@powerhousedao/switchboard
A powerful document-driven server that provides a unified API for managing and serving document models, drives, and reactors in the Powerhouse ecosystem.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| maintainer-change | maintainer-added | AI (maintainer-change): Consistent with trusted publisher's ongoing org releases, provenance unchanged. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Deps are legitimate DB/SDK libs matching stated server functionality. | ai | |
| dependencies | unvetted-dep:pglite-tools-legacy-02 | AI (dependencies): Intentional pinned legacy alias of official @electric-sql/pglite-tools. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Monorepo internal package; missing description is cosmetic. | ai | |
| dependencies | unvetted-dep:pglite-legacy-02 | AI (dependencies): Intentional pinned legacy alias of official @electric-sql/pglite for migration compat. | ai | |
| phantom-deps | phantom-dep:express | AI (phantom-deps): express is imported dynamically or via re-exports; stable for this package. | ai | |
| phantom-deps | phantom-dep:vite | AI (phantom-deps): vite is used as a runtime dep for the server's build/bundling pipeline; stable for this package. | ai | |
| phantom-deps | phantom-dep:exponential-backoff | AI (phantom-deps): Declared runtime dep used in config/retry logic; phantom-dep expected in monorepo setup. | ai | |
| phantom-deps | phantom-dep:cors | AI (phantom-deps): cors is a declared runtime dep used in Express server config; phantom-dep expected in monorepo. | ai | |
| phantom-deps | phantom-dep:graphql | AI (phantom-deps): graphql is a declared peer/runtime dep used transitively; phantom-dep expected in monorepo. | ai | |
| phantom-deps | phantom-dep:body-parser | AI (phantom-deps): body-parser is a declared runtime dep for Express middleware; phantom-dep expected in monorepo. | ai | |
| phantom-deps | phantom-dep:@openfeature/core | AI (phantom-deps): @openfeature/core is a peer dep of @openfeature/server-sdk; phantom-dep expected. | ai | |
| phantom-deps | phantom-dep:pg | AI (phantom-deps): pg is a declared runtime dep used in server config; phantom-dep is expected in monorepo setup. | ai | |
| phantom-deps | phantom-dep:@powerhousedao/analytics-engine-knex | AI (phantom-deps): Same-org package in a monorepo context; phantom dep detection is a stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@powerhousedao/analytics-engine-core | AI (phantom-deps): Same-org package in a monorepo context; phantom dep detection is a stable false positive for this package. | ai | |
| dependencies | unvetted-dep:document-drive | AI (dependencies): document-drive is a same-ecosystem Powerhouse package, consistently pinned at matching version in coordinated monorepo releases. Not a supply chain risk. | ai |
Versions (showing 19 of 19)
| Version | Deps | Published |
|---|---|---|
| 6.2.0 | 40 / 8 | |
| 6.0.0 | 39 / 8 | |
| 5.3.6 | 24 / 5 | |
| 5.3.5 | 24 / 5 | |
| 5.3.2 | 24 / 5 | |
| 5.3.1 | 24 / 5 | |
| 5.3.0 | 24 / 5 | |
| 5.1.0 | 19 / 4 | |
| 5.0.11 | 19 / 4 | |
| 5.0.9 | 19 / 4 | |
| 5.0.8 | 19 / 4 | |
| 5.0.7 | 19 / 4 | |
| 5.0.6 | 19 / 4 | |
| 5.0.5 | 19 / 4 | |
| 5.0.4 | 19 / 4 | |
| 5.0.3 | 19 / 4 | |
| 5.0.2 | 19 / 4 | |
| 5.0.1 | 19 / 4 | |
| 5.0.0 | 19 / 4 |
v6.2.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.3.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.3.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.3.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.3.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v5.0.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.