Use a package from the terminal
Run a package's own command line with sdxc pkg to decode a token, check a domain, render a diagram or convert a contact card, and script it with --json and exit codes.
Last updated
After reading this guide, you will know
- How to run any package's command line with
sdxc pkg, without installing the package - How every package command line reads input, prints reports and exits, so scripts and CI can rely on it
- Which packages ship a command line and what each one does
Many packages do work you also want at a terminal: generating a key pair, decoding a token
someone pasted into a ticket, checking a domain's mail records before a launch. Those packages
ship a small command line beside the library that calls the same functions your app does, and
the sdxc command runs any of them. This guide runs one, scripts it, and lists every package
that has one.
Run one with sdxc pkg
Install sdxc once, as The sdxc command shows:
npm add -g @sdxc/kitsdxc pkg followed by a package's name runs that package's command line, with everything
after the name passed to it as typed:
sdxc pkg jwt decode eyJhbGciOiJFUzI1NiJ9.eyJzdWIiOiIxMjMifQ.c2lnInside a project that installs @sdxc/jwt, it runs that version. Anywhere else it downloads
the published package with bunx, or with npx when Bun is missing, so nothing needs
installing first. sdxc pkg alone lists every package with a command line.
A project that pins its @sdxc packages to a release gets the command line from that same
release. In a project on 2026.10.25, sdxc pkg jwt runs the newest @sdxc/jwt published
on or before that date, so the command line decodes and signs tokens the way your app's code
does. Outside a project, or in one that pins no @sdxc package, it runs the newest version.
A mistyped name runs nothing and suggests the closest match, arguments included:
No @sdxc package command line is named "uiid". Did you mean `sdxc pkg uuid v4 -n 3`?Script it with --json and exit codes
Every package command line behaves the same way, so a script written against one reads the others:
Input comes from a path argument, or from stdin when the argument is
-or left out, so commands chain with pipes.Output goes to stdout, and diagnostics to stderr.
--jsonprints any report as JSON with a stable shape, for scripts and agents. Without it the output is meant for people.Exit codes:
0the command did its work,1it ran and found a problem (an invalid signature, a missing DMARC record, a domain about to expire),2the arguments or the input could not be read.Secrets such as signing keys and passwords are read from a file, stdin or a named environment variable, never from an argument, so they stay out of shell history.
--helpon any command lists its arguments and flags.
Exit code 1 makes a check usable in CI as it is:
sdxc pkg email-auth check example.com --json > email-auth.jsonThe step fails when a policy is missing, and the JSON report is there to read.
Find the command line you need
| Package | Command | What it does |
|---|---|---|
@sdxc/cron | sdxc pkg cron | Next occurrences of a schedule, a plain-English description, validation |
@sdxc/crypto | sdxc pkg crypto | Random tokens, hashes, HMACs, TOTP codes, scrypt password hashes |
@sdxc/diagram | sdxc pkg diagram | Render a Mermaid file to SVG, or check it |
@sdxc/distill | sdxc pkg distill | Extract the article from a web page |
@sdxc/doh | sdxc pkg doh | DNS lookups over HTTPS |
@sdxc/email-address | sdxc pkg email-address | Check addresses for syntax, disposable domains and mail servers |
@sdxc/email-auth | sdxc pkg email-auth | Check a domain's DMARC, SPF, MTA-STS, TLS-RPT, BIMI and DKIM |
@sdxc/font | sdxc pkg font | Inspect a font, or subset it to the characters a page uses |
@sdxc/html | sdxc pkg html | Query a page by role and accessible name, or print its outline |
@sdxc/http-signatures | sdxc pkg http-signatures | Sign a request, or verify a signed one |
@sdxc/icalendar | sdxc pkg icalendar | Validate a calendar, expand its recurrences, try out an RRULE |
@sdxc/ip | sdxc pkg ip | Classify an address, check whether a range contains it |
@sdxc/jscalendar | sdxc pkg jscalendar | Convert to and from iCalendar, expand recurrences, validate |
@sdxc/jscontact | sdxc pkg jscontact | Convert between vCard, jCard and JSContact, validate |
@sdxc/jsdoc | sdxc pkg jsdoc | Extract JSDoc from source files into a documentation model |
@sdxc/json-canonical | sdxc pkg json-canonical | Canonicalize JSON, hash the canonical form |
@sdxc/json-patch | sdxc pkg json-patch | Apply, diff and validate JSON Patch documents |
@sdxc/jsonc | sdxc pkg jsonc | Check JSON with comments, strip it to plain JSON |
@sdxc/jsonpath | sdxc pkg jsonpath | Query JSON with JSONPath |
@sdxc/jwt | sdxc pkg jwt | Decode, verify and sign tokens, generate signing keys |
@sdxc/merge-patch | sdxc pkg merge-patch | Apply and diff JSON Merge Patch documents |
@sdxc/openapi | sdxc pkg openapi | Check an OpenAPI document |
@sdxc/openpgp | sdxc pkg openpgp | Generate keys, sign, verify, inspect a key |
@sdxc/qr | sdxc pkg qr | Encode text as a QR code, to SVG or PNG |
@sdxc/rdap | sdxc pkg rdap | Look up a domain's registration, fail when it expires soon |
@sdxc/robots | sdxc pkg robots | Check a URL against robots.txt, parse a robots.txt |
@sdxc/security-headers | sdxc pkg security-headers | Audit a page's security headers, parse a CSP |
@sdxc/semver | sdxc pkg semver | Validate, compare and sort versions |
@sdxc/sitemap | sdxc pkg sitemap | List and validate a sitemap's URLs |
@sdxc/typeid | sdxc pkg typeid | Generate, parse and encode TypeIDs |
@sdxc/user-agent | sdxc pkg user-agent | Parse User-Agent strings, one per line from a log |
@sdxc/uuid | sdxc pkg uuid | Generate v4 and v7 UUIDs, validate one |
@sdxc/web-push | sdxc pkg web-push | Generate VAPID keys, send a test notification |
@sdxc/webmention | sdxc pkg webmention | Discover an endpoint, send and verify Webmentions |
@sdxc/well-known | sdxc pkg well-known | Check a security.txt, fetch and validate well-known documents |
@sdxc/zone-file | sdxc pkg zone-file | Validate, parse and format DNS zone files |
The guide for each package shows its command line where it helps, and --help lists the rest.
Where to go next
Build a command line — the
@sdxc/clipackage every one of these is built on, for a tool of your own.Your app's command line — commands that need your app's database and services.
Check a project —
sdxc doctor, for checks that read your project.