ChatNPM

ChatNPM: ChatArch npm registry and package maintenance helper

文档：https://arch.gh.wzhecnu.cn/ChatNPM/

快速开始

pip install chatnpm
chatnpm --tree
chatnpm --tree-brief
chatnpm package inspect npm --format json
chatnpm trusted audit . --format json
python -m pytest -q
python -m build

真实 CLI 树

chatnpm --tree 显示参数签名；chatnpm --tree-brief 保留相同节点和用途说明，但省略参数签名。两者均由 ChatStyle 从真实 Click 注册面生成。

chatnpm
├── --help  # Show this message and exit.
├── --version  # Show the version and exit.
├── --tree  # Print the registered CLI tree and exit.
├── --tree-brief  # Print the registered CLI tree without parameter signatures and exit.
├── package  # Inspect public npm registry metadata; read-only network access.
│   └── inspect <PACKAGE> [--version PACKAGE-VERSION] [--registry REGISTRY] [--format OUTPUT-FORMAT]  # Read public package metadata; sends one request and never outputs auth values.
└── trusted  # Audit npm Trusted Publishing evidence; read-only filesystem access.
    └── audit [PATH] [--format OUTPUT-FORMAT]  # Read package/workflow evidence under PATH; no account access or secret output.

npm 发布元数据只读检查

chatnpm package inspect <package> 会读取公开 npm registry packument，输出安全摘要：

package / version / scope
public maintainers count and names from registry metadata
repository and safe publishConfig summary
dist integrity/signature/attestation presence
provenance evidence when dist.attestations is present
local GitHub Actions evidence for npm OIDC / npm publish --provenance through chatnpm trusted audit

npm 的公开 registry 不提供类似 PyPI 项目设置页的 Trusted Publisher 表格，因此 ChatNPM 会明确报告：

Trusted Publishing settings: not exposed by public npm registry

这不是失败，也不是推断没有 Trusted Publishing；它只表示公开读回只能验证 registry provenance/attestation evidence，不能读取 npm 账号/包设置里的 trusted-publishing 配置。

CLI 规范

这个包使用 chatstyle>=0.2.0,<0.3.0 的 add_tree_option() 生成完整和简洁命令树，不维护包内 renderer。ChatNPM 没有 env/profile/config 行为，因此不依赖 ChatEnv。

目录结构

src/：包源码
tests/：CLI、registry、trusted publishing、docs/workflow contract 测试
docs/：长期维护文档，由 MkDocs Material + i18n 构建

开发说明

扩展前先阅读 DEVELOP.md 和 AGENTS.md。

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

chatnpm-0.1.4.tar.gz (14.5 kB view details)

Uploaded Aug 21, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

chatnpm-0.1.4-py3-none-any.whl (11.2 kB view details)

Uploaded Aug 21, 2026 Python 3

File details

Details for the file chatnpm-0.1.4.tar.gz.

File metadata

Download URL: chatnpm-0.1.4.tar.gz
Upload date: Aug 21, 2026
Size: 14.5 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for chatnpm-0.1.4.tar.gz
Algorithm	Hash digest
SHA256	`280a2950fbcc269fa4cff73f607d7dd2f3069fe11860264cac836a6941b19ac4`
MD5	`e3b86ca0dc675772fa77cfe40c6432fb`
BLAKE2b-256	`acdb29a1726a106d57edc7b3b4586ab84f5beac593c1d4c2e71947e57fd519e7`

See more details on using hashes here.

Provenance

The following attestation bundles were made for chatnpm-0.1.4.tar.gz:

Publisher: publish.yml on ChatArch/ChatNPM

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: chatnpm-0.1.4.tar.gz
- Subject digest: 280a2950fbcc269fa4cff73f607d7dd2f3069fe11860264cac836a6941b19ac4
- Sigstore transparency entry: 2551435585
- Sigstore integration time: Aug 21, 2026
Source repository:
- Permalink: ChatArch/ChatNPM@1377e4fc6252d29e2db48b9c268abff4d25e1ea2
- Branch / Tag: refs/tags/v0.1.4
- Owner: https://github.com/ChatArch
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: publish.yml@1377e4fc6252d29e2db48b9c268abff4d25e1ea2
- Trigger Event: push