@emuanalytics/flow-cli
The Flo.w CLI (`flow-engine-cli`) is a command line interface for working with Flo.w Engine via its REST API. It provides developers with tools to work with datasets, pipelines and other Flo.w resources.
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/index.mjs | AI (source-diff): Standard unbuild-generated ESM bundle; minified but not obfuscated, no encoded payloads. | ai | |
| phantom-deps | phantom-dep:uuid | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:find-up | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:inquirer | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:@types/yargs | AI (phantom-deps): Type-only package; framework-scoped, stable false positive. | ai | |
| phantom-deps | phantom-dep:string-width | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:csv-stringify | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:colorette | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:JSONStream | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:loose-json | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:node-emoji | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:cli-spinner | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:ora | AI (phantom-deps): Bundled CLI; deps resolved via bundler, not direct imports. Stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:zod | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:open | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:chalk | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:execa | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:table | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:yargs | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:yauzl | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:express | AI (phantom-deps): Same bundled CLI pattern. | ai | |
| phantom-deps | phantom-dep:lint-staged | AI (phantom-deps): lint-staged is a dev/config tool referenced in package.json scripts; not a runtime phantom dep. | ai | |
| phantom-deps | phantom-dep:https-proxy-agent | AI (phantom-deps): Listed as a runtime dep and used via config; stable false positive. | ai | |
| phantom-deps | phantom-dep:@types/uuid | AI (phantom-deps): @types packages are type-only and not directly imported at runtime; stable false positive. | ai | |
| phantom-deps | phantom-dep:tslib | AI (phantom-deps): tslib is a well-known TypeScript runtime implicit dep; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:debug | AI (phantom-deps): debug is referenced in config/transitive context; not a real phantom dep concern. | ai |
Versions (showing 13 of 13)
| Version | Deps | Published |
|---|---|---|
| 2.2.8 | 26 / 14 | |
| 2.2.6 | 26 / 14 | |
| 2.2.5 | 26 / 14 | |
| 2.2.4 | 26 / 14 | |
| 2.2.3 | 26 / 14 | |
| 2.2.2 | 25 / 14 | |
| 2.2.1 | 25 / 14 | |
| 2.2.0 | 25 / 14 | |
| 2.1.7 | 30 / 18 | |
| 2.1.2 | 30 / 18 | |
| 2.1.1 | 30 / 18 | |
| 2.1.0 | 30 / 18 | |
| 2.0.16 | 30 / 18 |
v2.1.2
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.1.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v2.0.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.