@tpsdev-ai/flair 0.54.1 → 0.54.2

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
-  "version": "0.54.1",
-  "commit": "0d841ae948846c95b1498d67330eaa3c5ddec84c",
-  "builtAt": "2026-09-14T17:20:36.218Z",
+  "version": "0.54.2",
+  "commit": "842bd1a5903663aabf48e6629b3b5ba17f0884b8",
+  "builtAt": "2026-09-15T18:02:12.387Z",
   "builder": "tsc"
 }

package/dist/commands/doctor.js

@@ -12,7 +12,8 @@ import { opsApiBindFinding } from "../lib/ops-api-bind.js";
 import { flairCliVersion, unpinnedSpecWarning } from "../lib/mcp-spec.js";
 import { staleSessionStartHookPins } from "../lib/owned-pins.js";
 import * as render from "../render.js";
-import { checkVersion, formatVersionNudge, probeInstanceVersion } from "../version-check.js";
+import { checkVersion, formatVersionNudge, probeInstanceVersion, FLAIR_PKG_NAME } from "../version-check.js";
+import { resolveRegistryNotice } from "../lib/npm-registry.js";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
@@ -187,6 +188,16 @@ export function register(program) {
                     `Commands run through the CLI; the instance serves the data.`)}`);
             }
         }
+        // flair#1692: name the registry (and where it came from) on every doctor
+        // check, so a redirected mirror is visible to the operator.
+        const registryNotice = await resolveRegistryNotice(FLAIR_PKG_NAME);
+        if (registryNotice.line) {
+            console.log(`  ${render.icons.info} ${render.wrap(render.c.dim, registryNotice.line)}`);
+        }
+        if (registryNotice.error) {
+            console.log(`  ${render.icons.warn} ${render.wrap(render.c.yellow, registryNotice.error)}`);
+            issues++;
+        }
         // 0.5 npm global bin dir on PATH (flair#1134) — a user-prefix
         // `npm i -g` succeeds and then `flair` is command-not-found because
         // <prefix>/bin never made it into PATH. postinstall warns at install

package/dist/commands/status.js

@@ -1,7 +1,8 @@
 import { resolveAdminUser } from "../lib/auth-resolve.js";
 import { opsApiBindFinding } from "../lib/ops-api-bind.js";
 import * as render from "../render.js";
-import { checkVersion, formatVersionNudge } from "../version-check.js";
+import { checkVersion, formatVersionNudge, FLAIR_PKG_NAME } from "../version-check.js";
+import { resolveRegistryNotice } from "../lib/npm-registry.js";
 let cli;
 /** Bind the cli-locals this module depends on. */
 export function bindCli(fns) {
@@ -193,6 +194,10 @@ export function register(program) {
         // fact is current (flair#1341). Independent of Harper health; runs either way.
         const versionCheckResult = await checkVersion(__pkgVersion);
         const versionNudge = formatVersionNudge(versionCheckResult);
+        // flair#1692: name the registry (and where it came from) on every status
+        // check, so a redirected mirror is never silent — including when the
+        // version answer came from cache and no network request was made.
+        const registryNotice = await resolveRegistryNotice(FLAIR_PKG_NAME);
         if (opts.json) {
             const out = { healthy, url: baseUrl, flairVersion: __pkgVersion, ...healthData };
             if (localWarnings.length > 0) {
@@ -205,6 +210,10 @@ export function register(program) {
                 out.discoveredPort = discoveredPort;
             if (versionCheckResult.latest)
                 out.latestVersion = versionCheckResult.latest;
+            if (registryNotice.line)
+                out.registry = registryNotice.line;
+            if (registryNotice.error)
+                out.registryError = registryNotice.error;
             console.log(JSON.stringify(out, null, 2));
             if (!healthy)
                 process.exit(1);
@@ -213,6 +222,10 @@ export function register(program) {
         if (!healthy) {
             console.log(`Flair v${__pkgVersion} — 🔴 unreachable`);
             console.log(`  URL:  ${baseUrl}`);
+            if (registryNotice.line)
+                console.log(`  ${registryNotice.line}`);
+            if (registryNotice.error)
+                console.log(`  ⚠ ${registryNotice.error}`);
             if (discoveredPort != null) {
                 const altUrl = `http://127.0.0.1:${discoveredPort}`;
                 console.log(`\n  ⚠ Found a Flair daemon listening on port ${discoveredPort} (URL: ${altUrl}).`);
@@ -288,6 +301,10 @@ export function register(program) {
         const metaParts = [pidPart, uptimePart].filter(Boolean).join(render.wrap(render.c.dim, " · "));
         console.log(`${versionStr} ${render.wrap(render.c.dim, "—")} ${runStatus}${metaParts ? `  ${metaParts}` : ""}`);
         console.log(render.kv("URL", baseUrl));
+        if (registryNotice.line)
+            console.log(render.kv("Registry", registryNotice.line.replace(/^registry:\s*/, "")));
+        if (registryNotice.error)
+            console.log(`  ${render.icons.warn} ${render.wrap(render.c.yellow, registryNotice.error)}`);
         if (versionNudge) {
             const color = versionNudge.severity === "red" ? render.c.red : render.c.yellow;
             console.log(`\n  ${render.wrap(color, "⚠")} ${render.wrap(color, versionNudge.message)}`);

package/dist/commands/upgrade.js

@@ -7,6 +7,7 @@ import { defaultKeysDir } from "../lib/auth-resolve.js";
 import { renderVerifiedSummary } from "../lib/doctor-run.js";
 import { isDetached, renderDetachedWarning } from "../lib/launchd-management.js";
 import { FLAIR_MCP_PACKAGE, clearFlairCliVersionCache } from "../lib/mcp-spec.js";
+import { createRegistryNoticePrinter, fetchLatestVersion, isStrictSemver } from "../lib/npm-registry.js";
 import { ownedPinRefreshShouldReport, refreshOwnedPins } from "../lib/owned-pins.js";
 import { extractSnapshotSafely, validateSnapshotArchive } from "../lib/safe-snapshot-extract.js";
 import { collectUpgradeExecPathWarning, findFlairPackageDir, resolveNpmGlobalFlairPackage, resolveServingFlairPackage } from "../lib/upgrade-exec-path.js";
@@ -836,17 +837,36 @@ export function register(program) {
             },
         ];
         const findings = [];
+        // flair#1692: name the registry (and where it came from) the moment it is
+        // resolved, so a redirected registry is visible to the operator before
+        // anything is fetched or installed. One line per distinct registry.
+        const noticeRegistry = createRegistryNoticePrinter();
         for (const { name, probe, kind, transitive } of packages) {
             if (transitive && !showAll)
                 continue;
             try {
                 let registryLatest = null;
                 try {
-                    const res = await fetch(`https://registry.npmjs.org/${name}/latest`, { signal: AbortSignal.timeout(5000) });
-                    if (res.ok) {
-                        const data = await res.json();
-                        registryLatest = typeof data.version === "string" && data.version ? data.version : null;
+                    // flair#1688: resolve the registry npm is configured to use for this
+                    // package (scope mapping + .npmrc + env) instead of a hardcoded host.
+                    // flair#1692: print it, refuse disallowed schemes, disable redirects,
+                    // and validate the returned value as strict semver before it can be
+                    // used as an `npm install` spec.
+                    const lookup = await fetchLatestVersion(name, {
+                        timeoutMs: 5000,
+                        onRegistry: noticeRegistry,
+                    });
+                    if (lookup.kind === "ok") {
+                        registryLatest = lookup.version;
+                    }
+                    else if (lookup.kind === "invalid") {
+                        console.error(`  ⚠ ${name}: registry returned a non-semver "latest" (${JSON.stringify(lookup.value)}) ` +
+                            `from ${lookup.registry.url} — refusing to use it as an install spec.`);
                     }
+                    else if (lookup.kind === "refused") {
+                        console.error(lookup.message);
+                    }
+                    // kind === "unavailable": offline/timed out — the pin path must still work.
                 }
                 catch { /* /latest timed out or failed — pin path must still work */ }
                 let latest;
@@ -867,7 +887,14 @@ export function register(program) {
                         continue;
                     latest = registryLatest;
                 }
-                if (name === FLAIR_PKG_NAME && latest !== "unknown") {
+                // flair#1692: a non-semver target must never reach an install spec
+                // (npm treats `pkg@<url>` as a remote tarball). This also covers the
+                // operator pin on the plain-tree lane.
+                if (!isStrictSemver(latest)) {
+                    console.error(`  ⚠ ${name}: refusing non-semver install target ${JSON.stringify(latest)} — expected a version like 1.2.3.`);
+                    continue;
+                }
+                if (name === FLAIR_PKG_NAME) {
                     try {
                         primeVersionCheckCache(latest);
                     }
@@ -1225,6 +1252,15 @@ export function register(program) {
         let flairInstallFailed = false;
         for (const { pkg, latest } of npmUpgrades) {
             try {
+                // flair#1692 backstop: the listing validated this, but the install is
+                // the point of no return. npm accepts `pkg@<url>` as a remote-tarball
+                // spec, so a non-semver target must never reach this argv.
+                if (!isStrictSemver(latest)) {
+                    console.error(`  ❌ ${pkg} upgrade skipped: non-semver target ${JSON.stringify(latest)}`);
+                    if (pkg === FLAIR_PKG_NAME)
+                        flairInstallFailed = true;
+                    continue;
+                }
                 if (treePlan && pkg === FLAIR_PKG_NAME) {
                     console.log(`  Fetching ${pkg}@${latest} (npm pack) and swapping ${treePlan.treeDir}...`);
                     await applyPlainTreeUpgrade(treePlan);

package/dist/engine-version.js

@@ -19,6 +19,7 @@
 import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { homedir } from "node:os";
+import { fetchDeclaredDependencies } from "./lib/npm-registry.js";
 /** Filename of the engine-version stamp inside the data directory. */
 export const ENGINE_VERSION_STAMP = "engine-version.txt";
 /** Root directory for pre-upgrade snapshots (~/.flair/upgrade-snapshots). */
@@ -47,11 +48,18 @@ export function readInstalledHarperVersion(packageRoot) {
  */
 export async function fetchDeclaredHarperVersion(flairVersion) {
     try {
-        const res = await fetch(`https://registry.npmjs.org/@tpsdev-ai/flair/${flairVersion}`, { signal: AbortSignal.timeout(5000) });
-        if (!res.ok)
+        // flair#1688: resolve the configured registry rather than assuming npmjs —
+        // the engine-version decision must look at the same package the upgrade
+        // will actually install. flair#1692: the same scheme allowlist, redirect
+        // refusal, npm transport, and non-default-registry handling apply.
+        const result = await fetchDeclaredDependencies("@tpsdev-ai/flair", flairVersion, { timeoutMs: 5000 });
+        if (result.kind === "refused") {
+            console.error(result.message);
             return null;
-        const data = await res.json();
-        return data.dependencies?.harper ?? data.dependencies?.["@harperfast/harper"] ?? null;
+        }
+        if (result.kind !== "ok")
+            return null;
+        return result.dependencies?.harper ?? result.dependencies?.["@harperfast/harper"] ?? null;
     }
     catch {
         return null;

package/dist/fabric-upgrade.js

@@ -30,6 +30,7 @@ import { mkdtempSync, rmSync, writeFileSync, readFileSync, existsSync } from "no
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { createRequire } from "node:module";
+import { createRegistryNoticePrinter, fetchDeclaredDependencies, fetchLatestVersion } from "./lib/npm-registry.js";
 /**
  * Minimum harper version whose component packager works when the
  * package root is under node_modules (flair#513 — the empty-tarball fix landed
@@ -154,30 +155,44 @@ export function buildDeployablePackageJson(flairVersion, pin) {
     return pkg;
 }
 // ─── Default (real) dependency implementations ──────────────────────────────
-const REGISTRY = "https://registry.npmjs.org";
+// flair#1692: one printer per process, so a Fabric upgrade names the registry
+// (and source) it stages from without repeating the line per lookup.
+const noticeRegistry = createRegistryNoticePrinter();
 async function defaultFetchLatestFlairVersion() {
-    const res = await fetch(`${REGISTRY}/${FLAIR_PKG}/latest`, {
-        signal: AbortSignal.timeout(10_000),
-    });
-    if (!res.ok) {
-        throw new Error(`npm registry returned ${res.status} for ${FLAIR_PKG}/latest`);
+    // flair#1688: the configured registry (scoped `@tpsdev-ai:registry`,
+    // project/user/global .npmrc, env `npm_config_registry`), not a hardcoded
+    // host — a Fabric upgrade must stage the package from the mirror the
+    // operator configured, or fail rather than silently use the public one.
+    // flair#1692: the value is validated as strict semver before it is used as
+    // `dependencies` in the staged package.json (npm accepts `pkg@<url>` as a
+    // remote-tarball spec, so an unvalidated value is an arbitrary-install
+    // primitive).
+    const result = await fetchLatestVersion(FLAIR_PKG, { timeoutMs: 10_000, onRegistry: noticeRegistry });
+    if (result.kind === "ok")
+        return result.version;
+    if (result.kind === "refused")
+        throw new Error(result.message);
+    if (result.kind === "invalid") {
+        throw new Error(`npm registry returned a non-semver latest version (${JSON.stringify(result.value)}) for ${FLAIR_PKG} ` +
+            `from ${result.registry.url} (source: ${result.registry.source}) — refusing to use it`);
     }
-    const data = (await res.json());
-    if (!data.version)
-        throw new Error(`No version in registry response for ${FLAIR_PKG}`);
-    return data.version;
+    throw new Error(`Could not determine ${FLAIR_PKG}/latest: ${result.message}`);
 }
 async function defaultFetchDeclaredHarperVersion(flairVersion) {
-    const res = await fetch(`${REGISTRY}/${FLAIR_PKG}/${flairVersion}`, {
-        signal: AbortSignal.timeout(10_000),
+    const result = await fetchDeclaredDependencies(FLAIR_PKG, flairVersion, {
+        timeoutMs: 10_000,
+        onRegistry: noticeRegistry,
     });
-    if (!res.ok)
+    if (result.kind === "refused") {
+        console.error(result.message);
+        return null;
+    }
+    if (result.kind !== "ok")
         return null;
-    const data = (await res.json());
     // Either package name (flair#870) — pre-rename flair versions declare the
     // scoped one, and those are precisely the versions that may need an override.
     for (const name of HARPER_PKG_NAMES) {
-        const declared = data.dependencies?.[name];
+        const declared = result.dependencies?.[name];
         if (declared)
             return declared;
     }

package/dist/lib/npm-registry.js

@@ -0,0 +1,578 @@
+/**
+ * npm-registry.ts — resolve the npm registry to query for a package, the way
+ * npm itself would, and fetch from it with npm's security boundaries applied
+ * (flair#1688, security review flair#1692).
+ *
+ * WHY THIS EXISTS. `flair upgrade`'s update check and Fabric version lookups
+ * used to fetch `https://registry.npmjs.org/<pkg>/latest` with a HARDCODED
+ * host. A user on a private mirror, an air-gapped registry, or a vetted
+ * internal proxy configured through npm never influenced those fetches: the
+ * upgrade path compared against the public registry's `latest` (reporting
+ * "you are current" when the mirror had a different/newer release) and, in CI,
+ * defeated the scoped `@tpsdev-ai:registry` config the macOS launchd lane sets.
+ * A supply-chain control (route all installs through the internal mirror) was
+ * bypassed by the update check itself.
+ *
+ * WHAT IT DOES. Given a package name, returns the registry base URL npm would
+ * use for it, honouring the same configuration npm does:
+ *
+ *   1. the `@<scope>:registry` mapping for a scoped package (scope-specific
+ *      config beats the default for that scope),
+ *   2. the default `registry`,
+ *   3. npm's own precedence: env `npm_config_<key>` > project `.npmrc` > user
+ *      `.npmrc` > global `.npmrc` > npm's builtin default.
+ *
+ * Rather than reimplement npm's ini parsing and precedence (which would surely
+ * drift from npm), we ask npm: `npm config list` already resolves every layer
+ * in the right order, and — unlike `npm config get` — its per-section headers
+ * let us name the layer a value came from, so the operator can SEE a
+ * redirected registry (`registry: … (source: user .npmrc …)`). The env layer
+ * is read directly too, as a fast path so tests (and scripts that export
+ * `npm_config_*`) never need a subprocess.
+ *
+ * SECURITY BOUNDARIES (flair#1692). This module is where every version
+ * decision flows through, so the resolver is the right chokepoint:
+ *
+ *   - SCHEME ALLOWLIST. Only `https:` is fetched by default. `http:` is
+ *     allowed ONLY for a loopback host (127.0.0.1 / localhost / ::1) — the CI
+ *     lane's registry — or when the operator explicitly opts in with
+ *     `FLAIR_ALLOW_INSECURE_REGISTRY=1`, in which case the resolution is
+ *     reported as INSECURE. `file:`/`ftp:`/anything else is refused outright.
+ *     A refusal names the actor, the state, and the remedy; it is never silent.
+ *
+ *   - SEMVER VALIDATION. A registry may return any string as `latest`, and npm
+ *     accepts `pkg@https://attacker/x.tgz` as a remote-tarball install spec.
+ *     So a fetched version is validated as strict semver BEFORE it can be used
+ *     as an install spec (see `isStrictSemver` / `fetchLatestVersion`). A
+ *     non-semver value is refused and printed, never installed.
+ *
+ *   - REDIRECTS. The version fetch passes `redirect: "error"`: a 302 from an
+ *     allowed registry cannot silently land on a disallowed host, which would
+ *     otherwise bypass the scheme allowlist.
+ *
+ *   - TRANSPORT. A bare `fetch()` cannot honour npm's `strict-ssl` / `cafile`
+ *     / `_authToken`. When the configured registry is a NON-default mirror
+ *     (i.e. not the public npmjs default) AND npm has transport config we
+ *     cannot replicate, the lookup is delegated to
+ *     `npm view <pkg> version --json --registry <url>`, which gets URL, TLS
+ *     trust, and auth from npm in one step. This is the reviewer's preferred
+ *     transport (flair#1692 item 4). For the public default npmjs registry we
+ *     fetch anonymously — public reads need no trust config — and the residual
+ *     gap is: a custom CA/auth token set for a registry OTHER than the
+ *     configured one is not carried. `_authToken` cannot be read back anyway:
+ *     npm marks auth options "protected" and refuses to print them.
+ *
+ * DEFAULT. When nothing is configured — and when npm is absent or errors —
+ * this returns npm's public default, `https://registry.npmjs.org`. A user with
+ * no registry configured must see exactly the behaviour they saw before this
+ * module existed.
+ */
+import { execFile } from "node:child_process";
+/** npm's public default, and the pre-flair#1688 behaviour. No trailing slash. */
+export const DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org";
+/**
+ * Opt-in for a deliberately plain-http registry that is not loopback. Any
+ * other non-https scheme is refused even with this set (flair#1692).
+ */
+export const INSECURE_REGISTRY_ENV = "FLAIR_ALLOW_INSECURE_REGISTRY";
+/**
+ * Thrown when the configured registry is not allowed. The message already
+ * contains actor + state + remedy, so callers only have to print it.
+ */
+export class RegistryRefusalError extends Error {
+    rawUrl;
+    source;
+    constructor(message, rawUrl, source) {
+        super(message);
+        this.name = "RegistryRefusalError";
+        this.rawUrl = rawUrl;
+        this.source = source;
+    }
+}
+// ─── npm config: value + source ─────────────────────────────────────────────
+/**
+ * npm represents "unset" as the literal string `undefined` from
+ * `npm config get`, and may pad with whitespace. Normalise all of that, plus a
+ * trailing slash, to a clean base URL (or null).
+ */
+function normalizeRegistryValue(raw) {
+    if (raw == null)
+        return null;
+    const trimmed = raw.trim();
+    if (trimmed === "" || trimmed === "undefined" || trimmed === "null")
+        return null;
+    return trimmed.replace(/\/+$/, "");
+}
+/**
+ * The `@scope` of a package name, or null for unscoped names.
+ * `@tpsdev-ai/flair` → `@tpsdev-ai`; `flair` → null.
+ *
+ * The scope is restricted to npm's legal scope characters. The result is
+ * interpolated into an npm config key (and, on Windows, a shell command), so
+ * a name that is not a real npm scope must never reach that path.
+ */
+export function packageScope(packageName) {
+    if (!packageName.startsWith("@"))
+        return null;
+    const slash = packageName.indexOf("/");
+    if (slash <= 1)
+        return null;
+    const scope = packageName.slice(0, slash);
+    return /^@[A-Za-z0-9._~-]+$/.test(scope) ? scope : null;
+}
+function describeConfigLayer(layer, from) {
+    switch (layer) {
+        case "env":
+            return "env";
+        case "cli":
+            return "command line";
+        case "project":
+            return `project .npmrc (${from})`;
+        case "user":
+            return `user .npmrc (${from})`;
+        case "global":
+            return `global .npmrc (${from})`;
+        case "builtin":
+            return "npm builtin";
+        default:
+            return from || "npm config";
+    }
+}
+/**
+ * Parse the human output of `npm config list` into key → {value, source}.
+ *
+ * Only non-default config is printed, grouped under section headers such as
+ * `; "project" config from /path/.npmrc`. Values already overridden by a
+ * higher layer are printed COMMENTED OUT (`; registry = … ; overridden by …`),
+ * so the single active line per key wins — which is exactly npm's precedence.
+ * `publishConfig` values are publish-time only and are ignored.
+ *
+ * Exported for the unit tests that pin the parse without spawning npm.
+ */
+export function parseNpmConfigList(stdout) {
+    const entries = new Map();
+    let layer = "unknown";
+    let source = "npm config";
+    let ignore = false;
+    for (const rawLine of String(stdout).split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (line === "")
+            continue;
+        const header = line.match(/^;\s*"([^"]+)"(?:\s+config)?\s+from\s+(.+)$/);
+        if (header) {
+            const name = header[1];
+            const from = header[2].trim();
+            if (name === "publishConfig") {
+                ignore = true;
+                layer = "publish";
+                source = from;
+                continue;
+            }
+            ignore = false;
+            const knownLayers = ["env", "cli", "project", "user", "global", "builtin"];
+            layer = knownLayers.includes(name)
+                ? name
+                : "unknown";
+            source = describeConfigLayer(layer, from);
+            continue;
+        }
+        // Comments (including overridden values) and the trailing node-version
+        // footer are not config we can use.
+        if (line.startsWith(";"))
+            continue;
+        if (ignore)
+            continue;
+        const m = line.match(/^([^=]+?)\s*=\s*(.*)$/);
+        if (!m)
+            continue;
+        const key = m[1].trim();
+        let value = m[2].trim();
+        // npm redacts auth in `npm config list`; presence is all we need.
+        if (value === "(protected)")
+            value = "";
+        else if (value.startsWith('"') && value.endsWith('"')) {
+            try {
+                value = JSON.parse(value);
+            }
+            catch {
+                value = value.slice(1, -1);
+            }
+        }
+        entries.set(key, { value, layer, source });
+    }
+    return entries;
+}
+// ─── Default readers: ask npm, memoised per process ─────────────────────────
+let entriesCache = null;
+function runNpmConfigList() {
+    return new Promise((resolve) => {
+        execFile(process.platform === "win32" ? "npm.cmd" : "npm", ["config", "list"], { timeout: 5000, encoding: "utf-8", shell: process.platform === "win32" }, (err, stdout) => {
+            // npm missing, timed out, or errored — treat as "cannot determine".
+            // The caller falls back to the public default, never a broken URL.
+            if (err)
+                return resolve(new Map());
+            try {
+                resolve(parseNpmConfigList(String(stdout)));
+            }
+            catch {
+                resolve(new Map());
+            }
+        });
+    });
+}
+/**
+ * Every explicitly-set npm config value, resolved once per process (the config
+ * does not change under a running command).
+ */
+export function defaultNpmConfigEntries() {
+    if (!entriesCache)
+        entriesCache = runNpmConfigList();
+    return entriesCache;
+}
+/** Default `NpmConfigEntryReader` — one key from the memoised config map. */
+export async function defaultNpmConfigEntryReader(key) {
+    const entries = await defaultNpmConfigEntries();
+    return entries.get(key) ?? null;
+}
+/** Drop the memoised npm answers — tests that change registry env between runs. */
+export function clearNpmRegistryCache() {
+    entriesCache = null;
+}
+// ─── Scheme allowlist ───────────────────────────────────────────────────────
+/** The loopback hosts `http:` is allowed for without an opt-in (CI lane). */
+export function isLoopbackHost(hostname) {
+    const h = hostname.trim().toLowerCase().replace(/^\[|\]$/g, "");
+    return h === "127.0.0.1" || h === "localhost" || h === "::1";
+}
+function insecureOptedIn(env) {
+    const raw = (env[INSECURE_REGISTRY_ENV] ?? "").trim().toLowerCase();
+    return raw === "1" || raw === "true" || raw === "yes";
+}
+function buildRegistryRefusal(rawUrl, source, problem, scheme) {
+    const actor = `the npm registry is configured as ${JSON.stringify(rawUrl)} (source: ${source})`;
+    const state = scheme === "http:"
+        ? "Flair only queries registries over https; plain http is allowed only for a loopback host (127.0.0.1, localhost, ::1)."
+        : `Flair refuses the "${scheme ?? "unknown"}" scheme for a registry — only http(s) is considered at all.`;
+    const remedy = scheme === "http:"
+        ? `Point \`registry\` / \`@scope:registry\` at an https URL, or set ${INSECURE_REGISTRY_ENV}=1 to allow this plain-http registry deliberately (file:/ftp: are never allowed).`
+        : "Point `registry` / `@scope:registry` at an https URL.";
+    return `Refusing npm registry: ${problem}.\n  actor: ${actor}\n  state: ${state}\n  remedy: ${remedy}`;
+}
+/**
+ * Validate a normalized registry URL against the scheme allowlist.
+ *
+ * Returns the resolution on success (with `insecure` set when the explicit
+ * opt-in permitted a non-loopback `http:` registry) and throws a
+ * `RegistryRefusalError` whose message carries actor + state + remedy.
+ */
+export function validateRegistryUrl(rawUrl, source, env = process.env) {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch {
+        throw new RegistryRefusalError(buildRegistryRefusal(rawUrl, source, "it is not a valid URL", null), rawUrl, source);
+    }
+    const scheme = parsed.protocol.toLowerCase();
+    if (scheme === "https:") {
+        return { url: rawUrl, source, insecure: false };
+    }
+    if (scheme === "http:") {
+        if (isLoopbackHost(parsed.hostname)) {
+            return { url: rawUrl, source, insecure: false };
+        }
+        if (insecureOptedIn(env)) {
+            return { url: rawUrl, source, insecure: true };
+        }
+        throw new RegistryRefusalError(buildRegistryRefusal(rawUrl, source, "plain http is not allowed for a non-loopback host", scheme), rawUrl, source);
+    }
+    throw new RegistryRefusalError(buildRegistryRefusal(rawUrl, source, `the "${scheme}" scheme is never fetched`, scheme), rawUrl, source);
+}
+async function readEntry(readConfig, key) {
+    try {
+        const entry = await readConfig(key);
+        if (!entry)
+            return null;
+        const value = normalizeRegistryValue(entry.value);
+        if (!value)
+            return null;
+        return { ...entry, value };
+    }
+    catch {
+        // A custom reader must never break version resolution — treat a throw as
+        // "unset" and let the fallback (public default) apply.
+        return null;
+    }
+}
+/**
+ * Resolve the registry for `packageName` together with HOW it was chosen, and
+ * validate its scheme. Throws `RegistryRefusalError` for a disallowed scheme.
+ */
+export async function resolveNpmRegistryDetailed(packageName, deps = {}) {
+    const env = deps.env ?? process.env;
+    const readConfig = deps.readConfig ?? defaultNpmConfigEntryReader;
+    // Scope mapping first: for a scoped package a configured `@scope:registry`
+    // beats the default `registry`, and npm resolves project/user/global files.
+    const scope = packageScope(packageName);
+    if (scope) {
+        const envScoped = normalizeRegistryValue(env[`npm_config_${scope}:registry`]);
+        if (envScoped) {
+            return validateRegistryUrl(envScoped, `env npm_config_${scope}:registry`, env);
+        }
+        const scoped = await readEntry(readConfig, `${scope}:registry`);
+        if (scoped) {
+            return validateRegistryUrl(scoped.value, `${scope}:registry (${scoped.source})`, env);
+        }
+    }
+    // env `npm_config_registry` beats any .npmrc default, so read it before npm.
+    const envDefault = normalizeRegistryValue(env.npm_config_registry);
+    if (envDefault) {
+        return validateRegistryUrl(envDefault, "env npm_config_registry", env);
+    }
+    const configured = await readEntry(readConfig, "registry");
+    if (configured) {
+        return validateRegistryUrl(configured.value, `registry (${configured.source})`, env);
+    }
+    return validateRegistryUrl(DEFAULT_NPM_REGISTRY, "default npm public registry", env);
+}
+/**
+ * Resolve the registry base URL for `packageName` the way npm would, without
+ * the source metadata. Throws `RegistryRefusalError` for a disallowed scheme.
+ */
+export async function resolveNpmRegistry(packageName, deps = {}) {
+    return (await resolveNpmRegistryDetailed(packageName, deps)).url;
+}
+/** One operator-facing line naming the registry and where it came from. */
+export function formatRegistryLine(res) {
+    const flag = res.insecure ? " [INSECURE]" : "";
+    return `registry: ${res.url} (source: ${res.source})${flag}`;
+}
+/**
+ * A printer that emits each distinct registry line once per process, so a
+ * listing that resolves the same registry for N packages prints one line.
+ */
+export function createRegistryNoticePrinter(sink = (line) => console.log(line)) {
+    const seen = new Set();
+    return (res) => {
+        const line = formatRegistryLine(res);
+        if (seen.has(line))
+            return;
+        seen.add(line);
+        sink(line);
+    };
+}
+/**
+ * Resolve + validate for a caller that only wants to REPORT the registry
+ * (status/doctor). Never throws: a refusal comes back as `error`.
+ */
+export async function resolveRegistryNotice(packageName, deps = {}) {
+    try {
+        const res = await resolveNpmRegistryDetailed(packageName, deps);
+        return { line: formatRegistryLine(res), error: null };
+    }
+    catch (err) {
+        if (err instanceof RegistryRefusalError)
+            return { line: null, error: err.message };
+        return { line: null, error: err instanceof Error ? err.message : String(err) };
+    }
+}
+// ─── Strict semver ──────────────────────────────────────────────────────────
+/**
+ * The semver.org regex, exact. A registry value must match this before it can
+ * be used as an `npm install` spec: npm accepts `pkg@<url>` as a remote-tarball
+ * spec, so a hostile/compromised registry returning a URL as `latest` would
+ * otherwise turn the update check into an arbitrary install (flair#1692).
+ */
+const STRICT_SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/;
+/** True when `value` is a strict semver version (not a range, tag, or URL). */
+export function isStrictSemver(value) {
+    return typeof value === "string" && STRICT_SEMVER.test(value.trim());
+}
+function boolValue(value) {
+    return value == null ? true : !/^(false|0|no)$/i.test(value.trim());
+}
+/**
+ * The npm auth-config key that applies to `registryUrl`, or null. npm stores a
+ * registry token as `//host/path/:_authToken` (longest matching prefix wins),
+ * plus a legacy unscoped `_authToken`. npm refuses to print the VALUE; we only
+ * need to know one exists so we can delegate to `npm view` (flair#1692 item 4).
+ */
+export function registryAuthTokenKey(registryUrl, entries) {
+    if (entries.has("_authToken"))
+        return "_authToken";
+    let parsed;
+    try {
+        parsed = new URL(registryUrl);
+    }
+    catch {
+        return null;
+    }
+    const hostPath = `//${parsed.host}${parsed.pathname.replace(/\/+$/, "")}/`;
+    let best = null;
+    for (const key of entries.keys()) {
+        if (!key.endsWith(":_authToken"))
+            continue;
+        const prefix = key.slice(0, -":_authToken".length);
+        if (!prefix.endsWith("/"))
+            continue;
+        if (!hostPath.startsWith(prefix) && !prefix.startsWith(hostPath))
+            continue;
+        if (best === null || prefix.length > best.length - ":_authToken".length)
+            best = key;
+    }
+    return best;
+}
+/** Read npm's transport trust config (TLS + auth) for the fetch decision. */
+export async function readRegistryTransport(registryUrl, deps = {}) {
+    const readConfig = deps.readConfig ?? defaultNpmConfigEntryReader;
+    const readMap = deps.readConfigMap ?? defaultNpmConfigEntries;
+    const strictSsl = boolValue((await readEntry(readConfig, "strict-ssl"))?.value);
+    const cafile = (await readEntry(readConfig, "cafile"))?.value ?? null;
+    const ca = (await readEntry(readConfig, "ca"))?.value ?? null;
+    let authTokenKey = null;
+    try {
+        authTokenKey = registryAuthTokenKey(registryUrl, await readMap());
+    }
+    catch {
+        authTokenKey = null;
+    }
+    return { strictSsl, cafile, ca, authTokenKey };
+}
+/**
+ * True when the transport config cannot be honoured by a bare `fetch()` and
+ * the lookup must go through npm (`npm view`). Covers a custom CA, a disabled
+ * TLS check, and a configured registry auth token.
+ */
+export function registryNeedsNpmTransport(config) {
+    return !config.strictSsl || config.cafile != null || config.ca != null || config.authTokenKey != null;
+}
+/**
+ * GET a registry URL as JSON with redirects REFUSED. `redirect: "error"` is
+ * load-bearing: without it a 302 from an allow-listed registry would silently
+ * land on a disallowed host (flair#1692 item 5).
+ */
+async function fetchRegistryJson(url, timeoutMs, fetchImpl) {
+    const doFetch = fetchImpl ?? fetch;
+    try {
+        const res = await doFetch(url, {
+            redirect: "error",
+            headers: { accept: "application/json" },
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        if (!res.ok)
+            return { ok: false, message: `registry returned HTTP ${res.status}` };
+        return { ok: true, data: await res.json(), message: "" };
+    }
+    catch (err) {
+        const message = err instanceof Error && err.message ? err.message : "registry fetch failed";
+        return { ok: false, message };
+    }
+}
+function npmBin() {
+    return process.platform === "win32" ? "npm.cmd" : "npm";
+}
+/**
+ * `npm view <spec> <field> --json`. Used when npm transport config (CA, TLS
+ * override, auth token) cannot be replicated by `fetch()`.
+ */
+function runNpmViewJson(spec, field, registryUrl, timeoutMs) {
+    return new Promise((resolve) => {
+        execFile(npmBin(), ["view", spec, field, "--json", "--registry", registryUrl], { timeout: timeoutMs, encoding: "utf-8", shell: process.platform === "win32" }, (err, stdout, stderr) => {
+            if (err) {
+                const message = String(stderr || err.message || "npm view failed").trim();
+                return resolve({ ok: false, message });
+            }
+            try {
+                resolve({ ok: true, data: JSON.parse(String(stdout).trim()), message: "" });
+            }
+            catch {
+                resolve({ ok: false, message: "npm view returned non-JSON output" });
+            }
+        });
+    });
+}
+/** True when this registry should be queried through npm rather than fetch(). */
+async function useNpmTransport(registry, deps) {
+    if (registry.url === DEFAULT_NPM_REGISTRY)
+        return false;
+    const transport = await readRegistryTransport(registry.url, deps);
+    return registryNeedsNpmTransport(transport);
+}
+/**
+ * Resolve the registry for `packageName` and fetch its `latest` dist-tag,
+ * validating the result as strict semver before returning it. Never throws for
+ * a refusal or a network failure — those come back as discriminated results so
+ * every caller can decide whether to skip, warn, or abort.
+ */
+export async function fetchLatestVersion(packageName, deps = {}) {
+    let registry;
+    try {
+        registry = await resolveNpmRegistryDetailed(packageName, deps);
+    }
+    catch (err) {
+        if (err instanceof RegistryRefusalError)
+            return { kind: "refused", message: err.message };
+        return { kind: "refused", message: err instanceof Error ? err.message : String(err) };
+    }
+    deps.onRegistry?.(registry);
+    const timeoutMs = deps.timeoutMs ?? 5000;
+    let raw = null;
+    if (await useNpmTransport(registry, deps)) {
+        const out = await runNpmViewJson(packageName, "version", registry.url, timeoutMs);
+        if (!out.ok)
+            return { kind: "unavailable", message: out.message, registry };
+        if (typeof out.data === "string")
+            raw = out.data;
+    }
+    else {
+        const out = await fetchRegistryJson(`${registry.url}/${packageName}/latest`, timeoutMs, deps.fetchImpl);
+        if (!out.ok)
+            return { kind: "unavailable", message: out.message, registry };
+        const data = out.data;
+        if (data && typeof data.version === "string")
+            raw = data.version;
+    }
+    if (raw == null || raw.trim() === "") {
+        return { kind: "unavailable", message: "registry response had no version", registry };
+    }
+    const value = raw.trim();
+    if (!isStrictSemver(value))
+        return { kind: "invalid", value, registry };
+    return { kind: "ok", version: value, registry };
+}
+/**
+ * Resolve the registry for `packageName` and fetch the declared `dependencies`
+ * map for `version`. Used to decide the Harper engine version a target flair
+ * release declares, so the same registry/auth/TLS path is used.
+ */
+export async function fetchDeclaredDependencies(packageName, version, deps = {}) {
+    let registry;
+    try {
+        registry = await resolveNpmRegistryDetailed(packageName, deps);
+    }
+    catch (err) {
+        if (err instanceof RegistryRefusalError)
+            return { kind: "refused", message: err.message };
+        return { kind: "refused", message: err instanceof Error ? err.message : String(err) };
+    }
+    deps.onRegistry?.(registry);
+    const timeoutMs = deps.timeoutMs ?? 5000;
+    let data;
+    if (await useNpmTransport(registry, deps)) {
+        const out = await runNpmViewJson(`${packageName}@${version}`, "dependencies", registry.url, timeoutMs);
+        if (!out.ok)
+            return { kind: "unavailable", message: out.message, registry };
+        data = out.data;
+    }
+    else {
+        const out = await fetchRegistryJson(`${registry.url}/${packageName}/${version}`, timeoutMs, deps.fetchImpl);
+        if (!out.ok)
+            return { kind: "unavailable", message: out.message, registry };
+        data = out.data;
+    }
+    const depsField = data?.dependencies;
+    const dependencies = depsField && typeof depsField === "object" && !Array.isArray(depsField)
+        ? depsField
+        : null;
+    return { kind: "ok", dependencies, registry };
+}

package/dist/resources/mcp-tools.js

@@ -26,8 +26,13 @@
  * the resolved agent, never from the tool arguments — an agent can only act as
  * itself (no forging of agentId / authorId in the body).
  *
- * NOTE (flair#1580): MCP-facing metadata (name, description, inputSchema,
- * output shape) lives in `@tpsdev-ai/flair-tool-descriptors`. This registry
+ * NOTE (flair#1580, vendored by flair#1683): MCP-facing metadata (name,
+ * description, inputSchema, output shape) lives in the descriptor module
+ * vendored at build time into `./tool-descriptors/` (source of truth:
+ * packages/flair-tool-descriptors/src/index.ts — see
+ * scripts/vendor-tool-descriptors.mjs). It is imported by RELATIVE PATH so it
+ * resolves inside the packed tarball with no registry dependency on the
+ * private descriptor package. This registry
  * binds each *native* descriptor to its Harper impl. The stdio adapter binds
  * the same list (stdio surface) to FlairClient HTTP — tool-set drift is
  * impossible by construction. One-sided tools (`attention`, archive verbs,
@@ -53,7 +58,7 @@ import { resolveVersion } from "./version.js";
 import { agentContext, adminContext, collectionResource } from "./in-process.js";
 import { unionUsageMemoryIds } from "./usage-ids.js";
 import { SKILL_TAG, isSkillWrite } from "./skill-write.js";
-import { NATIVE_TOOL_DESCRIPTORS, toMcpToolDef, } from "@tpsdev-ai/flair-tool-descriptors";
+import { NATIVE_TOOL_DESCRIPTORS, toMcpToolDef, } from "./tool-descriptors/index.js";
 const H = {};
 const LOADERS = {
     SemanticSearch: async () => (await import("./SemanticSearch.js")).SemanticSearch,

package/{node_modules/@tpsdev-ai/flair-tool-descriptors/dist → dist/resources/tool-descriptors}/index.js

@@ -1,3 +1,7 @@
+// ⚠️  GENERATED FILE — DO NOT EDIT, DO NOT COMMIT (flair#1683).
+// Verbatim build-time copy of packages/flair-tool-descriptors/src/index.ts, the single source of truth.
+// Regenerated by scripts/vendor-tool-descriptors.mjs (see each package's
+// `prebuild`). Edit the source, not this copy.
 /**
  * Transport-agnostic MCP tool descriptors (flair#1580).
  *

package/dist/version-check.js

@@ -32,6 +32,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { parseSemverCore } from "./fabric-upgrade.js";
+import { fetchLatestVersion } from "./lib/npm-registry.js";
 export const FLAIR_PKG_NAME = "@tpsdev-ai/flair";
 export const DEFAULT_CACHE_PATH = join(homedir(), ".flair", ".version-check-cache.json");
 /** How long a cached "latest" answer is trusted before we re-hit the registry. */
@@ -65,19 +66,39 @@ function writeCacheFile(path, entry) {
 }
 async function defaultFetchLatest(timeoutMs) {
     try {
-        const res = await fetch(`https://registry.npmjs.org/${FLAIR_PKG_NAME}/latest`, {
-            signal: AbortSignal.timeout(timeoutMs),
-        });
-        if (!res.ok)
+        // flair#1688: honour the registry npm is configured to use (scoped
+        // `@scope:registry`, project/user/global .npmrc, env `npm_config_registry`)
+        // rather than a hardcoded public host — a private mirror must not be
+        // silently bypassed by the update check.
+        //
+        // flair#1692: `fetchLatestVersion` validates the URL scheme, refuses
+        // redirects, applies npm's transport where a bare fetch cannot, and —
+        // critically — validates the returned value as strict semver before it can
+        // ever be used as an install spec.
+        const result = await fetchLatestVersion(FLAIR_PKG_NAME, { timeoutMs });
+        if (result.kind === "ok")
+            return result.version;
+        if (result.kind === "invalid") {
+            // A hostile/compromised registry can return a URL or tag as `latest`;
+            // npm would install `pkg@<url>` as a remote tarball. Refuse, and say so
+            // rather than silently treating it as "no update".
+            console.error(`flair version check: the configured registry returned a non-semver "latest" (${JSON.stringify(result.value)}) ` +
+                `from ${result.registry.url} — refusing to use it. Check \`registry\` / \`@scope:registry\` (source: ${result.registry.source}).`);
             return null;
-        const data = (await res.json());
-        return typeof data?.version === "string" ? data.version : null;
-    }
-    catch {
+        }
+        if (result.kind === "refused") {
+            console.error(result.message);
+            return null;
+        }
         // Offline, DNS failure, timeout, registry 5xx, bad JSON — all the same:
         // we couldn't determine "latest" over the network this time.
         return null;
     }
+    catch {
+        // Defense-in-depth: the helper already swallows its failure modes. This
+        // guards the status/doctor never-throws contract even if it does not.
+        return null;
+    }
 }
 export function defaultVersionCheckDeps() {
     return {

package/docs/releasing.md

@@ -8,8 +8,7 @@ A maintainer then approves the staged tarballs on npmjs.com with 2FA to make the
 > `flair-bench` is version-bumped and tagged in lockstep with the other 7, and stages in
 > its own step in CI for [historical reasons](#flair-bench-bootstrap-one-time-done). That
 > step is no longer allowed to fail: every already-published package must stage
-> for a release to pass. `@tpsdev-ai/flair-tool-descriptors` is the one
-> first-publish exception until an npm org owner bootstraps it.
+> for a release to pass.
 
 ```
  merge release PR ──▶ push tag v0.11.0 ──▶ CI stages all packages ──▶ npm staging
@@ -147,17 +146,15 @@ Leave `npm publish` **unchecked** under allowed actions. This structurally preve
 CI/OIDC identity from publishing anything live directly — the only path to live is the
 human 2FA approval of a staged package.
 
-Packages: `flair-client`, `flair-tool-descriptors`, `flair-mcp`, `flair`,
+Packages: `flair-client`, `flair-mcp`, `flair`,
 `openclaw-flair`, `pi-flair`, `n8n-nodes-flair`, `langgraph-flair`, `flair-bench`.
 
-> A package must already exist on npm before a trusted publisher can be added.
-> `@tpsdev-ai/flair-tool-descriptors` (flair#1580) is the next first-publish:
-> stage it with the dedicated continue-on-error step, then an npm org owner
-> publishes once and registers its Trusted Publisher (same playbook as
-> `flair-bench` below). Until that exists on the registry, `@tpsdev-ai/flair`
-> and `@tpsdev-ai/flair-mcp` tarballs bundle it (`bundleDependencies` +
-> `scripts/materialize-bundled-descriptors.mjs`) so `npm install` of those
-> tarballs does not 404.
+> `flair-tool-descriptors` is private and never published. Since flair#1683 it is a
+> **build-time source**: `scripts/vendor-tool-descriptors.mjs` copies it into each
+> consumer's own tree at prebuild (`resources/tool-descriptors/` for `flair`,
+> `packages/flair-mcp/src/tool-descriptors/` for `flair-mcp`) and the consumers
+> import it by relative path. Nothing declares or bundles it as a dependency —
+> 0.54.1's `bundleDependencies` broke fresh global installs (flair#1681 → #1683).
 
 ### `flair-bench` bootstrap (one-time, done)
 
@@ -196,6 +193,15 @@ review. Because the release is triggered by a tag push, its deployment policy mu
 **`v*` tags** (Settings → Environments → `release` → Deployment branches and tags →
 Selected branches and tags → add tag rule `v*`).
 
+### Required status checks (ruleset)
+
+Add **`First-publish preflight`** to the main branch ruleset's required status
+checks (repo settings → Rules → main). This is a repo-settings act, not a code
+change: until it is listed, the release-PR job is **advisory only** and a red
+first-publish preflight can be merged past. The tag-triggered
+`release-publish.yml` also runs the same check before staging, so a hazard is
+still stopped on the normal release path either way.
+
 ### Approver 2FA
 
 The maintainer who approves staged packages must have 2FA enabled on their npm account.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tpsdev-ai/flair",
-  "version": "0.54.1",
+  "version": "0.54.2",
   "packageManager": "bun@1.3.10",
   "description": "Identity, memory, and soul for AI agents. Cryptographic identity (Ed25519), semantic memory with local embeddings, and persistent personality — all in a single process.",
   "type": "module",
@@ -46,11 +46,10 @@
   ],
   "scripts": {
     "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
-    "prebuild": "npm run clean && cd packages/flair-tool-descriptors && npm run build",
+    "prebuild": "npm run clean && node scripts/vendor-tool-descriptors.mjs",
     "build": "tsc -p tsconfig.json --noCheck && node scripts/write-build-info.mjs",
     "build:cli": "tsc -p tsconfig.cli.json --noCheck && node scripts/write-build-info.mjs",
-    "prepack": "node scripts/materialize-bundled-descriptors.mjs",
-    "prepublishOnly": "npm run build && npm run build:cli",
+    "prepack": "npm run build && npm run build:cli",
     "test": "bun run test:unit",
     "test:unit": "bun scripts/test-unit.ts",
     "test:e2e": "playwright test",
@@ -72,12 +71,8 @@
     "jose": "6.2.2",
     "js-yaml": "^4.3.2",
     "tar": "^7.5.22",
-    "tweetnacl": "1.0.3",
-    "@tpsdev-ai/flair-tool-descriptors": "0.54.1"
+    "tweetnacl": "1.0.3"
   },
-  "bundleDependencies": [
-    "@tpsdev-ai/flair-tool-descriptors"
-  ],
   "overrides": {
     "react-native-fs": "npm:empty-npm-package@1.0.0",
     "brace-expansion": "^5.0.9",

package/node_modules/@tpsdev-ai/flair-tool-descriptors/LICENSE

@@ -1,19 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   Copyright 2026 TPS Dev AI
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

package/node_modules/@tpsdev-ai/flair-tool-descriptors/README.md

@@ -1,22 +0,0 @@
-# @tpsdev-ai/flair-tool-descriptors
-
-Transport-agnostic MCP tool descriptors for [Flair](https://tps.dev/#flair).
-
-This package is **pure data and types**: tool name, description, JSON Schema
-`inputSchema`, output shape, and reviewed surface flags. It imports neither
-Harper nor FlairClient. The Flair server binds each native descriptor to its
-Harper implementation; `@tpsdev-ai/flair-mcp` binds each stdio descriptor to a
-FlairClient HTTP call. Both tool sets are derived from this list, so a new
-descriptor appears on every listed surface with zero hand-wiring (flair#1580).
-
-## Install
-
-```bash
-npm install @tpsdev-ai/flair-tool-descriptors
-```
-
-## Surfaces
-
-`native` and `stdio` default to true. Set either to `false` for a reviewed
-one-sided tool (`attention` is native-only; `relationship_store` is
-stdio-only). The #1578 exemption list is derived from those flags.

package/node_modules/@tpsdev-ai/flair-tool-descriptors/dist/index.d.ts

@@ -1,70 +0,0 @@
-/**
- * Transport-agnostic MCP tool descriptors (flair#1580).
- *
- * Pure data + types: name, description, inputSchema, output shape, and
- * reviewed surface flags. No Harper, no FlairClient, no Zod, no HTTP.
- *
- * The server TOOLS registry binds each native descriptor to its Harper impl.
- * The flair-mcp stdio adapter binds each stdio descriptor to a FlairClient
- * call. Both tool sets are DERIVED from this list — a new descriptor appears
- * on every surface that lists it, with zero hand-wiring.
- */
-/** JSON Schema object used as MCP tools/list inputSchema. */
-export interface JsonSchemaObject {
-    type: "object";
-    properties: Record<string, JsonSchemaProperty>;
-    required?: string[];
-}
-export interface JsonSchemaProperty {
-    type?: string;
-    description?: string;
-    enum?: string[];
-    items?: {
-        type?: string;
-    };
-    default?: unknown;
-}
-/** MCP tool descriptor as returned by tools/list. */
-export interface McpToolDef {
-    name: string;
-    description: string;
-    inputSchema: JsonSchemaObject;
-    annotations?: Record<string, unknown>;
-}
-/**
- * One MCP-facing tool. `native` / `stdio` default true — omit both and the
- * tool appears on every surface. Set false for a reviewed one-sided tool
- * (the #1578 exemption list is derived from these flags).
- */
-export interface ToolDescriptor {
-    name: string;
-    description: string;
-    inputSchema: JsonSchemaObject;
-    /** One-line output shape (MCP metadata). Native conformance contracts pin this as `summary`. */
-    outputShape: string;
-    annotations?: Record<string, unknown>;
-    /** When false, native /mcp does not bind this tool. Default true. */
-    native?: boolean;
-    /** When false, the stdio adapter does not bind this tool. Default true. */
-    stdio?: boolean;
-    /** Stdio-only description when the HTTP path differs from native /mcp policy. */
-    stdioDescription?: string;
-    /** Properties advertised on native /mcp only (reviewed, e.g. flair#1579). */
-    stdioOmitProperties?: readonly string[];
-    /** Properties advertised on the stdio adapter only (reviewed). */
-    stdioExtraProperties?: Record<string, JsonSchemaProperty>;
-}
-export declare function isNativeTool(d: ToolDescriptor): boolean;
-export declare function isStdioTool(d: ToolDescriptor): boolean;
-export declare function toMcpToolDef(d: ToolDescriptor): McpToolDef;
-/** Native tools/list def, minus reviewed stdio-only omissions. */
-export declare function toStdioMcpToolDef(d: ToolDescriptor): McpToolDef;
-export declare function descriptorNames(descriptors: readonly ToolDescriptor[]): string[];
-export declare const TOOL_DESCRIPTORS: readonly ToolDescriptor[];
-export declare const NATIVE_TOOL_DESCRIPTORS: readonly ToolDescriptor[];
-export declare const STDIO_TOOL_DESCRIPTORS: readonly ToolDescriptor[];
-/** Derived #1578 exemption list — one-sided by construction, not hand-synced. */
-export declare const SURFACE_EXEMPTIONS: {
-    readonly registryOnly: string[];
-    readonly adapterOnly: string[];
-};

package/node_modules/@tpsdev-ai/flair-tool-descriptors/package.json

@@ -1,46 +0,0 @@
-{
-  "name": "@tpsdev-ai/flair-tool-descriptors",
-  "version": "0.54.1",
-  "description": "Transport-agnostic MCP tool descriptors for Flair — name, description, inputSchema, output shape. No Harper, no FlairClient.",
-  "type": "module",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
-    }
-  },
-  "files": [
-    "dist/",
-    "LICENSE",
-    "README.md"
-  ],
-  "scripts": {
-    "build": "tsc --noCheck",
-    "test": "bun test",
-    "prepublishOnly": "npm run build"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "license": "Apache-2.0",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/tpsdev-ai/flair.git",
-    "directory": "packages/flair-tool-descriptors"
-  },
-  "homepage": "https://tps.dev/#flair",
-  "keywords": [
-    "flair",
-    "mcp",
-    "tools",
-    "descriptors"
-  ],
-  "devDependencies": {
-    "typescript": "5.9.3"
-  }
-}