@nepopsx/cli 0.0.23 → 0.0.25

package/dist/index.js

@@ -1,21 +1,26 @@
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
 import { Command } from 'commander';
 import { initCommand } from './commands/init.js';
 import { upCommand } from './commands/up.js';
 import { syncCommand } from './commands/sync.js';
 import { doctorCommand } from './commands/doctor.js';
 import { installCommand } from './commands/install.js';
-import { activateCommand } from './commands/activate.js';
 import { decodeCommand } from './commands/decode.js';
 import { loginCommand } from './commands/login.js';
 import { scanCommand } from './commands/scan.js';
 import { pushLearningsCommand } from './commands/push-learnings.js';
 import { captureCommand } from './commands/capture.js';
+import { importCommand } from './commands/import.js';
+import { importAgentsCommand } from './commands/import-agents.js';
+import { guardCommand } from './commands/guard.js';
 import { serverClearCommand, serverSetCommand, serverShowCommand, } from './commands/server.js';
+const pkg = JSON.parse(readFileSync(fileURLToPath(new URL('../package.json', import.meta.url)), 'utf8'));
 const program = new Command();
 program
     .name('nepopsx')
     .description('NEPOPSX — AI Agent Platform for Engineering Teams')
-    .version('0.0.19');
+    .version(pkg.version);
 program
     .command('up')
     .description('Guided onboarding: scaffold + resolve the entitled agent + tailor it via your own Copilot/Claude (no API keys) + render. Resumable — safe to re-run.')
@@ -57,11 +62,6 @@ program
     .description('Validate workspace.yaml and check workspace health')
     .option('-c, --config <path>', 'Path to workspace.yaml', '.nepopsx/workspace.yaml')
     .action(doctorCommand);
-program
-    .command('activate <key>')
-    .description('Activate an NEPOPSX license key for this machine')
-    .option('-c, --config <path>', 'Path to workspace.yaml', '.nepopsx/workspace.yaml')
-    .action(activateCommand);
 program
     .command('decode <file>')
     .description('Forensic decode — extract fingerprint from a generated file')
@@ -105,6 +105,27 @@ program
     .option('--workspace <slug>', 'Workspace slug')
     .option('--agent <name>', 'Only capture learnings for a specific agent')
     .action(captureCommand);
+program
+    .command('import')
+    .description('Ingest existing agent-memory files (GitHub Copilot instructions, Claude project memory) as pending learnings')
+    .option('-c, --config <path>', 'Path to workspace.yaml', '.nepopsx/workspace.yaml')
+    .option('--workspace <slug>', 'Workspace slug (auto-detected if omitted)')
+    .option('--source <source>', 'Which source to import: copilot | claude-memory | all', 'all')
+    .option('--agent <name>', 'Attribute imports to this agent (default: the source adapter id)')
+    .option('--dry-run', 'Preview candidates without sending anything')
+    .option('--force', 'Re-import files already recorded under .nepopsx/imported/')
+    .action(importCommand);
+program
+    .command('import-agents')
+    .description('Comprehend existing custom agents (.claude/agents, .github/agents) into governed PENDING bundles')
+    .option('-c, --config <path>', 'Path to workspace.yaml', '.nepopsx/workspace.yaml')
+    .option('--workspace <slug>', 'Workspace slug (auto-detected if omitted)')
+    .option('--dry-run', 'Preview comprehended bundles + redaction + batch plan without sending')
+    .action(importAgentsCommand);
+program
+    .command('guard')
+    .description('PreToolUse policy hook — blocks dangerous tool calls from .nepopsx/policy.json + built-in rules (reads the hook payload on stdin)')
+    .action(guardCommand);
 program
     .command('scan')
     .description('LLM-powered analysis — enrich workspace.yaml and installed agent configs')

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,mDAAmD,CAAC;KAChE,OAAO,CAAC,QAAQ,CAAC,CAAC;AAErB,OAAO;KACJ,OAAO,CAAC,IAAI,CAAC;KACb,WAAW,CAAC,sJAAsJ,CAAC;KACnK,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC;KAClF,MAAM,CAAC,gBAAgB,EAAE,mDAAmD,CAAC;KAC7E,MAAM,CAAC,4BAA4B,EAAE,sEAAsE,CAAC;KAC5G,MAAM,CAAC,UAAU,EAAE,2EAA2E,CAAC;KAC/F,MAAM,CAAC,WAAW,EAAE,kFAAkF,CAAC;KACvG,MAAM,CAAC,SAAS,CAAC,CAAC;AAErB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,wDAAwD,CAAC;KACrE,MAAM,CAAC,mBAAmB,EAAE,0CAA0C,CAAC;KACvE,MAAM,CAAC,WAAW,CAAC,CAAC;AAEvB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,6EAA6E,CAAC;KAC1F,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC;KAClF,MAAM,CAAC,UAAU,EAAE,+DAA+D,CAAC;KACnF,MAAM,CAAC,oBAAoB,EAAE,8CAA8C,CAAC;KAC5E,MAAM,CAAC,WAAW,EAAE,iCAAiC,CAAC;KACtD,MAAM,CAAC,WAAW,EAAE,qDAAqD,CAAC;KAC1E,MAAM,CAAC,mBAAmB,EAAE,uDAAuD,CAAC;KACpF,MAAM,CAAC,OAAO,EAAE,iEAAiE,CAAC;KAClF,MAAM,CAAC,SAAS,EAAE,2EAA2E,CAAC;KAC9F,MAAM,CAAC,WAAW,CAAC,CAAC;AAEvB,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,gEAAgE,CAAC;KAC7E,MAAM,CAAC,iBAAiB,EAAE,6BAA6B,CAAC;KACxD,MAAM,CAAC,SAAS,EAAE,gEAAgE,CAAC;KACnF,MAAM,CAAC,gBAAgB,EAAE,6DAA6D,CAAC;KACvF,MAAM,CAAC,WAAW,EAAE,qDAAqD,CAAC;KAC1E,MAAM,CAAC,UAAU,EAAE,uEAAuE,CAAC;KAC3F,MAAM,CAAC,4BAA4B,EAAE,+EAA+E,CAAC;KACrH,MAAM,CAAC,cAAc,CAAC,CAAC;AAE1B,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,oDAAoD,CAAC;KACjE,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC;KAClF,MAAM,CAAC,aAAa,CAAC,CAAC;AAEzB,OAAO;KACJ,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CAAC,kDAAkD,CAAC;KAC/D,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC;KAClF,MAAM,CAAC,eAAe,CAAC,CAAC;AAE3B,OAAO;KACJ,OAAO,CAAC,eAAe,CAAC;KACxB,WAAW,CAAC,6DAA6D,CAAC;KAC1E,MAAM,CAAC,aAAa,CAAC,CAAC;AAEzB,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,oGAAoG,CAAC;KACjH,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC;KAClF,MAAM,CAAC,cAAc,EAAE,wDAAwD,CAAC;KAChF,MAAM,CAAC,YAAY,CAAC,CAAC;AAExB,MAAM,aAAa,GAAG,OAAO;KAC1B,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,0DAA0D,CAAC,CAAC;AAE3E,aAAa;KACV,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,+CAA+C,CAAC;KAC5D,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAE7B,aAAa;KACV,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,+DAA+D,CAAC;KAC5E,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAE5B,aAAa;KACV,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,0DAA0D,CAAC;KACvE,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAE9B,SAAS,iBAAiB,CAAC,KAAa,EAAE,QAAkB;IAC1D,OAAO,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,OAAO;KACJ,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CAAC,sEAAsE,CAAC;KACnF,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC;KAClF,MAAM,CAAC,oBAAoB,EAAE,gBAAgB,CAAC;KAC9C,MAAM,CAAC,gBAAgB,EAAE,0CAA0C,CAAC;KACpE,MAAM,CAAC,WAAW,EAAE,oBAAoB,CAAC;KACzC,MAAM,CAAC,oBAAoB,CAAC,CAAC;AAEhC,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,gHAAgH,CAAC;KAC7H,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC;KAClF,MAAM,CAAC,oBAAoB,EAAE,gBAAgB,CAAC;KAC9C,MAAM,CAAC,gBAAgB,EAAE,6CAA6C,CAAC;KACvE,MAAM,CAAC,cAAc,CAAC,CAAC;AAE1B,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,0EAA0E,CAAC;KACvF,MAAM,CAAC,WAAW,EAAE,wBAAwB,CAAC;KAC7C,MAAM,CAAC,mBAAmB,EAAE,sDAAsD,CAAC;KACnF,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;KAC1C,MAAM,CAAC,kBAAkB,EAAE,4DAA4D,CAAC;KACxF,MAAM,CAAC,mBAAmB,EAAE,0BAA0B,EAAE,OAAO,CAAC;KAChE,MAAM,CAAC,yBAAyB,EAAE,qCAAqC,EAAE,OAAO,CAAC;KACjF,MAAM,CAAC,gBAAgB,EAAE,6BAA6B,EAAE,GAAG,CAAC;KAC5D,MAAM,CAAC,WAAW,EAAE,yCAAyC,CAAC;KAC9D,MAAM,CAAC,WAAW,EAAE,wCAAwC,CAAC;KAC7D,MAAM,CAAC,eAAe,EAAE,oCAAoC,CAAC;KAC7D,MAAM,CAAC,kBAAkB,EAAE,+BAA+B,EAAE,iBAAiB,EAAE,EAAE,CAAC;KAClF,MAAM,CAAC,SAAS,EAAE,2DAA2D,CAAC;KAC9E,MAAM,CAAC,gBAAgB,EAAE,qDAAqD,CAAC;KAC/E,MAAM,CAAC,UAAU,EAAE,mEAAmE,CAAC;KACvF,MAAM,CAAC,WAAW,CAAC,CAAC;AAEvB,OAAO,CAAC,KAAK,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAC1D,CAAC;AAEzB,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,mDAAmD,CAAC;KAChE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,IAAI,CAAC;KACb,WAAW,CAAC,sJAAsJ,CAAC;KACnK,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC;KAClF,MAAM,CAAC,gBAAgB,EAAE,mDAAmD,CAAC;KAC7E,MAAM,CAAC,4BAA4B,EAAE,sEAAsE,CAAC;KAC5G,MAAM,CAAC,UAAU,EAAE,2EAA2E,CAAC;KAC/F,MAAM,CAAC,WAAW,EAAE,kFAAkF,CAAC;KACvG,MAAM,CAAC,SAAS,CAAC,CAAC;AAErB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,wDAAwD,CAAC;KACrE,MAAM,CAAC,mBAAmB,EAAE,0CAA0C,CAAC;KACvE,MAAM,CAAC,WAAW,CAAC,CAAC;AAEvB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,6EAA6E,CAAC;KAC1F,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC;KAClF,MAAM,CAAC,UAAU,EAAE,+DAA+D,CAAC;KACnF,MAAM,CAAC,oBAAoB,EAAE,8CAA8C,CAAC;KAC5E,MAAM,CAAC,WAAW,EAAE,iCAAiC,CAAC;KACtD,MAAM,CAAC,WAAW,EAAE,qDAAqD,CAAC;KAC1E,MAAM,CAAC,mBAAmB,EAAE,uDAAuD,CAAC;KACpF,MAAM,CAAC,OAAO,EAAE,iEAAiE,CAAC;KAClF,MAAM,CAAC,SAAS,EAAE,2EAA2E,CAAC;KAC9F,MAAM,CAAC,WAAW,CAAC,CAAC;AAEvB,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,gEAAgE,CAAC;KAC7E,MAAM,CAAC,iBAAiB,EAAE,6BAA6B,CAAC;KACxD,MAAM,CAAC,SAAS,EAAE,gEAAgE,CAAC;KACnF,MAAM,CAAC,gBAAgB,EAAE,6DAA6D,CAAC;KACvF,MAAM,CAAC,WAAW,EAAE,qDAAqD,CAAC;KAC1E,MAAM,CAAC,UAAU,EAAE,uEAAuE,CAAC;KAC3F,MAAM,CAAC,4BAA4B,EAAE,+EAA+E,CAAC;KACrH,MAAM,CAAC,cAAc,CAAC,CAAC;AAE1B,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,oDAAoD,CAAC;KACjE,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC;KAClF,MAAM,CAAC,aAAa,CAAC,CAAC;AAEzB,OAAO;KACJ,OAAO,CAAC,eAAe,CAAC;KACxB,WAAW,CAAC,6DAA6D,CAAC;KAC1E,MAAM,CAAC,aAAa,CAAC,CAAC;AAEzB,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,oGAAoG,CAAC;KACjH,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC;KAClF,MAAM,CAAC,cAAc,EAAE,wDAAwD,CAAC;KAChF,MAAM,CAAC,YAAY,CAAC,CAAC;AAExB,MAAM,aAAa,GAAG,OAAO;KAC1B,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,0DAA0D,CAAC,CAAC;AAE3E,aAAa;KACV,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,+CAA+C,CAAC;KAC5D,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAE7B,aAAa;KACV,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,+DAA+D,CAAC;KAC5E,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAE5B,aAAa;KACV,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,0DAA0D,CAAC;KACvE,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAE9B,SAAS,iBAAiB,CAAC,KAAa,EAAE,QAAkB;IAC1D,OAAO,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,OAAO;KACJ,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CAAC,sEAAsE,CAAC;KACnF,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC;KAClF,MAAM,CAAC,oBAAoB,EAAE,gBAAgB,CAAC;KAC9C,MAAM,CAAC,gBAAgB,EAAE,0CAA0C,CAAC;KACpE,MAAM,CAAC,WAAW,EAAE,oBAAoB,CAAC;KACzC,MAAM,CAAC,oBAAoB,CAAC,CAAC;AAEhC,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,gHAAgH,CAAC;KAC7H,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC;KAClF,MAAM,CAAC,oBAAoB,EAAE,gBAAgB,CAAC;KAC9C,MAAM,CAAC,gBAAgB,EAAE,6CAA6C,CAAC;KACvE,MAAM,CAAC,cAAc,CAAC,CAAC;AAE1B,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,8GAA8G,CAAC;KAC3H,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC;KAClF,MAAM,CAAC,oBAAoB,EAAE,2CAA2C,CAAC;KACzE,MAAM,CAAC,mBAAmB,EAAE,uDAAuD,EAAE,KAAK,CAAC;KAC3F,MAAM,CAAC,gBAAgB,EAAE,kEAAkE,CAAC;KAC5F,MAAM,CAAC,WAAW,EAAE,6CAA6C,CAAC;KAClE,MAAM,CAAC,SAAS,EAAE,2DAA2D,CAAC;KAC9E,MAAM,CAAC,aAAa,CAAC,CAAC;AAEzB,OAAO;KACJ,OAAO,CAAC,eAAe,CAAC;KACxB,WAAW,CAAC,kGAAkG,CAAC;KAC/G,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC;KAClF,MAAM,CAAC,oBAAoB,EAAE,2CAA2C,CAAC;KACzE,MAAM,CAAC,WAAW,EAAE,uEAAuE,CAAC;KAC5F,MAAM,CAAC,mBAAmB,CAAC,CAAC;AAE/B,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,mIAAmI,CAAC;KAChJ,MAAM,CAAC,YAAY,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,0EAA0E,CAAC;KACvF,MAAM,CAAC,WAAW,EAAE,wBAAwB,CAAC;KAC7C,MAAM,CAAC,mBAAmB,EAAE,sDAAsD,CAAC;KACnF,MAAM,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;KAC1C,MAAM,CAAC,kBAAkB,EAAE,4DAA4D,CAAC;KACxF,MAAM,CAAC,mBAAmB,EAAE,0BAA0B,EAAE,OAAO,CAAC;KAChE,MAAM,CAAC,yBAAyB,EAAE,qCAAqC,EAAE,OAAO,CAAC;KACjF,MAAM,CAAC,gBAAgB,EAAE,6BAA6B,EAAE,GAAG,CAAC;KAC5D,MAAM,CAAC,WAAW,EAAE,yCAAyC,CAAC;KAC9D,MAAM,CAAC,WAAW,EAAE,wCAAwC,CAAC;KAC7D,MAAM,CAAC,eAAe,EAAE,oCAAoC,CAAC;KAC7D,MAAM,CAAC,kBAAkB,EAAE,+BAA+B,EAAE,iBAAiB,EAAE,EAAE,CAAC;KAClF,MAAM,CAAC,SAAS,EAAE,2DAA2D,CAAC;KAC9E,MAAM,CAAC,gBAAgB,EAAE,qDAAqD,CAAC;KAC/E,MAAM,CAAC,UAAU,EAAE,mEAAmE,CAAC;KACvF,MAAM,CAAC,WAAW,CAAC,CAAC;AAEvB,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/dist/learnings/memory-index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `.nepopsx/MEMORY.md` — a generated, git-committed, human-scannable index of the
+ * local learning store, modeled on `~/.claude/MEMORY.md`.
+ *
+ * One line per learning (title → status → one-line hook → link), so the store is
+ * reviewable in a PR diff. Regenerated by `nepopsx import` and `nepopsx sync`. It
+ * scans both the hand-authored `learnings/` dir and the imported provenance dir.
+ */
+/**
+ * Regenerate `<rootDir>/.nepopsx/MEMORY.md`. Returns the count of indexed learnings
+ * and the index path. Best-effort: never throws.
+ */
+export declare function regenerateMemoryIndex(rootDir: string): {
+    count: number;
+    path: string;
+};
+//# sourceMappingURL=memory-index.d.ts.map

package/dist/learnings/memory-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-index.d.ts","sourceRoot":"","sources":["../../src/learnings/memory-index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAsBH;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CA4CtF"}

package/dist/learnings/memory-index.js

@@ -0,0 +1,73 @@
+/**
+ * `.nepopsx/MEMORY.md` — a generated, git-committed, human-scannable index of the
+ * local learning store, modeled on `~/.claude/MEMORY.md`.
+ *
+ * One line per learning (title → status → one-line hook → link), so the store is
+ * reviewable in a PR diff. Regenerated by `nepopsx import` and `nepopsx sync`. It
+ * scans both the hand-authored `learnings/` dir and the imported provenance dir.
+ */
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { relative, resolve } from 'node:path';
+import { loadLearningFiles } from './yaml-learnings.js';
+const NEPOPSX_DIR = '.nepopsx';
+/** First non-empty content line, trimmed to a short hook for the index. */
+function hook(content) {
+    const line = content
+        .split(/\r?\n/)
+        .map((l) => l.replace(/^[#>*\-\s]+/, '').trim())
+        .find((l) => l.length > 0);
+    if (!line)
+        return '';
+    return line.length > 100 ? `${line.slice(0, 97)}…` : line;
+}
+function titleFromSlug(slug) {
+    return slug.replace(/-/g, ' ').replace(/\b\w/g, (c) => c.toUpperCase());
+}
+/**
+ * Regenerate `<rootDir>/.nepopsx/MEMORY.md`. Returns the count of indexed learnings
+ * and the index path. Best-effort: never throws.
+ */
+export function regenerateMemoryIndex(rootDir) {
+    const base = resolve(rootDir, NEPOPSX_DIR);
+    const indexPath = resolve(base, 'MEMORY.md');
+    const files = [
+        ...loadLearningFiles(resolve(base, 'learnings')),
+        ...loadLearningFiles(resolve(base, 'imported')),
+    ];
+    // De-dupe by slug (a learning may exist both locally and as an import record);
+    // keep the first seen (learnings/ is scanned first).
+    const bySlug = new Map();
+    for (const f of files) {
+        if (!bySlug.has(f.learning.slug))
+            bySlug.set(f.learning.slug, f);
+    }
+    const entries = [...bySlug.values()].sort((a, b) => a.learning.slug.localeCompare(b.learning.slug));
+    const lines = [
+        '# NEPOPSX Memory Index',
+        '',
+        '<!-- Generated by `nepopsx import` / `nepopsx sync`. Do not edit by hand. -->',
+        '',
+    ];
+    if (entries.length === 0) {
+        lines.push('_No local learnings yet. Run `nepopsx import` or let the reflector capture some._', '');
+    }
+    else {
+        for (const { learning, filePath } of entries) {
+            const rel = relative(base, filePath);
+            const h = hook(learning.content);
+            const tags = [learning.status, learning.type].filter(Boolean).join(' · ');
+            lines.push(`- [${titleFromSlug(learning.slug)}](${rel}) — ${tags}${h ? ` — ${h}` : ''}`);
+        }
+        lines.push('');
+    }
+    try {
+        if (!existsSync(base))
+            mkdirSync(base, { recursive: true });
+        writeFileSync(indexPath, lines.join('\n'), 'utf-8');
+    }
+    catch {
+        /* best-effort */
+    }
+    return { count: entries.length, path: indexPath };
+}
+//# sourceMappingURL=memory-index.js.map

package/dist/learnings/memory-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-index.js","sourceRoot":"","sources":["../../src/learnings/memory-index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,GAAG,UAAU,CAAC;AAE/B,2EAA2E;AAC3E,SAAS,IAAI,CAAC,OAAe;IAC3B,MAAM,IAAI,GAAG,OAAO;SACjB,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SAC/C,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAE7C,MAAM,KAAK,GAAG;QACZ,GAAG,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAChD,GAAG,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;KAChD,CAAC;IAEF,+EAA+E;IAC/E,qDAAqD;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAEpG,MAAM,KAAK,GAAa;QACtB,wBAAwB;QACxB,EAAE;QACF,+EAA+E;QAC/E,EAAE;KACH,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,mFAAmF,EAAE,EAAE,CAAC,CAAC;IACtG,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,OAAO,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACrC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1E,KAAK,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAG,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACpD,CAAC"}

package/dist/licensing/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * Licensing barrel — re-export all licensing modules.
  */
-export { readLicense, writeLicense, reconcileLicenseWorkspace, activateLicense, validateLicense, resolveEntitlement, enforceTierLimits, isDevMode, type ActivationResult, type RefreshResult, type TierViolation, } from './license-manager.js';
+export { readLicense, writeLicense, reconcileLicenseWorkspace, validateLicense, resolveEntitlement, enforceTierLimits, isDevMode, type TierViolation, } from './license-manager.js';
 export { getCachedEntitlement, setCachedEntitlement, clearCachedEntitlement, serverEnforces, } from './entitlement-cache.js';
 export { fetchRemoteTemplates, type TemplateBundle, } from './template-fetch.js';
 export { applySteganography, decodeSteganography, forensicDecode, fingerprintToId, } from './fingerprint.js';

package/dist/licensing/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/licensing/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,YAAY,EACZ,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/licensing/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,YAAY,EACZ,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,SAAS,EACT,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC"}

package/dist/licensing/index.js

@@ -1,7 +1,7 @@
 /**
  * Licensing barrel — re-export all licensing modules.
  */
-export { readLicense, writeLicense, reconcileLicenseWorkspace, activateLicense, validateLicense, resolveEntitlement, enforceTierLimits, isDevMode, } from './license-manager.js';
+export { readLicense, writeLicense, reconcileLicenseWorkspace, validateLicense, resolveEntitlement, enforceTierLimits, isDevMode, } from './license-manager.js';
 export { getCachedEntitlement, setCachedEntitlement, clearCachedEntitlement, serverEnforces, } from './entitlement-cache.js';
 export { fetchRemoteTemplates, } from './template-fetch.js';
 export { applySteganography, decodeSteganography, forensicDecode, fingerprintToId, } from './fingerprint.js';

package/dist/licensing/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/licensing/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,YAAY,EACZ,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,SAAS,GAIV,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,oBAAoB,GAErB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/licensing/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,YAAY,EACZ,yBAAyB,EACzB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,SAAS,GAEV,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,oBAAoB,GAErB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC"}

package/dist/licensing/installer.d.ts

@@ -1,10 +1,10 @@
 /**
- * Agent bundle installer — downloads, decrypts, verifies, and writes
+ * Agent bundle installer — downloads, decodes, verifies, and writes
  * agent template files from the NEPOPSX API.
  *
  * Flow:
- *   1. downloadBundle  — POST /v1/templates/:agent/:version  (auth: Bearer <key>)
- *   2. decryptBundle   — AES-256-GCM, key = SHA-256(licenseKey + ":nepopsx-template-key")
+ *   1. downloadBundle  — POST /v1/templates/:agent/:version  (auth: Bearer <device token>)
+ *   2. decryptBundle   — base64-decode the plaintext payload (served over TLS)
  *   3. verifyBundleSha — SHA-256 of raw JSON must match server-provided sha256
  *   4. writeAgentFiles — atomic write via temp + rename into .github/<relative-path>
  */
@@ -12,8 +12,6 @@ import type { License, OutputProvider } from "@nepopsx/core";
 import type { CustomInstruction } from "../generator/render.js";
 export interface EncryptedBundle {
     payload: string;
-    iv: string;
-    tag: string;
     agent: string;
     version: string;
     sha256: string;
@@ -33,10 +31,11 @@ export interface AgentBootstrapConfig {
 export declare function downloadBundle(cwd: string, license: License, agent: string, version: string, customInstructions?: CustomInstruction[], providers?: OutputProvider[]): Promise<EncryptedBundle>;
 export declare function downloadBootstrapConfig(cwd: string, license: License, agent: string, version: string, customInstructions?: CustomInstruction[]): Promise<AgentBootstrapConfig>;
 /**
- * Decrypt an AES-256-GCM bundle using the license key.
- * Returns the raw JSON string (not yet parsed).
+ * Decode a bundle payload. The backend now serves plaintext base64 over TLS to an
+ * authenticated request (no at-rest encryption). Returns the raw JSON string. The
+ * second arg is accepted-and-ignored for call-site compatibility.
  */
-export declare function decryptBundle(bundle: EncryptedBundle, licenseKey: string): string;
+export declare function decryptBundle(bundle: EncryptedBundle, _credential?: string): string;
 /**
  * Verify that the decrypted JSON matches the server's sha256.
  * Throws if the digest does not match.

package/dist/licensing/installer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../../src/licensing/installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAIhE,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAID;;GAEG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,kBAAkB,GAAE,iBAAiB,EAAO,EAC5C,SAAS,GAAE,cAAc,EAAO,GAC/B,OAAO,CAAC,eAAe,CAAC,CA2B1B;AAED,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,kBAAkB,GAAE,iBAAiB,EAAO,GAC3C,OAAO,CAAC,oBAAoB,CAAC,CA6B/B;AAID;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAcjF;AAID;;;GAGG;AACH,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAOhF;AAID;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,aAAa,EAAE,CAmBjB"}
+{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../../src/licensing/installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAIhE,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAID;;GAEG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,kBAAkB,GAAE,iBAAiB,EAAO,EAC5C,SAAS,GAAE,cAAc,EAAO,GAC/B,OAAO,CAAC,eAAe,CAAC,CA2B1B;AAED,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,kBAAkB,GAAE,iBAAiB,EAAO,GAC3C,OAAO,CAAC,oBAAoB,CAAC,CA6B/B;AAID;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnF;AAID;;;GAGG;AACH,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAOhF;AAID;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,aAAa,EAAE,CAmBjB"}

package/dist/licensing/installer.js

@@ -1,14 +1,14 @@
 /**
- * Agent bundle installer — downloads, decrypts, verifies, and writes
+ * Agent bundle installer — downloads, decodes, verifies, and writes
  * agent template files from the NEPOPSX API.
  *
  * Flow:
- *   1. downloadBundle  — POST /v1/templates/:agent/:version  (auth: Bearer <key>)
- *   2. decryptBundle   — AES-256-GCM, key = SHA-256(licenseKey + ":nepopsx-template-key")
+ *   1. downloadBundle  — POST /v1/templates/:agent/:version  (auth: Bearer <device token>)
+ *   2. decryptBundle   — base64-decode the plaintext payload (served over TLS)
  *   3. verifyBundleSha — SHA-256 of raw JSON must match server-provided sha256
  *   4. writeAgentFiles — atomic write via temp + rename into .github/<relative-path>
  */
-import { createDecipheriv, createHash } from "node:crypto";
+import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { resolveApiBase } from "../config/api-config.js";
@@ -65,20 +65,12 @@ export async function downloadBootstrapConfig(cwd, license, agent, version, cust
 }
 // ─── Decrypt ────────────────────────────────────────────────
 /**
- * Decrypt an AES-256-GCM bundle using the license key.
- * Returns the raw JSON string (not yet parsed).
+ * Decode a bundle payload. The backend now serves plaintext base64 over TLS to an
+ * authenticated request (no at-rest encryption). Returns the raw JSON string. The
+ * second arg is accepted-and-ignored for call-site compatibility.
  */
-export function decryptBundle(bundle, licenseKey) {
-    const key = createHash("sha256")
-        .update(`${licenseKey}:nepopsx-template-key`)
-        .digest();
-    const iv = Buffer.from(bundle.iv, "base64");
-    const tag = Buffer.from(bundle.tag, "base64");
-    const encrypted = Buffer.from(bundle.payload, "base64");
-    const decipher = createDecipheriv("aes-256-gcm", key, iv);
-    decipher.setAuthTag(tag);
-    const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
-    return decrypted.toString("utf-8");
+export function decryptBundle(bundle, _credential) {
+    return Buffer.from(bundle.payload, "base64").toString("utf-8");
 }
 // ─── Verify ─────────────────────────────────────────────────
 /**

package/dist/licensing/installer.js.map

@@ -1 +1 @@
-{"version":3,"file":"installer.js","sourceRoot":"","sources":["../../src/licensing/installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAyB3D,+DAA+D;AAE/D;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,OAAgB,EAChB,KAAa,EACb,OAAe,EACf,qBAA0C,EAAE,EAC5C,YAA8B,EAAE;IAEhC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,GAAG,OAAO,cAAc,kBAAkB,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/F,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;QAC3C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,OAAO,CAAC,GAAG,EAAE;YACtC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC;YAC7C,mBAAmB,EAAE,kBAAkB;YACvC,0DAA0D;YAC1D,SAAS;SACV,CAAC;KACH,EAAE,mBAAmB,CAAC,CAAC;IAExB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,2BAA2B,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CAC9E,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAA8B,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAW,EACX,OAAgB,EAChB,KAAa,EACb,OAAe,EACf,qBAA0C,EAAE;IAE5C,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,GAAG,OAAO,cAAc,kBAAkB,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAEhH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,OAAO,CAAC,GAAG,EAAE;YACtC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC;YAC7C,mBAAmB,EAAE,kBAAkB;SACxC,CAAC;KACH,EACD,mBAAmB,CACpB,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,qCAAqC,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CACxF,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAAmC,CAAC;AAC1D,CAAC;AAED,+DAA+D;AAE/D;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAuB,EAAE,UAAkB;IACvE,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC7B,MAAM,CAAC,GAAG,UAAU,uBAAuB,CAAC;SAC5C,MAAM,EAAE,CAAC;IAEZ,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAExD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAEzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAChF,OAAO,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,+DAA+D;AAE/D;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,aAAqB,EAAE,WAAmB;IACxE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjF,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,gEAAgE,WAAW,iBAAiB,MAAM,EAAE,CACrG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+DAA+D;AAE/D;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,SAAiC;IAEjC,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;QAE1B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QAED,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACrC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAEtB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"installer.js","sourceRoot":"","sources":["../../src/licensing/installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAuB3D,+DAA+D;AAE/D;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,OAAgB,EAChB,KAAa,EACb,OAAe,EACf,qBAA0C,EAAE,EAC5C,YAA8B,EAAE;IAEhC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,GAAG,OAAO,cAAc,kBAAkB,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/F,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;QAC3C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,OAAO,CAAC,GAAG,EAAE;YACtC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC;YAC7C,mBAAmB,EAAE,kBAAkB;YACvC,0DAA0D;YAC1D,SAAS;SACV,CAAC;KACH,EAAE,mBAAmB,CAAC,CAAC;IAExB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,2BAA2B,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CAC9E,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAA8B,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAW,EACX,OAAgB,EAChB,KAAa,EACb,OAAe,EACf,qBAA0C,EAAE;IAE5C,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,GAAG,OAAO,cAAc,kBAAkB,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAEhH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,GAAG,EACH;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,OAAO,CAAC,GAAG,EAAE;YACtC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC;YAC7C,mBAAmB,EAAE,kBAAkB;SACxC,CAAC;KACH,EACD,mBAAmB,CACpB,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,qCAAqC,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CACxF,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAAmC,CAAC;AAC1D,CAAC;AAED,+DAA+D;AAE/D;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAAuB,EAAE,WAAoB;IACzE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,+DAA+D;AAE/D;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,aAAqB,EAAE,WAAmB;IACxE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjF,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,gEAAgE,WAAW,iBAAiB,MAAM,EAAE,CACrG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+DAA+D;AAE/D;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,SAAiC;IAEjC,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;QAE1B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QAED,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACrC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAEtB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/licensing/license-manager.d.ts

@@ -1,53 +1,33 @@
 /**
- * License manager — handles license activation, validation,
- * online refresh, and tier-based feature gating.
+ * Auth/session helpers. Post-migration the CLI has ONE credential: the opaque
+ * device token from `nepopsx login`, stored in the GLOBAL `~/.nepopsx/config.json`
+ * (never in the repo — see {@link readAuth}). The `License` shape is kept as a thin
+ * compatibility view — `.key` IS the device token — so existing commands send the
+ * right Bearer credential unchanged. Auth and entitlement are server-authoritative
+ * now (the backend 401/402s); there is no license.json, no machine binding, and no
+ * online validate/refresh.
  */
 import { type License, type LicenseStatus, type LicenseTier, type WorkspaceConfig, type Entitlement } from '@nepopsx/core';
 /**
- * Read the local license file. Returns null if not found or invalid.
+ * Build a `License`-shaped view from the stored device token. `.key` IS the opaque
+ * `opsx_dvc_…` token sent as a Bearer credential; `org`/`tier` come from the plan
+ * captured at login; `workspace` is the live local name. Returns null if not
+ * logged in. (No license.json — the device token in config.json is the credential.)
  */
 export declare function readLicense(rootDir: string): License | null;
+/** No-op: the workspace is sourced live from disk in `readLicense` now. */
+export declare function reconcileLicenseWorkspace<T extends License | null>(_rootDir: string, license: T): T;
+/** No-op kept for callers: there is no license.json to write any more. */
+export declare function writeLicense(_rootDir: string, _license: License): void;
 /**
- * Write license to disk. Creates .nepopsx/ if needed.
+ * Confirm a device token is present. Auth + entitlement are enforced by the
+ * backend (401/402) — this no longer calls the server.
  */
-export declare function writeLicense(rootDir: string, license: License): void;
+export declare function validateLicense(rootDir: string, _config: WorkspaceConfig): Promise<LicenseStatus>;
 /**
- * Heal the license's `workspace` field against the live `workspace.yaml`.
- *
- * The license is activated before `workspace.yaml` exists, so it is born with
- * `workspace: "unknown"`. Once the real config exists, reconcile the in-memory
- * license (and persist it) so every downstream `license.workspace` read — and
- * every backend call derived from it — uses the live workspace name instead of
- * the stale snapshot. Best-effort: returns the license unchanged when the config
- * is absent or already matches. Accepts/returns `null` for the no-license path.
- */
-export declare function reconcileLicenseWorkspace<T extends License | null>(rootDir: string, license: T): T;
-export interface ActivationResult {
-    success: boolean;
-    license?: License;
-    error?: string;
-}
-/**
- * Activate a license key for this machine + workspace.
- * Calls the remote API to validate the key and bind it.
- */
-export declare function activateLicense(rootDir: string, licenseKey: string, workspaceName: string): Promise<ActivationResult>;
-/**
- * Validate the current license. Attempts online refresh if expired.
- * Returns detailed status.
- */
-export declare function validateLicense(rootDir: string, config: WorkspaceConfig): Promise<LicenseStatus>;
-/** Result of a successful refresh: the updated license + the org's entitlement (if returned). */
-export interface RefreshResult {
-    license: License;
-    entitlement?: Entitlement;
-}
-/**
- * Resolve the org's entitlement for DISPLAY: cache → synthesized from the plan manifest +
- * the license's (denormalized) tier when offline or on an older backend. Never throws.
- *
- * This is advisory only — the backend's 402 responses are the single hard authority. Use it
- * to show the user their current plan/limits, not to allow/deny an operation locally.
+ * Resolve the org's entitlement for DISPLAY: cache → synthesized from the plan
+ * manifest + the session's plan. Advisory only — the backend's 402s are the hard
+ * authority. Never throws.
  */
 export declare function resolveEntitlement(rootDir: string, license: License): Promise<Entitlement>;
 export interface TierViolation {
@@ -57,17 +37,11 @@ export interface TierViolation {
     required_tier: LicenseTier;
 }
 /**
- * Check whether the workspace config exceeds the license tier's scale limits.
- *
- * **Advisory only (ADR 0001/0002):** the server is the enforcement authority. Callers should
- * surface violations as a *warning* + upgrade hint and proceed; they must not hard-block on
- * this result. Agent quality (customs, philosophy, prompts) is identical across all tiers —
- * the differentiators are scale (services / agent packages) and tooling access (LLM scan).
+ * Check whether the workspace config exceeds the tier's scale limits.
+ * **Advisory only** — the server is the enforcement authority (402). Surface as a
+ * warning + upgrade hint and proceed; never hard-block on this result.
  */
 export declare function enforceTierLimits(config: WorkspaceConfig, tier: LicenseTier): TierViolation[];
-/**
- * Check if the CLI is running in dev mode (for NEPOPSX agent developers).
- * Set NEPOPSX_DEV=1 to bypass license checks.
- */
+/** Set NEPOPSX_DEV=1 to bypass auth checks (for NEPOPSX agent developers). */
 export declare function isDevMode(): boolean;
 //# sourceMappingURL=license-manager.d.ts.map

package/dist/licensing/license-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"license-manager.d.ts","sourceRoot":"","sources":["../../src/licensing/license-manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EACL,KAAK,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,WAAW,EAAmB,KAAK,eAAe,EACzF,KAAK,WAAW,EAGjB,MAAM,eAAe,CAAC;AAavB;;GAEG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAiB3D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAUpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,OAAO,GAAG,IAAI,EAChE,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,GACT,CAAC,CAWH;AAID,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAoD3B;AAID;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,aAAa,CAAC,CA8IxB;AAID,iGAAiG;AACjG,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAmDD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAchG;AAID,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,WAAW,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,GAAG,aAAa,EAAE,CA4B7F;AAID;;;GAGG;AACH,wBAAgB,SAAS,IAAI,OAAO,CAEnC"}
+{"version":3,"file":"license-manager.d.ts","sourceRoot":"","sources":["../../src/licensing/license-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,WAAW,EAIjB,MAAM,eAAe,CAAC;AAQvB;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAe3D;AAED,2EAA2E;AAC3E,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,OAAO,GAAG,IAAI,EAChE,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,CAAC,GACT,CAAC,CAEH;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI,CAEtE;AAID;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,aAAa,CAAC,CA0BxB;AAID;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,WAAW,CAAC,CActB;AAID,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,WAAW,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,WAAW,GAChB,aAAa,EAAE,CA4BjB;AAID,8EAA8E;AAC9E,wBAAgB,SAAS,IAAI,OAAO,CAEnC"}