | 799 | await network.ozone.daemon.ctx.queueRouter.routeReports() | CODE |
| CRITICAL | packages/ozone/tests/get-profiles.test.ts | 34 | const { data } = await modClient.agent.app.bsky.actor.getProfiles( | CODE |
| CRITICAL | packages/ozone/tests/get-lists.test.ts | 44 | agent.api.app.bsky.graph.getLists( | CODE |
| CRITICAL | packages/ozone/tests/get-lists.test.ts | 48 | appviewAgent.api.app.bsky.graph.getLists({ actor: sc.dids.alice }), | CODE |
| CRITICAL | packages/ozone/tests/report-routing.test.ts | 163 | await network.ozone.daemon.ctx.queueRouter.routeReports() | CODE |
| CRITICAL | packages/ozone/tests/report-routing.test.ts | 231 | await network.ozone.daemon.ctx.queueRouter.routeReports() | CODE |
| CRITICAL | packages/ozone/tests/report-routing.test.ts | 260 | await network.ozone.daemon.ctx.queueRouter.routeReports() | CODE |
| CRITICAL | packages/ozone/tests/report-routing.test.ts | 274 | await network.ozone.daemon.ctx.queueRouter.routeReports() | CODE |
| CRITICAL | packages/ozone/tests/query-labels.test.ts | 95 | agent.api.com.atproto.label.queryLabels({ uriPatterns }), | CODE |
| CRITICAL⚡ | packages/ozone/tests/query-labels.test.ts | 109 | const first = await agent.api.com.atproto.label.queryLabels(params) | CODE |
| CRITICAL⚡ | packages/ozone/tests/query-labels.test.ts | 110 | const second = await agent.api.com.atproto.label.queryLabels({ | CODE |
| CRITICAL⚡ | packages/ozone/tests/query-labels.test.ts | 116 | const otherSource = await agent.api.com.atproto.label.queryLabels({ | CODE |
| CRITICAL⚡ | packages/ozone/tests/query-labels.test.ts | 125 | const res = await agent.api.com.atproto.label.queryLabels({ | CODE |
| CRITICAL⚡ | packages/ozone/tests/query-labels.test.ts | 132 | const res = await agent.api.com.atproto.label.queryLabels({ | CODE |
| CRITICAL⚡ | packages/ozone/tests/query-labels.test.ts | 139 | const res = await agent.api.com.atproto.label.queryLabels({ | CODE |
| CRITICAL⚡ | packages/ozone/tests/query-labels.test.ts | 146 | const res = await agent.api.com.atproto.label.queryLabels({ | CODE |
| CRITICAL⚡ | packages/ozone/tests/query-labels.test.ts | 156 | const res = await agent.api.com.atproto.label.queryLabels({ | CODE |
| CRITICAL⚡ | packages/ozone/tests/query-labels.test.ts | 163 | const res1 = await agent.api.com.atproto.label.queryLabels({ | CODE |
| CRITICAL⚡ | packages/ozone/tests/query-labels.test.ts | 167 | const res2 = await agent.api.com.atproto.label.queryLabels({ | CODE |
| CRITICAL | packages/ozone/tests/query-labels.test.ts | 179 | const res = await agent.api.com.atproto.label.queryLabels({ | CODE |
| CRITICAL | packages/ozone/tests/query-labels.test.ts | 219 | const res = await agent.api.com.atproto.label.queryLabels({ | CODE |
| CRITICAL | packages/ozone/tests/inbox-seen.test.ts | 30 | return sc.agent.tools.ozone.inbox.updateSeen( | CODE |
| CRITICAL⚡ | packages/ozone/tests/inbox-seen.test.ts | 56 | sc.agent.tools.ozone.inbox.listNotifications({ section }, options), | CODE |
| CRITICAL⚡ | packages/ozone/tests/inbox-seen.test.ts | 57 | sc.agent.tools.ozone.inbox.listNotifications( | CODE |
| CRITICAL⚡ | packages/ozone/tests/inbox-seen.test.ts | 61 | sc.agent.tools.ozone.inbox.getUnreadCount({ section }, options), | CODE |
| CRITICAL | packages/ozone/tests/report-assignment.test.ts | 60 | await network.ozone.ctx.db.db.deleteFrom('report_queue').execute() | CODE |
| CRITICAL | packages/ozone/tests/report-assignment.test.ts | 63 | await network.ozone.ctx.db.db.deleteFrom('moderator_assignment').execute() | CODE |
| CRITICAL | packages/ozone/tests/strike-expiry-processor.test.ts | 132 | await network.ozone.daemon.ctx.strikeExpiryProcessor.processExpiredStrikes() | CODE |
| CRITICAL | packages/ozone/tests/strike-expiry-processor.test.ts | 144 | await network.ozone.daemon.ctx.strikeExpiryProcessor.processExpiredStrikes() | CODE |
| CRITICAL | packages/ozone/tests/strike-expiry-processor.test.ts | 175 | await network.ozone.daemon.ctx.strikeExpiryProcessor.processExpiredStrikes() | CODE |
| CRITICAL | packages/ozone/tests/strike-expiry-processor.test.ts | 202 | await network.ozone.daemon.ctx.strikeExpiryProcessor.processExpiredStrikes() | CODE |
| CRITICAL | packages/ozone/tests/strike-expiry-processor.test.ts | 249 | await network.ozone.daemon.ctx.strikeExpiryProcessor.processExpiredStrikes() | CODE |
| CRITICAL⚡ | packages/ozone/tests/strike-expiry-processor.test.ts | 278 | await network.ozone.daemon.ctx.strikeExpiryProcessor.getCursor() | CODE |
| CRITICAL⚡ | packages/ozone/tests/strike-expiry-processor.test.ts | 280 | await network.ozone.daemon.ctx.strikeExpiryProcessor.processExpiredStrikes() | CODE |
| CRITICAL⚡ | packages/ozone/tests/strike-expiry-processor.test.ts | 284 | await network.ozone.daemon.ctx.strikeExpiryProcessor.getCursor() | CODE |
| CRITICAL⚡ | packages/ozone/tests/strike-expiry-processor.test.ts | 294 | await network.ozone.daemon.ctx.strikeExpiryProcessor.processExpiredStrikes() | CODE |
| CRITICAL⚡ | packages/ozone/tests/strike-expiry-processor.test.ts | 296 | await network.ozone.daemon.ctx.strikeExpiryProcessor.getCursor() | CODE |
| CRITICAL | packages/ozone/tests/inbox-subject-reads.test.ts | 62 | network.ozone.ctx.db.db.getExecutor(), | CODE |
| CRITICAL | packages/ozone/tests/get-config.test.ts | 25 | const { data } = await agent.api.tools.ozone.server.getConfig( | CODE |
| CRITICAL | packages/ozone/tests/repo-search.test.ts | 83 | const result = await agent.api.tools.ozone.moderation.searchRepos( | CODE |
| CRITICAL | packages/ozone/tests/repo-search.test.ts | 113 | const res = await agent.api.tools.ozone.moderation.searchRepos( | CODE |
| CRITICAL | packages/ozone/tests/repo-search.test.ts | 126 | const res = await agent.api.tools.ozone.moderation.searchRepos( | CODE |
| CRITICAL | packages/ozone/tests/repo-search.test.ts | 138 | const full = await agent.api.tools.ozone.moderation.searchRepos( | CODE |
| CRITICAL | packages/ozone/tests/repo-search.test.ts | 151 | const res = await agent.api.tools.ozone.moderation.searchRepos( | CODE |
| 1308 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/lexicon-resolver/src/lexicon.ts | 107 | export async function resolveLexiconDidAuthority( | CODE |
| LOW | …ages/oauth/oauth-types/src/oauth-client-id-loopback.ts | 35 | export function assertOAuthLoopbackClientId( | CODE |
| LOW | …ages/oauth/oauth-types/src/oauth-client-id-loopback.ts | 52 | export function parseOAuthLoopbackClientId( | CODE |
| LOW | …ages/oauth/oauth-types/src/oauth-client-id-loopback.ts | 68 | export function safeParseOAuthLoopbackClientId( | CODE |
| LOW | …ages/oauth/oauth-types/src/oauth-client-id-loopback.ts | 113 | export function safeParseOAuthLoopbackClientIdQueryString( | CODE |
| LOW | …es/oauth/oauth-types/src/atproto-loopback-client-id.ts | 24 | export function buildAtprotoLoopbackClientId( | CODE |
| LOW | …es/oauth/oauth-types/src/atproto-loopback-client-id.ts | 64 | export function parseAtprotoLoopbackClientId( | CODE |
| LOW | …/oauth/oauth-types/src/oauth-client-id-discoverable.ts | 73 | export function isOAuthClientIdDiscoverable( | CODE |
| LOW⚡ | …/oauth/oauth-types/src/oauth-client-id-discoverable.ts | 116 | export function isConventionalOAuthClientId( | CODE |
| LOW⚡ | …/oauth/oauth-types/src/oauth-client-id-discoverable.ts | 122 | export function assertOAuthDiscoverableClientId( | CODE |
| LOW⚡ | …/oauth/oauth-types/src/oauth-client-id-discoverable.ts | 128 | export function parseOAuthDiscoverableClientId(clientId: string): URL { | CODE |
| LOW | …th/oauth-types/src/atproto-loopback-client-metadata.ts | 18 | export function atprotoLoopbackClientMetadata( | CODE |
| LOW | …th/oauth-types/src/atproto-loopback-client-metadata.ts | 26 | export function buildAtprotoLoopbackClientMetadata( | CODE |
| LOW | packages/oauth/oauth-provider/src/oauth-utils.ts | 4 | export function buildProtectedResourceMetadata( | CODE |
| LOW | packages/oauth/oauth-provider/src/dpop/dpop-manager.ts | 205 | function wrapInvalidDpopProofError( | CODE |
| LOW | …th/oauth-provider/src/errors/www-authenticate-error.ts | 32 | function formatWWWAuthenticateHeader(wwwAuthenticate: WWWAuthenticate): string { | CODE |
| LOW | …th/oauth-provider/src/errors/www-authenticate-error.ts | 47 | function wwwAuthenticateEntryToString([type, params]: WWWAuthenticateEntry) { | CODE |
| LOW | …ckages/oauth/oauth-provider/src/client/client-utils.ts | 17 | export function parseDiscoverableClientId( | CODE |
| LOW | …der/src/router/create-authorization-page-middleware.ts | 266 | function parseOAuthAuthorizationRequestQuery( | CODE |
| LOW | …h-provider/src/router/assets/send-cookie-error-page.ts | 5 | export function sendCookieErrorPageFactory( | CODE |
| LOW | …auth/oauth-provider/src/router/assets/send-redirect.ts | 75 | export function sendAuthorizationResultRedirect( | CODE |
| LOW | packages/oauth/oauth-client/src/oauth-client-auth.ts | 16 | export function negotiateClientAuthMethod( | CODE |
| LOW | packages/oauth/oauth-client/src/oauth-client-auth.ts | 82 | export function createClientCredentialsFactory( | CODE |
| LOW | packages/oauth/oauth-scopes/src/atproto-oauth-scope.ts | 52 | export function normalizeAtprotoOauthScope(scope: string) { | CODE |
| LOW | packages/oauth/oauth-scopes/src/atproto-oauth-scope.ts | 61 | export function normalizeAtprotoOauthScopeValue( | CODE |
| LOW | …t-browser-example/src/providers/BskyClientProvider.tsx | 44 | export function useAuthenticatedBskyClient( | CODE |
| LOW | …auth/oauth-provider-ui/src/contexts/authentication.tsx | 298 | export function ProvideAuthenticatedSession({ | CODE |
| LOW | …-ui/src/components/enable-email-auth-factor-dialog.tsx | 12 | export function EnableEmailAuthFactorDialog({ | CODE |
| LOW | …der-ui/src/components/oauth-session-details-dialog.tsx | 16 | export function OAuthSessionDetailsDialog({ | CODE |
| LOW | …ui/src/components/disable-email-auth-factor-dialog.tsx | 24 | export function DisableEmailAuthFactorDialog({ | CODE |
| LOW | …/components/disable-email-auth-factor-confirm-form.tsx | 23 | export function DisableEmailAuthFactorConfirmForm({ | CODE |
| LOW | …/components/forms/input-handle-custom-instructions.tsx | 33 | export function InputHandleCustomInstructions({ | CODE |
| LOW | …provider-ui/src/components/utils/scope-description.tsx | 282 | function hasOnlyBskyAppSpecificPermissions( | CODE |
| LOW | …provider-ui/src/components/utils/scope-description.tsx | 336 | function BlueskyAppviewPermissions({ | CODE |
| LOW | …provider-ui/src/components/utils/scope-description.tsx | 771 | function isOfficialBlueskyAppviewServiceId(aud: string): boolean { | CODE |
| LOW | …provider-ui/src/components/utils/scope-description.tsx | 808 | function scopeEnablesPrivateBskyAppMethods(scope: string): boolean { | CODE |
| LOW | packages/oauth/oauth-provider-ui/src/data/email.ts | 130 | export function useDisableEmailAuthFactor() { | CODE |
| LOW | …ges/oauth/oauth-provider-ui/src/data/oauth-sessions.ts | 43 | export function useRevokeOAuthSessionMutation() { | CODE |
| LOW | …s/oauth/oauth-provider-ui/src/data/account-sessions.ts | 42 | export function useRevokeAccountSessionMutation() { | CODE |
| LOW | …-provider-ui/src/routes/account/u/$accountId/about.tsx | 11 | function importLocalizedPageModule( | CODE |
| LOW | packages/ozone/tests/_inbox.ts | 73 | export async function withNotificationInsertFailure( | CODE |
| LOW | packages/ozone/src/inbox/preferences.ts | 6 | export async function getNotificationPreferences( | CODE |
| LOW | packages/ozone/src/inbox/preferences.ts | 19 | export async function putNotificationPreferences( | CODE |
| LOW | packages/ozone/src/config/strike-suspension.ts | 6 | export function parseStrikeSuspensionConfig( | CODE |
| LOW | packages/ozone/src/report/activity.ts | 180 | export async function bulkInsertReportActivities( | CODE |
| LOW | packages/ozone/src/setting/validators.ts | 453 | function assertKnownPriorityLevels( | CODE |
| LOW | packages/lex/lex-client/tests/client.test.ts | 35 | function expectTypedAdultContentPref( | CODE |
| LOW | packages/lex/lex-client/src/errors.ts | 558 | function buildResponseOverviewMessage(response: Response): string { | CODE |
| LOW | packages/lex/lex-client/src/www-authenticate.ts | 35 | export function parseWWWAuthenticateHeader( | CODE |
| LOW | packages/lex/lex-installer/src/lexicons-manifest.ts | 45 | export function normalizeLexiconsManifest( | CODE |
| LOW | packages/lex/lex-server/src/lib/www-authenticate.ts | 76 | export function formatWWWAuthenticateHeader( | CODE |
| LOW | packages/lex/lex-server/src/lib/www-authenticate.ts | 96 | function formatWWWAuthenticateChallenge( | CODE |
| LOW | packages/lex/lex-server/src/lib/www-authenticate.ts | 105 | function formatWWWAuthenticateParams(params: WWWAuthenticateParams): string { | CODE |
| LOW | packages/lex/lex-builder/src/ref-resolver.ts | 423 | function asSafeDefinitionIdentifier(name: string) { | CODE |
| LOW | packages/internal/xrpc-utils/src/accept.ts | 28 | export function buildProxiedContentEncoding( | CODE |
| LOW | packages/internal/xrpc-utils/src/accept.ts | 112 | function parseAcceptEncodingDefinition(def: string): Accept { | CODE |
| LOW | …ternal/opentelemetry-node/tests/http-server-harness.ts | 27 | export function describeHttpServerInstrumentation(options: { | CODE |
| LOW | …ges/internal/opentelemetry-node/src/instrumentation.ts | 53 | export function getDefaultAtprotoInstrumentations( | CODE |
| LOW | packages/internal/fetch/src/fetch-request.ts | 155 | export function checkForbiddenDomainNamePolicy( | CODE |
| LOW | packages/internal/fetch/src/fetch-request.ts | 179 | export function protocolCheckRequestTransform(protocols: ProtocolConfig) { | CODE |
| 40 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tsconfig/base.tsconfig.json | 1 | { | COMMENT |
| LOW | packages/oauth/oauth-types/src/uri.ts | 161 | COMMENT | |
| LOW | packages/oauth/oauth-provider/src/oauth-provider.ts | 561 | COMMENT | |
| LOW | packages/oauth/oauth-provider/src/oauth-provider.ts | 641 | COMMENT | |
| LOW | packages/oauth/oauth-provider/src/types/email.ts | 1 | import { isEmailValid } from '@hapi/address' | COMMENT |
| LOW | …es/oauth/oauth-provider/src/request/request-manager.ts | 161 | if (!parameters.redirect_uri) { | COMMENT |
| LOW | …ages/oauth/oauth-provider/src/client/client-manager.ts | 421 | ) | COMMENT |
| LOW | …ages/oauth/oauth-provider/src/client/client-manager.ts | 481 | ) | COMMENT |
| LOW | …ages/oauth/oauth-provider/src/client/client-manager.ts | 541 | COMMENT | |
| LOW | …ages/oauth/oauth-provider/src/client/client-manager.ts | 581 | // | COMMENT |
| LOW | …ages/oauth/oauth-provider/src/client/client-manager.ts | 701 | } | COMMENT |
| LOW | …ages/oauth/oauth-provider/src/client/client-manager.ts | 721 | // > URI scheme based on a domain name that is under the control of | COMMENT |
| LOW | packages/oauth/oauth-provider/src/client/client.ts | 241 | // > 3. The JWT MUST contain an "aud" (audience) claim containing a | COMMENT |
| LOW | packages/oauth/oauth-provider/src/client/client.ts | 261 | // > unique identifier for the token. The authorization server | COMMENT |
| LOW | …es/oauth/oauth-provider/src/metadata/build-metadata.ts | 41 | 'public', // The same "sub" is returned for all clients | COMMENT |
| LOW | …der/src/router/create-authorization-page-middleware.ts | 81 | // Do not perform any of the following logic if the request is invalid | COMMENT |
| LOW | packages/oauth/oauth-client/README.md | 21 | // These must be the same metadata as the one exposed on the | COMMENT |
| LOW | packages/oauth/oauth-client/src/session-getter.ts | 121 | tokenSet: newTokenSet, | COMMENT |
| LOW | packages/oauth/oauth-client/src/identity-resolver.ts | 1 | export { | COMMENT |
| LOW | packages/oauth/oauth-client/src/identity-resolver.ts | 21 | COMMENT | |
| LOW | packages/oauth/oauth-client/src/oauth-client-auth.ts | 121 | client_assertion: await key.createJwt( | COMMENT |
| LOW | …ckages/oauth/oauth-provider-ui/authorization-page.html | 161 | 'account:email', | COMMENT |
| LOW | …ges/oauth/oauth-provider-ui/src/authorization-page.tsx | 81 | const [rejected, setRejected] = useState<null | boolean>(null) | COMMENT |
| LOW | …ges/oauth/oauth-provider-ui/src/authorization-page.tsx | 101 | // call fails, we will show a link that the user can click to continue | COMMENT |
| LOW | …ges/oauth/oauth-provider-ui/src/authorization-page.tsx | 121 | // In case automatically redirecting fails, we will also show a link that | COMMENT |
| LOW | …/oauth-provider-ui/src/components/forms/form-shell.tsx | 141 | // @NOTE `Form` defaults to noValidate, which leaves any control outside | COMMENT |
| LOW | packages/identity/src/fetch.ts | 21 | // | COMMENT |
| LOW | packages/lex/lex-schema/src/core/schema.ts | 301 | } | COMMENT |
| LOW | packages/lex/lex-schema/src/core/schema.ts | 321 | // also define those aliases directly on the schema instance, so that they can | COMMENT |
| LOW | packages/lex/lex-schema/src/schema/params.ts | 301 | // This should never happen. If it *does*, it means that the user of | COMMENT |
| LOW | packages/lex/lex-data/src/cid.ts | 101 | // uses "exports" field in package.json, which do not contain "types" | COMMENT |
| LOW | packages/internal/opentelemetry-node/src/index.ts | 101 | // configured, but NodeSDK then defaults every unspecified | COMMENT |
| LOW | …ges/internal/opentelemetry-node/src/instrumentation.ts | 61 | // We first normalize the path to extract the local XRPC method (lxm) | COMMENT |
| LOW | packages/pds/tests/account.test.ts | 161 | // const userKey = await crypto.Secp256k1Keypair.create() | COMMENT |
| LOW | packages/pds/tests/account.test.ts | 181 | COMMENT | |
| LOW | packages/pds/tests/account.test.ts | 201 | // handle: 'byo-did.test', | COMMENT |
| LOW | packages/pds/tests/account.test.ts | 221 | // const attempt2 = agent.api.com.atproto.server.createAccount({ | COMMENT |
| LOW | packages/pds/tests/account.test.ts | 241 | // const did4 = await ctx.plcClient.createDid({ | COMMENT |
| LOW | packages/pds/tests/proxied/proxy-oauth-aud.test.ts | 21 | // check. An OAuth caller granted `rpc:<lxm>?aud=<did>#<serviceId>` (the | COMMENT |
| LOW | packages/pds/tests/seeds/users-bulk.ts | 21 | } | COMMENT |
| LOW | packages/pds/src/account-manager/account-manager.ts | 1081 | 'confirmation token required', | COMMENT |
| LOW | packages/dev-env/src/mock/index.ts | 681 | // import * as seedThreadV2 from '../seed/thread-v2.js' | COMMENT |
| LOW | packages/lex-cli/bin.js | 1 | #!/usr/bin/env node | COMMENT |
| LOW | packages/api/jest.setup.ts | 21 | // cause = `label:${actual.cause.labelDef.id}` | COMMENT |
| LOW | packages/ws-client/src/websocket.ts | 141 | // Consecutive failed connections since the last successful open, so the | COMMENT |
| LOW | packages/ws-client/src/websocket.ts | 221 | // always already recorded here, since a transport settles its iteration | COMMENT |
| LOW | packages/ws-client/src/websocket.ts | 261 | // Post-increment so the first reconnect waits ~1s (2^0) and each | COMMENT |
| LOW | packages/ws-client/src/message-channel.ts | 81 | interface Waiter<M extends DataMode> { | COMMENT |
| LOW | packages/ws-client/src/transport/browser-transport.ts | 161 | options.onClose(detail) | COMMENT |
| LOW | packages/ws-client/src/transport/browser-transport.ts | 241 | } | COMMENT |
| LOW | packages/ws-client/src/transport/node-transport.ts | 101 | function reportClose(detail: CloseEventDetail): void { | COMMENT |
| LOW | packages/ws-client/src/transport/node-transport.ts | 121 | if (pendingError) return | COMMENT |
| LOW | packages/syntax/src/recordkey.ts | 1 | export type RecordKeyString = string | COMMENT |
| LOW | packages/syntax/src/did.ts | 1 | // Human-readable constraints: | COMMENT |
| LOW | packages/syntax/src/handle.ts | 21 | ] | COMMENT |
| LOW | packages/bsky/src/hydration/hydrator.ts | 321 | COMMENT | |
| LOW | packages/bsky/src/hydration/hydrator.ts | 621 | COMMENT | |
| LOW | packages/bsky/src/hydration/hydrator.ts | 961 | // - profile | COMMENT |
| LOW | packages/bsky/src/hydration/hydrator.ts | 1221 | starterPacks, | COMMENT |
| LOW | packages/bsky/src/api/blob-resolver.ts | 81 | // The promise returned by streamBlob() will be rejected as soon as | COMMENT |
| 7 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …rovider-ui/src/components/forms/fields/token-field.tsx | 12 | 'type' | 'pattern' | 'minLength' | 'maxLength' | 'placeholder' | 'below' | CODE |
| LOW | packages/did/tests/methods/web.test.ts | 40 | ['lorem ipsum dolor sit', 'Invalid did:web prefix'], | CODE |
| LOW | packages/did/tests/methods/plc.test.ts | 24 | ['lorem ipsum dolor sit', 'Invalid did:plc prefix'], | CODE |
| LOW | packages/lex/lex-client/src/response.bench.ts | 65 | 'Lorem ipsum dolor sit amet, consectetur adipiscing elit 🤩.\n'.repeat( | CODE |
| LOW | packages/lex/lex-client/src/response.bench.ts | 65 | 'Lorem ipsum dolor sit amet, consectetur adipiscing elit 🤩.\n'.repeat( | CODE |
| LOW⚡ | packages/lex/lex-schema/tests/l.test.ts | 307 | street: '123 Main St', | CODE |
| LOW⚡ | packages/lex/lex-schema/tests/l.test.ts | 316 | street: '123 Main St', | CODE |
| LOW⚡ | packages/lex/lex-schema/tests/l.test.ts | 324 | street: '123 Main St', | CODE |
| LOW | packages/lex/lex-schema/tests/l.test.ts | 378 | street: '123 Main St', | CODE |
| LOW⚡ | packages/lex/lex-schema/src/schema/typed-object.test.ts | 464 | displayName: 'John Doe', | CODE |
| LOW⚡ | packages/lex/lex-schema/src/schema/typed-object.test.ts | 474 | displayName: 'John Doe', | CODE |
| LOW⚡ | packages/lex/lex-schema/src/schema/typed-object.test.ts | 482 | displayName: 'John Doe', | CODE |
| LOW⚡ | packages/lex/lex-schema/src/schema/typed-object.test.ts | 490 | displayName: 'John Doe', | CODE |
| LOW⚡ | packages/lex/lex-schema/src/schema/typed-object.test.ts | 499 | displayName: 'John Doe', | CODE |
| LOW⚡ | packages/lex/lex-schema/src/schema/typed-object.test.ts | 507 | displayName: 'John Doe', | CODE |
| LOW | packages/lex/lex-schema/src/schema/custom.test.ts | 175 | const validResult = schema.safeParse('user@example.com') | CODE |
| LOW | packages/lex/lex-schema/src/schema/refine.test.ts | 59 | const result = schema.safeParse('user@example.com') | CODE |
| LOW | packages/lex/lex-schema/src/schema/refine.test.ts | 188 | email: 'user@example.com', | CODE |
| LOW | packages/lex/lex-schema/src/schema/refine.test.ts | 196 | email: 'user@example.com', | CODE |
| LOW | packages/lex/lex-schema/src/schema/regexp.test.ts | 87 | const result = schema.safeParse('user@example.com') | CODE |
| LOW | packages/lex/lex-json/src/json-bytes-decoder.bench.ts | 65 | 'Lorem ipsum dolor sit amet, consectetur adipiscing elit 🤩.\n'.repeat( | CODE |
| LOW | packages/lex/lex-json/src/json-bytes-decoder.bench.ts | 65 | 'Lorem ipsum dolor sit amet, consectetur adipiscing elit 🤩.\n'.repeat( | CODE |
| LOW | packages/lex/lex-json/src/json-bytes-decoder.bench.ts | 113 | 'Lorém ipsum dolor sit amet, consectetur adipiscing elit 🤩.', | CODE |
| LOW | packages/lex/lex-json/src/json-bytes-decoder.bench.ts | 159 | name: 'John Doe', | CODE |
| LOW | packages/lex/lex-json/src/lex-json.bench.ts | 62 | 'Lorem ipsum dolor sit amet, consectetur adipiscing elit 🤩.\n'.repeat( | CODE |
| LOW | packages/lex/lex-json/src/lex-json.bench.ts | 62 | 'Lorem ipsum dolor sit amet, consectetur adipiscing elit 🤩.\n'.repeat( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | packages/lex/lex-resolver/src/lex-resolver.ts | 236 | * // Step 1: Resolve the authority to get the AT URI | COMMENT |
| LOW⚡ | packages/lex/lex-resolver/src/lex-resolver.ts | 240 | * // Step 2: Fetch the lexicon from the URI | COMMENT |
| LOW | packages/api/OAUTH.md | 24 | ## Step 1: Create your client metadata | COMMENT |
| LOW | packages/api/OAUTH.md | 88 | ## Step 2: Setup your SPA | COMMENT |
| LOW | packages/api/OAUTH.md | 165 | ## Step 3: Implement the OAuth flow | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …kages/lex/lex-document/src/lexicon-iterable-indexer.ts | 17 | * // Documents are indexed lazily as requested | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | packages/oauth/oauth-client/src/oauth-client-auth.ts | 45 | // more robust against keysets containing keys without a "kid" property. | COMMENT |
| MEDIUM | packages/bsky/src/image/server.ts | 89 | // Definitely not an image ? Let's fail right away. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | packages/lex/lex-resolver/src/lex-resolver.ts | 236 | * // Step 1: Resolve the authority to get the AT URI | COMMENT |
| LOW⚡ | packages/lex/lex-resolver/src/lex-resolver.ts | 240 | * // Step 2: Fetch the lexicon from the URI | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/dev-infra/with-test-db.sh | 3 | # Example usage: | COMMENT |
| LOW | packages/dev-infra/with-test-redis-and-db.sh | 3 | # Example usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/workflows/repo.yaml | 115 | # want to live dangerously and need an immediate workaround, you can try | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | packages/lex/lex-server/src/nodejs.ts | 350 | async function handleRequest( | CODE |