@somewhere-tech/cli 0.12.9 → 0.14.0

package/dist/swpx/run-swpx.js

@@ -0,0 +1,54 @@
+/** `swpx <package> [args...]` — the verdict gate in front of `npx`.
+ *
+ *  resolve → verdict → act:
+ *    verified           → print the green one-liner, delegate to real npx.
+ *    unverified/suspicious → print the evidence block, STOP (exit 1). The user's
+ *                           documented override is to run `npx` directly, per
+ *                           the landing page ("your choice, not ours") — so we
+ *                           deliberately do not prompt or take a --yes flag
+ *                           (which would also collide with npx -y).
+ *    blocked            → print the red block, hard refuse (exit 1, no run).
+ *    can't resolve / verdict unreachable → fall back to npx unchecked. We are a
+ *                           gate, not a wall: our outage must not stop the user.
+ *
+ *  All verdict messaging goes to STDERR so swpx is transparent on stdout — the
+ *  executed program owns stdout. */
+import { parseSpec } from './registry.js';
+import { decide, renderVerdict } from './render.js';
+import { bindDeps, msg } from './run-common.js';
+import { dim } from '../lib/output.js';
+export async function runSwpx(args, deps = {}) {
+    const d = bindDeps(deps);
+    // The package is the first non-flag arg, so `swpx -y create-next-app` works.
+    const pkgArg = args.find((a) => !a.startsWith('-'));
+    if (!pkgArg) {
+        d.errLog('Usage: swpx <package> [args...]');
+        return { exitCode: 1, action: 'stopped' };
+    }
+    const spec = parseSpec(pkgArg);
+    let version;
+    try {
+        version = await d.resolveVersion(spec.name, spec.version);
+    }
+    catch (err) {
+        d.errLog(dim(`swpx: couldn't resolve ${spec.name} (${msg(err)}) — running npx unchecked`));
+        return { exitCode: await d.runReal('npx', args), action: 'fallback' };
+    }
+    let verdict;
+    try {
+        verdict = await d.getVerdict(spec.name, version);
+    }
+    catch {
+        d.errLog(dim('swpx: verdict service unavailable — running npx unchecked'));
+        return { exitCode: await d.runReal('npx', args), action: 'fallback' };
+    }
+    const action = decide(verdict);
+    for (const l of renderVerdict(verdict))
+        d.errLog(l);
+    if (action === 'run') {
+        return { exitCode: await d.runReal('npx', args), action: 'ran' };
+    }
+    // unverified/suspicious and blocked both stop swpx; only the exit reason differs.
+    return { exitCode: 1, action: action === 'block' ? 'blocked' : 'stopped' };
+}
+//# sourceMappingURL=run-swpx.js.map

package/dist/swpx/run-swpx.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-swpx.js","sourceRoot":"","sources":["../../src/swpx/run-swpx.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;oCAcoC;AAEpC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAgB,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAOvC,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,OAAgB,EAAE;IAC9D,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEzB,6EAA6E;IAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,CAAC,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAC5C,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAE/B,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;QAC3F,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACxE,CAAC;IAED,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC,CAAC;QAC3E,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC;QAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACnE,CAAC;IACD,kFAAkF;IAClF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAC7E,CAAC"}

package/dist/swpx/spawn.js

@@ -0,0 +1,30 @@
+/** Shell out to the REAL npx / npm. swpx/swpm are wrappers, never replacements:
+ *  once a verdict says "go", the genuine tool runs with the user's exact args,
+ *  inheriting stdio so its output is untouched (we keep our own messaging on
+ *  stderr). The child's exit code becomes ours. A launch failure (tool not on
+ *  PATH) resolves to 127 rather than throwing — the caller already printed the
+ *  verdict; a missing npm is the user's environment, not a swpx error. */
+import { spawn } from 'node:child_process';
+import { dim } from '../lib/output.js';
+export function runReal(cmd, args) {
+    // SWPX_DRY_RUN: show the decision + what WOULD run, without executing. Useful
+    // for "what would swpx do?" and for testing the gate end-to-end offline.
+    if (process.env.SWPX_DRY_RUN) {
+        console.error(dim(`swpx: [dry-run] would run: ${cmd} ${args.join(' ')}`));
+        return Promise.resolve(0);
+    }
+    return new Promise((resolve) => {
+        const child = spawn(cmd, args, {
+            stdio: 'inherit',
+            // On Windows npx/npm are .cmd shims that need a shell; on POSIX we spawn
+            // the binary directly (no shell → no quoting/injection surface).
+            shell: process.platform === 'win32',
+        });
+        child.on('error', (err) => {
+            console.error(dim(`swpx: failed to launch ${cmd} — ${err.message}`));
+            resolve(127);
+        });
+        child.on('exit', (code, signal) => resolve(signal ? 1 : code ?? 0));
+    });
+}
+//# sourceMappingURL=spawn.js.map

package/dist/swpx/spawn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../../src/swpx/spawn.ts"],"names":[],"mappings":"AAAA;;;;;0EAK0E;AAE1E,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAEvC,MAAM,UAAU,OAAO,CAAC,GAAkB,EAAE,IAAc;IACxD,8EAA8E;IAC9E,yEAAyE;IACzE,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,8BAA8B,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YAC7B,KAAK,EAAE,SAAS;YAChB,yEAAyE;YACzE,iEAAiE;YACjE,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;SACpC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACrE,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/swpx/tree.js

@@ -0,0 +1,101 @@
+/** Resolve a project's dependency tree for `swpm install`.
+ *
+ *  When a lockfile is present it IS the resolved tree — the exact versions npm
+ *  would install — so we read it directly (no registry round-trips, no guessing
+ *  ranges). Without a lockfile we fall back to the direct deps in package.json
+ *  and let the caller resolve their ranges. Parsing is split from fs reads so
+ *  the lockfile/manifest parsers are unit-tested against fixture strings. */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+export function parsePackageJsonDeps(pkgJson) {
+    let obj;
+    try {
+        obj = JSON.parse(pkgJson);
+    }
+    catch {
+        return { directNames: [], ranges: {} };
+    }
+    const ranges = {};
+    const o = obj;
+    for (const field of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+        const d = o?.[field];
+        if (d && typeof d === 'object') {
+            for (const [k, v] of Object.entries(d)) {
+                if (typeof v === 'string')
+                    ranges[k] = v;
+            }
+        }
+    }
+    return { directNames: Object.keys(ranges), ranges };
+}
+/** Extract every concrete package@version from a package-lock.json /
+ *  npm-shrinkwrap.json string. Handles lockfile v2/v3 (`packages` keyed by
+ *  node_modules paths) and the older v1 (`dependencies` tree). Deduped. */
+export function parseLockfile(lock) {
+    let obj;
+    try {
+        obj = JSON.parse(lock);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    const seen = new Set();
+    const add = (name, version) => {
+        if (!name || typeof version !== 'string')
+            return;
+        const id = `${name}@${version}`;
+        if (seen.has(id))
+            return;
+        seen.add(id);
+        out.push({ package: name, version });
+    };
+    const packages = obj.packages;
+    if (packages && typeof packages === 'object') {
+        for (const [key, val] of Object.entries(packages)) {
+            if (!key)
+                continue; // "" is the root project
+            const idx = key.lastIndexOf('node_modules/');
+            if (idx === -1)
+                continue;
+            if (val?.link)
+                continue; // workspace symlink, not a real install
+            add(key.slice(idx + 'node_modules/'.length), val?.version);
+        }
+        return out;
+    }
+    // lockfile v1: recursive `dependencies` tree.
+    const walk = (deps) => {
+        if (!deps || typeof deps !== 'object')
+            return;
+        for (const [name, info] of Object.entries(deps)) {
+            add(name, info?.version);
+            walk(info?.dependencies);
+        }
+    };
+    walk(obj.dependencies);
+    return out;
+}
+/** Read package.json + the first lockfile we find in `dir`. Missing files yield
+ *  an empty-ish tree rather than throwing — the caller decides what to do with
+ *  no deps. */
+export function readTree(dir) {
+    let directNames = [];
+    let ranges = {};
+    const pkgPath = join(dir, 'package.json');
+    if (existsSync(pkgPath)) {
+        const parsed = parsePackageJsonDeps(readFileSync(pkgPath, 'utf-8'));
+        directNames = parsed.directNames;
+        ranges = parsed.ranges;
+    }
+    let locked = [];
+    for (const lockName of ['package-lock.json', 'npm-shrinkwrap.json']) {
+        const lockPath = join(dir, lockName);
+        if (existsSync(lockPath)) {
+            locked = parseLockfile(readFileSync(lockPath, 'utf-8'));
+            break;
+        }
+    }
+    return { directNames, ranges, locked };
+}
+//# sourceMappingURL=tree.js.map

package/dist/swpx/tree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tree.js","sourceRoot":"","sources":["../../src/swpx/tree.ts"],"names":[],"mappings":"AAAA;;;;;;6EAM6E;AAE7E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAgBjC,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAIlD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAChF,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,EAAE,CAAC;gBAClE,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;AACtD,CAAC;AAED;;2EAE2E;AAC3E,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAgB,EAAE,EAAE;QAC7C,IAAI,CAAC,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO;QACjD,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO;QACzB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,GAAG,CAAC,QAA4E,CAAC;IAClG,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,GAAG;gBAAE,SAAS,CAAC,yBAAyB;YAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;YAC7C,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,SAAS;YACzB,IAAI,GAAG,EAAE,IAAI;gBAAE,SAAS,CAAC,wCAAwC;YACjE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,8CAA8C;IAC9C,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,EAAE;QAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAoE,CAAC,EAAE,CAAC;YAChH,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YACzB,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACvB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;eAEe;AACf,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,IAAI,WAAW,GAAa,EAAE,CAAC;IAC/B,IAAI,MAAM,GAA2B,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACjC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IACzB,CAAC;IACD,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,QAAQ,IAAI,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,aAAa,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YACxD,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACzC,CAAC"}

package/dist/swpx/types.js

@@ -0,0 +1,14 @@
+/** Shared types for the swpx / swpm verdict layer.
+ *
+ *  The verdict API lives on the `npm` platform project (npm.somewhere.tech),
+ *  NOT the /v1 control plane. It is unauthenticated (free, no login) — the CLI
+ *  hits it with a plain fetch, independent of `somewhere login`. See
+ *  verdict-client.ts.
+ *
+ *  The `Verdict` shape mirrors the D1 `verdicts` row (tsk_f30faf55) plus the
+ *  live MAL advisory check, which is NOT cached (a version can be retroactively
+ *  flagged). The `--json` output is a stable PROJECTION of this (toJsonVerdict)
+ *  — that projection is the public contract shown on npm.somewhere.tech, so it
+ *  is intentionally narrower than the internal row. */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/swpx/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/swpx/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;uDAWuD"}

package/dist/swpx/verdict-client.js

@@ -0,0 +1,109 @@
+/** Client for the verdict API hosted on the `npm` platform project.
+ *
+ *  This is NOT the /v1 control plane and NOT the runner — it's the public,
+ *  unauthenticated verdict service at npm.somewhere.tech (FAQ: "Free, no
+ *  login"). So this client deliberately does not touch ApiClient or the stored
+ *  developer key. Override the host for staging/tests via SWPX_VERDICT_URL.
+ *
+ *  Reachability is a product guarantee, inverted: if the verdict API is down,
+ *  the user must still get normal npm behaviour ("a gate, not a wall"). So every
+ *  failure here raises VerdictUnavailable and the command layer falls back to
+ *  the real npx/npm. We never block on our own outage. */
+const VERDICT_BASE = process.env.SWPX_VERDICT_URL?.replace(/\/$/, '') || 'https://npm.somewhere.tech';
+/** Short by design: the verdict check sits in front of every `npx`, so a slow
+ *  or unreachable service must fail fast to fallback, not stall the user. */
+const VERDICT_TIMEOUT_MS = Number(process.env.SWPX_VERDICT_TIMEOUT_MS) || 4000;
+const defaultFetch = (url, init) => fetch(url, init);
+/** Raised whenever the verdict couldn't be obtained — network error, timeout,
+ *  non-2xx, or unparseable body. The command layer treats it as "fall back to
+ *  the real tool", never as "block". */
+export class VerdictUnavailable extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'VerdictUnavailable';
+    }
+}
+/** Accept either a bare verdict object or a `{ ok, data }` envelope. */
+function unwrap(body) {
+    if (body && typeof body === 'object' && 'ok' in body) {
+        const env = body;
+        if (env.ok === true)
+            return env.data;
+        throw new VerdictUnavailable(env.message || env.error || 'verdict API returned ok:false');
+    }
+    return body;
+}
+function timeoutSignal() {
+    try {
+        return AbortSignal.timeout(VERDICT_TIMEOUT_MS);
+    }
+    catch {
+        return undefined; // very old runtime — let the request run without our timeout
+    }
+}
+/** Look up one package@version. Throws VerdictUnavailable on any failure. */
+export async function getVerdict(name, version, fetchImpl = defaultFetch) {
+    const url = `${VERDICT_BASE}/api/verdict/${encodeURIComponent(name)}/${encodeURIComponent(version)}`;
+    let res;
+    try {
+        res = await fetchImpl(url, { headers: { Accept: 'application/json' }, signal: timeoutSignal() });
+    }
+    catch (err) {
+        throw new VerdictUnavailable(err instanceof Error ? err.message : String(err));
+    }
+    if (!res.ok)
+        throw new VerdictUnavailable(`verdict API returned ${res.status}`);
+    let body;
+    try {
+        body = await res.json();
+    }
+    catch {
+        throw new VerdictUnavailable('verdict API returned a non-JSON body');
+    }
+    const v = unwrap(body);
+    if (!v || typeof v !== 'object' || typeof v.verdict !== 'string') {
+        throw new VerdictUnavailable('verdict API returned an unexpected shape');
+    }
+    // Trust the caller's resolved coordinates over whatever the row echoes back.
+    return { ...v, package: name, version };
+}
+/** Batch-check a resolved tree. Throws VerdictUnavailable on any failure so the
+ *  caller can fall back to a plain `npm install`. The returned array is aligned
+ *  to the input order; any row the service omits is dropped (caller treats a
+ *  missing row as "unknown", not "verified"). */
+export async function getVerdictBatch(pkgs, fetchImpl = defaultFetch) {
+    if (pkgs.length === 0)
+        return [];
+    const url = `${VERDICT_BASE}/api/verdict/batch`;
+    let res;
+    try {
+        res = await fetchImpl(url, {
+            method: 'POST',
+            headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+            body: JSON.stringify({ packages: pkgs }),
+            signal: timeoutSignal(),
+        });
+    }
+    catch (err) {
+        throw new VerdictUnavailable(err instanceof Error ? err.message : String(err));
+    }
+    if (!res.ok)
+        throw new VerdictUnavailable(`verdict API returned ${res.status}`);
+    let body;
+    try {
+        body = await res.json();
+    }
+    catch {
+        throw new VerdictUnavailable('verdict API returned a non-JSON body');
+    }
+    const data = unwrap(body);
+    const results = Array.isArray(data)
+        ? data
+        : data?.results;
+    if (!Array.isArray(results)) {
+        throw new VerdictUnavailable('verdict API batch returned an unexpected shape');
+    }
+    return results.filter((v) => !!v && typeof v === 'object' && typeof v.verdict === 'string');
+}
+export const verdictBaseUrl = VERDICT_BASE;
+//# sourceMappingURL=verdict-client.js.map

package/dist/swpx/verdict-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdict-client.js","sourceRoot":"","sources":["../../src/swpx/verdict-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;0DAU0D;AAK1D,MAAM,YAAY,GAChB,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,4BAA4B,CAAC;AAEnF;6EAC6E;AAC7E,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC;AAE/E,MAAM,YAAY,GAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAC5C,KAAK,CAAC,GAAG,EAAE,IAAmB,CAAsC,CAAC;AAEvE;;wCAEwC;AACxC,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,wEAAwE;AACxE,SAAS,MAAM,CAAC,IAAa;IAC3B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAA0E,CAAC;QACvF,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QACrC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,IAAI,+BAA+B,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,6DAA6D;IACjF,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,OAAe,EACf,YAAuB,YAAY;IAEnC,MAAM,GAAG,GAAG,GAAG,YAAY,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IACrG,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;IACnG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAChF,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAwB,CAAC;IAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAa,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC9E,MAAM,IAAI,kBAAkB,CAAC,0CAA0C,CAAC,CAAC;IAC3E,CAAC;IACD,6EAA6E;IAC7E,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC1C,CAAC;AAED;;;iDAGiD;AACjD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAiD,EACjD,YAAuB,YAAY;IAEnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,GAAG,YAAY,oBAAoB,CAAC;IAChD,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACzB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACxC,MAAM,EAAE,aAAa,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAChF,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,CAAC,CAAC,IAAI;QACN,CAAC,CAAE,IAA8B,EAAE,OAAO,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAAC,gDAAgD,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAa,CAAC,OAAO,KAAK,QAAQ,CAChG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC"}

package/dist/swpx-bin.js

@@ -0,0 +1,20 @@
+/** Entry for the standalone `swpx` binary (and `somewhere npx`).
+ *
+ *  `swpx check <pkg> [--json]` inspects without running; anything else is a
+ *  package to run through the verdict gate. No commander here — a wrapper must
+ *  pass the user's flags through to the target package untouched, so we read
+ *  raw argv. `main` is side-effect-free (deps injectable) so it's unit-tested;
+ *  bin/swpx.js does the process.exit. */
+import { runSwpx } from './swpx/run-swpx.js';
+import { runCheck } from './swpx/check.js';
+export async function main(argv, deps = {}) {
+    if (argv[0] === 'check') {
+        const rest = argv.slice(1);
+        const json = rest.includes('--json');
+        const pkg = rest.find((a) => !a.startsWith('-'));
+        return runCheck(pkg, { json }, deps);
+    }
+    const { exitCode } = await runSwpx(argv, deps);
+    return exitCode;
+}
+//# sourceMappingURL=swpx-bin.js.map

package/dist/swpx-bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"swpx-bin.js","sourceRoot":"","sources":["../src/swpx-bin.ts"],"names":[],"mappings":"AAAA;;;;;;yCAMyC;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAG3C,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAc,EAAE,OAAgB,EAAE;IAC3D,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@somewhere-tech/cli",
-  "version": "0.12.9",
+  "version": "0.14.0",
   "description": "CLI for somewhere.tech — auth, projects, deploy, pull, promote, db, logs, env, MCP bridge.",
   "keywords": [
     "somewhere",
@@ -22,7 +22,9 @@
   "type": "module",
   "bin": {
     "somewhere": "bin/somewhere.js",
-    "sw": "bin/somewhere.js"
+    "sw": "bin/somewhere.js",
+    "swpx": "bin/swpx.js",
+    "swpm": "bin/swpm.js"
   },
   "files": [
     "bin",
@@ -44,17 +46,16 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "chalk": "^5.3.0",
     "chokidar": "^4.0.3",
     "commander": "^12.0.0",
-    "open": "^10.0.0",
-    "ora": "^8.0.0",
     "prompts": "^2.4.2",
+    "semver": "^7.6.3",
     "undici": "^8.4.1"
   },
   "devDependencies": {
     "@types/node": "^22.19.21",
     "@types/prompts": "^2.4.0",
+    "@types/semver": "^7.5.8",
     "typescript": "^5.4.0"
   }
 }