DPUse File Previewer Tool

...

Report a Vulnerability · Open an Issue

About DPUse

DPUse (Data Positioning & Use) is an in-browser application that positions your data for use through three core activities: sourcing, contextualising, and publishing.

Sourcing uses a library of Connectors to establish Connections to applications, databases, file stores, and curated datasets; these connections are subsequently used to configure structured Data Views from the underlying sources.

Contextualising extracts chronological events from those Data Views and maps them into comprehensive Context Models. This gives the DPUse Engine the structural framework needed to generate deterministic transactions, facts, or observations.

Publishing uses a library of Presenters to render standard Presentations immediately using the contextualised data; additionally, Cookbooks of Recipes let you build Data Apps using your preferred tools.

In addition, DPUse provides Tools used by the application, and you can use them to construct connectors and presenters.

Introduction

...

Usage

This package is available on npm. Install it with:

npm install @dpuse/dpuse-tool-file-previewer

To work on the source instead, clone this repository.

git clone https://github.com/dpuse/dpuse-tool-file-previewer.git
cd dpuse-tool-file-previewer
npm install

Requires Node.js 24 or later, npm 12 or later, and TypeScript 6.0.3 or later.

This repository is managed using the common set of actions provided by @dpuse/dpuse-development. See the scripts block in package.json for details.

Dependency Licenses

License data is updated each time npm run document is run, using license-checker. The following table lists every package whose code, styles or assets are included in this project's build, as recorded by the build itself. Modules loaded at run time are not included; each documents its own. These dependencies have been checked and confirmed to use 0BSD or MIT, all of which allow commercial use. All are used unmodified, so any licence conditions that apply only to modified versions are not triggered. Developers cloning this repository should independently verify development dependencies.

| Dependency | Version | License(s) | Document | | :--------------------------------------------------------------------- | :-----: | :--------- | :-------------------------------------------------------------------- | | @borewit/text-codec | 0.2.2 | MIT | LICENSE | | @dpuse/dpuse-shared | 1.0.142 | MIT | LICENSE | | @tokenizer/inflate | 0.5.1 | MIT | LICENSE | | debug | 4.4.3 | MIT | LICENSE | | file-type | 22.2.0 | MIT | LICENSE | | jschardet | 4.0.0 | 0BSD | LICENSE | | ms | 2.1.3 | MIT | LICENSE | | strtok3 | 10.6.2 | MIT | LICENSE | | token-types | 6.1.2 | MIT | LICENSE | | uint8array-extras | 1.6.0 | MIT | LICENSE | | valibot | 1.5.0 | MIT | LICENSE |

Dependency Tree

The dependency tree below shows how each package in the table above is reached — direct and transitive — along with its installed version, release date, and update status. A package that does not ship itself, such as one whose parts are bundled separately, is left out and what ships beneath it is shown in its place. Packages flagged ❗ have a newer version available; ⚠️ indicates a package that hasn't been updated in the last 6 months or longer. Neither flag necessarily indicates a problem: we let new releases stabilise before upgrading, and some packages are mature and stable (have limited or no dependencies), so they require no active development.

• @dpuse/dpuse-shared 1.0.142 — this month: 2026-10-25
  • file-type 22.2.0 — this month: 2026-10-14
  • valibot 1.5.0 — 1 mth ago: 2026-09-09
• file-type 22.2.0 — this month: 2026-10-14
  • @tokenizer/inflate 0.5.1 — this month: 2026-10-13 → latest: 0.6.0 — this month: 2026-10-24 ❗
    • debug 4.4.3 — 13 mths ago: 2025-09-13 ⚠️
    • token-types 6.1.2 — 9 mths ago: 2026-01-01 ⚠️
  • strtok3 10.6.2 — this month: 2026-10-18
  • token-types 6.1.2 — 9 mths ago: 2026-01-01 ⚠️
    • @borewit/text-codec 0.2.2 — 7 mths ago: 2026-03-11 ⚠️
  • uint8array-extras 1.6.0 — this month: 2026-09-26
• jschardet 4.0.0 — this month: 2026-09-26

Bundle Analysis

This report is updated with each release, from the bundle the release builds, using Sonda, which analyses final source maps to reveal the actual effects of tree-shaking and minification rather than relying on pre-build estimates.

Note: Sonda's Vite reports currently exclude CSS files, since Vite does not generate source maps for CSS.

| Chunk/Module/File | Composition | | :---------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------ | | dist/dpuse-tool-file-previewer.es.js | 1239.3 kB · gzip 718.3 kB · 100.0% of the build | |     jschardet → dist/jschardet.esm.min.js | ██████████████████░░ 90.6% · 1122.3 kB | |     file-type → source/index.js + 7 more | █░░░░░░░░░░░░░░░░░░░ 3.7% · 45.3 kB | |         ↳ 8 smaller files | ▒░░░░░░░░░░░░░░░░░░░ 3.7% · 45.3 kB | |     @dpuse/dpuse-shared → dist/dpuse-shared.es.js | ░░░░░░░░░░░░░░░░░░░░ 1.2% · 15.4 kB | |     strtok3 → lib/AbstractTokenizer.js + 12 more | ░░░░░░░░░░░░░░░░░░░░ 0.8% · 9.4 kB | |         ↳ 13 smaller files | ░░░░░░░░░░░░░░░░░░░░ 0.8% · 9.4 kB | |     @tokenizer/inflate → lib/ZipHandler.js + 3 more | ░░░░░░░░░░░░░░░░░░░░ 0.7% · 8.4 kB | |         ↳ 4 smaller files | ░░░░░░░░░░░░░░░░░░░░ 0.7% · 8.4 kB | |     src → index.ts | ░░░░░░░░░░░░░░░░░░░░ 0.6% · 7.1 kB | |     debug → src/browser.js + 1 more | ░░░░░░░░░░░░░░░░░░░░ 0.4% · 5.1 kB | |         ↳ 2 smaller files | ░░░░░░░░░░░░░░░░░░░░ 0.4% · 5.1 kB | |     @borewit/text-codec → lib/index.js | ░░░░░░░░░░░░░░░░░░░░ 0.3% · 3.3 kB | |     ms → index.js | ░░░░░░░░░░░░░░░░░░░░ 0.1% · 1.6 kB | |     uint8array-extras → index.js | ░░░░░░░░░░░░░░░░░░░░ 0.1% · 1.2 kB | |     token-types → lib/index.js | ░░░░░░░░░░░░░░░░░░░░ 0.1% · 1018 B | |     (bundler output, whitespace & JSON) | ░░░░░░░░░░░░░░░░░░░░ 1.6% · 19.2 kB |

Bars show each row's share of its output file. ↳ rows are part of the row above.

• n more = the row also holds n more files from the same package or folder, each no larger than the one named. A package can appear under several output files, each holding different files, never the same file twice.

(bundler output, whitespace & JSON) = bytes Sonda can't trace to a source file: whitespace (indentation and line breaks), code the bundler generates (region comments, the combined import/export lines, its small runtime helper and wrappers), and imported JSON such as config.json, which the bundler doesn't map. The JSON and the generated code are real bytes that ship; the whitespace mostly disappears once compressed.

Quality & Security

This section is updated each time npm run document is run. Settings come from the repository's workflow files and GitHub. Test coverage and the Fallow score are measured at the same time.

Testing

| Check | Status | What it does | | :------------------- | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Unit tests | ✅ On | Vitest runs the unit tests. Part of the CI workflow on every push and pull request to main. | | Property-based tests | ❌ Off | fast-check runs many random inputs per test to find edge cases, alongside the unit tests. | | Test coverage | ✅ On | Vitest's V8 coverage measures the share of source lines the unit tests run. The target is 80%. |

Code Quality

| Check | Status | What it does | | :------------ | :----- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Code analysis | ❌ Off | SonarCloud checks every push for bugs, code smells and vulnerabilities. | | Linting | ✅ On | ESLint checks the code for errors and style problems. Part of the CI workflow on every push and pull request to main. |

Security Analysis

| Check | Status | What it does | | :-------------- | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Push protection | ✅ On | GitHub push protection blocks pushes that contain credentials. | | Static analysis | ✅ On | CodeQL scans GitHub Actions and JavaScript/TypeScript for security vulnerabilities, using the extended security queries, on every push and pull request to main and weekly. | | Secret scanning | ✅ On | GitHub secret scanning detects credentials, such as API keys and tokens, committed to the repository. |

Dependencies

| Check | Status | What it does | | :------------------ | :----- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Vulnerability audit | ✅ On | npm audit fails when a shipped dependency has any known vulnerability, or a development dependency has a high or critical one. Part of the CI workflow on every push and pull request to main. | | Supply chain risk | ✅ On | Socket flags malicious packages, typosquatting and suspicious behaviour that may not yet have a CVE. | | Security alerts | ✅ On | Dependabot alerts when a dependency has a known vulnerability, using the GitHub Advisory Database. | | Security updates | ❌ Off | Dependabot opens pull requests that update vulnerable dependencies. These are handled manually. | | Version updates | ❌ Off | Dependabot opens pull requests for new dependency versions. These are handled manually. |

OpenSSF 🚧

This project is working towards the OpenSSF Best Practices Passing badge, a self-certification covering security policy, vulnerability reporting, build processes, code quality, and more. Currently the OpenSSF Scorecard provides an independent automated assessment of the project's security practices and is an ongoing area of improvement.

Reporting Vulnerabilities

Please do not open public GitHub issues for security vulnerabilities. Use GitHub private vulnerability reporting instead. See SECURITY.md for the full disclosure policy, contact details, and expected response times.

Contributing

This repository is maintained solely by its owner and does not, at present, accept external contributions into the canonical repo. Its source is published openly under the MIT License — every DPUse project is fully open source except DPUse Engine, which remains closed and proprietary.

For security vulnerabilities, see Reporting Vulnerabilities. For bugs, inconsistencies, or other feedback, open a GitHub issue — feedback is read, but responses and fixes are at the maintainer's discretion.

License

This project is licensed under the MIT License, permitting free use, modification, and distribution.

MIT © 2026 Jonathan Terrell