Npm
@funsaized/npmv2026.08.30.1
Security Notice
This extension includes AI agent skills that can modify AI assistant behavior. Review the skill files before installing.
01README
Typed, reproducible npm project operations
02Behaviors
@funsaized/npm/projectv2026.08.30.1project.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| projectDir | string | |
| expectedNpmVersion? | string | |
| expectedNodeVersion? | string | |
| strictToolchain | boolean | |
| configPolicy | literal | |
| lifecycleScripts | enum | |
| allowedScripts | array | |
| allowedRebuildPackages | array | |
| environment | record | |
| defaultTimeoutMs | number | |
| requireCleanGit | boolean |
fn inspect(expectedGitHead?: string)
Inspect npm manifests, configuration hashes, Git state, and toolchain
| Argument | Type | Description |
|---|---|---|
| expectedGitHead? | string |
fn ci()
Run reproducible npm ci with lifecycle scripts denied by default
fn run()
Run an existing, explicitly allowed package script without a shell
fn list()
Record raw and normalized npm ls JSON output
fn audit()
Record npm audit JSON before independently applying findings policy
fn sbom()
Record a bounded CycloneDX or SPDX SBOM before applying completeness policy
fn pack()
Preview or produce one bounded npm package tarball without registry mutation
fn rebuild()
Run install scripts only for explicitly selected and globally allowed packages
fn query(selector: string, failOnMatches: boolean, minCount?: number, maxResults: number, expectedGitHead?: string)
Record bounded normalized npm dependency selector results and apply count policy
| Argument | Type | Description |
|---|---|---|
| selector | string | |
| failOnMatches | boolean | |
| minCount? | number | |
| maxResults | number | |
| expectedGitHead? | string |
Resources
project(infinite)— Inspected npm project metadata and toolchain identity
invocation(infinite)— Success or durable failure evidence for one operation
dependencyTree(infinite)— Normalized npm dependency tree
auditReport(infinite)— Normalized npm audit execution, findings, and policy result
sbom(infinite)— Normalized software bill of materials and policy result
packResult(infinite)— Dry-run or produced npm package artifact metadata
queryResult(infinite)— Bounded normalized npm dependency selector results
Files
log(text/plain)— Redacted streaming command log
rawJson(application/json)— Redacted raw npm JSON output
packageArtifact(application/gzip)— Packed npm tarball produced without registry mutation
03Workflows
@funsaized/npm/verifycf64f11c-d2d2-4902-baf9-17995d793ddc
Reproducibly install and verify an npm project at an exact Git commit
verifyInspect, install, audit, inventory, and generate an SBOM
1.inspect${{ inputs.model }}.inspect— Bind project and toolchain identity to the reviewed commit
2.ci${{ inputs.model }}.ci— Restore the exact package-lock dependency tree
3.audit${{ inputs.model }}.audit— Apply the configured vulnerability policy
4.sbom${{ inputs.model }}.sbom— Produce CycloneDX dependency evidence
5.list${{ inputs.model }}.list— Record the normalized installed dependency tree
04Reports
@funsaized/npm/audit-findingsmethod
audit_findings.ts
Summarize normalized npm audit findings and policy outcome
npmsecurityaudit
@funsaized/npm/invocationmethod
invocation.ts
Summarize npm invocation identity, outcome, and input hashes
npmevidencesupply-chain
@funsaized/npm/sbom-summarymethod
sbom_summary.ts
Summarize npm SBOM package, license, and completeness evidence
npmsbomsupply-chain
05Skills
swamp-npm1 file
06Previous Versions
2026.08.26.3
Publish statically extractable model metadata so registry pages show methods and arguments.
Added 1 behaviors
2026.08.26.2
Fix registry model metadata indexing by publishing the model at the canonical archive path.
2026.08.26.1
Initial typed npm project operations: inspect, ci, run, list, and audit
07Stats
A
93 / 100
Downloads
574
Archive size
51.8 KB
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License1/2partial
no SPDX license declared
- Verified public repository2/2earned
Repository
https://github.com/funsaized/swamp-npm08Platforms
09Labels