@nepopsx/cli 0.0.1

package/dist/licensing/index.js

@@ -0,0 +1,7 @@
+/**
+ * Licensing barrel — re-export all licensing modules.
+ */
+export { readLicense, writeLicense, activateLicense, validateLicense, enforceTierLimits, isDevMode, } from './license-manager.js';
+export { fetchRemoteTemplates, } from './template-fetch.js';
+export { applySteganography, decodeSteganography, forensicDecode, fingerprintToId, } from './fingerprint.js';
+//# sourceMappingURL=index.js.map

package/dist/licensing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/licensing/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,YAAY,EACZ,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,SAAS,GAGV,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,oBAAoB,GAErB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,GAChB,MAAM,kBAAkB,CAAC"}

package/dist/licensing/license-manager.d.ts

@@ -0,0 +1,44 @@
+/**
+ * License manager — handles license activation, validation,
+ * online refresh, and tier-based feature gating.
+ */
+import { type License, type LicenseStatus, type LicenseTier, type WorkspaceConfig } from '@nepopsx/core';
+/**
+ * Read the local license file. Returns null if not found or invalid.
+ */
+export declare function readLicense(rootDir: string): License | null;
+/**
+ * Write license to disk. Creates .opsx/ if needed.
+ */
+export declare function writeLicense(rootDir: string, license: License): void;
+export interface ActivationResult {
+    success: boolean;
+    license?: License;
+    error?: string;
+}
+/**
+ * Activate a license key for this machine + workspace.
+ * Calls the remote API to validate the key and bind it.
+ */
+export declare function activateLicense(rootDir: string, licenseKey: string, workspaceName: string): Promise<ActivationResult>;
+/**
+ * Validate the current license. Attempts online refresh if expired.
+ * Returns detailed status.
+ */
+export declare function validateLicense(rootDir: string, config: WorkspaceConfig): Promise<LicenseStatus>;
+export interface TierViolation {
+    feature: string;
+    limit: string;
+    actual: string;
+    required_tier: LicenseTier;
+}
+/**
+ * Check if the workspace config exceeds the license tier's limits.
+ */
+export declare function enforceTierLimits(config: WorkspaceConfig, tier: LicenseTier): TierViolation[];
+/**
+ * Check if the CLI is running in dev mode (for OPSX agent developers).
+ * Set OPSX_DEV=1 to bypass license checks.
+ */
+export declare function isDevMode(): boolean;
+//# sourceMappingURL=license-manager.d.ts.map

package/dist/licensing/license-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-manager.d.ts","sourceRoot":"","sources":["../../src/licensing/license-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EACL,KAAK,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,WAAW,EAAmB,KAAK,eAAe,EAG1F,MAAM,eAAe,CAAC;AAYvB;;GAEG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAiB3D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAUpE;AAID,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAoD3B;AAID;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,aAAa,CAAC,CAkIxB;AA+CD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,WAAW,CAAC;CAC5B;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,GAAG,aAAa,EAAE,CAgD7F;AAID;;;GAGG;AACH,wBAAgB,SAAS,IAAI,OAAO,CAEnC"}

package/dist/licensing/license-manager.js

@@ -0,0 +1,311 @@
+/**
+ * License manager — handles license activation, validation,
+ * online refresh, and tier-based feature gating.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { TIER_LIMITS, generateMachineId, generateFingerprint, checkExpiry, } from '@nepopsx/core';
+import { resolveApiBase } from '../config/api-config.js';
+const LICENSE_DIR = '.opsx';
+const LICENSE_FILE = 'license.json';
+// ─── API configuration ──────────────────────────────────────
+const REQUEST_TIMEOUT_MS = 10_000;
+// ─── License file operations ────────────────────────────────
+/**
+ * Read the local license file. Returns null if not found or invalid.
+ */
+export function readLicense(rootDir) {
+    const licensePath = join(rootDir, LICENSE_DIR, LICENSE_FILE);
+    if (!existsSync(licensePath))
+        return null;
+    try {
+        const raw = readFileSync(licensePath, 'utf-8');
+        const data = JSON.parse(raw);
+        // Basic shape validation
+        if (!data.key || !data.org || !data.tier || !data.valid_until || !data.machine_id) {
+            return null;
+        }
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Write license to disk. Creates .opsx/ if needed.
+ */
+export function writeLicense(rootDir, license) {
+    const dir = join(rootDir, LICENSE_DIR);
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true });
+    }
+    writeFileSync(join(dir, LICENSE_FILE), JSON.stringify(license, null, 2) + '\n', 'utf-8');
+}
+/**
+ * Activate a license key for this machine + workspace.
+ * Calls the remote API to validate the key and bind it.
+ */
+export async function activateLicense(rootDir, licenseKey, workspaceName) {
+    const machineId = generateMachineId();
+    const apiBase = resolveApiBase(rootDir);
+    try {
+        const response = await fetchWithTimeout(`${apiBase}/license/activate`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                key: licenseKey,
+                machine_id: machineId,
+                workspace: workspaceName,
+            }),
+        });
+        if (!response.ok) {
+            const body = await response.text();
+            return {
+                success: false,
+                error: `Activation failed (${response.status}): ${body}`,
+            };
+        }
+        const data = await response.json();
+        const license = {
+            key: licenseKey,
+            org: data.org,
+            tier: data.tier,
+            valid_until: data.valid_until,
+            refresh_token: data.refresh_token,
+            machine_id: machineId,
+            workspace: workspaceName,
+            activated_at: new Date().toISOString(),
+            last_refreshed: new Date().toISOString(),
+        };
+        writeLicense(rootDir, license);
+        return { success: true, license };
+    }
+    catch (err) {
+        // Network failure — might be offline
+        return {
+            success: false,
+            error: `Cannot reach OPSX API: ${err.message}. Check your internet connection.`,
+        };
+    }
+}
+// ─── Validation ─────────────────────────────────────────────
+/**
+ * Validate the current license. Attempts online refresh if expired.
+ * Returns detailed status.
+ */
+export async function validateLicense(rootDir, config) {
+    const license = readLicense(rootDir);
+    const apiBase = resolveApiBase(rootDir);
+    // No license file
+    if (!license) {
+        return {
+            valid: false,
+            expired: true,
+            days_remaining: 0,
+            tier: 'free',
+            org: '',
+            fingerprint: '',
+            message: 'No license found. Run `opsx activate <key>` to activate.',
+        };
+    }
+    // Machine binding check
+    const currentMachineId = generateMachineId();
+    if (license.machine_id !== currentMachineId) {
+        return {
+            valid: false,
+            expired: false,
+            days_remaining: 0,
+            tier: license.tier,
+            org: license.org,
+            fingerprint: '',
+            message: 'License is bound to a different machine. Run `opsx activate <key>` to re-activate.',
+        };
+    }
+    const { expired, daysRemaining } = checkExpiry(license.valid_until);
+    const fingerprint = generateFingerprint(license.org, license.key, license.workspace);
+    // Still valid — return immediately
+    if (!expired) {
+        try {
+            const response = await fetchWithTimeout(`${apiBase}/license/validate`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    key: license.key,
+                    machine_id: license.machine_id,
+                    workspace: license.workspace,
+                }),
+            });
+            if (response.ok) {
+                const data = await response.json();
+                if (data.valid) {
+                    const updatedLicense = {
+                        ...license,
+                        org: data.org,
+                        tier: data.tier,
+                        valid_until: data.valid_until,
+                        last_refreshed: new Date().toISOString(),
+                    };
+                    writeLicense(rootDir, updatedLicense);
+                    const onlineExpiry = checkExpiry(updatedLicense.valid_until);
+                    return {
+                        valid: true,
+                        expired: false,
+                        days_remaining: onlineExpiry.daysRemaining,
+                        tier: updatedLicense.tier,
+                        org: updatedLicense.org,
+                        fingerprint,
+                        message: data.message,
+                    };
+                }
+                return {
+                    valid: false,
+                    expired: false,
+                    days_remaining: daysRemaining,
+                    tier: license.tier,
+                    org: license.org,
+                    fingerprint,
+                    message: data.message,
+                };
+            }
+        }
+        catch {
+            // Fall back to local validation when offline or backend is unavailable.
+        }
+        return {
+            valid: true,
+            expired: false,
+            days_remaining: daysRemaining,
+            tier: license.tier,
+            org: license.org,
+            fingerprint,
+            message: daysRemaining <= 7
+                ? `License expires in ${daysRemaining} day(s). Renew at opsx.dev.`
+                : `Licensed to ${license.org} (${license.tier}).`,
+        };
+    }
+    // Expired — attempt online refresh
+    const refreshed = await refreshLicense(rootDir, license);
+    if (refreshed) {
+        const newExpiry = checkExpiry(refreshed.valid_until);
+        return {
+            valid: true,
+            expired: false,
+            days_remaining: newExpiry.daysRemaining,
+            tier: refreshed.tier,
+            org: refreshed.org,
+            fingerprint,
+            message: `License refreshed. Valid until ${refreshed.valid_until}.`,
+        };
+    }
+    // Refresh failed — license is truly expired
+    return {
+        valid: false,
+        expired: true,
+        days_remaining: daysRemaining,
+        tier: license.tier,
+        org: license.org,
+        fingerprint,
+        message: `License expired on ${license.valid_until}. Renew at opsx.dev or run \`opsx activate <key>\`.`,
+    };
+}
+// ─── Refresh ────────────────────────────────────────────────
+/**
+ * Attempt to refresh the license via the remote API.
+ * Returns updated license on success, null on failure.
+ */
+async function refreshLicense(rootDir, license) {
+    const apiBase = resolveApiBase(rootDir);
+    try {
+        const response = await fetchWithTimeout(`${apiBase}/license/refresh`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                refresh_token: license.refresh_token,
+                machine_id: license.machine_id,
+            }),
+        });
+        if (!response.ok)
+            return null;
+        const data = await response.json();
+        const updated = {
+            ...license,
+            tier: data.tier,
+            valid_until: data.valid_until,
+            refresh_token: data.refresh_token,
+            last_refreshed: new Date().toISOString(),
+        };
+        writeLicense(rootDir, updated);
+        return updated;
+    }
+    catch {
+        // Network failure — can't refresh
+        return null;
+    }
+}
+/**
+ * Check if the workspace config exceeds the license tier's limits.
+ */
+export function enforceTierLimits(config, tier) {
+    const limits = TIER_LIMITS[tier];
+    const violations = [];
+    // Service count
+    if (config.services.length > limits.max_services) {
+        violations.push({
+            feature: 'services',
+            limit: `${limits.max_services}`,
+            actual: `${config.services.length}`,
+            required_tier: tier === 'free' ? 'team' : 'enterprise',
+        });
+    }
+    // Agent count
+    if (config.agents) {
+        const enabledAgents = Object.values(config.agents).filter((a) => a.enabled).length;
+        if (enabledAgents > limits.max_agents) {
+            violations.push({
+                feature: 'agents',
+                limit: `${limits.max_agents}`,
+                actual: `${enabledAgents}`,
+                required_tier: tier === 'free' ? 'team' : 'enterprise',
+            });
+        }
+    }
+    // Customs
+    if (config.customs_dir && !limits.customs_allowed) {
+        violations.push({
+            feature: 'customs',
+            limit: 'not available',
+            actual: 'customs_dir configured',
+            required_tier: 'team',
+        });
+    }
+    // Philosophy
+    if (config.philosophy && !limits.philosophy_allowed) {
+        violations.push({
+            feature: 'philosophy',
+            limit: 'not available',
+            actual: 'philosophy configured',
+            required_tier: 'team',
+        });
+    }
+    return violations;
+}
+// ─── Dev mode bypass ────────────────────────────────────────
+/**
+ * Check if the CLI is running in dev mode (for OPSX agent developers).
+ * Set OPSX_DEV=1 to bypass license checks.
+ */
+export function isDevMode() {
+    return process.env.OPSX_DEV === '1';
+}
+// ─── Utilities ──────────────────────────────────────────────
+async function fetchWithTimeout(url, init) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    try {
+        return await fetch(url, { ...init, signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+//# sourceMappingURL=license-manager.js.map

package/dist/licensing/license-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-manager.js","sourceRoot":"","sources":["../../src/licensing/license-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAW,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAEL,WAAW,EACX,iBAAiB,EAAE,mBAAmB,EAAE,WAAW,GACpD,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,YAAY,GAAG,cAAc,CAAC;AAEpC,+DAA+D;AAE/D,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,+DAA+D;AAE/D;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE7B,yBAAyB;QACzB,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAe,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,OAAgB;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACvC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,aAAa,CACX,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EACvB,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACvC,OAAO,CACR,CAAC;AACJ,CAAC;AAUD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAe,EACf,UAAkB,EAClB,aAAqB;IAErB,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAExC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,OAAO,mBAAmB,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,GAAG,EAAE,UAAU;gBACf,UAAU,EAAE,SAAS;gBACrB,SAAS,EAAE,aAAa;aACzB,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,sBAAsB,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE;aACzD,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAK/B,CAAC;QAEF,MAAM,OAAO,GAAY;YACvB,GAAG,EAAE,UAAU;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,aAAa;YACxB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtC,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACzC,CAAC;QAEF,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAE/B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,qCAAqC;QACrC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,0BAA0B,GAAG,CAAC,OAAO,mCAAmC;SAChF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+DAA+D;AAE/D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAe,EACf,MAAuB;IAEvB,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAExC,kBAAkB;IAClB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,CAAC;YACjB,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,EAAE;YACP,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,0DAA0D;SACpE,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,MAAM,gBAAgB,GAAG,iBAAiB,EAAE,CAAC;IAC7C,IAAI,OAAO,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;QAC5C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,KAAK;YACd,cAAc,EAAE,CAAC;YACjB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,oFAAoF;SAC9F,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAErF,mCAAmC;IACnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,OAAO,mBAAmB,EAAE;gBACrE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;iBAC7B,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAM/B,CAAC;gBAEF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,cAAc,GAAY;wBAC9B,GAAG,OAAO;wBACV,GAAG,EAAE,IAAI,CAAC,GAAG;wBACb,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;qBACzC,CAAC;oBACF,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;oBAEtC,MAAM,YAAY,GAAG,WAAW,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;oBAC7D,OAAO;wBACL,KAAK,EAAE,IAAI;wBACX,OAAO,EAAE,KAAK;wBACd,cAAc,EAAE,YAAY,CAAC,aAAa;wBAC1C,IAAI,EAAE,cAAc,CAAC,IAAI;wBACzB,GAAG,EAAE,cAAc,CAAC,GAAG;wBACvB,WAAW;wBACX,OAAO,EAAE,IAAI,CAAC,OAAO;qBACtB,CAAC;gBACJ,CAAC;gBAED,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE,KAAK;oBACd,cAAc,EAAE,aAAa;oBAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,WAAW;oBACX,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,KAAK;YACd,cAAc,EAAE,aAAa;YAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,WAAW;YACX,OAAO,EAAE,aAAa,IAAI,CAAC;gBACzB,CAAC,CAAC,sBAAsB,aAAa,6BAA6B;gBAClE,CAAC,CAAC,eAAe,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,IAAI,IAAI;SACpD,CAAC;IACJ,CAAC;IAED,mCAAmC;IACnC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACrD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,KAAK;YACd,cAAc,EAAE,SAAS,CAAC,aAAa;YACvC,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,WAAW;YACX,OAAO,EAAE,kCAAkC,SAAS,CAAC,WAAW,GAAG;SACpE,CAAC;IACJ,CAAC;IAED,4CAA4C;IAC5C,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,aAAa;QAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,WAAW;QACX,OAAO,EAAE,sBAAsB,OAAO,CAAC,WAAW,qDAAqD;KACxG,CAAC;AACJ,CAAC;AAED,+DAA+D;AAE/D;;;GAGG;AACH,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,OAAgB;IAC7D,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAExC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,OAAO,kBAAkB,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAE9B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAI/B,CAAC;QAEF,MAAM,OAAO,GAAY;YACvB,GAAG,OAAO;YACV,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACzC,CAAC;QAEF,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAWD;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAuB,EAAE,IAAiB;IAC1E,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,UAAU,GAAoB,EAAE,CAAC;IAEvC,gBAAgB;IAChB,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;QACjD,UAAU,CAAC,IAAI,CAAC;YACd,OAAO,EAAE,UAAU;YACnB,KAAK,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE;YAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE;YACnC,aAAa,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY;SACvD,CAAC,CAAC;IACL,CAAC;IAED,cAAc;IACd,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QACnF,IAAI,aAAa,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CAAC;gBACd,OAAO,EAAE,QAAQ;gBACjB,KAAK,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE;gBAC7B,MAAM,EAAE,GAAG,aAAa,EAAE;gBAC1B,aAAa,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY;aACvD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,UAAU;IACV,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;QAClD,UAAU,CAAC,IAAI,CAAC;YACd,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,wBAAwB;YAChC,aAAa,EAAE,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED,aAAa;IACb,IAAI,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACpD,UAAU,CAAC,IAAI,CAAC;YACd,OAAO,EAAE,YAAY;YACrB,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,uBAAuB;YAC/B,aAAa,EAAE,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,+DAA+D;AAE/D;;;GAGG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC;AACtC,CAAC;AAED,+DAA+D;AAE/D,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAiB;IAC5D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC"}

package/dist/licensing/template-fetch.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Remote template fetch client — retrieves agent templates from the
+ * OPSX API instead of shipping them in the npm package.
+ *
+ * Flow:
+ *   1. CLI sends license key + agent name + version to API
+ *   2. API validates license, checks tier, returns encrypted template bundle
+ *   3. CLI decrypts bundle IN MEMORY (never writes .hbs to disk)
+ *   4. Returns template map for the rendering engine
+ *
+ * In dev mode (OPSX_DEV=1) or for free tier, falls back to local templates.
+ */
+import type { License } from '@nepopsx/core';
+export interface TemplateBundle {
+    /** Agent name (e.g., "feature-factory") */
+    agent: string;
+    /** Agent version */
+    version: string;
+    /** Map of relative path → template content */
+    templates: Record<string, string>;
+    /** Whether this came from remote or local fallback */
+    source: 'remote' | 'local';
+}
+/**
+ * Fetch agent templates from the remote OPSX API.
+ * Templates are encrypted and decrypted in memory.
+ *
+ * @returns TemplateBundle on success, null on failure (caller should use local fallback)
+ */
+export declare function fetchRemoteTemplates(rootDir: string, license: License, agentName: string, agentVersion: string): Promise<TemplateBundle | null>;
+//# sourceMappingURL=template-fetch.d.ts.map

package/dist/licensing/template-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-fetch.d.ts","sourceRoot":"","sources":["../../src/licensing/template-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAO7C,MAAM,WAAW,cAAc;IAC7B,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,sDAAsD;IACtD,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC;CAC5B;AAiBD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAoChC"}

package/dist/licensing/template-fetch.js

@@ -0,0 +1,92 @@
+/**
+ * Remote template fetch client — retrieves agent templates from the
+ * OPSX API instead of shipping them in the npm package.
+ *
+ * Flow:
+ *   1. CLI sends license key + agent name + version to API
+ *   2. API validates license, checks tier, returns encrypted template bundle
+ *   3. CLI decrypts bundle IN MEMORY (never writes .hbs to disk)
+ *   4. Returns template map for the rendering engine
+ *
+ * In dev mode (OPSX_DEV=1) or for free tier, falls back to local templates.
+ */
+import { createDecipheriv, createHash } from 'node:crypto';
+import { resolveApiBase } from '../config/api-config.js';
+const REQUEST_TIMEOUT_MS = 30_000;
+// ─── Public API ─────────────────────────────────────────────
+/**
+ * Fetch agent templates from the remote OPSX API.
+ * Templates are encrypted and decrypted in memory.
+ *
+ * @returns TemplateBundle on success, null on failure (caller should use local fallback)
+ */
+export async function fetchRemoteTemplates(rootDir, license, agentName, agentVersion) {
+    const apiBase = resolveApiBase(rootDir);
+    try {
+        const response = await fetchWithTimeout(`${apiBase}/templates/${agentName}/${agentVersion}`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Authorization': `Bearer ${license.key}`,
+            },
+            body: JSON.stringify({
+                machine_id: license.machine_id,
+                workspace: license.workspace,
+            }),
+        });
+        if (!response.ok) {
+            return null;
+        }
+        const encrypted = await response.json();
+        const templates = decryptBundle(encrypted, license.key);
+        return {
+            agent: agentName,
+            version: agentVersion,
+            templates,
+            source: 'remote',
+        };
+    }
+    catch {
+        // Network failure — caller should fall back to local templates
+        return null;
+    }
+}
+// ─── Decryption ─────────────────────────────────────────────
+/**
+ * Derive the AES-256 key from the license key.
+ * Key = SHA-256(license_key + "opsx-template-key")
+ */
+function deriveKey(licenseKey) {
+    return createHash('sha256')
+        .update(`${licenseKey}:opsx-template-key`)
+        .digest();
+}
+/**
+ * Decrypt an AES-256-GCM encrypted template bundle.
+ * Returns the template map (path → content).
+ */
+function decryptBundle(bundle, licenseKey) {
+    const key = deriveKey(licenseKey);
+    const iv = Buffer.from(bundle.iv, 'base64');
+    const tag = Buffer.from(bundle.tag, 'base64');
+    const encrypted = Buffer.from(bundle.payload, 'base64');
+    const decipher = createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(tag);
+    const decrypted = Buffer.concat([
+        decipher.update(encrypted),
+        decipher.final(),
+    ]);
+    return JSON.parse(decrypted.toString('utf-8'));
+}
+// ─── Utilities ──────────────────────────────────────────────
+async function fetchWithTimeout(url, init) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    try {
+        return await fetch(url, { ...init, signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+//# sourceMappingURL=template-fetch.js.map

package/dist/licensing/template-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-fetch.js","sourceRoot":"","sources":["../../src/licensing/template-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AA4BlC,+DAA+D;AAE/D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,OAAgB,EAChB,SAAiB,EACjB,YAAoB;IAEpB,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAExC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,OAAO,cAAc,SAAS,IAAI,YAAY,EAAE,EACnD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU,OAAO,CAAC,GAAG,EAAE;aACzC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC;SACH,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAqB,CAAC;QAC3D,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAExD,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,YAAY;YACrB,SAAS;YACT,MAAM,EAAE,QAAQ;SACjB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+DAA+D;AAE/D;;;GAGG;AACH,SAAS,SAAS,CAAC,UAAkB;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,GAAG,UAAU,oBAAoB,CAAC;SACzC,MAAM,EAAE,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,MAAuB,EAAE,UAAkB;IAChE,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAEzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;QAC1B,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,+DAA+D;AAE/D,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAiB;IAC5D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC"}

package/dist/security/agent-validator.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Agent package validator — validates structure and safety of
+ * agent packages before loading their templates.
+ */
+import { type ScanThreat } from './scanner.js';
+export interface AgentValidationResult {
+    valid: boolean;
+    errors: string[];
+    warnings: string[];
+    threats: ScanThreat[];
+}
+/**
+ * Validate an agent package directory for safety:
+ * 1. Check structural requirements
+ * 2. Ensure no override of protected partials
+ * 3. Scan templates for injection patterns
+ * 4. Check for unrestricted dangerous tool usage
+ */
+export declare function validateAgentPackage(agentDir: string, agentName: string): AgentValidationResult;
+//# sourceMappingURL=agent-validator.d.ts.map

package/dist/security/agent-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-validator.d.ts","sourceRoot":"","sources":["../../src/security/agent-validator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAEjE,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAYD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,qBAAqB,CAoD/F"}

package/dist/security/agent-validator.js

@@ -0,0 +1,67 @@
+/**
+ * Agent package validator — validates structure and safety of
+ * agent packages before loading their templates.
+ */
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { scanForInjection } from './scanner.js';
+// Partials exist per-agent-package (registered then cleared between packages).
+// No cross-contamination is possible in the current architecture.
+// Content scanning handles injection detection in partial files.
+// Tool patterns that require safety context in agent templates
+const DANGEROUS_TOOL_PATTERNS = [
+    /run_in_terminal.*mode.*async/is,
+    /run_in_terminal[^}]*(?!.*confirm)/is, // run_in_terminal without confirm mention nearby
+];
+/**
+ * Validate an agent package directory for safety:
+ * 1. Check structural requirements
+ * 2. Ensure no override of protected partials
+ * 3. Scan templates for injection patterns
+ * 4. Check for unrestricted dangerous tool usage
+ */
+export function validateAgentPackage(agentDir, agentName) {
+    const result = {
+        valid: true,
+        errors: [],
+        warnings: [],
+        threats: [],
+    };
+    // 1. Structural checks
+    const requiredDirs = ['agents'];
+    for (const dir of requiredDirs) {
+        if (!existsSync(join(agentDir, dir))) {
+            result.warnings.push(`Agent "${agentName}" is missing ${dir}/ directory.`);
+        }
+    }
+    // 2. Scan all template files for injection patterns
+    const templateDirs = ['agents', 'prompts', 'instructions', 'partials'];
+    for (const dir of templateDirs) {
+        const dirPath = join(agentDir, dir);
+        if (!existsSync(dirPath))
+            continue;
+        for (const file of readdirSync(dirPath)) {
+            if (!file.endsWith('.md') && !file.endsWith('.hbs'))
+                continue;
+            const content = readFileSync(join(dirPath, file), 'utf-8');
+            const fileSource = `agent:${agentName}/${dir}/${file}`;
+            const threats = scanForInjection(content, fileSource);
+            // Only flag critical threats as errors for agent packages
+            // (agent templates may legitimately mention security concepts)
+            const critical = threats.filter((t) => t.severity === 'critical');
+            if (critical.length > 0) {
+                result.threats.push(...critical);
+                result.errors.push(`Agent "${agentName}" template ${dir}/${file} contains ${critical.length} critical security pattern(s).`);
+                result.valid = false;
+            }
+            // Non-critical threats are warnings
+            const nonCritical = threats.filter((t) => t.severity !== 'critical');
+            if (nonCritical.length > 0) {
+                result.threats.push(...nonCritical);
+                result.warnings.push(`Agent "${agentName}" template ${dir}/${file} has ${nonCritical.length} security pattern(s) — review recommended.`);
+            }
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=agent-validator.js.map

package/dist/security/agent-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-validator.js","sourceRoot":"","sources":["../../src/security/agent-validator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAmB,MAAM,cAAc,CAAC;AASjE,+EAA+E;AAC/E,kEAAkE;AAClE,iEAAiE;AAEjE,+DAA+D;AAC/D,MAAM,uBAAuB,GAAG;IAC9B,gCAAgC;IAChC,qCAAqC,EAAE,iDAAiD;CACzF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,SAAiB;IACtE,MAAM,MAAM,GAA0B;QACpC,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,EAAE;KACZ,CAAC;IAEF,uBAAuB;IACvB,MAAM,YAAY,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,SAAS,gBAAgB,GAAG,cAAc,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;IACvE,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QAEnC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,SAAS;YAE9D,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAC3D,MAAM,UAAU,GAAG,SAAS,SAAS,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YAEvD,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACtD,0DAA0D;YAC1D,+DAA+D;YAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;YAClE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;gBACjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAChB,UAAU,SAAS,cAAc,GAAG,IAAI,IAAI,aAAa,QAAQ,CAAC,MAAM,gCAAgC,CACzG,CAAC;gBACF,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YACvB,CAAC;YAED,oCAAoC;YACpC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;YACrE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;gBACpC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,UAAU,SAAS,cAAc,GAAG,IAAI,IAAI,QAAQ,WAAW,CAAC,MAAM,4CAA4C,CACnH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/security/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Security barrel — re-export all security modules from a single entry point.
+ */
+export { scanForInjection, scanForSecrets, scanCustomInstructions, scanPhilosophyCustom, scanConfigForSecrets, formatThreats, type ScanThreat, type ScanResult, } from './scanner.js';
+export { validateAgentPackage, type AgentValidationResult, } from './agent-validator.js';
+export { generateManifest, verifyManifest, type ManifestEntry, type IntegrityResult, } from './integrity.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,KAAK,UAAU,EACf,KAAK,UAAU,GAChB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,oBAAoB,EACpB,KAAK,qBAAqB,GAC3B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,KAAK,aAAa,EAClB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC"}

package/dist/security/index.js

@@ -0,0 +1,7 @@
+/**
+ * Security barrel — re-export all security modules from a single entry point.
+ */
+export { scanForInjection, scanForSecrets, scanCustomInstructions, scanPhilosophyCustom, scanConfigForSecrets, formatThreats, } from './scanner.js';
+export { validateAgentPackage, } from './agent-validator.js';
+export { generateManifest, verifyManifest, } from './integrity.js';
+//# sourceMappingURL=index.js.map

package/dist/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,GAGd,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,oBAAoB,GAErB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,gBAAgB,EAChB,cAAc,GAGf,MAAM,gBAAgB,CAAC"}