What applies here

Configuration and security mechanisms are injected from outside, not hardcoded inside.

usage-convention · 1 support

Development and test tooling are confined to devDependencies while runtime behavior relies on minimal production deps.

stack-binding

Observability spans the entire request lifecycle — from middleware entry to outbound fetch to per-request ticket resolution — with per-partition concurrency limiting and timing instrumentation throughout.

usage-convention · 2 supports

Correctness footgun: [shared-reference-leak] src/queue/bulkhead.ts:19 — getAll() returns the internal this.bulkheads Map directly; callers can add/delete entries and retrieve Bulkhead instances to mutate queue/running (TS private is not runtime-enforced). | damage: A caller can corrupt concurrency accounting — e.g., push a task directly into queue or set running to 0 — causing _drain() to double-execute or skip tasks, silently losing or duplicating scheduled work with no error.

Correctness Footgun · high

Correctness footgun: [shared-reference-leak] src/queue/bulkhead.ts:19 — Constructor stores globalConfig and partitionConfigs by reference without copying; get() spreads them lazily at bulkhead-creation time. | damage: A caller mutating its config object after constructing the registry gets inconsistent concurrency/maxQueue limits: already-created bulkheads honor old values, new ones honor new values — silent, unpredictable capacity behavior across partitions.

Correctness Footgun · high

Professed "Authentication proves who; authorization decides what" is contradicted by the latest evidence read (not offered, since 2026-08-15).

Profession Contradicted · medium

The probe found no PII fields in any schema, yet the library parses arbitrary HTTP response bodies through Zod. If any upstream API returns user data (names, emails, addresses), the schema would either be permissive and pass PII through un-flagged, or the schemas are narrow enough that the probe's…

Security · low

Response bodies are runtime-validated with Zod, but the request options and client configuration that determine what URL/host/headers are contacted are only type-level checked — a caller with a type error at compile time can still ship a request to an unintended host at runtime.

Security · low

Authentication is delegated to middleware with no recorded evidence of what that middleware does — the probe recorded the delegation, not the strategy. Without knowing whether it's cryptographic (mTLS, JWT) or advisory (a header check that any caller can forge), the entire perimeter could be a…

Security · low