@somewhere-tech/cli 0.12.9 → 0.15.0

package/dist/swpx/run-swpm.js

@@ -0,0 +1,95 @@
+/** `swpm <args...>` — the verdict gate in front of `npm`.
+ *
+ *  Only install-family subcommands are gated (install/i/add/ci); everything else
+ *  (run, test, publish, …) passes straight through to npm untouched. For an
+ *  install we batch-check the resolved tree and print the summary, then:
+ *    - any BLOCKED package  → stop, exit 1, don't install.
+ *    - otherwise            → run the real npm install (unverified rows warn but
+ *                             don't gate every install).
+ *  Couldn't verify (unreachable / unresolvable tree) → LOUD warning then fall
+ *  back to npm, OR refuse under enforce. Summary goes to stderr; npm owns stdout. */
+import { parseSpec } from './registry.js';
+import { renderTree } from './render.js';
+import { bindDeps } from './run-common.js';
+import { dim } from '../lib/output.js';
+import { resolveEnforce, stripEnforceFlags, loudUnavailable, refused } from './enforce.js';
+import { VerdictUnavailable } from './verdict-client.js';
+/** npm's own install aliases (including its built-in typo aliases). */
+const INSTALL_SUBS = new Set(['install', 'i', 'in', 'ins', 'add', 'ci', 'isntall']);
+function alignVerdicts(toCheck, verdicts) {
+    const byKey = new Map(verdicts.map((v) => [`${v.package}@${v.version}`, v]));
+    // A row the service didn't return is "unknown" → surfaced as unverified, never
+    // silently counted as verified.
+    return toCheck.map((t) => byKey.get(`${t.package}@${t.version}`) ?? {
+        package: t.package,
+        version: t.version,
+        verdict: 'unverified',
+    });
+}
+export async function runSwpm(args, deps = {}) {
+    const d = bindDeps(deps);
+    const enforce = deps.enforce ?? resolveEnforce(args);
+    const clean = stripEnforceFlags(args);
+    const sub = clean[0];
+    if (!sub || !INSTALL_SUBS.has(sub)) {
+        return { exitCode: await d.runReal('npm', clean), action: 'passthrough' };
+    }
+    // Couldn't verify the tree → LOUD, then fall back (default) or refuse (enforce).
+    const failOpen = async (rateLimited) => {
+        loudUnavailable(d.errLog, 'this install', rateLimited);
+        if (enforce) {
+            refused(d.errLog, 'this install', 'npm');
+            return { exitCode: 1, action: 'blocked' };
+        }
+        return { exitCode: await d.runReal('npm', clean), action: 'fallback' };
+    };
+    const explicit = clean.slice(1).filter((a) => !a.startsWith('-'));
+    let toCheck = [];
+    let directCount = 0;
+    try {
+        if (explicit.length) {
+            toCheck = await Promise.all(explicit.map(async (a) => {
+                const s = parseSpec(a);
+                return { package: s.name, version: await d.resolveVersion(s.name, s.version) };
+            }));
+            directCount = toCheck.length;
+        }
+        else {
+            const tree = d.readTree(process.cwd());
+            if (tree.locked.length) {
+                toCheck = tree.locked;
+                const directSet = new Set(tree.directNames);
+                directCount = tree.locked.filter((l) => directSet.has(l.package)).length;
+            }
+            else if (tree.directNames.length) {
+                toCheck = await Promise.all(tree.directNames.map(async (name) => ({
+                    package: name,
+                    version: await d.resolveVersion(name, tree.ranges[name]),
+                })));
+                directCount = toCheck.length;
+            }
+            else {
+                d.errLog(dim('swpm: no dependencies found in package.json — running npm'));
+                return { exitCode: await d.runReal('npm', clean), action: 'passthrough' };
+            }
+        }
+    }
+    catch {
+        return failOpen(false);
+    }
+    let verdicts;
+    try {
+        verdicts = await d.getVerdictBatch(toCheck);
+    }
+    catch (err) {
+        return failOpen(err instanceof VerdictUnavailable && err.rateLimited);
+    }
+    const aligned = alignVerdicts(toCheck, verdicts);
+    for (const l of renderTree(aligned, directCount))
+        d.errLog(l);
+    if (aligned.some((v) => v.verdict === 'blocked')) {
+        return { exitCode: 1, action: 'blocked' };
+    }
+    return { exitCode: await d.runReal('npm', clean), action: 'ran' };
+}
+//# sourceMappingURL=run-swpm.js.map

package/dist/swpx/run-swpm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-swpm.js","sourceRoot":"","sources":["../../src/swpx/run-swpm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;qFASqF;AAErF,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAgB,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGzD,uEAAuE;AACvE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AAYpF,SAAS,aAAa,CAAC,OAAiB,EAAE,QAAmB;IAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,+EAA+E;IAC/E,gCAAgC;IAChC,OAAO,OAAO,CAAC,GAAG,CAChB,CAAC,CAAC,EAAE,EAAE,CACJ,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI;QACxC,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,YAAqB;KAC/B,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,OAAgB,EAAE;IAC9D,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC5E,CAAC;IAED,iFAAiF;IACjF,MAAM,QAAQ,GAAG,KAAK,EAAE,WAAoB,EAAwB,EAAE;QACpE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;QACvD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;YACzC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC5C,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACzE,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CACzB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;gBACvB,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;gBACvB,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACjF,CAAC,CAAC,CACH,CAAC;YACF,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACvC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACvB,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;gBACtB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC5C,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YAC3E,CAAC;iBAAM,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;gBACnC,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CACzB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;oBACpC,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,MAAM,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;iBACzD,CAAC,CAAC,CACJ,CAAC;gBACF,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACN,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC,CAAC;gBAC3E,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,QAAmB,CAAC;IACxB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,GAAG,YAAY,kBAAkB,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC;QAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAE9D,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACpE,CAAC"}

package/dist/swpx/run-swpx.js

@@ -0,0 +1,65 @@
+/** `swpx <package> [args...]` — the verdict gate in front of `npx`.
+ *
+ *  resolve → verdict → act:
+ *    verified           → print the green one-liner, delegate to real npx.
+ *    unverified/suspicious → print the evidence block, STOP (exit 1). The user's
+ *                           documented override is to run `npx` directly, per
+ *                           the landing page ("your choice, not ours") — so we
+ *                           deliberately do not prompt or take a --yes flag
+ *                           (which would also collide with npx -y).
+ *    blocked            → print the red block, hard refuse (exit 1, no run).
+ *    can't resolve / verdict unreachable → fall back to npx unchecked. We are a
+ *                           gate, not a wall: our outage must not stop the user.
+ *
+ *  All verdict messaging goes to STDERR so swpx is transparent on stdout — the
+ *  executed program owns stdout. */
+import { parseSpec } from './registry.js';
+import { decide, renderVerdict } from './render.js';
+import { bindDeps } from './run-common.js';
+import { resolveEnforce, stripEnforceFlags, loudUnavailable, refused } from './enforce.js';
+import { VerdictUnavailable } from './verdict-client.js';
+export async function runSwpx(args, deps = {}) {
+    const d = bindDeps(deps);
+    const enforce = deps.enforce ?? resolveEnforce(args);
+    const passthrough = stripEnforceFlags(args);
+    // The package is the first non-flag arg, so `swpx -y create-next-app` works.
+    const pkgArg = passthrough.find((a) => !a.startsWith('-'));
+    if (!pkgArg) {
+        d.errLog('Usage: swpx <package> [args...]');
+        return { exitCode: 1, action: 'stopped' };
+    }
+    const spec = parseSpec(pkgArg);
+    // Couldn't verify → LOUD warning (never silent), then fall back (default) OR
+    // refuse (enforce / fail-closed).
+    const failOpen = async (rateLimited) => {
+        loudUnavailable(d.errLog, spec.name, rateLimited);
+        if (enforce) {
+            refused(d.errLog, spec.name, 'npx');
+            return { exitCode: 1, action: 'blocked' };
+        }
+        return { exitCode: await d.runReal('npx', passthrough), action: 'fallback' };
+    };
+    let version;
+    try {
+        version = await d.resolveVersion(spec.name, spec.version);
+    }
+    catch {
+        return failOpen(false);
+    }
+    let verdict;
+    try {
+        verdict = await d.getVerdict(spec.name, version);
+    }
+    catch (err) {
+        return failOpen(err instanceof VerdictUnavailable && err.rateLimited);
+    }
+    const action = decide(verdict);
+    for (const l of renderVerdict(verdict))
+        d.errLog(l);
+    if (action === 'run') {
+        return { exitCode: await d.runReal('npx', passthrough), action: 'ran' };
+    }
+    // unverified/suspicious and blocked both stop swpx; only the exit reason differs.
+    return { exitCode: 1, action: action === 'block' ? 'blocked' : 'stopped' };
+}
+//# sourceMappingURL=run-swpx.js.map

package/dist/swpx/run-swpx.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-swpx.js","sourceRoot":"","sources":["../../src/swpx/run-swpx.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;oCAcoC;AAEpC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAgB,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAOzD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,OAAgB,EAAE;IAC9D,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAE5C,6EAA6E;IAC7E,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,CAAC,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAC5C,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAE/B,6EAA6E;IAC7E,kCAAkC;IAClC,MAAM,QAAQ,GAAG,KAAK,EAAE,WAAoB,EAAwB,EAAE;QACpE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAClD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC5C,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC/E,CAAC,CAAC;IAEF,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,GAAG,YAAY,kBAAkB,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC;QAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1E,CAAC;IACD,kFAAkF;IAClF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAC7E,CAAC"}

package/dist/swpx/spawn.js

@@ -0,0 +1,30 @@
+/** Shell out to the REAL npx / npm. swpx/swpm are wrappers, never replacements:
+ *  once a verdict says "go", the genuine tool runs with the user's exact args,
+ *  inheriting stdio so its output is untouched (we keep our own messaging on
+ *  stderr). The child's exit code becomes ours. A launch failure (tool not on
+ *  PATH) resolves to 127 rather than throwing — the caller already printed the
+ *  verdict; a missing npm is the user's environment, not a swpx error. */
+import { spawn } from 'node:child_process';
+import { dim } from '../lib/output.js';
+export function runReal(cmd, args) {
+    // SWPX_DRY_RUN: show the decision + what WOULD run, without executing. Useful
+    // for "what would swpx do?" and for testing the gate end-to-end offline.
+    if (process.env.SWPX_DRY_RUN) {
+        console.error(dim(`swpx: [dry-run] would run: ${cmd} ${args.join(' ')}`));
+        return Promise.resolve(0);
+    }
+    return new Promise((resolve) => {
+        const child = spawn(cmd, args, {
+            stdio: 'inherit',
+            // On Windows npx/npm are .cmd shims that need a shell; on POSIX we spawn
+            // the binary directly (no shell → no quoting/injection surface).
+            shell: process.platform === 'win32',
+        });
+        child.on('error', (err) => {
+            console.error(dim(`swpx: failed to launch ${cmd} — ${err.message}`));
+            resolve(127);
+        });
+        child.on('exit', (code, signal) => resolve(signal ? 1 : code ?? 0));
+    });
+}
+//# sourceMappingURL=spawn.js.map

package/dist/swpx/spawn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../../src/swpx/spawn.ts"],"names":[],"mappings":"AAAA;;;;;0EAK0E;AAE1E,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAEvC,MAAM,UAAU,OAAO,CAAC,GAAkB,EAAE,IAAc;IACxD,8EAA8E;IAC9E,yEAAyE;IACzE,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,8BAA8B,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YAC7B,KAAK,EAAE,SAAS;YAChB,yEAAyE;YACzE,iEAAiE;YACjE,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;SACpC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACrE,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/swpx/tree.js

@@ -0,0 +1,101 @@
+/** Resolve a project's dependency tree for `swpm install`.
+ *
+ *  When a lockfile is present it IS the resolved tree — the exact versions npm
+ *  would install — so we read it directly (no registry round-trips, no guessing
+ *  ranges). Without a lockfile we fall back to the direct deps in package.json
+ *  and let the caller resolve their ranges. Parsing is split from fs reads so
+ *  the lockfile/manifest parsers are unit-tested against fixture strings. */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+export function parsePackageJsonDeps(pkgJson) {
+    let obj;
+    try {
+        obj = JSON.parse(pkgJson);
+    }
+    catch {
+        return { directNames: [], ranges: {} };
+    }
+    const ranges = {};
+    const o = obj;
+    for (const field of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+        const d = o?.[field];
+        if (d && typeof d === 'object') {
+            for (const [k, v] of Object.entries(d)) {
+                if (typeof v === 'string')
+                    ranges[k] = v;
+            }
+        }
+    }
+    return { directNames: Object.keys(ranges), ranges };
+}
+/** Extract every concrete package@version from a package-lock.json /
+ *  npm-shrinkwrap.json string. Handles lockfile v2/v3 (`packages` keyed by
+ *  node_modules paths) and the older v1 (`dependencies` tree). Deduped. */
+export function parseLockfile(lock) {
+    let obj;
+    try {
+        obj = JSON.parse(lock);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    const seen = new Set();
+    const add = (name, version) => {
+        if (!name || typeof version !== 'string')
+            return;
+        const id = `${name}@${version}`;
+        if (seen.has(id))
+            return;
+        seen.add(id);
+        out.push({ package: name, version });
+    };
+    const packages = obj.packages;
+    if (packages && typeof packages === 'object') {
+        for (const [key, val] of Object.entries(packages)) {
+            if (!key)
+                continue; // "" is the root project
+            const idx = key.lastIndexOf('node_modules/');
+            if (idx === -1)
+                continue;
+            if (val?.link)
+                continue; // workspace symlink, not a real install
+            add(key.slice(idx + 'node_modules/'.length), val?.version);
+        }
+        return out;
+    }
+    // lockfile v1: recursive `dependencies` tree.
+    const walk = (deps) => {
+        if (!deps || typeof deps !== 'object')
+            return;
+        for (const [name, info] of Object.entries(deps)) {
+            add(name, info?.version);
+            walk(info?.dependencies);
+        }
+    };
+    walk(obj.dependencies);
+    return out;
+}
+/** Read package.json + the first lockfile we find in `dir`. Missing files yield
+ *  an empty-ish tree rather than throwing — the caller decides what to do with
+ *  no deps. */
+export function readTree(dir) {
+    let directNames = [];
+    let ranges = {};
+    const pkgPath = join(dir, 'package.json');
+    if (existsSync(pkgPath)) {
+        const parsed = parsePackageJsonDeps(readFileSync(pkgPath, 'utf-8'));
+        directNames = parsed.directNames;
+        ranges = parsed.ranges;
+    }
+    let locked = [];
+    for (const lockName of ['package-lock.json', 'npm-shrinkwrap.json']) {
+        const lockPath = join(dir, lockName);
+        if (existsSync(lockPath)) {
+            locked = parseLockfile(readFileSync(lockPath, 'utf-8'));
+            break;
+        }
+    }
+    return { directNames, ranges, locked };
+}
+//# sourceMappingURL=tree.js.map

package/dist/swpx/tree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tree.js","sourceRoot":"","sources":["../../src/swpx/tree.ts"],"names":[],"mappings":"AAAA;;;;;;6EAM6E;AAE7E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAgBjC,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAIlD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAChF,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,EAAE,CAAC;gBAClE,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;AACtD,CAAC;AAED;;2EAE2E;AAC3E,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAgB,EAAE,EAAE;QAC7C,IAAI,CAAC,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO;QACjD,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO;QACzB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,GAAG,CAAC,QAA4E,CAAC;IAClG,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,GAAG;gBAAE,SAAS,CAAC,yBAAyB;YAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;YAC7C,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,SAAS;YACzB,IAAI,GAAG,EAAE,IAAI;gBAAE,SAAS,CAAC,wCAAwC;YACjE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,8CAA8C;IAC9C,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,EAAE;QAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAoE,CAAC,EAAE,CAAC;YAChH,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YACzB,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACvB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;eAEe;AACf,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,IAAI,WAAW,GAAa,EAAE,CAAC;IAC/B,IAAI,MAAM,GAA2B,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACjC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IACzB,CAAC;IACD,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,QAAQ,IAAI,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,aAAa,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YACxD,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACzC,CAAC"}

package/dist/swpx/types.js

@@ -0,0 +1,14 @@
+/** Shared types for the swpx / swpm verdict layer.
+ *
+ *  The verdict API lives on the `npm` platform project (npm.somewhere.tech),
+ *  NOT the /v1 control plane. It is unauthenticated (free, no login) — the CLI
+ *  hits it with a plain fetch, independent of `somewhere login`. See
+ *  verdict-client.ts.
+ *
+ *  The `Verdict` shape mirrors the D1 `verdicts` row (tsk_f30faf55) plus the
+ *  live MAL advisory check, which is NOT cached (a version can be retroactively
+ *  flagged). The `--json` output is a stable PROJECTION of this (toJsonVerdict)
+ *  — that projection is the public contract shown on npm.somewhere.tech, so it
+ *  is intentionally narrower than the internal row. */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/swpx/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/swpx/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;uDAWuD"}

package/dist/swpx/verdict-client.js

@@ -0,0 +1,112 @@
+/** Client for the verdict API hosted on the `npm` platform project.
+ *
+ *  This is NOT the /v1 control plane and NOT the runner — it's the public,
+ *  unauthenticated verdict service at npm.somewhere.tech (FAQ: "Free, no
+ *  login"). So this client deliberately does not touch ApiClient or the stored
+ *  developer key. Override the host for staging/tests via SWPX_VERDICT_URL.
+ *
+ *  Reachability is a product guarantee, inverted: if the verdict API is down,
+ *  the user must still get normal npm behaviour ("a gate, not a wall"). So every
+ *  failure here raises VerdictUnavailable and the command layer falls back to
+ *  the real npx/npm. We never block on our own outage. */
+const VERDICT_BASE = process.env.SWPX_VERDICT_URL?.replace(/\/$/, '') || 'https://npm.somewhere.tech';
+/** Short by design: the verdict check sits in front of every `npx`, so a slow
+ *  or unreachable service must fail fast to fallback, not stall the user. */
+const VERDICT_TIMEOUT_MS = Number(process.env.SWPX_VERDICT_TIMEOUT_MS) || 4000;
+const defaultFetch = (url, init) => fetch(url, init);
+/** Raised whenever the verdict couldn't be obtained — network error, timeout,
+ *  non-2xx, or unparseable body. The command layer treats it as "fall back to
+ *  the real tool", never as "block". */
+export class VerdictUnavailable extends Error {
+    /** True when the service answered 429 — a throttle, not an outage/tampering. */
+    rateLimited;
+    constructor(message, rateLimited = false) {
+        super(message);
+        this.name = 'VerdictUnavailable';
+        this.rateLimited = rateLimited;
+    }
+}
+/** Accept either a bare verdict object or a `{ ok, data }` envelope. */
+function unwrap(body) {
+    if (body && typeof body === 'object' && 'ok' in body) {
+        const env = body;
+        if (env.ok === true)
+            return env.data;
+        throw new VerdictUnavailable(env.message || env.error || 'verdict API returned ok:false');
+    }
+    return body;
+}
+function timeoutSignal() {
+    try {
+        return AbortSignal.timeout(VERDICT_TIMEOUT_MS);
+    }
+    catch {
+        return undefined; // very old runtime — let the request run without our timeout
+    }
+}
+/** Look up one package@version. Throws VerdictUnavailable on any failure. */
+export async function getVerdict(name, version, fetchImpl = defaultFetch) {
+    const url = `${VERDICT_BASE}/api/verdict/${encodeURIComponent(name)}/${encodeURIComponent(version)}`;
+    let res;
+    try {
+        res = await fetchImpl(url, { headers: { Accept: 'application/json' }, signal: timeoutSignal() });
+    }
+    catch (err) {
+        throw new VerdictUnavailable(err instanceof Error ? err.message : String(err));
+    }
+    if (!res.ok)
+        throw new VerdictUnavailable(`verdict API returned ${res.status}`, res.status === 429);
+    let body;
+    try {
+        body = await res.json();
+    }
+    catch {
+        throw new VerdictUnavailable('verdict API returned a non-JSON body');
+    }
+    const v = unwrap(body);
+    if (!v || typeof v !== 'object' || typeof v.verdict !== 'string') {
+        throw new VerdictUnavailable('verdict API returned an unexpected shape');
+    }
+    // Trust the caller's resolved coordinates over whatever the row echoes back.
+    return { ...v, package: name, version };
+}
+/** Batch-check a resolved tree. Throws VerdictUnavailable on any failure so the
+ *  caller can fall back to a plain `npm install`. The returned array is aligned
+ *  to the input order; any row the service omits is dropped (caller treats a
+ *  missing row as "unknown", not "verified"). */
+export async function getVerdictBatch(pkgs, fetchImpl = defaultFetch) {
+    if (pkgs.length === 0)
+        return [];
+    const url = `${VERDICT_BASE}/api/verdict/batch`;
+    let res;
+    try {
+        res = await fetchImpl(url, {
+            method: 'POST',
+            headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+            body: JSON.stringify({ packages: pkgs }),
+            signal: timeoutSignal(),
+        });
+    }
+    catch (err) {
+        throw new VerdictUnavailable(err instanceof Error ? err.message : String(err));
+    }
+    if (!res.ok)
+        throw new VerdictUnavailable(`verdict API returned ${res.status}`, res.status === 429);
+    let body;
+    try {
+        body = await res.json();
+    }
+    catch {
+        throw new VerdictUnavailable('verdict API returned a non-JSON body');
+    }
+    const data = unwrap(body);
+    const results = Array.isArray(data)
+        ? data
+        : data?.results;
+    if (!Array.isArray(results)) {
+        throw new VerdictUnavailable('verdict API batch returned an unexpected shape');
+    }
+    return results.filter((v) => !!v && typeof v === 'object' && typeof v.verdict === 'string');
+}
+export const verdictBaseUrl = VERDICT_BASE;
+//# sourceMappingURL=verdict-client.js.map

package/dist/swpx/verdict-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdict-client.js","sourceRoot":"","sources":["../../src/swpx/verdict-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;0DAU0D;AAK1D,MAAM,YAAY,GAChB,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,4BAA4B,CAAC;AAEnF;6EAC6E;AAC7E,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC;AAE/E,MAAM,YAAY,GAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAC5C,KAAK,CAAC,GAAG,EAAE,IAAmB,CAAsC,CAAC;AAEvE;;wCAEwC;AACxC,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,gFAAgF;IACvE,WAAW,CAAU;IAC9B,YAAY,OAAe,EAAE,WAAW,GAAG,KAAK;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAED,wEAAwE;AACxE,SAAS,MAAM,CAAC,IAAa;IAC3B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAA0E,CAAC;QACvF,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QACrC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,IAAI,+BAA+B,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,6DAA6D;IACjF,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,OAAe,EACf,YAAuB,YAAY;IAEnC,MAAM,GAAG,GAAG,GAAG,YAAY,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IACrG,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;IACnG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;IACpG,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAwB,CAAC;IAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAa,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC9E,MAAM,IAAI,kBAAkB,CAAC,0CAA0C,CAAC,CAAC;IAC3E,CAAC;IACD,6EAA6E;IAC7E,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC1C,CAAC;AAED;;;iDAGiD;AACjD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAiD,EACjD,YAAuB,YAAY;IAEnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,GAAG,YAAY,oBAAoB,CAAC;IAChD,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACzB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACxC,MAAM,EAAE,aAAa,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;IACpG,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACjC,CAAC,CAAC,IAAI;QACN,CAAC,CAAE,IAA8B,EAAE,OAAO,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAAC,gDAAgD,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAa,CAAC,OAAO,KAAK,QAAQ,CAChG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC"}

package/dist/swpx-bin.js

@@ -0,0 +1,20 @@
+/** Entry for the standalone `swpx` binary (and `somewhere npx`).
+ *
+ *  `swpx check <pkg> [--json]` inspects without running; anything else is a
+ *  package to run through the verdict gate. No commander here — a wrapper must
+ *  pass the user's flags through to the target package untouched, so we read
+ *  raw argv. `main` is side-effect-free (deps injectable) so it's unit-tested;
+ *  bin/swpx.js does the process.exit. */
+import { runSwpx } from './swpx/run-swpx.js';
+import { runCheck } from './swpx/check.js';
+export async function main(argv, deps = {}) {
+    if (argv[0] === 'check') {
+        const rest = argv.slice(1);
+        const json = rest.includes('--json');
+        const pkg = rest.find((a) => !a.startsWith('-'));
+        return runCheck(pkg, { json }, deps);
+    }
+    const { exitCode } = await runSwpx(argv, deps);
+    return exitCode;
+}
+//# sourceMappingURL=swpx-bin.js.map

package/dist/swpx-bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"swpx-bin.js","sourceRoot":"","sources":["../src/swpx-bin.ts"],"names":[],"mappings":"AAAA;;;;;;yCAMyC;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAG3C,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAc,EAAE,OAAgB,EAAE;IAC3D,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@somewhere-tech/cli",
-  "version": "0.12.9",
+  "version": "0.15.0",
   "description": "CLI for somewhere.tech — auth, projects, deploy, pull, promote, db, logs, env, MCP bridge.",
   "keywords": [
     "somewhere",
@@ -22,7 +22,9 @@
   "type": "module",
   "bin": {
     "somewhere": "bin/somewhere.js",
-    "sw": "bin/somewhere.js"
+    "sw": "bin/somewhere.js",
+    "swpx": "bin/swpx.js",
+    "swpm": "bin/swpm.js"
   },
   "files": [
     "bin",
@@ -44,17 +46,16 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "chalk": "^5.3.0",
     "chokidar": "^4.0.3",
     "commander": "^12.0.0",
-    "open": "^10.0.0",
-    "ora": "^8.0.0",
     "prompts": "^2.4.2",
+    "semver": "^7.6.3",
     "undici": "^8.4.1"
   },
   "devDependencies": {
     "@types/node": "^22.19.21",
     "@types/prompts": "^2.4.0",
+    "@types/semver": "^7.5.8",
     "typescript": "^5.4.0"
   }
 }