@drops-it/dpm 1.0.1

package/dist/api.d.ts

@@ -0,0 +1,46 @@
+import type { DpmConfig } from "./config.js";
+export declare class DpmApi {
+    private config;
+    constructor(config: DpmConfig);
+    private headers;
+    private url;
+    whoami(): Promise<{
+        username: string;
+        id: string;
+        scopes: string[];
+    }>;
+    search(q: string): Promise<{
+        packages: Array<Record<string, unknown>>;
+    }>;
+    getPackage(name: string): Promise<{
+        name: string;
+        description?: string;
+        latest?: string | null;
+        source?: string;
+        versions: Array<{
+            version: string;
+            dependencies?: Record<string, string>;
+            dist: {
+                tarball: string;
+                integrity: string;
+            };
+        }>;
+        "dist-tags": Record<string, string>;
+    } | null>;
+    publish(body: {
+        manifest: Record<string, unknown>;
+        tarballBase64: string;
+        access?: "public" | "private";
+    }): Promise<any>;
+    startDeviceLogin(): Promise<{
+        deviceCode: string;
+        userCode: string;
+        verificationUrl: string;
+        expiresIn: number;
+    }>;
+    pollDeviceLogin(deviceCode: string): Promise<{
+        status: "pending" | "approved";
+        token?: string;
+    }>;
+    downloadTarball(tarballUrl: string): Promise<Buffer>;
+}

package/dist/api.js

@@ -0,0 +1,82 @@
+export class DpmApi {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    headers(json = true) {
+        const h = {
+            "user-agent": "dpm-cli/1.0",
+            accept: "application/json",
+        };
+        if (json)
+            h["content-type"] = "application/json";
+        if (this.config.token)
+            h.authorization = `Bearer ${this.config.token}`;
+        return h;
+    }
+    url(p) {
+        return `${this.config.registry.replace(/\/$/, "")}${p}`;
+    }
+    async whoami() {
+        const res = await fetch(this.url("/dpm/v1/whoami"), { headers: this.headers() });
+        if (!res.ok)
+            throw new Error(`whoami failed (${res.status})`);
+        return res.json();
+    }
+    async search(q) {
+        const res = await fetch(this.url(`/dpm/v1/search?q=${encodeURIComponent(q)}`), {
+            headers: this.headers(),
+        });
+        if (!res.ok)
+            throw new Error(`search failed (${res.status})`);
+        return res.json();
+    }
+    async getPackage(name) {
+        const res = await fetch(this.url(`/dpm/v1/packages/${encodeURIComponent(name)}`), { headers: this.headers() });
+        if (res.status === 404)
+            return null;
+        if (!res.ok)
+            throw new Error(`view failed (${res.status})`);
+        return res.json();
+    }
+    async publish(body) {
+        const res = await fetch(this.url("/dpm/v1/publish"), {
+            method: "PUT",
+            headers: this.headers(),
+            body: JSON.stringify(body),
+        });
+        if (!res.ok) {
+            const err = await res.text();
+            throw new Error(`publish failed (${res.status}): ${err}`);
+        }
+        return res.json();
+    }
+    async startDeviceLogin() {
+        const res = await fetch(this.url("/api/v1/auth/cli/device"), {
+            method: "POST",
+            headers: this.headers(),
+        });
+        if (!res.ok)
+            throw new Error(`device login failed (${res.status})`);
+        return res.json();
+    }
+    async pollDeviceLogin(deviceCode) {
+        const res = await fetch(this.url("/api/v1/auth/cli/poll"), {
+            method: "POST",
+            headers: this.headers(),
+            body: JSON.stringify({ deviceCode }),
+        });
+        if (!res.ok)
+            throw new Error(`poll failed (${res.status})`);
+        return res.json();
+    }
+    async downloadTarball(tarballUrl) {
+        const url = tarballUrl.startsWith("http")
+            ? tarballUrl
+            : this.url(tarballUrl);
+        const res = await fetch(url, { headers: this.headers(false) });
+        if (!res.ok)
+            throw new Error(`tarball download failed (${res.status})`);
+        return Buffer.from(await res.arrayBuffer());
+    }
+}

package/dist/audit.d.ts

@@ -0,0 +1,33 @@
+import type { DpmApi } from "./api.js";
+import type { Lockfile } from "./config.js";
+export type VulnSeverity = "info" | "low" | "moderate" | "high" | "critical";
+export type AdvisoryHit = {
+    name: string;
+    version: string;
+    title: string;
+    severity: VulnSeverity;
+    url?: string;
+    vulnerable_versions?: string;
+};
+export type ProposedFix = {
+    name: string;
+    from: string;
+    to: string;
+    direct: boolean;
+    /** True when the fix requires widening a top-level range (--force). */
+    breaking: boolean;
+};
+/**
+ * Queries the public npm advisory bulk API for known vulnerabilities
+ * in the given installed package versions.
+ */
+export declare function auditPackages(packages: Record<string, {
+    version: string;
+}>): Promise<AdvisoryHit[]>;
+/**
+ * Proposes non-vulnerable versions for each vulnerable package,
+ * preferring the smallest bump that still satisfies parent ranges.
+ */
+export declare function proposeFixes(api: DpmApi, lock: Lockfile, hits: AdvisoryHit[], topLevel: Record<string, string>, force?: boolean): Promise<ProposedFix[]>;
+/** Formats an npm-style colored vulnerability summary for the console. */
+export declare function formatAuditReport(hits: AdvisoryHit[], fixes?: ProposedFix[]): string;

package/dist/audit.js

@@ -0,0 +1,210 @@
+import semver from "semver";
+import { c, severityColor } from "./colors.js";
+const SEVERITY_ORDER = ["info", "low", "moderate", "high", "critical"];
+function asSeverity(raw) {
+    const s = (raw || "moderate").toLowerCase();
+    if (SEVERITY_ORDER.includes(s))
+        return s;
+    return "moderate";
+}
+/**
+ * Queries the public npm advisory bulk API for known vulnerabilities
+ * in the given installed package versions.
+ */
+export async function auditPackages(packages) {
+    const names = Object.keys(packages);
+    if (names.length === 0)
+        return [];
+    const body = {};
+    for (const name of names) {
+        body[name] = [packages[name].version];
+    }
+    let res;
+    try {
+        res = await fetch("https://registry.npmjs.org/-/npm/v1/security/advisories/bulk", {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                accept: "application/json",
+                "user-agent": "dpm-cli/1.0",
+            },
+            body: JSON.stringify(body),
+        });
+    }
+    catch {
+        return [];
+    }
+    if (!res.ok)
+        return [];
+    let data;
+    try {
+        data = (await res.json());
+    }
+    catch {
+        return [];
+    }
+    const hits = [];
+    for (const [name, advisories] of Object.entries(data)) {
+        if (!Array.isArray(advisories) || !packages[name])
+            continue;
+        for (const adv of advisories) {
+            hits.push({
+                name,
+                version: packages[name].version,
+                title: adv.title || "Known vulnerability",
+                severity: asSeverity(adv.severity),
+                url: adv.url,
+                vulnerable_versions: adv.vulnerable_versions,
+            });
+        }
+    }
+    hits.sort((a, b) => SEVERITY_ORDER.indexOf(b.severity) - SEVERITY_ORDER.indexOf(a.severity));
+    return hits;
+}
+function versionIsVulnerable(version, hits) {
+    return hits.some((h) => {
+        if (!h.vulnerable_versions)
+            return false;
+        try {
+            return semver.satisfies(version, h.vulnerable_versions, { includePrerelease: true });
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/** Collect parent dependency ranges that constrain a package in the lockfile. */
+function parentRanges(name, lock, topLevel) {
+    const ranges = [];
+    if (topLevel[name])
+        ranges.push(topLevel[name]);
+    for (const pkg of Object.values(lock.packages)) {
+        const r = pkg.dependencies?.[name];
+        if (r)
+            ranges.push(r);
+    }
+    return ranges;
+}
+/**
+ * Proposes non-vulnerable versions for each vulnerable package,
+ * preferring the smallest bump that still satisfies parent ranges.
+ */
+export async function proposeFixes(api, lock, hits, topLevel, force = false) {
+    const byName = new Map();
+    for (const h of hits) {
+        const list = byName.get(h.name) || [];
+        list.push(h);
+        byName.set(h.name, list);
+    }
+    const fixes = [];
+    for (const [name, pkgHits] of byName) {
+        const current = lock.packages[name]?.version;
+        if (!current)
+            continue;
+        const meta = await api.getPackage(name);
+        if (!meta)
+            continue;
+        const versions = meta.versions
+            .map((v) => v.version)
+            .filter((v) => semver.valid(v))
+            .sort(semver.compare);
+        const safe = versions.filter((v) => !versionIsVulnerable(v, pkgHits));
+        if (safe.length === 0)
+            continue;
+        const ranges = parentRanges(name, lock, topLevel);
+        const direct = Boolean(topLevel[name]);
+        const inRange = (v) => ranges.length === 0 ||
+            ranges.every((r) => {
+                try {
+                    return semver.satisfies(v, r);
+                }
+                catch {
+                    return false;
+                }
+            });
+        let target = safe.find((v) => semver.gte(v, current) && inRange(v)) ??
+            safe.filter((v) => inRange(v)).at(-1);
+        let breaking = false;
+        if (!target && force) {
+            target = safe.filter((v) => semver.gte(v, current)).at(0) ?? safe.at(-1);
+            breaking = true;
+        }
+        if (!target || target === current)
+            continue;
+        fixes.push({ name, from: current, to: target, direct, breaking });
+    }
+    return fixes.sort((a, b) => a.name.localeCompare(b.name));
+}
+function countBySeverity(hits) {
+    const counts = {
+        info: 0,
+        low: 0,
+        moderate: 0,
+        high: 0,
+        critical: 0,
+    };
+    for (const h of hits)
+        counts[h.severity] += 1;
+    return counts;
+}
+/** Formats an npm-style colored vulnerability summary for the console. */
+export function formatAuditReport(hits, fixes = []) {
+    if (hits.length === 0) {
+        return `${c.green("found 0 vulnerabilities")}`;
+    }
+    const counts = countBySeverity(hits);
+    const parts = SEVERITY_ORDER.filter((s) => counts[s] > 0).map((s) => {
+        const color = severityColor(s);
+        return color(`${counts[s]} ${s}`);
+    });
+    const byPkg = new Map();
+    for (const h of hits) {
+        let agg = byPkg.get(h.name);
+        if (!agg) {
+            agg = {
+                version: h.version,
+                max: h.severity,
+                counts: { info: 0, low: 0, moderate: 0, high: 0, critical: 0 },
+            };
+            byPkg.set(h.name, agg);
+        }
+        agg.counts[h.severity] += 1;
+        if (SEVERITY_ORDER.indexOf(h.severity) > SEVERITY_ORDER.indexOf(agg.max)) {
+            agg.max = h.severity;
+        }
+    }
+    const fixByName = new Map(fixes.map((f) => [f.name, f]));
+    const pkgLines = [...byPkg.entries()]
+        .sort((a, b) => SEVERITY_ORDER.indexOf(b[1].max) - SEVERITY_ORDER.indexOf(a[1].max))
+        .slice(0, 8)
+        .map(([name, info]) => {
+        const detail = SEVERITY_ORDER.filter((s) => info.counts[s] > 0)
+            .map((s) => severityColor(s)(`${info.counts[s]} ${s}`))
+            .join(", ");
+        const fix = fixByName.get(name);
+        const fixHint = fix
+            ? c.green(` → ${fix.to}${fix.breaking ? " (breaking)" : ""}`)
+            : c.dim("  (no fix available)");
+        return `  ${c.bold(name)}@${c.dim(info.version)}  ${detail}${fixHint}`;
+    });
+    const extra = byPkg.size > 8 ? `\n  ${c.dim(`… and ${byPkg.size - 8} more packages`)}` : "";
+    const fixable = fixes.filter((f) => !f.breaking).length;
+    const forced = fixes.filter((f) => f.breaking).length;
+    const footer = [""];
+    if (fixable > 0) {
+        footer.push(c.cyan(`  ${fixable} vulnerabilit${fixable === 1 ? "y" : "ies"} fixable with:`));
+        footer.push(`    ${c.bold("dpm audit fix")}`);
+    }
+    if (forced > 0) {
+        footer.push(c.yellow(`  ${forced} require a breaking update:`));
+        footer.push(`    ${c.bold("dpm audit fix --force")}`);
+    }
+    if (fixable === 0 && forced === 0) {
+        footer.push(c.dim("  No automatic fixes available for these advisories."));
+    }
+    return [
+        "",
+        `${c.bold(`found ${hits.length} vulnerabilit${hits.length === 1 ? "y" : "ies"}`)} (${parts.join(", ")})`,
+        ...pkgLines,
+    ].join("\n") + extra + footer.join("\n");
+}

package/dist/colors.d.ts

@@ -0,0 +1,15 @@
+/** ANSI styling helpers that stay silent when stdout is not a TTY or NO_COLOR is set. */
+export declare const c: {
+    reset: string;
+    dim: (text: string) => string;
+    bold: (text: string) => string;
+    green: (text: string) => string;
+    yellow: (text: string) => string;
+    red: (text: string) => string;
+    cyan: (text: string) => string;
+    magenta: (text: string) => string;
+    blue: (text: string) => string;
+    white: (text: string) => string;
+    gray: (text: string) => string;
+};
+export declare function severityColor(severity: string): (text: string) => string;

package/dist/colors.js

@@ -0,0 +1,30 @@
+/** ANSI styling helpers that stay silent when stdout is not a TTY or NO_COLOR is set. */
+const enabled = () => Boolean(process.stdout.isTTY) && !process.env.NO_COLOR && process.env.FORCE_COLOR !== "0";
+const wrap = (open, close = "\x1b[0m") => (text) => enabled() ? `${open}${text}${close}` : text;
+export const c = {
+    reset: "\x1b[0m",
+    dim: wrap("\x1b[2m"),
+    bold: wrap("\x1b[1m"),
+    green: wrap("\x1b[32m"),
+    yellow: wrap("\x1b[33m"),
+    red: wrap("\x1b[31m"),
+    cyan: wrap("\x1b[36m"),
+    magenta: wrap("\x1b[35m"),
+    blue: wrap("\x1b[34m"),
+    white: wrap("\x1b[37m"),
+    gray: wrap("\x1b[90m"),
+};
+export function severityColor(severity) {
+    switch (severity) {
+        case "critical":
+            return (t) => c.bold(c.red(t));
+        case "high":
+            return c.red;
+        case "moderate":
+            return c.yellow;
+        case "low":
+            return c.cyan;
+        default:
+            return c.gray;
+    }
+}

package/dist/config.d.ts

@@ -0,0 +1,23 @@
+export type DpmConfig = {
+    registry: string;
+    token?: string;
+};
+export type Lockfile = {
+    lockfileVersion: 1;
+    packages: Record<string, {
+        version: string;
+        resolved: string;
+        integrity: string;
+        source: "dpm" | "npm";
+        dependencies?: Record<string, string>;
+    }>;
+};
+declare const CONFIG_PATH: string;
+export declare function loadConfig(): Promise<DpmConfig>;
+export declare function saveConfig(config: DpmConfig): Promise<void>;
+export declare function loadLockfile(cwd?: string): Promise<Lockfile>;
+export declare function saveLockfile(lock: Lockfile, cwd?: string): Promise<void>;
+export declare function readPackageJson(cwd?: string): Promise<Record<string, unknown>>;
+export declare function writePackageJson(data: Record<string, unknown>, cwd?: string): Promise<void>;
+export declare function ensureDir(dir: string): Promise<void>;
+export { CONFIG_PATH };

package/dist/config.js

@@ -0,0 +1,43 @@
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import path from "node:path";
+import YAML from "yaml";
+const CONFIG_PATH = path.join(homedir(), ".dpmrc");
+export async function loadConfig() {
+    try {
+        const raw = await readFile(CONFIG_PATH, "utf8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return {
+            registry: process.env.DPM_REGISTRY || "https://dpm.drops-it.com",
+            token: process.env.DPM_TOKEN,
+        };
+    }
+}
+export async function saveConfig(config) {
+    await writeFile(CONFIG_PATH, JSON.stringify(config, null, 2), { mode: 0o600 });
+}
+export async function loadLockfile(cwd = process.cwd()) {
+    try {
+        const raw = await readFile(path.join(cwd, "dpm-lock.yaml"), "utf8");
+        return YAML.parse(raw);
+    }
+    catch {
+        return { lockfileVersion: 1, packages: {} };
+    }
+}
+export async function saveLockfile(lock, cwd = process.cwd()) {
+    await writeFile(path.join(cwd, "dpm-lock.yaml"), YAML.stringify(lock));
+}
+export async function readPackageJson(cwd = process.cwd()) {
+    const raw = await readFile(path.join(cwd, "package.json"), "utf8");
+    return JSON.parse(raw);
+}
+export async function writePackageJson(data, cwd = process.cwd()) {
+    await writeFile(path.join(cwd, "package.json"), `${JSON.stringify(data, null, 2)}\n`);
+}
+export async function ensureDir(dir) {
+    await mkdir(dir, { recursive: true });
+}
+export { CONFIG_PATH };

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,208 @@
+#!/usr/bin/env node
+import { exec } from "node:child_process";
+import { Command } from "commander";
+import { DpmApi } from "./api.js";
+import { loadConfig, saveConfig, writePackageJson } from "./config.js";
+import { addPackages, auditFix, installAll, installGlobalPackages, packTarball, removePackage, runAudit, } from "./install.js";
+import { createUi } from "./ui.js";
+import { CLI_VERSION, maybeNotifyUpdate } from "./updateCheck.js";
+const program = new Command();
+program.name("dpm").description("Drops Package Manager").version(CLI_VERSION);
+program.hook("preAction", async () => {
+    await maybeNotifyUpdate();
+});
+program
+    .command("config")
+    .argument("[key]")
+    .argument("[value]")
+    .description("Get or set CLI config")
+    .action(async (key, value) => {
+    const config = await loadConfig();
+    if (!key) {
+        console.log(JSON.stringify({ ...config, token: config.token ? "***" : undefined }, null, 2));
+        return;
+    }
+    if (value === undefined) {
+        console.log(config[key]);
+        return;
+    }
+    if (key === "registry")
+        config.registry = value;
+    if (key === "token")
+        config.token = value;
+    await saveConfig(config);
+    console.log("Saved.");
+});
+program
+    .command("login")
+    .description("Log in via Drops-IT (browser device flow)")
+    .action(async () => {
+    const config = await loadConfig();
+    const api = new DpmApi(config);
+    const device = await api.startDeviceLogin();
+    const site = config.registry.includes("127.0.0.1") || config.registry.includes("localhost")
+        ? "http://127.0.0.1:25121"
+        : "https://dpm.drops-it.com";
+    const url = `${site}${device.verificationUrl}?code=${device.userCode}`;
+    console.log(`Open ${url}`);
+    console.log(`User code: ${device.userCode}`);
+    exec(`${process.platform === "win32" ? "start" : "xdg-open"} "" "${url}"`);
+    const started = Date.now();
+    while (Date.now() - started < device.expiresIn * 1000) {
+        await new Promise((r) => setTimeout(r, 2000));
+        const poll = await api.pollDeviceLogin(device.deviceCode);
+        if (poll.status === "approved" && poll.token) {
+            config.token = poll.token;
+            await saveConfig(config);
+            const who = await new DpmApi(config).whoami();
+            console.log(`Logged in as ${who.username}`);
+            return;
+        }
+    }
+    console.error("Login timed out.");
+    process.exit(1);
+});
+program
+    .command("logout")
+    .description("Remove local DPM token")
+    .action(async () => {
+    const config = await loadConfig();
+    delete config.token;
+    await saveConfig(config);
+    console.log("Logged out.");
+});
+program
+    .command("whoami")
+    .description("Show current DPM user")
+    .action(async () => {
+    const api = new DpmApi(await loadConfig());
+    const who = await api.whoami();
+    console.log(who.username);
+});
+program
+    .command("init")
+    .description("Create a package.json")
+    .action(async () => {
+    await writePackageJson({
+        name: "my-package",
+        version: "1.0.0",
+        description: "",
+        main: "index.js",
+        license: "MIT",
+        dependencies: {},
+    });
+    console.log("Created package.json");
+});
+program
+    .command("search")
+    .argument("<query>")
+    .action(async (query) => {
+    const api = new DpmApi(await loadConfig());
+    const { packages } = await api.search(query);
+    for (const p of packages) {
+        console.log(`${p.name}@${p.version ?? "?"} — ${p.description || ""} [${p.source || "dpm"}]`);
+    }
+});
+program
+    .command("view")
+    .argument("<name>")
+    .action(async (name) => {
+    const api = new DpmApi(await loadConfig());
+    const meta = await api.getPackage(name);
+    if (!meta) {
+        console.error("Not found");
+        process.exit(1);
+    }
+    console.log(JSON.stringify(meta, null, 2));
+});
+program
+    .command("install")
+    .alias("i")
+    .argument("[packages...]", "optional packages to add (like npm i lodash)")
+    .option("-g, --global", "install into the npm global prefix")
+    .description("Install package.json deps, or add packages then install")
+    .action(async (packages, opts) => {
+    const api = new DpmApi(await loadConfig());
+    const ui = createUi();
+    if (opts.global) {
+        await installGlobalPackages(api, packages, ui);
+        return;
+    }
+    if (packages.length > 0) {
+        await addPackages(api, packages, process.cwd(), ui);
+        return;
+    }
+    await installAll(api, process.cwd(), ui);
+});
+program
+    .command("add")
+    .argument("<packages...>")
+    .option("-g, --global", "install into the npm global prefix")
+    .description("Add dependencies to package.json and install")
+    .action(async (packages, opts) => {
+    const api = new DpmApi(await loadConfig());
+    const ui = createUi();
+    if (opts.global) {
+        await installGlobalPackages(api, packages, ui);
+        return;
+    }
+    await addPackages(api, packages, process.cwd(), ui);
+});
+program
+    .command("update")
+    .description("Re-resolve and install dependencies")
+    .action(async () => {
+    const api = new DpmApi(await loadConfig());
+    await installAll(api, process.cwd(), createUi());
+});
+program
+    .command("remove")
+    .alias("rm")
+    .argument("<name>")
+    .action(async (name) => {
+    await removePackage(name, process.cwd(), createUi());
+});
+const auditCmd = program
+    .command("audit")
+    .description("Report known vulnerabilities (like npm audit)")
+    .action(async () => {
+    const api = new DpmApi(await loadConfig());
+    await runAudit(api, process.cwd(), createUi());
+});
+auditCmd
+    .command("fix")
+    .description("Apply available vulnerability fixes")
+    .option("--force", "allow breaking version bumps")
+    .action(async (opts) => {
+    const api = new DpmApi(await loadConfig());
+    await auditFix(api, process.cwd(), createUi(), Boolean(opts.force));
+});
+program
+    .command("publish")
+    .option("--access <access>", "public or private")
+    .action(async (opts) => {
+    const api = new DpmApi(await loadConfig());
+    const packed = await packTarball();
+    const result = await api.publish({
+        manifest: packed.manifest,
+        tarballBase64: packed.tarballBase64,
+        access: opts.access,
+    });
+    console.log(`Published ${result.name}@${result.version} (${result.access})`);
+});
+program
+    .command("link")
+    .description("Reserved for local workspace linking")
+    .action(() => {
+    console.log("Use file: dependencies or workspaces for now.");
+});
+program
+    .command("unlink")
+    .description("Reserved for local workspace unlinking")
+    .action(() => {
+    console.log("Unlink placeholder — remove file: links from package.json.");
+});
+program.parseAsync(process.argv).catch((err) => {
+    console.error(err instanceof Error ? err.message : err);
+    process.exit(1);
+});

package/dist/install.d.ts

@@ -0,0 +1,48 @@
+import { DpmApi } from "./api.js";
+import { auditPackages, type ProposedFix } from "./audit.js";
+import { type Lockfile } from "./config.js";
+export type InstallLog = {
+    info: (msg: string) => void;
+    warn: (msg: string) => void;
+    success?: (msg: string) => void;
+    status?: (msg: string) => void;
+    clearStatus?: () => void;
+};
+export type InstallOptions = {
+    /** Prefer these exact versions when they satisfy the requested range. */
+    preferredVersions?: Record<string, string>;
+    /** Skip the post-install vulnerability check (used by nested audit-fix reinstall). */
+    skipAudit?: boolean;
+};
+/** Parse `name`, `name@1.2.3`, `name@^1`, `@scope/name`, `@scope/name@1.0.0`. */
+export declare function parsePackageSpec(spec: string): {
+    name: string;
+    range: string;
+};
+export declare function installAll(api: DpmApi, cwd?: string, log?: InstallLog, options?: InstallOptions): Promise<Lockfile>;
+export declare function addPackages(api: DpmApi, specs: string[], cwd?: string, log?: InstallLog): Promise<Lockfile>;
+/**
+ * Installs packages into the npm global prefix (bins linked by npm).
+ * Used for CLI self-updates: `dpm i -g @drops-it/dpm`.
+ */
+export declare function installGlobalPackages(api: DpmApi, specs: string[], log?: InstallLog): Promise<void>;
+export declare function addPackage(api: DpmApi, name: string, range?: string, cwd?: string, log?: InstallLog): Promise<Lockfile>;
+export declare function removePackage(name: string, cwd?: string, log?: InstallLog): Promise<void>;
+/**
+ * Runs a vulnerability audit against the current lockfile (or installs first).
+ */
+export declare function runAudit(api: DpmApi, cwd?: string, log?: InstallLog): Promise<{
+    hits: Awaited<ReturnType<typeof auditPackages>>;
+    fixes: ProposedFix[];
+}>;
+/**
+ * Applies available advisory fixes (like `npm audit fix`), then reinstalls.
+ */
+export declare function auditFix(api: DpmApi, cwd?: string, log?: InstallLog, force?: boolean): Promise<{
+    fixed: ProposedFix[];
+    lock: Lockfile;
+}>;
+export declare function packTarball(cwd?: string): Promise<{
+    manifest: Record<string, unknown>;
+    tarballBase64: string;
+}>;

package/dist/install.js

@@ -0,0 +1,354 @@
+import { createHash } from "node:crypto";
+import { execFile } from "node:child_process";
+import { access, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+import * as tar from "tar";
+import semver from "semver";
+import { auditPackages, formatAuditReport, proposeFixes, } from "./audit.js";
+import { c } from "./colors.js";
+import { loadLockfile, readPackageJson, saveLockfile, writePackageJson, } from "./config.js";
+import { createUi } from "./ui.js";
+const execFileAsync = promisify(execFile);
+function asUi(log) {
+    if ("status" in log && typeof log.status === "function" && "clearStatus" in log) {
+        return log;
+    }
+    return createUi();
+}
+function integrityOf(buf) {
+    return `sha512-${createHash("sha512").update(buf).digest("base64")}`;
+}
+async function extractToNodeModules(name, tarball, cwd) {
+    const target = path.join(cwd, "node_modules", ...name.split("/"));
+    await rm(target, { recursive: true, force: true });
+    await mkdir(target, { recursive: true });
+    const tmp = path.join(cwd, "node_modules", `.dpm-tmp-${Date.now()}-${Math.random().toString(16).slice(2)}.tgz`);
+    await writeFile(tmp, tarball);
+    await tar.x({ file: tmp, cwd: target, strip: 1 });
+    await rm(tmp, { force: true });
+}
+function pickVersion(versions, range, distTags, preferred) {
+    // Audit-fix preferred versions always win when present in the registry.
+    if (preferred && versions.includes(preferred))
+        return preferred;
+    if (range === "latest" || range === "*" || range === "") {
+        return distTags.latest ?? semver.maxSatisfying(versions, "*");
+    }
+    if (semver.valid(range))
+        return versions.includes(range) ? range : null;
+    return semver.maxSatisfying(versions, range);
+}
+/** Parse `name`, `name@1.2.3`, `name@^1`, `@scope/name`, `@scope/name@1.0.0`. */
+export function parsePackageSpec(spec) {
+    if (spec.startsWith("@")) {
+        const at = spec.indexOf("@", 1);
+        if (at === -1)
+            return { name: spec, range: "latest" };
+        return { name: spec.slice(0, at), range: spec.slice(at + 1) || "latest" };
+    }
+    const at = spec.lastIndexOf("@");
+    if (at <= 0)
+        return { name: spec, range: "latest" };
+    return { name: spec.slice(0, at), range: spec.slice(at + 1) || "latest" };
+}
+async function ensurePackageJson(cwd, log) {
+    try {
+        await access(path.join(cwd, "package.json"));
+        return readPackageJson(cwd);
+    }
+    catch {
+        log.warn("no package.json found — creating one");
+        const pkg = {
+            name: path.basename(cwd) || "my-package",
+            version: "1.0.0",
+            private: true,
+            dependencies: {},
+        };
+        await writePackageJson(pkg, cwd);
+        return pkg;
+    }
+}
+async function resolveRange(api, name, range) {
+    const meta = await api.getPackage(name);
+    if (!meta)
+        throw new Error(`Package not found: ${name}`);
+    if (range === "latest" || range === "*") {
+        const latest = meta.latest || meta["dist-tags"]?.latest;
+        if (!latest)
+            throw new Error(`No versions for ${name}`);
+        return `^${latest}`;
+    }
+    if (semver.valid(range))
+        return range;
+    return range;
+}
+function setStatus(log, msg) {
+    if (log.status)
+        log.status(msg);
+    else
+        log.info(msg);
+}
+function topLevelDeps(pkg) {
+    return {
+        ...(pkg.dependencies || {}),
+        ...(pkg.devDependencies || {}),
+    };
+}
+function readOverrides(pkg) {
+    const raw = pkg.overrides || {};
+    const out = {};
+    for (const [name, value] of Object.entries(raw)) {
+        if (typeof value === "string")
+            out[name] = value;
+    }
+    return out;
+}
+export async function installAll(api, cwd = process.cwd(), log = createUi(), options = {}) {
+    const ui = asUi(log);
+    const pkg = await ensurePackageJson(cwd, ui);
+    const deps = topLevelDeps(pkg);
+    const entries = Object.entries(deps);
+    if (entries.length === 0) {
+        ui.warn("package.json has no dependencies");
+        await saveLockfile({ lockfileVersion: 1, packages: {} }, cwd);
+        return { lockfileVersion: 1, packages: {} };
+    }
+    ui.info(`${c.cyan("→")} resolving ${c.bold(String(entries.length))} top-level dependenc${entries.length === 1 ? "y" : "ies"}`);
+    const lock = { lockfileVersion: 1, packages: {} };
+    const queue = [...entries];
+    let installed = 0;
+    const started = Date.now();
+    const preferred = {
+        ...readOverrides(pkg),
+        ...(options.preferredVersions || {}),
+    };
+    while (queue.length) {
+        const [name, range] = queue.pop();
+        if (lock.packages[name])
+            continue;
+        const progress = () => {
+            const pending = queue.length + 1;
+            return `${c.dim(`${installed} done · ${pending} left`)}`;
+        };
+        setStatus(ui, `resolve ${c.bold(name)}@${range}  ${progress()}`);
+        const meta = await api.getPackage(name);
+        if (!meta)
+            throw new Error(`Package not found: ${name}`);
+        const versions = meta.versions.map((v) => v.version);
+        const version = pickVersion(versions, range, meta["dist-tags"] || {}, preferred[name]);
+        if (!version)
+            throw new Error(`No version of ${name} matches ${range}`);
+        const ver = meta.versions.find((v) => v.version === version);
+        const source = meta.source || "dpm";
+        const sourceTag = source === "npm" ? c.magenta("[npm]") : c.blue("[dpm]");
+        setStatus(ui, `download ${c.bold(name)}@${c.green(version)} ${sourceTag}  ${progress()}`);
+        const tarball = await api.downloadTarball(ver.dist.tarball);
+        const integrity = ver.dist.integrity || integrityOf(tarball);
+        setStatus(ui, `extract ${c.bold(name)}@${c.green(version)}  ${progress()}`);
+        await extractToNodeModules(name, tarball, cwd);
+        installed += 1;
+        lock.packages[name] = {
+            version,
+            resolved: ver.dist.tarball,
+            integrity,
+            source,
+            dependencies: ver.dependencies,
+        };
+        for (const [dep, depRange] of Object.entries(ver.dependencies || {})) {
+            if (!lock.packages[dep])
+                queue.push([dep, depRange]);
+        }
+    }
+    ui.clearStatus();
+    await saveLockfile(lock, cwd);
+    const elapsed = ((Date.now() - started) / 1000).toFixed(1);
+    if (ui.success) {
+        ui.success(`added ${c.bold(String(installed))} package${installed === 1 ? "" : "s"} in ${elapsed}s`);
+    }
+    else {
+        ui.info(`added ${installed} package${installed === 1 ? "" : "s"} in ${elapsed}s`);
+    }
+    if (!options.skipAudit) {
+        setStatus(ui, "checking vulnerabilities…");
+        const hits = await auditPackages(lock.packages);
+        const fixes = hits.length
+            ? await proposeFixes(api, lock, hits, deps, true)
+            : [];
+        ui.clearStatus();
+        ui.info(formatAuditReport(hits, fixes));
+    }
+    return lock;
+}
+export async function addPackages(api, specs, cwd = process.cwd(), log = createUi()) {
+    if (specs.length === 0)
+        return installAll(api, cwd, log);
+    const ui = asUi(log);
+    const pkg = await ensurePackageJson(cwd, ui);
+    const deps = pkg.dependencies || {};
+    for (const spec of specs) {
+        const { name, range } = parsePackageSpec(spec);
+        setStatus(ui, `add ${c.bold(name)}`);
+        const savedRange = await resolveRange(api, name, range);
+        deps[name] = savedRange;
+        ui.info(`${c.green("+")} ${c.bold(name)}@${c.cyan(savedRange)}`);
+    }
+    pkg.dependencies = deps;
+    await writePackageJson(pkg, cwd);
+    return installAll(api, cwd, ui);
+}
+/**
+ * Installs packages into the npm global prefix (bins linked by npm).
+ * Used for CLI self-updates: `dpm i -g @drops-it/dpm`.
+ */
+export async function installGlobalPackages(api, specs, log = createUi()) {
+    if (specs.length === 0) {
+        throw new Error("global install requires at least one package name");
+    }
+    const ui = asUi(log);
+    for (const spec of specs) {
+        const { name, range } = parsePackageSpec(spec);
+        setStatus(ui, `resolve ${c.bold(name)}`);
+        const meta = await api.getPackage(name);
+        if (!meta)
+            throw new Error(`Package not found: ${name}`);
+        const versions = meta.versions.map((v) => v.version);
+        const version = pickVersion(versions, range, meta["dist-tags"] || {});
+        if (!version)
+            throw new Error(`No version of ${name} matches ${range}`);
+        const ver = meta.versions.find((v) => v.version === version);
+        setStatus(ui, `download ${c.bold(name)}@${c.green(version)}`);
+        const tarball = await api.downloadTarball(ver.dist.tarball);
+        const tmp = path.join(process.cwd(), `.dpm-global-${Date.now()}-${Math.random().toString(16).slice(2)}.tgz`);
+        await writeFile(tmp, tarball);
+        try {
+            setStatus(ui, `npm install -g ${c.bold(name)}@${c.green(version)}`);
+            await execFileAsync("npm", ["install", "-g", tmp], {
+                windowsHide: true,
+                maxBuffer: 10 * 1024 * 1024,
+            });
+        }
+        finally {
+            await rm(tmp, { force: true });
+        }
+        ui.clearStatus();
+        if (ui.success)
+            ui.success(`installed ${c.bold(name)}@${c.green(version)} globally`);
+        else
+            ui.info(`installed ${name}@${version} globally`);
+    }
+}
+export async function addPackage(api, name, range = "latest", cwd = process.cwd(), log = createUi()) {
+    const spec = range === "latest" ? name : `${name}@${range}`;
+    return addPackages(api, [spec], cwd, log);
+}
+export async function removePackage(name, cwd = process.cwd(), log = createUi()) {
+    const ui = asUi(log);
+    const pkg = await readPackageJson(cwd);
+    const deps = pkg.dependencies || {};
+    const dev = pkg.devDependencies || {};
+    if (!deps[name] && !dev[name]) {
+        ui.warn(`${name} is not in package.json`);
+    }
+    delete deps[name];
+    delete dev[name];
+    pkg.dependencies = deps;
+    pkg.devDependencies = dev;
+    await writePackageJson(pkg, cwd);
+    await rm(path.join(cwd, "node_modules", ...name.split("/")), {
+        recursive: true,
+        force: true,
+    });
+    const lock = await loadLockfile(cwd);
+    delete lock.packages[name];
+    await saveLockfile(lock, cwd);
+    if (ui.success)
+        ui.success(`removed ${c.bold(name)}`);
+    else
+        ui.info(`removed ${name}`);
+}
+/**
+ * Runs a vulnerability audit against the current lockfile (or installs first).
+ */
+export async function runAudit(api, cwd = process.cwd(), log = createUi()) {
+    const ui = asUi(log);
+    let lock = await loadLockfile(cwd);
+    if (Object.keys(lock.packages).length === 0) {
+        lock = await installAll(api, cwd, ui, { skipAudit: true });
+    }
+    setStatus(ui, "checking vulnerabilities…");
+    const hits = await auditPackages(lock.packages);
+    const pkg = await readPackageJson(cwd);
+    const deps = topLevelDeps(pkg);
+    const fixes = hits.length ? await proposeFixes(api, lock, hits, deps, true) : [];
+    ui.clearStatus();
+    ui.info(formatAuditReport(hits, fixes));
+    return { hits, fixes: fixes.filter((f) => !f.breaking) };
+}
+/**
+ * Applies available advisory fixes (like `npm audit fix`), then reinstalls.
+ */
+export async function auditFix(api, cwd = process.cwd(), log = createUi(), force = false) {
+    const ui = asUi(log);
+    let lock = await loadLockfile(cwd);
+    if (Object.keys(lock.packages).length === 0) {
+        lock = await installAll(api, cwd, ui, { skipAudit: true });
+    }
+    setStatus(ui, "checking vulnerabilities…");
+    const hits = await auditPackages(lock.packages);
+    const pkg = await readPackageJson(cwd);
+    const deps = topLevelDeps(pkg);
+    const fixes = await proposeFixes(api, lock, hits, deps, force);
+    ui.clearStatus();
+    const applicable = force ? fixes : fixes.filter((f) => !f.breaking);
+    if (applicable.length === 0) {
+        ui.info(formatAuditReport(hits, await proposeFixes(api, lock, hits, deps, true)));
+        ui.warn(force ? "no fixes available" : "no non-breaking fixes — try dpm audit fix --force");
+        return { fixed: [], lock };
+    }
+    const preferred = {};
+    const dependencies = pkg.dependencies || {};
+    const devDependencies = pkg.devDependencies || {};
+    const overrides = readOverrides(pkg);
+    for (const fix of applicable) {
+        preferred[fix.name] = fix.to;
+        ui.info(`${c.green("fix")} ${c.bold(fix.name)} ${c.dim(fix.from)} ${c.cyan("→")} ${c.green(fix.to)}${fix.breaking ? c.yellow(" (breaking)") : ""}`);
+        if (dependencies[fix.name]) {
+            dependencies[fix.name] = `^${fix.to}`;
+        }
+        else if (devDependencies[fix.name]) {
+            devDependencies[fix.name] = `^${fix.to}`;
+        }
+        else {
+            // Persist transitive fixes so the next plain install keeps them.
+            overrides[fix.name] = fix.to;
+        }
+    }
+    pkg.dependencies = dependencies;
+    pkg.devDependencies = devDependencies;
+    if (Object.keys(overrides).length > 0)
+        pkg.overrides = overrides;
+    await writePackageJson(pkg, cwd);
+    const next = await installAll(api, cwd, ui, {
+        preferredVersions: preferred,
+        skipAudit: false,
+    });
+    return { fixed: applicable, lock: next };
+}
+export async function packTarball(cwd = process.cwd()) {
+    const manifest = await readPackageJson(cwd);
+    const out = path.join(cwd, `.dpm-pack-${Date.now()}.tgz`);
+    await tar.c({
+        gzip: true,
+        file: out,
+        cwd,
+        prefix: "package",
+        filter: (p) => !p.includes("node_modules") &&
+            !p.startsWith(".git") &&
+            !p.endsWith(".tgz") &&
+            p !== "dpm-lock.yaml",
+    }, ["."]);
+    const buf = await readFile(out);
+    await rm(out, { force: true });
+    return { manifest, tarballBase64: buf.toString("base64") };
+}

package/dist/ui.d.ts

@@ -0,0 +1,17 @@
+/** Clears the ephemeral status line and writes permanent output. */
+export type Ui = {
+    info: (msg: string) => void;
+    warn: (msg: string) => void;
+    success: (msg: string) => void;
+    /** Overwrites the current in-progress line (cleared when the next status or commit runs). */
+    status: (msg: string) => void;
+    /** Ends the status line and prints a lasting message. */
+    commit: (msg: string) => void;
+    /** Clears any active status line without printing. */
+    clearStatus: () => void;
+};
+/**
+ * Builds a terminal UI with one live animated status line that replaces itself
+ * as each package is fetched, plus permanent info/warn lines.
+ */
+export declare function createUi(): Ui;

package/dist/ui.js

@@ -0,0 +1,76 @@
+import { c } from "./colors.js";
+const isTty = () => Boolean(process.stdout.isTTY);
+const FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+/**
+ * Builds a terminal UI with one live animated status line that replaces itself
+ * as each package is fetched, plus permanent info/warn lines.
+ */
+export function createUi() {
+    let active = false;
+    let label = "";
+    let frame = 0;
+    let timer = null;
+    const paint = () => {
+        if (!isTty() || !active)
+            return;
+        const spin = c.cyan(FRAMES[frame % FRAMES.length]);
+        const cols = process.stdout.columns || 80;
+        const prefix = `${spin} `;
+        const max = Math.max(20, cols - 3);
+        const text = label.length > max ? `${label.slice(0, max - 1)}…` : label;
+        process.stdout.write(`\r\x1b[2K${prefix}${text}`);
+    };
+    const stopSpin = () => {
+        if (timer) {
+            clearInterval(timer);
+            timer = null;
+        }
+    };
+    const clearLine = () => {
+        stopSpin();
+        if (!active)
+            return;
+        if (isTty())
+            process.stdout.write(`\r\x1b[2K`);
+        active = false;
+        label = "";
+    };
+    const status = (msg) => {
+        if (!isTty())
+            return;
+        label = msg;
+        active = true;
+        if (!timer) {
+            frame = 0;
+            paint();
+            timer = setInterval(() => {
+                frame += 1;
+                paint();
+            }, 80);
+        }
+        else {
+            paint();
+        }
+    };
+    const commit = (msg) => {
+        clearLine();
+        console.log(msg);
+    };
+    return {
+        status,
+        commit,
+        clearStatus: clearLine,
+        info: (msg) => {
+            clearLine();
+            console.log(msg);
+        },
+        success: (msg) => {
+            clearLine();
+            console.log(`${c.green("✔")} ${msg}`);
+        },
+        warn: (msg) => {
+            clearLine();
+            console.warn(`${c.yellow("warn")} ${msg}`);
+        },
+    };
+}

package/dist/updateCheck.d.ts

@@ -0,0 +1,7 @@
+export declare const CLI_NAME: string;
+export declare const CLI_VERSION: string;
+/**
+ * On the first dpm command of each day, checks DPM + npm for a newer CLI
+ * and prints how to update with dpm when one exists. Never blocks on failure.
+ */
+export declare function maybeNotifyUpdate(): Promise<void>;

package/dist/updateCheck.js

@@ -0,0 +1,105 @@
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { homedir } from "node:os";
+import path from "node:path";
+import semver from "semver";
+import { c } from "./colors.js";
+import { loadConfig } from "./config.js";
+const require = createRequire(import.meta.url);
+const pkg = require("../package.json");
+export const CLI_NAME = pkg.name;
+export const CLI_VERSION = pkg.version;
+/** Package names checked for a newer CLI release. */
+const UPDATE_CANDIDATES = ["dpm", "@drops-it/dpm"];
+const STATE_DIR = path.join(homedir(), ".dpm");
+const STATE_PATH = path.join(STATE_DIR, "update-check.json");
+function todayKey() {
+    const d = new Date();
+    const y = d.getFullYear();
+    const m = String(d.getMonth() + 1).padStart(2, "0");
+    const day = String(d.getDate()).padStart(2, "0");
+    return `${y}-${m}-${day}`;
+}
+async function loadState() {
+    try {
+        return JSON.parse(await readFile(STATE_PATH, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+async function saveState(state) {
+    await mkdir(STATE_DIR, { recursive: true });
+    await writeFile(STATE_PATH, JSON.stringify(state), { mode: 0o600 });
+}
+async function fetchLatestFromDpm(name, registry) {
+    const url = `${registry.replace(/\/$/, "")}/dpm/v1/packages/${encodeURIComponent(name)}`;
+    const res = await fetch(url, {
+        headers: { accept: "application/json", "user-agent": `dpm-cli/${CLI_VERSION}` },
+        signal: AbortSignal.timeout(2500),
+    });
+    if (!res.ok)
+        return null;
+    const data = (await res.json());
+    return data.latest || data["dist-tags"]?.latest || null;
+}
+async function fetchLatestFromNpm(name) {
+    const scopedUrl = name.startsWith("@")
+        ? `https://registry.npmjs.org/${name.replace("/", "%2F")}`
+        : `https://registry.npmjs.org/${encodeURIComponent(name)}`;
+    const res = await fetch(scopedUrl, {
+        headers: { accept: "application/json", "user-agent": `dpm-cli/${CLI_VERSION}` },
+        signal: AbortSignal.timeout(2500),
+    });
+    if (!res.ok)
+        return null;
+    const data = (await res.json());
+    return data["dist-tags"]?.latest || null;
+}
+async function resolveNewestAvailable() {
+    const config = await loadConfig();
+    const found = [];
+    await Promise.all(UPDATE_CANDIDATES.map(async (name) => {
+        const [dpm, npm] = await Promise.all([
+            fetchLatestFromDpm(name, config.registry).catch(() => null),
+            fetchLatestFromNpm(name).catch(() => null),
+        ]);
+        if (dpm && semver.valid(dpm))
+            found.push(dpm);
+        if (npm && semver.valid(npm))
+            found.push(npm);
+    }));
+    if (found.length === 0)
+        return null;
+    return found.sort(semver.rcompare)[0] ?? null;
+}
+/**
+ * On the first dpm command of each day, checks DPM + npm for a newer CLI
+ * and prints how to update with dpm when one exists. Never blocks on failure.
+ */
+export async function maybeNotifyUpdate() {
+    const day = todayKey();
+    const prev = await loadState();
+    if (prev?.day === day)
+        return;
+    // Mark the day early so a slow/failed check does not retry every command.
+    await saveState({ day, latest: prev?.latest });
+    try {
+        const latest = await resolveNewestAvailable();
+        if (!latest || !semver.valid(CLI_VERSION))
+            return;
+        await saveState({ day, latest });
+        if (!semver.gt(latest, CLI_VERSION))
+            return;
+        const updatePkg = CLI_NAME.startsWith("@") ? CLI_NAME : "@drops-it/dpm";
+        console.error([
+            "",
+            `${c.yellow("▲")} ${c.bold("dpm")} update available: ${c.dim(CLI_VERSION)} ${c.cyan("→")} ${c.green(latest)}`,
+            `  Update with: ${c.bold(`dpm i -g ${updatePkg}`)}`,
+            "",
+        ].join("\n"));
+    }
+    catch {
+        // Ignore network / parse errors — update checks must never break commands.
+    }
+}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@drops-it/dpm",
+  "version": "1.0.1",
+  "description": "Drops Package Manager CLI",
+  "type": "module",
+  "bin": {
+    "dpm": "dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "dev": "tsx src/index.ts",
+    "build": "tsc -p tsconfig.json",
+    "build:windows": "node scripts/build-windows.mjs",
+    "sign:windows": "powershell -ExecutionPolicy Bypass -File scripts/sign-windows.ps1",
+    "prepublishOnly": "npm run build"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "commander": "^12.1.0",
+    "semver": "^7.6.3",
+    "tar": "^7.4.3",
+    "yaml": "^2.7.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.5",
+    "@types/semver": "^7.5.8",
+    "esbuild": "^0.25.0",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.3"
+  },
+  "keywords": [
+    "dpm",
+    "package-manager",
+    "drops-it",
+    "cli"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Drops-IT/DPM.git"
+  }
+}