@ornexus/neocortex 3.8.0

package/packages/client/dist/cache/crypto-utils.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+/** On-disk envelope format. expiresAt is inside the encrypted data payload. */
+export interface EncryptedEnvelope {
+    /** Base64-encoded initialization vector (12 bytes) */
+    iv: string;
+    /** Base64-encoded PBKDF2 salt */
+    salt: string;
+    /** Base64-encoded GCM auth tag */
+    tag: string;
+    /** Base64-encoded encrypted data (contains plaintext + expiresAt) */
+    data: string;
+}
+export declare function deriveKey(passphrase: string, salt: Buffer): Buffer;
+export declare function encrypt(plaintext: string, passphrase: string, ttlMs?: number): string;
+export interface DecryptResult {
+    plaintext: string;
+    expired: boolean;
+}
+export declare function decrypt(envelopeJson: string, passphrase: string): DecryptResult;
+//# sourceMappingURL=crypto-utils.d.ts.map

package/packages/client/dist/cache/crypto-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-utils.d.ts","sourceRoot":"","sources":["../../src/cache/crypto-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA6BH,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,sDAAsD;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;CACd;AAUD,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAElE;AAID,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAqBrF;AAID,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,aAAa,CAyB/E"}

package/packages/client/dist/cache/crypto-utils.js

@@ -0,0 +1,77 @@
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+/**
+ * @neocortex/client - Crypto Utilities
+ *
+ * AES-256-GCM encryption/decryption with PBKDF2 key derivation.
+ * Used by EncryptedCache to protect cached assets at rest.
+ *
+ * Security design:
+ * - IV: 12 bytes (NIST SP 800-38D recommended for GCM)
+ * - Salt: 32 bytes random per entry
+ * - Key: PBKDF2 with 100k iterations, SHA-512
+ * - expiresAt is inside the encrypted payload (authenticated by GCM tag)
+ */
+import { randomBytes, pbkdf2Sync, createCipheriv, createDecipheriv } from 'node:crypto';
+// ── Constants ────────────────────────────────────────────────────────────
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12; // NIST SP 800-38D recommended for AES-GCM
+const SALT_LENGTH = 32;
+const KEY_LENGTH = 32;
+const AUTH_TAG_LENGTH = 16;
+const PBKDF2_ITERATIONS = 100_000;
+const PBKDF2_DIGEST = 'sha512';
+// ── Key Derivation ───────────────────────────────────────────────────────
+export function deriveKey(passphrase, salt) {
+    return pbkdf2Sync(passphrase, salt, PBKDF2_ITERATIONS, KEY_LENGTH, PBKDF2_DIGEST);
+}
+// ── Encrypt ──────────────────────────────────────────────────────────────
+export function encrypt(plaintext, passphrase, ttlMs) {
+    const iv = randomBytes(IV_LENGTH);
+    const salt = randomBytes(SALT_LENGTH);
+    const key = deriveKey(passphrase, salt);
+    const expiresAt = ttlMs != null ? Date.now() + ttlMs : null;
+    const payload = { plaintext, expiresAt };
+    const payloadJson = JSON.stringify(payload);
+    const cipher = createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
+    const encrypted = Buffer.concat([cipher.update(payloadJson, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    const envelope = {
+        iv: iv.toString('base64'),
+        salt: salt.toString('base64'),
+        tag: tag.toString('base64'),
+        data: encrypted.toString('base64'),
+    };
+    return JSON.stringify(envelope);
+}
+export function decrypt(envelopeJson, passphrase) {
+    const raw = JSON.parse(envelopeJson);
+    if (!raw.iv || !raw.salt || !raw.tag || !raw.data) {
+        throw new Error('Invalid cache envelope: missing required fields');
+    }
+    const iv = Buffer.from(raw.iv, 'base64');
+    const salt = Buffer.from(raw.salt, 'base64');
+    const tag = Buffer.from(raw.tag, 'base64');
+    const data = Buffer.from(raw.data, 'base64');
+    const key = deriveKey(passphrase, salt);
+    const decipher = createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
+    decipher.setAuthTag(tag);
+    const decrypted = Buffer.concat([decipher.update(data), decipher.final()]);
+    const payload = JSON.parse(decrypted.toString('utf8'));
+    const expired = payload.expiresAt != null && Date.now() > payload.expiresAt;
+    return {
+        plaintext: payload.plaintext,
+        expired,
+    };
+}
+//# sourceMappingURL=crypto-utils.js.map

package/packages/client/dist/cache/crypto-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-utils.js","sourceRoot":"","sources":["../../src/cache/crypto-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAExF,4EAA4E;AAE5E,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,0CAA0C;AAChE,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,aAAa,GAAG,QAAQ,CAAC;AAsB/B,4EAA4E;AAE5E,MAAM,UAAU,SAAS,CAAC,UAAkB,EAAE,IAAY;IACxD,OAAO,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AACpF,CAAC;AAED,4EAA4E;AAE5E,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,UAAkB,EAAE,KAAc;IAC3E,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAExC,MAAM,SAAS,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,MAAM,OAAO,GAAqB,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEhC,MAAM,QAAQ,GAAsB;QAClC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3B,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACnC,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AASD,MAAM,UAAU,OAAO,CAAC,YAAoB,EAAE,UAAkB;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAA+B,CAAC;IAEnE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAExC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAC1F,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAEzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAqB,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAEzE,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAE5E,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO;KACR,CAAC;AACJ,CAAC"}

package/packages/client/dist/cache/encrypted-cache.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+import type { CacheProvider } from '../types/index.js';
+export interface EncryptedCacheOptions {
+    /** Directory where encrypted cache files are stored */
+    cacheDir: string;
+    /** Passphrase for encryption (typically the license key) */
+    passphrase: string;
+}
+export declare class EncryptedCache implements CacheProvider {
+    private readonly cacheDir;
+    private readonly passphrase;
+    private initPromise;
+    constructor(options: EncryptedCacheOptions);
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string, ttlMs?: number): Promise<void>;
+    clear(): Promise<void>;
+    private keyToPath;
+    private ensureDir;
+}
+//# sourceMappingURL=encrypted-cache.d.ts.map

package/packages/client/dist/cache/encrypted-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-cache.d.ts","sourceRoot":"","sources":["../../src/cache/encrypted-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAgBH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AASvD,MAAM,WAAW,qBAAqB;IACpC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,qBAAa,cAAe,YAAW,aAAa;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,WAAW,CAA8B;gBAErC,OAAO,EAAE,qBAAqB;IAKpC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkBxC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW9D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAc5B,OAAO,CAAC,SAAS;IAKjB,OAAO,CAAC,SAAS;CASlB"}

package/packages/client/dist/cache/encrypted-cache.js

@@ -0,0 +1,92 @@
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+/**
+ * @neocortex/client - EncryptedCache
+ *
+ * Filesystem-backed encrypted cache implementing the CacheProvider interface.
+ * Stores assets as AES-256-GCM encrypted files with PBKDF2 key derivation.
+ * Cache keys are hashed with SHA-256 to produce safe filenames.
+ *
+ * All public methods are designed to never throw - cache failures are
+ * silently handled since caching is a non-critical optimization.
+ */
+import { mkdir, writeFile, readFile, rm, readdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { encrypt, decrypt } from './crypto-utils.js';
+// ── Constants ────────────────────────────────────────────────────────────
+const CACHE_FILE_EXTENSION = '.enc';
+// ── EncryptedCache Implementation ────────────────────────────────────────
+export class EncryptedCache {
+    cacheDir;
+    passphrase;
+    initPromise = null;
+    constructor(options) {
+        this.cacheDir = options.cacheDir;
+        this.passphrase = options.passphrase;
+    }
+    async get(key) {
+        try {
+            const filePath = this.keyToPath(key);
+            const raw = await readFile(filePath, 'utf8');
+            const result = decrypt(raw, this.passphrase);
+            if (result.expired) {
+                // Clean up expired entry (fire-and-forget)
+                rm(filePath, { force: true }).catch(() => { });
+                return null;
+            }
+            return result.plaintext;
+        }
+        catch {
+            return null;
+        }
+    }
+    async set(key, value, ttlMs) {
+        try {
+            await this.ensureDir();
+            const filePath = this.keyToPath(key);
+            const encrypted = encrypt(value, this.passphrase, ttlMs);
+            await writeFile(filePath, encrypted, 'utf8');
+        }
+        catch {
+            // Cache write failures are non-critical
+        }
+    }
+    async clear() {
+        try {
+            const entries = await readdir(this.cacheDir).catch(() => []);
+            const removals = entries
+                .filter((entry) => entry.endsWith(CACHE_FILE_EXTENSION))
+                .map((entry) => rm(join(this.cacheDir, entry), { force: true }).catch(() => { }));
+            await Promise.all(removals);
+        }
+        catch {
+            // Clear failures are non-critical
+        }
+    }
+    // ── Private Methods ─────────────────────────────────────────────────
+    keyToPath(key) {
+        const hash = createHash('sha256').update(key).digest('hex');
+        return join(this.cacheDir, `${hash}${CACHE_FILE_EXTENSION}`);
+    }
+    ensureDir() {
+        if (!this.initPromise) {
+            this.initPromise = mkdir(this.cacheDir, { recursive: true }).then(() => undefined).catch((err) => {
+                this.initPromise = null; // allow retry on next call
+                throw err;
+            });
+        }
+        return this.initPromise;
+    }
+}
+//# sourceMappingURL=encrypted-cache.js.map

package/packages/client/dist/cache/encrypted-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted-cache.js","sourceRoot":"","sources":["../../src/cache/encrypted-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAErD,4EAA4E;AAE5E,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAWpC,4EAA4E;AAE5E,MAAM,OAAO,cAAc;IACR,QAAQ,CAAS;IACjB,UAAU,CAAS;IAC5B,WAAW,GAAyB,IAAI,CAAC;IAEjD,YAAY,OAA8B;QACxC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAE7C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,2CAA2C;gBAC3C,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC9C,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,MAAM,CAAC,SAAS,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,KAAc;QAClD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACzD,MAAM,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,OAAO;iBACrB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;iBACvD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC;YACnF,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;IACH,CAAC;IAED,uEAAuE;IAE/D,SAAS,CAAC,GAAW;QAC3B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,GAAG,oBAAoB,EAAE,CAAC,CAAC;IAC/D,CAAC;IAEO,SAAS;QACf,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC/F,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,2BAA2B;gBACpD,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,WAAY,CAAC;IAC3B,CAAC;CACF"}

package/packages/client/dist/cache/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+export { EncryptedCache, type EncryptedCacheOptions } from './encrypted-cache.js';
+//# sourceMappingURL=index.d.ts.map

package/packages/client/dist/cache/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cache/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC"}

package/packages/client/dist/cache/index.js

@@ -0,0 +1,14 @@
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+export { EncryptedCache } from './encrypted-cache.js';
+//# sourceMappingURL=index.js.map

package/packages/client/dist/cache/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cache/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,cAAc,EAA8B,MAAM,sBAAsB,CAAC"}

package/packages/client/dist/cli.d.ts

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/packages/client/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;GAWG"}

package/packages/client/dist/cli.js

@@ -0,0 +1,182 @@
+#!/usr/bin/env node
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+/**
+ * @neocortex/client - CLI Entry Point
+ *
+ * Routes subcommands to their respective handlers:
+ *   neocortex-client invoke  --args "..."
+ *   neocortex-client activate NX-PRO-xxx
+ *   neocortex-client cache-status
+ *   neocortex-client --help
+ *   neocortex-client --version
+ *
+ * Story 46.2 - AC1-AC7
+ */
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+// ── Version Resolution ─────────────────────────────────────────────────────
+function getVersion() {
+    try {
+        // Walk up from dist/cli.js to find the root package.json
+        const thisFile = fileURLToPath(import.meta.url);
+        let dir = dirname(thisFile);
+        // Try up to 5 levels
+        for (let i = 0; i < 5; i++) {
+            try {
+                const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf-8'));
+                if (pkg.name === '@ornexus/neocortex' || pkg.name === '@neocortex/client') {
+                    return pkg.version ?? '0.0.0';
+                }
+            }
+            catch {
+                // no package.json at this level
+            }
+            dir = dirname(dir);
+        }
+    }
+    catch {
+        // fallback
+    }
+    return '0.0.0';
+}
+// ── Help Text ──────────────────────────────────────────────────────────────
+const HELP_TEXT = `
+neocortex-client - Neocortex Client CLI
+
+Usage:
+  neocortex-client <command> [options]
+
+Commands:
+  invoke         Send orchestration request to server
+  activate       Activate license key
+  cache-status   Show cache and circuit breaker status
+
+Options:
+  --help, -h     Show this help message
+  --version, -v  Show version number
+
+Invoke Options:
+  --args <string>        Raw args to send (e.g., "*yolo @docs/stories/1.1.story.md")
+  --project-root <path>  Project root directory (default: cwd)
+  --format <type>        Output format: json | plain (default: plain)
+  --server-url <url>     Server URL override
+
+Activate Options:
+  <license-key>          License key (e.g., NX-PRO-ABC-123)
+  --server-url <url>     Server URL override
+  --non-interactive      Skip interactive prompts
+
+Examples:
+  neocortex-client invoke --args "*status"
+  neocortex-client invoke --args "*yolo @docs/stories/1.1.story.md" --format json
+  neocortex-client activate NX-PRO-ABC-123
+  neocortex-client cache-status
+`.trim();
+// ── Main ───────────────────────────────────────────────────────────────────
+async function main() {
+    const args = process.argv.slice(2);
+    const command = args[0];
+    if (!command || command === '--help' || command === '-h') {
+        console.log(HELP_TEXT);
+        process.exit(0);
+    }
+    if (command === '--version' || command === '-v') {
+        console.log(getVersion());
+        process.exit(0);
+    }
+    const subArgs = args.slice(1);
+    switch (command) {
+        case 'invoke': {
+            const { invokeCliHandler } = await import('./commands/invoke.js');
+            const exitCode = await invokeCliHandler(subArgs);
+            process.exit(exitCode);
+            break;
+        }
+        case 'activate': {
+            const { activate } = await import('./commands/activate.js');
+            // Parse activate args
+            let licenseKey;
+            let serverUrl;
+            let nonInteractive = false;
+            for (let i = 0; i < subArgs.length; i++) {
+                const arg = subArgs[i];
+                if (arg === '--server-url') {
+                    serverUrl = subArgs[++i];
+                }
+                else if (arg === '--non-interactive') {
+                    nonInteractive = true;
+                }
+                else if (arg === '--help' || arg === '-h') {
+                    console.log(HELP_TEXT);
+                    process.exit(0);
+                }
+                else if (!arg.startsWith('-')) {
+                    licenseKey = arg;
+                }
+            }
+            if (!licenseKey) {
+                console.error('Error: License key is required.');
+                console.error('Usage: neocortex-client activate <license-key>');
+                console.error('Example: neocortex-client activate NX-PRO-ABC-123');
+                process.exit(1);
+            }
+            try {
+                const result = await activate({
+                    licenseKey,
+                    serverUrl,
+                    nonInteractive,
+                });
+                if (result.success) {
+                    console.log(result.message);
+                    if (result.tier) {
+                        console.log(`Tier: ${result.tier}`);
+                    }
+                    if (result.configPath) {
+                        console.log(`Config: ${result.configPath}`);
+                    }
+                    process.exit(0);
+                }
+                else {
+                    console.error(result.message);
+                    process.exit(1);
+                }
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                console.error(`Activation failed: ${message}`);
+                process.exit(1);
+            }
+            break;
+        }
+        case 'cache-status': {
+            // cache-status requires initialized circuit breaker and telemetry queue.
+            // For CLI use, we provide a simplified status report.
+            console.log('Cache status requires an active client session.');
+            console.log('Use this command within a running Neocortex client context.');
+            process.exit(0);
+            break;
+        }
+        default: {
+            console.error(`Unknown command: ${command}`);
+            console.error('Run "neocortex-client --help" for usage information.');
+            process.exit(1);
+        }
+    }
+}
+main().catch((err) => {
+    console.error(`Fatal error: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/packages/client/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,8EAA8E;AAE9E,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,yDAAyD;QACzD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5B,qBAAqB;QACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;gBACzE,IAAI,GAAG,CAAC,IAAI,KAAK,oBAAoB,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;oBAC1E,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;gBAChC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;YACD,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,WAAW;IACb,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAE9E,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BjB,CAAC,IAAI,EAAE,CAAC;AAET,8EAA8E;AAE9E,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAExB,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE9B,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAClE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QAED,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;YAE5D,sBAAsB;YACtB,IAAI,UAA8B,CAAC;YACnC,IAAI,SAA6B,CAAC;YAClC,IAAI,cAAc,GAAG,KAAK,CAAC;YAE3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACxC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;gBACxB,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;oBAC3B,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC3B,CAAC;qBAAM,IAAI,GAAG,KAAK,mBAAmB,EAAE,CAAC;oBACvC,cAAc,GAAG,IAAI,CAAC;gBACxB,CAAC;qBAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;oBAC5C,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;qBAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChC,UAAU,GAAG,GAAG,CAAC;gBACnB,CAAC;YACH,CAAC;YAED,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACjD,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBAChE,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC;oBAC5B,UAAU;oBACV,SAAS;oBACT,cAAc;iBACf,CAAC,CAAC;gBAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBAC5B,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;wBAChB,OAAO,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;oBACtC,CAAC;oBACD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;wBACtB,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;oBAC9C,CAAC;oBACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,OAAO,CAAC,KAAK,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,yEAAyE;YACzE,sDAAsD;YACtD,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC/D,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;YAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,MAAM;QACR,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACR,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,gBAAgB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/packages/client/dist/commands/activate.d.ts

@@ -0,0 +1,48 @@
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+export interface ActivateOptions {
+    /** License key to activate (e.g., NX-PRO-ABC-123) */
+    readonly licenseKey?: string;
+    /** Server URL override (default: production server) */
+    readonly serverUrl?: string;
+    /** Skip interactive prompt */
+    readonly nonInteractive?: boolean;
+}
+export interface ActivateResult {
+    readonly success: boolean;
+    readonly message: string;
+    readonly tier?: string;
+    readonly serverUrl?: string;
+    readonly configPath?: string;
+}
+/**
+ * Validate license key format.
+ * Format: NX-{TIER}-{random}-{random}
+ * Tiers: FREE, PRO, ENT
+ */
+export declare function validateLicenseKeyFormat(key: string): {
+    valid: boolean;
+    error?: string;
+};
+/**
+ * Activate a Neocortex license.
+ *
+ * Flow:
+ * 1. Validate license key format
+ * 2. Call IP Protection Server to activate
+ * 3. Cache JWT token via LicenseClient
+ * 4. Create/update ~/.neocortex/config.json
+ * 5. Return result with feedback
+ */
+export declare function activate(options: ActivateOptions): Promise<ActivateResult>;
+//# sourceMappingURL=activate.d.ts.map

package/packages/client/dist/commands/activate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activate.d.ts","sourceRoot":"","sources":["../../src/commands/activate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA8BH,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,8BAA8B;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAYD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAmBxF;AA8BD;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAuGhF"}