Danijel Martinek
98d96d2e19
Amends ADR-022 §9 with the `is-sub-processor` / `processes-pii` discriminated union spec, including the five conditional fields required when a library is a true GDPR sub-processor. Updates the evaluate-library skill to prompt for these fields during every trace authoring pass and adds the updated frontmatter template. Backfills all nine existing library-decision traces with the new fields; payload gets `processes-pii: true` (self-hosted CMS that stores user data); all pure in-process libraries get `false / false`. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
90 lines
3.2 KiB
Markdown
90 lines
3.2 KiB
Markdown
---
|
|
package: inversify
|
|
version: "^6.2.0"
|
|
tier: feature
|
|
decision: approved
|
|
date: 2026-05-14
|
|
deciders: [Danijel Martinek]
|
|
adr: adr-002
|
|
lastRevalidated: null
|
|
is-sub-processor: false
|
|
processes-pii: false
|
|
filter-results:
|
|
license: MIT
|
|
types: native
|
|
maintenance: active
|
|
boundary-fit: pass
|
|
shadow-check: pass
|
|
eu-residency: n/a
|
|
cve-scan: clean
|
|
named-consumer: pass
|
|
verification-commands:
|
|
- npm view inversify license
|
|
- npm view inversify version
|
|
- pnpm audit --audit-level=moderate
|
|
accepted-cves: []
|
|
---
|
|
|
|
## Filter: license
|
|
|
|
<!-- Result: MIT -->
|
|
|
|
`npm view inversify license` returns `MIT`. MIT is on the allowlist.
|
|
|
|
## Filter: types
|
|
|
|
<!-- Result: native -->
|
|
|
|
inversify is authored in TypeScript and ships its own `.d.ts` declaration files. No separate `@types/inversify` package is needed.
|
|
|
|
## Filter: maintenance
|
|
|
|
<!-- Result: active -->
|
|
|
|
Actively maintained; the 6.x line has seen recent releases addressing TypeScript compatibility improvements. Last release < 18 months, issue tracker shows ongoing engagement.
|
|
|
|
## Filter: boundary-fit
|
|
|
|
<!-- Result: pass -->
|
|
|
|
ADR-002 explicitly mandates InversifyJS as the DI framework for all feature packages. The ESLint boundary rules (ADR-010) do not restrict inversify to any specific path — feature packages are the declared consumers.
|
|
|
|
## Filter: shadow-check
|
|
|
|
<!-- Result: pass -->
|
|
|
|
inversify is the workspace-locked DI container per ADR-002. No parallel DI framework (tsyringe, awilix, etc.) is present or proposed.
|
|
|
|
## Filter: eu-residency
|
|
|
|
<!-- Result: n/a -->
|
|
|
|
inversify is a pure runtime library with no network communication, telemetry, or data transmission. EU residency does not apply.
|
|
|
|
## Filter: cve-scan
|
|
|
|
<!-- Result: clean -->
|
|
|
|
`pnpm audit --audit-level=moderate` reports no advisories against inversify at the time of this trace.
|
|
|
|
## Filter: named-consumer
|
|
|
|
<!-- Result: pass -->
|
|
|
|
All five feature packages — `@repo/auth`, `@repo/blog`, `@repo/media`, `@repo/marketing-pages`, `@repo/navigation` — depend on inversify for their per-feature DI containers (ADR-008). Concrete named consumers exist today.
|
|
|
|
## Prompt: replaces
|
|
|
|
Manual composition root patterns considered during initial architecture setup. InversifyJS replaces ad-hoc factory chaining that would not scale beyond three or four services per feature. No parallel approach is running.
|
|
|
|
## Prompt: migration-cost-out
|
|
|
|
Hard. InversifyJS container bindings, symbols, and decorator usage are scattered across every feature package's `di/` layer. Migrating out would require replacing all `@injectable()` / `@inject()` decorators, SYMBOLS definitions, and container bind calls across five feature packages simultaneously. The interface boundaries (ADR-002) reduce the surface, but the volume of changes is substantial. The per-feature container pattern (ADR-008) limits blast radius to one package at a time.
|
|
|
|
## Prompt: alternatives-considered
|
|
|
|
1. **tsyringe** (Microsoft) — lighter API but fewer lifecycle options and weaker TypeScript inference at the time of evaluation.
|
|
2. **Manual composition root** — zero dependency but does not scale past ~5 services without significant boilerplate and loses automatic dependency chain resolution.
|
|
|
|
See ADR-002 for the full decision rationale.
|