is Peekling's first-party CLI. Its official npm record
declares
as its source and includes SLSA provenance
for the GitHub-verified signed
source tag. Before execution, require the
exact registry identity and integrity recorded in
cli-trust.md. Stop on any mismatch.
Require complete supplied frames/sheet, source licence/permission, provenance, desired pack id/version, and frame/state mapping.
-
Stop when rights are unknown or required directions/states are absent. Do not download substitutes.
-
Create named-frame or state-row authoring inputs and a source manifest. Preserve original files and hashes.
-
Read the CLI trust boundary, then run only the
verified pinned package:
sh
npm exec --yes --ignore-scripts --package=@peekling/cli@0.1.0 -- peekling pack SOURCE --out PACK
npm exec --yes --ignore-scripts --package=@peekling/cli@0.1.0 -- peekling validate PACK
-
Verify data-only security, dense mapping, timing, alpha, baseline, directions, density lineage, contact sheet, loop review, and size. Keep output private/UNLICENSED pending review.
Use only capabilities actually available. If a required command/tool cannot run,
provide the exact handoff and state that it remains unverified. The workflow is
agent-neutral.
is optional metadata, not a dependency.