{"ref":"artifact:satiroglu-kaev","page":"/artifacts/satiroglu-kaev","json":"/artifacts/satiroglu-kaev.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"satiroglu-kaev","name":"@satiroglu/kaev","artifact_type":"cli","ecosystem":"ui5","domain":"developer-experience","secondary_domains":["security-and-compliance"],"origin_ring":"independent","description":{"one_line":"A command line that runs rule-based checks over a SAPUI5 or OpenUI5 project, reporting each finding with a rule id, a category, a severity, a confidence and the file it sits in.","short":"Rule-based checker for SAPUI5 and OpenUI5 projects","what_it_solves":"KAEV is a command line run inside a UI5 project directory: it identifies the project context first, modelling application, component, library, theme-library and module projects, and runs only the checks that apply, over a catalogue covering project and configuration, UI5 API use, OData with architecture and performance, and security. It also runs the official [@ui5/linter](artifact:ui5-linter) in a restricted child process, which its rule reference limits to applicable application roots with a manifest; a manifest-less legacy project stays analysable by KAEV's own rules, and `--no-ui5-lint` skips the adapter where partial coverage is intentional. Every finding states what it rests on: Official for directly documented UI5 guidance, Derived for a static interpretation of documented behaviour, Heuristic for a KAEV risk pattern that needs project context, and the README states that fully dynamic URL construction and arbitrary cross-function data flow are not resolved. A run writes terminal, Markdown, JSON, SARIF, JUnit or GitHub Actions output; `check` and `doctor` are read-only, `report`, `init` and `baseline` create only the files asked for, and the documentation states the analysis is local and offline, with no telemetry and no source-code upload. Its own documentation places it beside UI5 CLI, UI5 Linter, TypeScript, ESLint, SAP Fiori tools, runtime testing and professional security review, and says it does not replace them.","when_not_to_use":"Not in a project whose dependencies must all carry an open-source licence: KAEV is proprietary software, its licence page states that downloading or viewing the npm package does not by itself grant permission to use, copy, modify, redistribute, sublicense, sell, host or create derivative works, and the LICENSE file shipped with the package carries the controlling terms. Not as the last word on whether a UI5 application is secure: its rule reference states that a heuristic finding is not proof of a vulnerability, and its documentation puts professional security review beside it rather than under it."},"links":{"npm":"https://www.npmjs.com/package/@satiroglu/kaev","repo":"https://github.com/satiroglu/kaev","homepage":"https://kaev.org/","docs":"https://docs.kaev.org/","changelog":"https://docs.kaev.org/changelog/"},"identity":{"author":"Ahmet Ertürk","license":"Proprietary"},"compat":{"runtimes":["node"]},"agent":{"source":{"url":"https://docs.kaev.org/getting-started/installation/","title":"KAEV documentation — Installation","checked":"2026-10-19"},"install":"npx @satiroglu/kaev@latest","minimal_example":"npm install --save-dev @satiroglu/kaev\nnpx kaev check"},"source_available":true,"type_properties":{"distribution":{"value":["npm"],"sources":[{"url":"https://github.com/satiroglu/kaev","title":"satiroglu/kaev — README, CI/CD","checked":"2026-10-19","quote":"npm install --save-dev @satiroglu/kaev"},{"url":"https://docs.kaev.org/getting-started/installation/","title":"KAEV documentation — Installation","checked":"2026-10-19","quote":"Package installation requires registry access. Project analysis itself runs offline."}]}},"requires":[{"ref":"artifact:ui5-linter","for":"Bundled and run through its Node API in a restricted child process, so KAEV's own report carries the official linter's findings as `UI5LINT/<original-rule-id>` rows classified as modernization. The adapter runs only for applicable application roots with a manifest, and `--no-ui5-lint` skips it for partial coverage.","requirement":"required","sources":[{"url":"https://github.com/satiroglu/kaev","title":"satiroglu/kaev — README, Why Kaev?","checked":"2026-10-19","quote":"Integrates the official `@ui5/linter` in a restricted child process."},{"url":"https://docs.kaev.org/reference/rules/","title":"KAEV documentation — Rules, Official UI5 Linter","checked":"2026-10-19","quote":"Individual IDs are emitted as `UI5LINT/<original-rule-id>`, classified as modernization, and scored conservatively."},{"url":"https://registry.npmjs.org/@satiroglu/kaev","title":"npm registry — @satiroglu/kaev 0.3.0, dependencies","checked":"2026-10-19","quote":"\"@ui5/linter\": \"1.23.7\""}]}],"provides":[{"capability":"capability:linting","what_it_does":"Brings a rule catalogue of its own to a UI5 project, covering project and configuration, UI5 API use, OData with architecture and performance, and security, and runs the official UI5 linter alongside it, each finding carrying a category, a severity, a confidence and a file location.","sources":[{"url":"https://docs.kaev.org/","title":"KAEV documentation","checked":"2026-10-19","quote":"Reports stable rule IDs, severity, confidence, file locations, evidence, and recommendations."},{"url":"https://docs.kaev.org/reference/rules/","title":"KAEV documentation — Rules","checked":"2026-10-19","quote":"Rule basis is Official for directly documented UI5 guidance, Derived for a static interpretation of documented behavior, and Heuristic for a KAEV risk pattern requiring project context."},{"url":"https://kaev.org/","title":"KAEV — What KAEV Checks","checked":"2026-10-19","quote":"One command checks the areas most likely to turn into UI5 maintenance, security, or production problems."}]},{"capability":"capability:frontend-performance","what_it_does":"Reports, by static rule rather than by measurement, the patterns in a project's own code that make a UI5 application slow to start or to respond: a synchronous jQuery, XHR or legacy OData read call, an OData model refreshed inside a loop, a literal setSizeLimit above 10,000, a local .filter() or .sort() over a traced OData collection, and an EventBus subscription or interval left without cleanup in onExit. Every row carries its basis and its boundary, so the refresh-in-a-loop and size-limit rules are marked heuristic, and the size-limit one states that it does not itself prove that all data is fetched.","sources":[{"url":"https://kaev.org/","title":"KAEV — Performance & OData","checked":"2026-10-19","quote":"Check synchronous requests, lifecycle cleanup, refresh placement, V2/V4 collection operations, and model size limits."},{"url":"https://docs.kaev.org/reference/rules/","title":"KAEV documentation — Rules, OData, architecture, and performance","checked":"2026-10-19","quote":"A proven OData model is refreshed inside a syntactic loop."},{"url":"https://docs.kaev.org/reference/rules/","title":"KAEV documentation — Rules, OData, architecture, and performance","checked":"2026-10-19","quote":"A proven OData model receives a literal setSizeLimit above 10,000. This does not itself prove that all data is fetched."}]}],"provenance":{"discovered_via":[{"source":"source:curator"}],"first_seen":"2026-09-30"},"history":[{"date":"2026-09-30","field":"entry","to":"created","reason":"Handed over as three URLs. Typed `cli` because what is published is a command with a `kaev` bin entry, run in a project directory rather than installed into a UI5 build; `independent` because the site states \"Independent developer tool. Not affiliated with or endorsed by SAP.\" It answers [linting](capability:linting) on the UI5 door, where the graph already reads UI5 linter as the core's answer and KAEV's own documentation names that linter as something it runs alongside its own rules — and it would be the first provider that capability holds on that door, whose coverage was assessed core-only on 2026-09-14 with a note saying the graph holds no UI5 provider. No repo link: the repository field of the npm record points at github.com/satiroglu/kaev, which still returned 404 on 2026-09-30, so the entry is reachable through npm, the site and the documentation. `when_not_to_use` states the proprietary licence and the heuristic disclaimer, both from the maker's own pages; `identity.license` is \"Proprietary\" because the npm record says \"SEE LICENSE IN LICENSE\" and the licence page says no open-source licence is granted."},{"date":"2026-10-01","field":"description.what_it_solves","from":"the UI5 linter runs for application roots that carry a manifest","to":"the UI5 linter runs in a restricted child process, for application roots","reason":"The manifest condition was not the README's claim. It states \"The official UI5 Linter adapter currently applies to application roots\" and \"Integrates the official `@ui5/linter` in a restricted child process\", so the condition came out and the child process went in. All seven sources were re-read on 2026-10-01 and every quote still stands word for word; 0.3.0, published 2026-09-30, is still the latest version, and github.com/satiroglu/kaev returned 404 again."},{"date":"2026-10-02","field":"description.what_it_solves","from":"the UI5 linter adapter applies to application roots","to":"the adapter is limited to applicable application roots with a manifest, and a manifest-less legacy project stays analysable by KAEV's own rules","reason":"Reinstating the condition dropped yesterday, with the half neither version carried. The README does say only \"The official UI5 Linter adapter currently applies to application roots\", but the rule reference, read again live today, states it in full: \"The adapter runs only for applicable application roots with a manifest; legacy manifest-less projects remain analyzable with native KAEV rules.\" That page is one of the two this entry already cites for the linting edge, so the condition rests on a source already on the record. The same page's \"Use --no-ui5-lint only when partial coverage is intentional.\" replaces the earlier reading that a run marks coverage partial."},{"date":"2026-10-02","field":"source_available","to":"false","reason":"Stated rather than left absent. The licence page says \"KAEV is proprietary software. No open-source license is granted.\", and the repository the npm record declares, git+https://github.com/satiroglu/kaev.git, returned 404 on 2026-09-30, on 2026-10-01 and again today, so there is no source to read and the entry now says so instead of staying silent. The same page's \"Public npm publication makes packaged files downloadable and inspectable. A proprietary license restricts legal rights but does not technically hide package contents.\" is about the published tarball, whose `bin` is the build output `dist/cli/cli.js`, and not about source anyone may read, so it is recorded here rather than carried as a true value."},{"date":"2026-10-02","field":"provides","from":"capability:linting","to":"capability:linting, capability:frontend-performance","reason":"kaev.org groups one of its four categories as \"Performance & OData\" and the rule reference carries the rows behind it, so the tool answers [frontend performance](capability:frontend-performance) as well as [linting](capability:linting), by static rule over the project's own code. That capability's reading says the core stops at configuration and the build and sends the reader to the browser's developer tools for the network log, which is the half these rules read statically instead. It was assessed core-only on 2026-09-14 and holds no provides edge from any artifact today, so this is the first one on it, and the state needs the same re-assessment as linting's."},{"date":"2026-10-19","field":"links.repo","from":null,"to":"https://github.com/satiroglu/kaev","reason":"The repository the npm record declares is now reachable. It returned 404 on 2026-09-30, 2026-10-01 and 2026-10-02; today it answers, as a public repository created on 2026-09-16 and last pushed on 2026-09-30, not a fork, carrying `src`, `tests`, `scripts`, `docs`, the README and the LICENSE file, with GitHub reading the licence as NOASSERTION. `source_available` moves to true with it: `src/index.ts` and the directories under it are the TypeScript the tool is built from, so there is source to read. The licence has not changed and grants no rights to use it — the README states \"Public npm publication makes package contents downloadable and inspectable; a proprietary license restricts legal rights but does not technically hide those contents.\" — which is why `identity.license` stays \"Proprietary\" and `when_not_to_use` stands as written."},{"date":"2026-10-19","field":"type_properties.distribution","from":null,"to":"npm","reason":"The one key the `cli` type owns (TYPE_PROPERTIES in vocab.json), stated from the README's CI/CD section, \"npm install --save-dev @satiroglu/kaev\", and the installation page, which gives the same command for a project-level install beside `npx @satiroglu/kaev@latest` and a global install. The installation page's \"Package installation requires registry access. Project analysis itself runs offline.\" is the second sentence it rests on: the registry is how the command arrives and the only thing it needs the network for."},{"date":"2026-10-19","field":"requires","from":null,"to":"artifact:ui5-linter","reason":"The dependency the entry could not point at before. [@ui5/linter](artifact:ui5-linter) is pinned at 1.23.7 in the npm record's dependencies and the README states \"Integrates the official `@ui5/linter` in a restricted child process\", so the edge is the maker's own statement; the `for` sentence carries the conditions the rule reference puts on the adapter rather than on the dependency, which ships with every install. Written now because the artifact exists to point at: it was not in the graph when this entry was drafted, and the prose link in `what_it_solves` moves from the repository address to the entry with it."}],"drafted_with_ai":true,"maintainers":["actor:satiroglu"],"contributors":["actor:satiroglu"]},"effective_normative_relations":[],"readings":{"liveness":[{"label":"Maintenance","tier":"good","evidence":"1 month since release"},{"label":"Continuity","tier":"fair","evidence":"one contributor, personally owned"},{"label":"Repository","tier":"good","evidence":"pushed 2026-09, not archived"}],"compatibility":[{"label":"Declared for","tier":"unknown","evidence":"no UI5 release lines in the atlas"},{"label":"Survived majors","tier":"unknown","evidence":"no UI5 release lines in the atlas"},{"label":"Maintainer's CI","tier":"poor","evidence":"verify failure, 2026-09-30"}],"practice":[{"label":"Tests","tier":"good","evidence":"29 test files, npm test"},{"label":"Docs","tier":"good","evidence":"docs/ with 6 pages, docs site, README 24 KB"},{"label":"Changelog","tier":"fair","evidence":"none in the repo"}],"reach":[{"value":7,"unit":"installs/week"},{"value":0,"unit":"watching"}]},"signals":{"crawled_at":"2026-10-25","latest_version":"0.3.0","majors":{"0.1":{"version":"0.1.0","date":"2026-09-23"},"0.2":{"version":"0.2.0","date":"2026-09-28"},"0.3":{"version":"0.3.0","date":"2026-09-30"}},"license":"SEE LICENSE IN LICENSE","first_release":"2026-09-23","last_release":"2026-09-30","releases":4,"cadence_days":2,"maintainers":1,"repository":"git+https://github.com/satiroglu/kaev.git","repository_directory":null,"peer_cds":null,"dependencies":7,"node_engine":"^20.11.0 || ^22.12.0 || ^24.0.0","test_script":true,"types":false,"downloads_weekly":7,"downloads_monthly":725,"stars":0,"forks":0,"open_issues":0,"archived":false,"pushed_at":"2026-09-30","license_spdx":null,"org_owned":false,"default_branch":"main","created_at":"2026-09-16T10:07:00Z","open_prs":0,"tree_truncated":false,"test_files":29,"workflows":1,"other_ci":false,"readme_bytes":24458,"docs_files":6,"changelog":false,"license_file":true,"dts_files":0,"first_commit":"2026-09-23","last_commit":"2026-09-30","commits":13,"contributors":1,"ci_status":"failure","ci_run_at":"2026-09-30","ci_workflow":"verify","ci_event":"push","readme_path":"README.md","readme_sha":"ae4722a3786c27bf4ec45df04f3addf9d3d17962","months_since_release":1,"dormant":false,"repo_read":"2026-10-25"},"release_notes":{"license":"SEE LICENSE IN LICENSE","quotable":false,"versions":[{"version":"0.3.0","date":"2026-09-30"},{"version":"0.2.1","date":"2026-09-28"},{"version":"0.2.0","date":"2026-09-28"},{"version":"0.1.0","date":"2026-09-23"}],"crawled_at":"2026-10-25"},"edges":{"maintainers":[{"ref":"actor:satiroglu","name":"aesatiroglu","json":"/actors/satiroglu.json"}],"contributors":[{"ref":"actor:satiroglu","name":"aesatiroglu","json":"/actors/satiroglu.json"}],"explained_by":[],"alternative_to_this":[],"needed_by":[],"available_via":[],"parts":[],"add_ons":[],"answered_through_parts":[]}}