create-openagent 0.1.1 → 0.2.0

package/dist/index.js

@@ -1,1412 +1,723 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { intro, outro, isCancel as isCancel2 } from "@clack/prompts";
-import pc from "picocolors";
+import { resolve as resolve2 } from "path";
+import { existsSync, realpathSync } from "fs";
+import { fileURLToPath } from "url";
+
+// package.json
+var package_default = {
+  name: "create-openagent",
+  version: "0.2.0",
+  description: "Create a working OpenAgentID app with local identity, real verification and live avatars.",
+  license: "Apache-2.0 OR MIT",
+  author: "L1fe Labs, Inc. <eng@l1fe.ai>",
+  homepage: "https://openagent.id",
+  repository: {
+    type: "git",
+    url: "https://github.com/OpenAgentID/openagent-sdk.git",
+    directory: "packages/create-openagent"
+  },
+  type: "module",
+  bin: {
+    "create-openagent": "./dist/index.js"
+  },
+  files: [
+    "dist",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE-APACHE",
+    "LICENSE-MIT"
+  ],
+  publishConfig: {
+    access: "public"
+  },
+  scripts: {
+    build: "tsup",
+    dev: "tsup --watch",
+    typecheck: "tsc --noEmit",
+    start: "node dist/index.js",
+    test: "node --test test/*.test.mjs"
+  },
+  dependencies: {
+    "@clack/prompts": "^0.7.0",
+    picocolors: "^1.0.0"
+  },
+  devDependencies: {
+    "@types/node": "^20.11.30",
+    tsup: "^8.0.2",
+    typescript: "^5.4.5"
+  },
+  engines: {
+    node: ">=20"
+  },
+  keywords: [
+    "create",
+    "openagent",
+    "agent",
+    "scaffold",
+    "cli",
+    "mcp",
+    "did",
+    "oas"
+  ]
+};
 
 // src/prompts.ts
 import * as p from "@clack/prompts";
-function parseFlagValue(args, flag) {
-  const idx = args.indexOf(flag);
-  if (idx >= 0 && idx + 1 < args.length) {
-    return args[idx + 1];
+function validateProjectName(value) {
+  if (typeof value !== "string" || /\s/.test(value) || !/^[a-z0-9][a-z0-9_-]{0,63}$/.test(value) || /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9]|node_modules)$/i.test(value)) {
+    throw new Error("Use a project name of 1\u201364 lowercase letters, numbers, dashes or underscores; no paths or reserved names.");
   }
-  return void 0;
-}
-function hasFlag(args, flag) {
-  return args.includes(flag);
-}
-async function collectOptions(projectNameArg, args) {
-  const projectName = projectNameArg ?? await p.text({
-    message: "Project name:",
-    placeholder: "my-agent-app",
-    validate: (value) => {
-      if (!value.trim()) return "Project name is required.";
-      if (!/^[a-z0-9][a-z0-9._-]*$/i.test(value)) {
-        return "Invalid project name (use alphanumeric, dashes, dots, underscores).";
+  return value;
+}
+function parseArguments(args) {
+  let projectName;
+  let yes = false;
+  let special;
+  const seen = /* @__PURE__ */ new Set();
+  for (let index = 0; index < args.length; index++) {
+    const arg = args[index];
+    if (typeof arg !== "string" || arg.length === 0) throw new Error("Empty arguments are not supported.");
+    const flag = arg === "-y" ? "--yes" : arg === "-h" ? "--help" : arg === "-v" ? "--version" : arg;
+    if (["--yes", "--help", "--version", "--template"].includes(flag)) {
+      if (seen.has(flag)) throw new Error("Duplicate option: " + flag);
+      seen.add(flag);
+      if (flag === "--yes") yes = true;
+      else if (flag === "--help" || flag === "--version") {
+        if (special) throw new Error("Use --help or --version on its own.");
+        special = flag === "--help" ? "help" : "version";
+      } else {
+        const value = args[++index];
+        if (value !== "starter") throw new Error("Only --template starter is supported in 0.2. Historical templates need migration to the current SDK.");
       }
-      return void 0;
+    } else if (arg.startsWith("-")) {
+      throw new Error("Unsupported option: " + arg + ". Use the local starter: create-openagent app --yes. Adapter, bridge, deploy and historical template options are not supported in 0.2.");
+    } else {
+      if (projectName !== void 0) throw new Error("Provide exactly one project name.");
+      projectName = validateProjectName(arg);
     }
-  });
-  if (p.isCancel(projectName)) throw new Error("Cancelled");
-  const templateFlag = parseFlagValue(args, "--template");
-  const template = templateFlag ?? await p.select({
-    message: "What type of agent app?",
-    options: [
-      { value: "agent", label: "Agent", hint: "Standalone agent with identity and tools" },
-      { value: "mcp-server", label: "MCP Server", hint: "Model Context Protocol server with auth" },
-      { value: "web-dashboard", label: "Web Dashboard", hint: "Next.js dashboard for agent management" },
-      { value: "full-stack", label: "Full Stack", hint: "Agent + MCP + Dashboard combined" }
-    ]
-  });
-  if (p.isCancel(template)) throw new Error("Cancelled");
-  const adapterFlag = parseFlagValue(args, "--adapter");
-  const adapters = adapterFlag ? [adapterFlag] : await p.multiselect({
-    message: "Authentication adapters?",
-    options: [
-      { value: "http", label: "HTTP", hint: "Bearer token / challenge-response" },
-      { value: "websocket", label: "WebSocket", hint: "Persistent connection auth" },
-      { value: "grpc", label: "gRPC", hint: "Protobuf-based auth" }
-    ],
-    initialValues: ["http"],
-    required: true
-  });
-  if (p.isCancel(adapters)) throw new Error("Cancelled");
-  const bridgeFlag = parseFlagValue(args, "--bridge");
-  const bridge = bridgeFlag ?? await p.select({
-    message: "Enterprise bridge?",
-    options: [
-      { value: "none", label: "None", hint: "Skip enterprise integration" },
-      { value: "oidc", label: "OIDC", hint: "OpenID Connect bridge for human SSO" },
-      { value: "scim", label: "SCIM", hint: "User provisioning bridge" }
-    ]
-  });
-  if (p.isCancel(bridge)) throw new Error("Cancelled");
-  const deployFlag = parseFlagValue(args, "--deploy");
-  const deploy = deployFlag ?? await p.select({
-    message: "Deploy target?",
-    options: [
-      { value: "local", label: "Local", hint: "Run locally with Node.js" },
-      { value: "cloudflare", label: "Cloudflare Workers", hint: "Edge-first deployment" },
-      { value: "vercel", label: "Vercel Edge", hint: "Next.js-optimized deployment" },
-      { value: "aws", label: "AWS Lambda", hint: "Serverless with API Gateway" },
-      { value: "docker", label: "Docker", hint: "Container deployment" }
-    ]
-  });
-  if (p.isCancel(deploy)) throw new Error("Cancelled");
-  const bioagentic = hasFlag(args, "--bioagentic") ? true : await p.confirm({
-    message: "Include Bioagentic entity classification?",
-    initialValue: false
-  });
-  if (p.isCancel(bioagentic)) throw new Error("Cancelled");
-  const fabrics = hasFlag(args, "--fabrics") ? true : await p.confirm({
-    message: "Include Fabrics routing?",
-    initialValue: false
-  });
-  if (p.isCancel(fabrics)) throw new Error("Cancelled");
+  }
+  if (special) {
+    if (args.length !== 1) throw new Error("Use --help or --version on its own.");
+    return Object.freeze({ kind: special });
+  }
+  if (yes && projectName === void 0) throw new Error("With --yes, provide a project name: create-openagent app --yes.");
+  return Object.freeze({ kind: "create", projectName, yes, template: "starter" });
+}
+async function collectOptions(input, interactive = Boolean(process.stdin.isTTY)) {
+  let name = input.projectName;
+  if (name === void 0) {
+    if (input.yes || !interactive) throw new Error("Provide a project name: create-openagent app --yes.");
+    const answer = await p.text({
+      message: "Project name:",
+      placeholder: "my-agent-app",
+      validate(value) {
+        try {
+          validateProjectName(value);
+          return void 0;
+        } catch (error) {
+          return error.message;
+        }
+      }
+    });
+    if (p.isCancel(answer)) throw new Error("Cancelled.");
+    name = validateProjectName(answer);
+  }
   return {
-    projectName: typeof projectName === "string" ? projectName : "my-agent-app",
-    template,
-    adapters,
-    bridge,
-    deploy,
-    bioagentic,
-    fabrics
+    projectName: validateProjectName(name),
+    template: "starter",
+    adapters: [],
+    bridge: "none",
+    deploy: "local",
+    bioagentic: false,
+    fabrics: false
   };
 }
 
 // src/scaffold.ts
-import { existsSync, mkdirSync, writeFileSync } from "fs";
-import { join, dirname } from "path";
-import { spinner } from "@clack/prompts";
+import { mkdirSync, writeFileSync } from "fs";
+import { join, dirname, resolve } from "path";
 
-// src/templates/agent.ts
-function generateAgentTemplate(options) {
+// src/templates/starter.ts
+function generateStarterTemplate(projectName) {
+  const name = validateProjectName(projectName);
   return [
-    { path: "package.json", content: packageJson(options) },
-    { path: "src/index.ts", content: indexTs() },
-    { path: "src/agent.ts", content: agentTs(options) },
-    { path: "src/tools.ts", content: toolsTs() },
-    { path: "README.md", content: readme(options) }
-  ];
-}
-function packageJson(options) {
-  const deps = {
-    "@openagentid/sdk": "^0.1.0"
-  };
-  if (options.bioagentic) {
-    deps["@openagentid/bioagentic"] = "^0.1.0";
-  }
-  if (options.fabrics) {
-    deps["@openagentid/fabrics"] = "^0.1.0";
-  }
-  return JSON.stringify(
-    {
-      name: options.projectName,
+    { path: "package.json", content: JSON.stringify({
+      name,
       version: "0.1.0",
       private: true,
       type: "module",
+      engines: { node: ">=20" },
       scripts: {
-        build: "tsup src/index.ts --format esm --target node20",
-        start: "node dist/index.js",
-        dev: "tsx src/index.ts",
-        typecheck: "tsc --noEmit"
+        dev: "node src/server.mjs",
+        agent: "node src/agent.mjs",
+        identity: "node src/identity.mjs",
+        test: "node --test test/*.test.mjs"
       },
-      dependencies: deps,
-      devDependencies: {
-        "@types/node": "^20.11.30",
-        tsup: "^8.0.2",
-        tsx: "^4.7.0",
-        typescript: "^5.4.5"
-      }
-    },
-    null,
-    2
-  );
-}
-function indexTs() {
-  return `/**
- * Entry point \u2014 creates the agent and runs it.
- */
-
-import { createAgent } from './agent.js';
-import { tools } from './tools.js';
-
-async function main(): Promise<void> {
-  const agent = await createAgent();
-
-  process.stdout.write(\`Agent created: \${agent.did}\\n\`);
-  process.stdout.write(\`Available tools: \${tools.map((t) => t.name).join(', ')}\\n\`);
-
-  // Example: fetch credentials for a provider
-  // const creds = await agent.credentialsFor('openai');
-  // const res = await creds.fetch('https://api.openai.com/v1/chat/completions', { ... });
-}
-
-main().catch((err) => {
-  process.stderr.write(\`Fatal: \${err instanceof Error ? err.message : String(err)}\\n\`);
-  process.exit(1);
-});
-`;
-}
-function agentTs(options) {
-  return `/**
- * Agent identity and authentication setup.
- */
-
-import { OpenAgent, type OpenAgentInstance } from '@openagentid/sdk';
-
-/** Configure the OpenAgent runtime. */
-OpenAgent.configure({
-  endpoints: {
-    oasResolver: process.env.OAS_RESOLVER_URL,
-    arsenalBroker: process.env.ARSENAL_BROKER_URL,
-    aegisVerifier: process.env.AEGIS_VERIFIER_URL,
-  },
-});
-
-/**
- * Create a new agent identity.
- *
- * In production, replace the parent DID and scopes with your own.
- */
-export async function createAgent(): Promise<OpenAgentInstance> {
-  const parentDid = process.env.OPENAGENT_PARENT_DID ?? 'did:oas:l1fe:hmr:alice';
-  const agentName = process.env.OPENAGENT_AGENT_NAME ?? '${options.projectName}';
-
-  return OpenAgent.createAgent({
-    parent: parentDid,
-    name: agentName,
-    scopes: ['openai:chat:completions', 'github:repo:read'],
-  });
-}
-`;
-}
-function toolsTs() {
-  return `/**
- * Example MCP tools \u2014 define your agent's capabilities here.
- */
-
-export interface Tool {
-  readonly name: string;
-  readonly description: string;
-  execute(input: Record<string, unknown>): Promise<unknown>;
-}
-
-/** Echo tool \u2014 returns the input as-is. Useful for testing. */
-const echoTool: Tool = {
-  name: 'echo',
-  description: 'Returns the input unchanged.',
-  async execute(input) {
-    return { echoed: input };
-  },
-};
-
-/** Timestamp tool \u2014 returns the current ISO timestamp. */
-const timestampTool: Tool = {
-  name: 'timestamp',
-  description: 'Returns the current UTC timestamp.',
-  async execute() {
-    return { timestamp: new Date().toISOString() };
-  },
-};
-
-export const tools: readonly Tool[] = [echoTool, timestampTool];
-`;
-}
-function readme(options) {
-  return `# ${options.projectName}
-
-An OpenAgent-powered agent application.
-
-## Setup
-
-\`\`\`bash
-npm install
-cp .env.example .env
-# Edit .env with your agent identity
-\`\`\`
-
-## Development
-
-\`\`\`bash
-npm run dev
-\`\`\`
-
-## Build & Run
-
-\`\`\`bash
-npm run build
-npm start
-\`\`\`
-
-## Configuration
-
-Set environment variables in \`.env\`:
-
-- \`OPENAGENT_PARENT_DID\` \u2014 Your human root DID
-- \`OPENAGENT_AGENT_NAME\` \u2014 Agent name
-- \`OAS_RESOLVER_URL\` \u2014 OAS identity resolver (optional for dev)
-- \`ARSENAL_BROKER_URL\` \u2014 Arsenal credential broker (optional for dev)
-- \`AEGIS_VERIFIER_URL\` \u2014 AEGIS verifier (optional for dev)
-
-## Learn More
-
-- [OpenAgent Docs](https://openagent.id/docs)
-- [OAS Specification](https://openagent.id/spec)
-`;
-}
-
-// src/templates/mcp-server.ts
-function generateMcpServerTemplate(options) {
-  return [
-    { path: "package.json", content: packageJson2(options) },
-    { path: "src/index.ts", content: indexTs2() },
-    { path: "src/server.ts", content: serverTs(options) },
-    { path: "src/tools/echo.ts", content: echoToolTs() },
-    { path: "src/tools/index.ts", content: toolsIndexTs() },
-    { path: "README.md", content: readme2(options) }
+      dependencies: { "@openagentid/sdk": "0.4.0" }
+    }, null, 2) + "\n" },
+    { path: ".gitignore", content: "node_modules/\n.openagent/\ncoverage/\n.env\n" },
+    { path: "src/workspaces.mjs", content: workspaces },
+    { path: "src/server.mjs", content: server },
+    { path: "src/agent.mjs", content: agent },
+    { path: "src/identity.mjs", content: identity },
+    { path: "public/index.html", content: html },
+    { path: "public/viewer.js", content: viewer },
+    { path: "public/style.css", content: css },
+    { path: "test/starter.test.mjs", content: tests },
+    { path: "README.md", content: readme }
   ];
 }
-function packageJson2(options) {
-  const deps = {
-    "@openagentid/sdk": "^0.1.0",
-    "@modelcontextprotocol/sdk": "^1.0.0"
-  };
-  if (options.bioagentic) {
-    deps["@openagentid/bioagentic"] = "^0.1.0";
-  }
-  if (options.fabrics) {
-    deps["@openagentid/fabrics"] = "^0.1.0";
-  }
-  return JSON.stringify(
-    {
-      name: options.projectName,
-      version: "0.1.0",
-      private: true,
-      type: "module",
-      scripts: {
-        build: "tsup src/index.ts --format esm --target node20",
-        start: "node dist/index.js",
-        dev: "tsx src/index.ts",
-        typecheck: "tsc --noEmit"
-      },
-      dependencies: deps,
-      devDependencies: {
-        "@types/node": "^20.11.30",
-        tsup: "^8.0.2",
-        tsx: "^4.7.0",
-        typescript: "^5.4.5"
-      }
-    },
-    null,
-    2
-  );
-}
-function indexTs2() {
-  return `/**
- * Entry point \u2014 starts the MCP server.
- */
-
-import { startServer } from './server.js';
-
-startServer().catch((err) => {
-  process.stderr.write(\`Fatal: \${err instanceof Error ? err.message : String(err)}\\n\`);
-  process.exit(1);
-});
-`;
-}
-function serverTs(options) {
-  return `/**
- * MCP Server with OpenAgent authentication middleware.
- *
- * Authenticates incoming tool calls using the OpenAgent SDK before
- * dispatching to tool handlers.
- */
-
-import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';
-import { OpenAgent, type AuthContext } from '@openagentid/sdk';
-import { tools } from './tools/index.js';
-
-const PORT = parseInt(process.env.PORT ?? '3200', 10);
-const HOST = process.env.HOST ?? '0.0.0.0';
-
-/** Configure OpenAgent runtime. */
-OpenAgent.configure({
-  endpoints: {
-    oasResolver: process.env.OAS_RESOLVER_URL,
-    arsenalBroker: process.env.ARSENAL_BROKER_URL,
-    aegisVerifier: process.env.AEGIS_VERIFIER_URL,
-  },
-});
-
-function sendJson(res: ServerResponse, body: unknown, status = 200): void {
-  const payload = JSON.stringify(body);
-  res.writeHead(status, {
-    'Content-Type': 'application/json',
-    'Content-Length': Buffer.byteLength(payload),
-  });
-  res.end(payload);
-}
-
-async function readBody(req: IncomingMessage): Promise<string> {
-  const chunks: Buffer[] = [];
-  for await (const chunk of req) {
-    chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : chunk);
-  }
-  return Buffer.concat(chunks).toString('utf-8');
-}
-
-/** Convert IncomingMessage to WHATWG Request. */
-function toRequest(req: IncomingMessage, body: string): Request {
-  const host = req.headers.host ?? \`\${HOST}:\${PORT}\`;
-  const url = \`http://\${host}\${req.url ?? '/'}\`;
-  const headers = new Headers();
-  for (const [key, value] of Object.entries(req.headers)) {
-    if (value !== undefined) {
-      headers.set(key, Array.isArray(value) ? value.join(', ') : value);
+var workspaces = String.raw`import { OpenAgentWorkspace } from '@openagentid/sdk/local';
+import { mkdir, lstat, readFile, writeFile } from 'node:fs/promises';
+import { dirname, resolve, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { randomUUID } from 'node:crypto';
+
+export const projectRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+async function stat(path) {
+  try { return await lstat(path); } catch (error) { if (error.code === 'ENOENT') return undefined; throw error; }
+}
+
+/** First setup deliberately imports the public identity into a separate receiver.
+ * Subsequent opens never recreate keys or trust, including after revocation. */
+export async function openStarter(root = projectRoot) {
+  const directory = join(resolve(root), '.openagent');
+  const existing = await stat(directory);
+  if (existing && (!existing.isDirectory() || existing.isSymbolicLink())) throw new Error('Invalid starter state directory.');
+  if (existing && process.platform !== 'win32' && ((existing.mode & 0o777) !== 0o700 || existing.uid !== process.getuid())) throw new Error('Starter state directory must be owned by this user with mode 0700.');
+  if (!existing) await mkdir(directory, { mode: 0o700 });
+  const signerPath = join(directory, 'signer');
+  const receiverPath = join(directory, 'receiver');
+  const markerPath = join(directory, 'starter.json');
+  const marker = await stat(markerPath);
+  let signer, receiver, did, audience;
+  if (!marker) {
+    if (await stat(signerPath) || await stat(receiverPath)) {
+      throw new Error('Incomplete starter setup. Existing state was preserved; inspect it before explicitly choosing a new workspace.');
     }
+    audience = 'urn:openagent:starter:' + randomUUID();
+    signer = await OpenAgentWorkspace.initialize(signerPath, { audience });
+    const created = await signer.createAgent('starter');
+    receiver = await OpenAgentWorkspace.initialize(receiverPath, { audience });
+    const document = await signer.exportIdentity(created.did);
+    await receiver.trustIdentity(document);
+    did = created.did;
+    await writeFile(join(directory, 'identity.json'), JSON.stringify(document, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
+    await writeFile(markerPath, JSON.stringify({ schemaVersion: 1, did, audience }) + '\n', { flag: 'wx', mode: 0o600 });
+  } else {
+    if (!marker.isFile() || marker.isSymbolicLink() || marker.size > 2048) throw new Error('Invalid starter metadata.');
+    if (process.platform !== 'win32' && ((marker.mode & 0o777) !== 0o600 || marker.uid !== process.getuid())) throw new Error('Starter metadata must be owned by this user with mode 0600.');
+    const saved = JSON.parse(await readFile(markerPath, 'utf8'));
+    if (!saved || Array.isArray(saved) || Object.keys(saved).sort().join(',') !== 'audience,did,schemaVersion' ||
+        saved.schemaVersion !== 1 || typeof saved.did !== 'string' || typeof saved.audience !== 'string' ||
+        !/^urn:openagent:starter:[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(saved.audience)) throw new Error('Invalid starter metadata.');
+    signer = await OpenAgentWorkspace.open(signerPath);
+    receiver = await OpenAgentWorkspace.open(receiverPath);
+    did = saved.did;
+    audience = saved.audience;
   }
-  const method = req.method ?? 'GET';
-  const hasBody = method !== 'GET' && method !== 'HEAD' && body.length > 0;
-  return new Request(url, { method, headers, body: hasBody ? body : undefined });
-}
-
-/** Authenticate the request and return the auth context, or null. */
-async function authenticate(
-  req: IncomingMessage,
-  body: string,
-): Promise<AuthContext | null> {
-  const request = toRequest(req, body);
-  try {
-    return await OpenAgent.authenticate(request);
-  } catch {
-    return null;
+  const signers = await signer.listAgents();
+  const peers = await receiver.listAgents();
+  const selected = signers.find(value => value.did === did && value.hasPrivateKey);
+  if (!selected || !peers.some(value => value.did === did)) throw new Error('Starter identity or receiver trust is missing. State was preserved.');
+  if ((await signer.inspect()).audience !== audience || (await receiver.inspect()).audience !== audience) {
+    throw new Error('Unexpected starter audience.');
   }
+  return Object.freeze({ signer, receiver, did, audience, directory });
 }
-
-interface McpRequest {
-  jsonrpc: '2.0';
-  id: string | number;
-  method: string;
-  params?: Record<string, unknown>;
-}
-
-async function handleMcpRequest(
-  mcpReq: McpRequest,
-  _authCtx: AuthContext,
-): Promise<unknown> {
-  if (mcpReq.method === 'tools/list') {
-    return {
-      jsonrpc: '2.0',
-      id: mcpReq.id,
-      result: {
-        tools: tools.map((t) => ({
-          name: t.name,
-          description: t.description,
-          inputSchema: t.inputSchema,
-        })),
-      },
+`;
+var server = String.raw`import { createServer } from 'node:http';
+import { webcrypto } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { openStarter, projectRoot } from './workspaces.mjs';
+
+const require = createRequire(import.meta.url);
+const contentTypes = { '/': 'text/html; charset=utf-8', '/viewer.js': 'text/javascript; charset=utf-8',
+  '/style.css': 'text/css; charset=utf-8', '/character-player.js': 'text/javascript; charset=utf-8' };
+class Refusal extends Error {
+  constructor(status, code) { super(code); this.status = status; this.code = code; }
+}
+function closed(value, keys) {
+  if (!value || typeof value !== 'object' || Array.isArray(value) ||
+      Object.keys(value).sort().join(',') !== [...keys].sort().join(',')) throw new Refusal(400, 'invalid_request');
+  return value;
+}
+async function jsonBody(request) {
+  if (!/^application\/json(?:;\s*charset=utf-8)?$/i.test(request.headers['content-type'] || '')) throw new Refusal(415, 'json_required');
+  const length = request.headers['content-length'];
+  if (length !== undefined && (!/^[0-9]+$/.test(length) || Number(length) > 24576)) throw new Refusal(413, 'body_too_large');
+  let timer;
+  const body = new Promise((accept, reject) => {
+    let size = 0;
+    const chunks = [];
+    const cleanup = () => { clearTimeout(timer); request.off('data', data); request.off('end', end); request.off('error', fail); request.off('aborted', aborted); };
+    const fail = error => { cleanup(); reject(error); };
+    const aborted = () => fail(new Refusal(400, 'invalid_request'));
+    const data = chunk => {
+      size += chunk.length;
+      if (size > 24576) { fail(new Refusal(413, 'body_too_large')); request.pause(); }
+      else chunks.push(chunk);
     };
-  }
-
-  if (mcpReq.method === 'tools/call') {
-    const toolName = (mcpReq.params?.name as string) ?? '';
-    const args = (mcpReq.params?.arguments as Record<string, unknown>) ?? {};
-    const tool = tools.find((t) => t.name === toolName);
-
-    if (!tool) {
-      return {
-        jsonrpc: '2.0',
-        id: mcpReq.id,
-        error: { code: -32601, message: \`Tool not found: \${toolName}\` },
-      };
-    }
-
-    const result = await tool.execute(args);
-    return {
-      jsonrpc: '2.0',
-      id: mcpReq.id,
-      result: { content: [{ type: 'text', text: JSON.stringify(result) }] },
+    const end = () => {
+      cleanup();
+      try { accept(JSON.parse(Buffer.concat(chunks).toString('utf8'))); }
+      catch { reject(new Refusal(400, 'invalid_request')); }
     };
+    request.on('data', data); request.once('end', end); request.once('error', fail); request.once('aborted', aborted);
+    timer = setTimeout(() => { fail(new Refusal(408, 'body_timeout')); request.pause(); }, 2000);
+  });
+  return body;
+}
+function headers(response) {
+  response.setHeader('cache-control', 'no-store');
+  response.setHeader('x-content-type-options', 'nosniff');
+  response.setHeader('referrer-policy', 'no-referrer');
+  response.setHeader('content-security-policy', "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'");
+}
+function json(response, status, value) {
+  response.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
+  response.end(JSON.stringify(value));
+}
+export async function startServer({ root = projectRoot, port = 3210 } = {}) {
+  if (!Number.isInteger(port) || port < 0 || port > 65535) throw new TypeError('Invalid loopback port.');
+  const workspaces = await openStarter(root);
+  const assets = new Map();
+  for (const [route, name] of [['/', 'index.html'], ['/viewer.js', 'viewer.js'], ['/style.css', 'style.css']]) {
+    assets.set(route, await readFile(new URL('../public/' + name, import.meta.url)));
   }
-
-  return {
-    jsonrpc: '2.0',
-    id: mcpReq.id,
-    error: { code: -32601, message: \`Method not found: \${mcpReq.method}\` },
-  };
-}
-
-export async function startServer(): Promise<void> {
-  const server = createServer(async (req, res) => {
-    const url = new URL(req.url ?? '/', \`http://\${req.headers.host ?? 'localhost'}\`);
-
-    if (url.pathname === '/health') {
-      sendJson(res, { status: 'ok', service: '${options.projectName}' });
-      return;
-    }
-
-    if (url.pathname === '/.well-known/openagent/agent.json') {
-      sendJson(res, {
-        did: \`did:oas:l1fe:agent:\${process.env.OPENAGENT_AGENT_NAME ?? '${options.projectName}'}\`,
-        name: process.env.OPENAGENT_AGENT_NAME ?? '${options.projectName}',
-        parent: process.env.OPENAGENT_PARENT_DID ?? 'did:oas:l1fe:hmr:unconfigured',
-        capabilities: { tools: tools.map((t) => t.name) },
-      });
-      return;
-    }
-
-    if (req.method !== 'POST') {
-      sendJson(res, { error: 'Method not allowed' }, 405);
-      return;
-    }
-
-    const body = await readBody(req);
-    const authCtx = await authenticate(req, body);
-
-    if (!authCtx) {
-      sendJson(res, { error: 'Authentication required' }, 401);
-      return;
-    }
-
+  // Resolve the public SDK package, then serve only its self-contained browser entry.
+  const sdkDirectory = dirname(require.resolve('@openagentid/sdk/characters'));
+  assets.set('/character-player.js', await readFile(join(sdkDirectory, 'browser', 'character-player.js')));
+  let revision = 0, completedRequests = 0, inFlight = 0, lastCompletedAtMs = null;
+  const snapshot = () => ({ schemaVersion: 1, did: workspaces.did, revision,
+    status: inFlight > 0 ? 'working' : completedRequests > 0 ? 'success' : 'idle',
+    completedRequests, lastCompletedAtMs });
+  let address;
+  const server = createServer({ maxHeaderSize: 8192 }, async (request, response) => {
+    headers(response);
     try {
-      const mcpReq = JSON.parse(body) as McpRequest;
-      const result = await handleMcpRequest(mcpReq, authCtx);
-      sendJson(res, result);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : 'Internal error';
-      sendJson(res, { jsonrpc: '2.0', id: null, error: { code: -32700, message } }, 400);
+      // An exact numeric host prevents DNS rebinding. Cross-origin browser writes
+      // are refused; the read-only viewer sends no control requests.
+      if (!['127.0.0.1', '::ffff:127.0.0.1'].includes(request.socket.remoteAddress) || request.headers.host !== address) throw new Refusal(403, 'loopback_only');
+      if (request.headers.origin !== undefined && request.headers.origin !== 'http://' + address) throw new Refusal(403, 'origin_refused');
+      if (request.headers['sec-fetch-site'] === 'cross-site') throw new Refusal(403, 'origin_refused');
+      const route = request.url;
+      if (request.method === 'GET' && assets.has(route)) {
+        if (request.headers['content-length'] !== undefined || request.headers['transfer-encoding'] !== undefined) throw new Refusal(400, 'invalid_request');
+        response.writeHead(200, { 'content-type': contentTypes[route] }); response.end(assets.get(route)); return;
+      }
+      if (request.method === 'GET' && route === '/state') {
+        if (request.headers['content-length'] !== undefined || request.headers['transfer-encoding'] !== undefined) throw new Refusal(400, 'invalid_request');
+        json(response, 200, snapshot()); return;
+      }
+      if (request.method !== 'POST' || !['/challenge', '/request'].includes(route)) throw new Refusal(404, 'not_found');
+      if (request.headers.origin !== undefined || request.headers['sec-fetch-site'] && request.headers['sec-fetch-site'] !== 'none') throw new Refusal(403, 'operator_command_required');
+      const body = await jsonBody(request);
+      if (route === '/challenge') {
+        closed(body, ['did']);
+        if (body.did !== workspaces.did) throw new Refusal(403, 'identity_refused');
+        let challenge;
+        try { challenge = await workspaces.receiver.issueChallenge(body.did); }
+        catch { throw new Refusal(403, 'identity_refused'); }
+        json(response, 200, challenge); return;
+      }
+      closed(body, ['nonce', 'proof', 'message']);
+      if (typeof body.nonce !== 'string' || body.nonce.length === 0 || body.nonce.length > 256 ||
+          typeof body.message !== 'string' || Buffer.byteLength(body.message, 'utf8') === 0 || Buffer.byteLength(body.message, 'utf8') > 4096) throw new Refusal(400, 'invalid_request');
+      closed(body.proof, ['token', 'delegations']);
+      if (typeof body.proof.token !== 'string' || body.proof.token.length > 16384 ||
+          !Array.isArray(body.proof.delegations) || body.proof.delegations.length !== 0) throw new Refusal(400, 'invalid_request');
+      let verified;
+      try { verified = await workspaces.receiver.verify(body.proof, { nonce: body.nonce }); }
+      catch { throw new Refusal(403, 'identity_refused'); }
+      if (verified.did !== workspaces.did) throw new Refusal(403, 'identity_refused');
+      if (revision >= Number.MAX_SAFE_INTEGER - 2 || completedRequests >= Number.MAX_SAFE_INTEGER - 1) throw new Refusal(503, 'request_unavailable');
+      inFlight++; revision++;
+      try {
+        const digest = Buffer.from(await webcrypto.subtle.digest('SHA-256', Buffer.from(body.message, 'utf8'))).toString('hex');
+        completedRequests++; lastCompletedAtMs = Date.now();
+        json(response, 200, { schemaVersion: 1, did: verified.did, message: body.message, digest });
+      } finally { inFlight--; revision++; }
+    } catch (error) {
+      const status = error instanceof Refusal ? error.status : 503;
+      const code = error instanceof Refusal ? error.code : 'request_unavailable';
+      if (status === 408 || status === 413) response.once('finish', () => request.destroy());
+      if (!response.headersSent && !response.destroyed) json(response, status, { error: code });
     }
   });
-
-  server.listen(PORT, HOST, () => {
-    process.stdout.write(\`MCP server listening on http://\${HOST}:\${PORT}\\n\`);
-    process.stdout.write(\`Tools: \${tools.map((t) => t.name).join(', ')}\\n\`);
+  server.requestTimeout = 5000;
+  server.headersTimeout = 5000;
+  server.keepAliveTimeout = 1000;
+  await new Promise((accept, reject) => {
+    server.once('error', reject);
+    server.listen(port, '127.0.0.1', () => { server.off('error', reject); accept(); });
+  });
+  address = '127.0.0.1:' + server.address().port;
+  return Object.freeze({ server, url: 'http://' + address, did: workspaces.did, workspaces,
+    close: () => new Promise((accept, reject) => { server.close(error => error ? reject(error) : accept()); server.closeAllConnections(); }),
   });
 }
-`;
-}
-function echoToolTs() {
-  return `/**
- * Echo tool \u2014 returns the input unchanged. Useful for testing.
- */
-
-import type { McpTool } from './index.js';
-
-export const echoTool: McpTool = {
-  name: 'echo',
-  description: 'Returns the input unchanged.',
-  inputSchema: {
-    type: 'object',
-    properties: {
-      message: { type: 'string', description: 'Message to echo back.' },
-    },
-    required: ['message'],
-  },
-  async execute(input) {
-    return { echoed: input };
-  },
-};
-`;
-}
-function toolsIndexTs() {
-  return `/**
- * Tool registry \u2014 add your tools here.
- */
-
-import { echoTool } from './echo.js';
-
-export interface McpTool {
-  readonly name: string;
-  readonly description: string;
-  readonly inputSchema: Record<string, unknown>;
-  execute(input: Record<string, unknown>): Promise<unknown>;
-}
-
-export const tools: readonly McpTool[] = [echoTool];
-`;
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    const raw = process.env.PORT || '3210';
+    if (!/^[0-9]+$/.test(raw) || Number(raw) < 1024 || Number(raw) > 65535) throw new Error('PORT must be an integer from 1024 to 65535.');
+    const app = await startServer({ port: Number(raw) });
+    console.log('OpenAgent viewer: ' + app.url);
+    console.log('Agent DID: ' + app.did);
+    console.log('Run in another terminal: npm run agent -- "Hello from my agent"');
+    for (const signal of ['SIGINT', 'SIGTERM']) process.once(signal, () => { app.close().then(() => process.exit(0), () => process.exit(1)); });
+  } catch (error) { console.error('Starter could not open: ' + error.message); process.exitCode = 1; }
 }
-function readme2(options) {
-  return `# ${options.projectName}
-
-An MCP server with OpenAgent authentication.
-
-## Setup
-
-\`\`\`bash
-npm install
-cp .env.example .env
-\`\`\`
-
-## Development
-
-\`\`\`bash
-npm run dev
-\`\`\`
-
-## Adding Tools
-
-1. Create a new file in \`src/tools/\`
-2. Export an \`McpTool\` object
-3. Add it to the \`tools\` array in \`src/tools/index.ts\`
-
-## Learn More
-
-- [OpenAgent Docs](https://openagent.id/docs)
-- [MCP Specification](https://modelcontextprotocol.io)
 `;
-}
-
-// src/templates/web-dashboard.ts
-function generateWebDashboardTemplate(options) {
-  return [
-    { path: "package.json", content: packageJson3(options) },
-    { path: "next.config.ts", content: nextConfig() },
-    { path: "src/app/layout.tsx", content: layoutTsx(options) },
-    { path: "src/app/page.tsx", content: pageTsx(options) },
-    { path: "src/app/api/auth/route.ts", content: authRoute() },
-    { path: "src/app/api/agents/route.ts", content: agentsRoute() },
-    { path: "src/lib/openagent.ts", content: openagentLib() },
-    { path: "src/lib/auth.ts", content: authLib(options) },
-    { path: "README.md", content: readme3(options) }
-  ];
-}
-function packageJson3(options) {
-  const deps = {
-    "@openagentid/sdk": "^0.1.0",
-    next: "^15.0.0",
-    react: "^19.0.0",
-    "react-dom": "^19.0.0"
-  };
-  if (options.bioagentic) {
-    deps["@openagentid/bioagentic"] = "^0.1.0";
+var agent = String.raw`import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { openStarter, projectRoot } from './workspaces.mjs';
+
+async function exchange(url, body) {
+  const response = await fetch(url, { method: 'POST', redirect: 'error',
+    headers: { 'content-type': 'application/json' }, body: JSON.stringify(body), signal: AbortSignal.timeout(5000) });
+  if (!response.ok || response.headers.get('cache-control') !== 'no-store') throw new Error('Receiver refused the request (' + response.status + ').');
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of response.body) {
+    size += chunk.length;
+    if (size > 16384) throw new Error('Receiver response exceeded its limit.');
+    chunks.push(chunk);
   }
-  return JSON.stringify(
-    {
-      name: options.projectName,
-      version: "0.1.0",
-      private: true,
-      scripts: {
-        dev: "next dev",
-        build: "next build",
-        start: "next start",
-        typecheck: "tsc --noEmit"
-      },
-      dependencies: deps,
-      devDependencies: {
-        "@types/node": "^20.11.30",
-        "@types/react": "^19.0.0",
-        "@types/react-dom": "^19.0.0",
-        typescript: "^5.4.5"
-      }
-    },
-    null,
-    2
-  );
-}
-function nextConfig() {
-  return `import type { NextConfig } from 'next';
-
-const config: NextConfig = {
-  reactStrictMode: true,
-  experimental: {
-    serverActions: {
-      bodySizeLimit: '2mb',
-    },
-  },
-};
-
-export default config;
-`;
-}
-function layoutTsx(options) {
-  return `import type { Metadata } from 'next';
-import type { ReactNode } from 'react';
-
-export const metadata: Metadata = {
-  title: '${options.projectName} \u2014 OpenAgent Dashboard',
-  description: 'Agent management dashboard powered by OpenAgent.',
-};
-
-export default function RootLayout({ children }: { children: ReactNode }) {
-  return (
-    <html lang="en">
-      <body style={{ fontFamily: 'system-ui, sans-serif', margin: 0, padding: '2rem' }}>
-        <header style={{ borderBottom: '1px solid #eee', paddingBottom: '1rem', marginBottom: '2rem' }}>
-          <h1 style={{ fontSize: '1.5rem', margin: 0 }}>
-            ${options.projectName}
-          </h1>
-          <p style={{ color: '#666', margin: '0.25rem 0 0' }}>OpenAgent Dashboard</p>
-        </header>
-        <main>{children}</main>
-      </body>
-    </html>
-  );
-}
-`;
-}
-function pageTsx(options) {
-  return `/**
- * Dashboard home \u2014 shows agent status and recent activity.
- */
-
-export default async function HomePage() {
-  const agentName = process.env.OPENAGENT_AGENT_NAME ?? '${options.projectName}';
-  const parentDid = process.env.OPENAGENT_PARENT_DID ?? 'did:oas:l1fe:hmr:unconfigured';
-
-  return (
-    <div>
-      <section style={{ marginBottom: '2rem' }}>
-        <h2>Agent Status</h2>
-        <table style={{ borderCollapse: 'collapse', width: '100%', maxWidth: '600px' }}>
-          <tbody>
-            <tr>
-              <td style={{ padding: '0.5rem', fontWeight: 'bold' }}>Name</td>
-              <td style={{ padding: '0.5rem' }}>{agentName}</td>
-            </tr>
-            <tr>
-              <td style={{ padding: '0.5rem', fontWeight: 'bold' }}>Parent DID</td>
-              <td style={{ padding: '0.5rem', fontFamily: 'monospace', fontSize: '0.85rem' }}>
-                {parentDid}
-              </td>
-            </tr>
-            <tr>
-              <td style={{ padding: '0.5rem', fontWeight: 'bold' }}>Status</td>
-              <td style={{ padding: '0.5rem', color: '#22c55e' }}>Active</td>
-            </tr>
-          </tbody>
-        </table>
-      </section>
-
-      <section>
-        <h2>API Endpoints</h2>
-        <ul style={{ lineHeight: 2 }}>
-          <li>
-            <code>GET /api/agents</code> \u2014 List managed agents
-          </li>
-          <li>
-            <code>POST /api/auth</code> \u2014 Authenticate agent request
-          </li>
-          <li>
-            <code>GET /.well-known/openagent/agent.json</code> \u2014 Agent discovery
-          </li>
-        </ul>
-      </section>
-    </div>
-  );
-}
-`;
-}
-function authRoute() {
-  return `/**
- * POST /api/auth \u2014 Authenticate an incoming agent request.
- */
-
-import { NextResponse, type NextRequest } from 'next/server';
-import { getRuntime } from '@/lib/openagent';
-
-export async function POST(request: NextRequest): Promise<NextResponse> {
-  const runtime = getRuntime();
-
+  return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+}
+export async function sendAgentRequest({ root = projectRoot, url = 'http://127.0.0.1:3210', message = 'Hello from my agent' } = {}) {
+  const target = new URL(url);
+  if (target.protocol !== 'http:' || target.hostname !== '127.0.0.1' || !target.port || target.username ||
+      target.password || target.pathname !== '/' || target.search || target.hash) throw new Error('Use the numeric loopback receiver origin shown by npm run dev.');
+  if (typeof message !== 'string' || Buffer.byteLength(message, 'utf8') === 0 || Buffer.byteLength(message, 'utf8') > 4096) throw new Error('Message must contain 1–4096 UTF-8 bytes.');
+  const { signer, did, audience } = await openStarter(root);
+  const challenge = await exchange(target.origin + '/challenge', { did });
+  if (!challenge || Array.isArray(challenge) || Object.keys(challenge).sort().join(',') !== 'audience,expiresAt,nonce' ||
+      challenge.audience !== audience || typeof challenge.nonce !== 'string' || challenge.nonce.length === 0 ||
+      challenge.nonce.length > 256 || !Number.isSafeInteger(challenge.expiresAt) || challenge.expiresAt <= Date.now() / 1000) throw new Error('Invalid receiver challenge.');
+  const proof = await signer.prove(did, { nonce: challenge.nonce, audience: challenge.audience });
+  return exchange(target.origin + '/request', { nonce: challenge.nonce, proof, message });
+}
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
   try {
-    const ctx = await runtime.authenticate(request as unknown as Request);
-    return NextResponse.json({
-      success: true,
-      data: {
-        did: ctx.did,
-        root: ctx.root,
-        scopes: ctx.scopes,
-        expiresAt: ctx.expiresAt,
-      },
-    });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : 'Authentication failed';
-    return NextResponse.json({ success: false, error: message }, { status: 401 });
-  }
+    if (process.argv.length > 3) throw new Error('Pass one quoted message: npm run agent -- "Hello from my agent"');
+    const result = await sendAgentRequest({ url: process.env.OPENAGENT_RECEIVER_URL || 'http://127.0.0.1:' + (process.env.PORT || '3210'), message: process.argv[2] || 'Hello from my agent' });
+    console.log(JSON.stringify(result, null, 2));
+  } catch (error) { console.error(error.message); process.exitCode = 1; }
 }
 `;
-}
-function agentsRoute() {
-  return `/**
- * GET /api/agents \u2014 List managed agents.
- * POST /api/agents \u2014 Create a new agent.
- */
+var identity = String.raw`import { openStarter } from './workspaces.mjs';
 
-import { NextResponse, type NextRequest } from 'next/server';
-import { getRuntime } from '@/lib/openagent';
-
-/**
- * In-memory agent registry for demonstration.
- * Replace with a persistent store in production.
- */
-const agents: Array<{ did: string; name: string; createdAt: string }> = [];
-
-export async function GET(): Promise<NextResponse> {
-  return NextResponse.json({ success: true, data: agents });
-}
-
-export async function POST(request: NextRequest): Promise<NextResponse> {
-  const runtime = getRuntime();
-
-  try {
-    const body = (await request.json()) as { name: string; scopes: string[] };
-
-    if (!body.name || !body.scopes?.length) {
-      return NextResponse.json(
-        { success: false, error: 'name and scopes are required' },
-        { status: 400 },
-      );
-    }
-
-    const parentDid = process.env.OPENAGENT_PARENT_DID ?? 'did:oas:l1fe:hmr:unconfigured';
-    const agent = await runtime.createAgent({
-      parent: parentDid,
-      name: body.name,
-      scopes: body.scopes,
-    });
-
-    const record = {
-      did: agent.did,
-      name: body.name,
-      createdAt: new Date().toISOString(),
-    };
-    agents.push(record);
-
-    return NextResponse.json({ success: true, data: record }, { status: 201 });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : 'Agent creation failed';
-    return NextResponse.json({ success: false, error: message }, { status: 500 });
+try {
+  const args = process.argv.slice(2);
+  if (args.length !== 1 || !['export', 'revoke'].includes(args[0])) throw new Error('Use npm run identity -- export or npm run identity -- revoke.');
+  const { signer, receiver, did } = await openStarter();
+  if (args[0] === 'export') console.log(JSON.stringify(await signer.exportIdentity(did), null, 2));
+  else {
+    await receiver.revoke(did);
+    console.log('Revoked receiver trust for ' + did + '. Restart does not undo this decision.');
   }
-}
+} catch (error) { console.error(error.message); process.exitCode = 1; }
 `;
-}
-function openagentLib() {
-  return `/**
- * OpenAgent SDK setup \u2014 shared runtime instance.
- */
-
-import { OpenAgent, type OpenAgentRuntime } from '@openagentid/sdk';
-
-let runtime: OpenAgentRuntime | undefined;
-
-export function getRuntime(): OpenAgentRuntime {
-  if (!runtime) {
-    runtime = OpenAgent.configure({
-      endpoints: {
-        oasResolver: process.env.OAS_RESOLVER_URL,
-        arsenalBroker: process.env.ARSENAL_BROKER_URL,
-        aegisVerifier: process.env.AEGIS_VERIFIER_URL,
-      },
-    });
-  }
-  return runtime;
-}
+var html = String.raw`<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>My OpenAgent</title><link rel="stylesheet" href="/style.css"><script type="module" src="/viewer.js"></script></head>
+<body><main><p class="eyebrow">OpenAgent · local starter</p><h1>Your agent, alive.</h1>
+<div id="avatar" aria-label="Agent avatar"></div><p id="status" role="status">Connecting to the local receiver…</p>
+<p id="identity"></p><div class="controls"><label>Skin <select id="skin"><option value="autos">Autos</option><option value="spacex">SpaceX</option></select></label>
+<label>Expression <select id="expression"><option value="">Follow actual status</option></select></label></div>
+<p>In another terminal, run:</p><pre>npm run agent -- "Hello from my agent"</pre>
+<p>This viewer is read-only. A completed request appears after the receiver verifies a fresh signed proof.</p>
+<p>Keys stay on this computer. No account or identity service is required.</p></main></body></html>
 `;
-}
-function authLib(options) {
-  const oidcSetup = options.bridge === "oidc" ? `
-/**
- * OIDC configuration for human authentication.
- * Set OIDC_* env vars to enable the bridge.
- */
-export const oidcConfig = {
-  issuerUrl: process.env.OIDC_ISSUER_URL,
-  clientId: process.env.OIDC_CLIENT_ID,
-  clientSecret: process.env.OIDC_CLIENT_SECRET,
-  redirectUri: process.env.OIDC_REDIRECT_URI ?? 'http://localhost:3000/api/auth/callback',
-} as const;
-
-export function isOidcConfigured(): boolean {
-  return Boolean(oidcConfig.issuerUrl && oidcConfig.clientId);
-}
-` : "";
-  return `/**
- * Authentication configuration \u2014 human + agent auth.
- */
-
-import { getRuntime } from './openagent.js';
-
-/**
- * Authenticate an incoming request. Returns the agent's auth context
- * or null if authentication fails.
- */
-export async function authenticateRequest(request: Request) {
-  const runtime = getRuntime();
+var css = String.raw`:root{font-family:system-ui,sans-serif;color:#ecf0f5;background:#10151c;color-scheme:dark}body{margin:0}main{max-width:760px;margin:0 auto;padding:48px 24px}h1{font-size:clamp(2rem,6vw,3.8rem);letter-spacing:-.05em;margin:12px 0}p{line-height:1.6;color:#bdc8d6}.eyebrow{font-size:.85rem;letter-spacing:.1em;text-transform:uppercase}#avatar{height:300px;display:flex;align-items:center;justify-content:center;margin:12px 0}#avatar svg{max-width:100%;height:280px}#identity{font-family:monospace;font-size:.85rem;overflow-wrap:anywhere}.controls{display:flex;gap:24px;flex-wrap:wrap}label{display:flex;gap:10px;align-items:center}select{padding:8px;border-radius:8px;background:#222d3b;color:inherit;border:1px solid #516176}pre{padding:18px;white-space:pre-wrap;background:#1b2532;border-radius:12px;border:1px solid #344458}#status{font-weight:600;color:#fff}
+`;
+var viewer = String.raw`import { mountCharacter, getCharacterExpressions } from '/character-player.js';
+
+const skin = document.querySelector('#skin');
+const expression = document.querySelector('#expression');
+const label = document.querySelector('#status');
+const identity = document.querySelector('#identity');
+for (const value of getCharacterExpressions()) {
+  const option = document.createElement('option'); option.value = value; option.textContent = value;
+  expression.append(option);
+}
+let player, did, revision = -1, latestStatus = 'idle', stopped = false, timer;
+skin.addEventListener('change', () => player?.setAppearance({ skin: skin.value }));
+expression.addEventListener('change', () => player?.update({ status: latestStatus, expression: expression.value || null }));
+async function refresh() {
   try {
-    return await runtime.authenticate(request);
+    const response = await fetch('/state', { cache: 'no-store', signal: AbortSignal.timeout(3000) });
+    if (!response.ok) throw new Error('Receiver unavailable.');
+    const state = await response.json();
+    if (stopped) return;
+    if (state.schemaVersion !== 1 || typeof state.did !== 'string' || !Number.isSafeInteger(state.revision) || state.revision < 0 ||
+        !['idle', 'working', 'success'].includes(state.status) || !Number.isSafeInteger(state.completedRequests) || state.completedRequests < 0) throw new Error('Invalid receiver state.');
+    if (!player || state.did !== did) {
+      player?.dispose(); document.querySelector('#avatar').replaceChildren();
+      did = state.did; player = mountCharacter(document.querySelector('#avatar'), did, { skin: skin.value, size: 280, reducedMotion: 'system' });
+      identity.textContent = did; revision = -1;
+    }
+    if (state.revision !== revision) {
+      latestStatus = state.status; player.update({ status: latestStatus, expression: expression.value || null }); revision = state.revision;
+    }
+    label.textContent = state.status + ' · ' + state.completedRequests + ' verified request' + (state.completedRequests === 1 ? '' : 's');
   } catch {
-    return null;
-  }
-}
-${oidcSetup}`;
+    if (!stopped) label.textContent = 'Receiver unavailable · showing the last verified request state';
+  } finally { if (!stopped) timer = setTimeout(refresh, 750); }
 }
-function readme3(options) {
-  return `# ${options.projectName}
-
-A Next.js dashboard for managing OpenAgent-powered agents.
-
-## Setup
-
-\`\`\`bash
-npm install
-cp .env.example .env
-\`\`\`
-
-## Development
-
-\`\`\`bash
-npm run dev
-\`\`\`
-
-Open [http://localhost:3000](http://localhost:3000).
-
-## API Routes
-
-- \`GET /api/agents\` \u2014 List agents
-- \`POST /api/agents\` \u2014 Create agent
-- \`POST /api/auth\` \u2014 Authenticate request
-
-## Learn More
-
-- [OpenAgent Docs](https://openagent.id/docs)
-- [Next.js Docs](https://nextjs.org/docs)
+window.addEventListener('pagehide', () => { stopped = true; clearTimeout(timer); player?.dispose(); player = undefined; });
+window.addEventListener('pageshow', event => { if (event.persisted) { stopped = false; refresh(); } });
+refresh();
 `;
-}
+var readme = String.raw`# Your OpenAgent starter
 
-// src/templates/full-stack.ts
-function generateFullStackTemplate(options) {
-  return [
-    { path: "package.json", content: packageJson4(options) },
-    { path: "next.config.ts", content: nextConfig2() },
-    { path: "src/app/layout.tsx", content: layoutTsx2(options) },
-    { path: "src/app/page.tsx", content: pageTsx2(options) },
-    { path: "src/app/api/auth/route.ts", content: authRoute2() },
-    { path: "src/app/api/agents/route.ts", content: agentsRoute2() },
-    { path: "src/lib/openagent.ts", content: openagentLib2() },
-    { path: "src/lib/auth.ts", content: authLib2(options) },
-    { path: "src/tools/echo.ts", content: echoToolTs2() },
-    { path: "src/tools/index.ts", content: toolsIndexTs2() },
-    { path: "README.md", content: readme4(options) }
-  ];
-}
-function packageJson4(options) {
-  const deps = {
-    "@openagentid/sdk": "^0.1.0",
-    "@modelcontextprotocol/sdk": "^1.0.0",
-    next: "^15.0.0",
-    react: "^19.0.0",
-    "react-dom": "^19.0.0"
-  };
-  if (options.bioagentic) {
-    deps["@openagentid/bioagentic"] = "^0.1.0";
-  }
-  if (options.fabrics) {
-    deps["@openagentid/fabrics"] = "^0.1.0";
-  }
-  return JSON.stringify(
-    {
-      name: options.projectName,
-      version: "0.1.0",
-      private: true,
-      scripts: {
-        dev: "next dev",
-        build: "next build",
-        start: "next start",
-        typecheck: "tsc --noEmit"
-      },
-      dependencies: deps,
-      devDependencies: {
-        "@types/node": "^20.11.30",
-        "@types/react": "^19.0.0",
-        "@types/react-dom": "^19.0.0",
-        typescript: "^5.4.5"
-      }
-    },
-    null,
-    2
-  );
-}
-function nextConfig2() {
-  return `import type { NextConfig } from 'next';
+Requires Node 20+. Run npm install, then npm run dev. Open the numeric loopback URL printed by the server. In another terminal run:
 
-const config: NextConfig = {
-  reactStrictMode: true,
-  experimental: {
-    serverActions: {
-      bodySizeLimit: '2mb',
-    },
-  },
-};
+    npm run agent -- "Hello from my agent"
 
-export default config;
-`;
-}
-function layoutTsx2(options) {
-  return `import type { Metadata } from 'next';
-import type { ReactNode } from 'react';
-
-export const metadata: Metadata = {
-  title: '${options.projectName} \u2014 OpenAgent Full Stack',
-  description: 'Full-stack agent platform powered by OpenAgent.',
-};
+The command obtains a receiver-issued challenge, signs it with a persisted Ed25519 key, and sends a proof. After verification, the receiver hashes and echoes the message. The browser shows the real completed-request count, animated Autos by default, optional SpaceX and selectable expressions. It does not simulate work or broadcast runtime state elsewhere. Reduced motion follows your browser preference.
 
-export default function RootLayout({ children }: { children: ReactNode }) {
-  return (
-    <html lang="en">
-      <body style={{ fontFamily: 'system-ui, sans-serif', margin: 0, padding: '2rem' }}>
-        <header style={{ borderBottom: '1px solid #eee', paddingBottom: '1rem', marginBottom: '2rem' }}>
-          <h1 style={{ fontSize: '1.5rem', margin: 0 }}>
-            ${options.projectName}
-          </h1>
-          <p style={{ color: '#666', margin: '0.25rem 0 0' }}>OpenAgent Full Stack</p>
-        </header>
-        <main>{children}</main>
-      </body>
-    </html>
-  );
-}
-`;
-}
-function pageTsx2(options) {
-  return `/**
- * Dashboard home \u2014 agent status, tools, and management.
- */
+On first setup, src/workspaces.mjs creates two separate local authorities, persists a unique receiver audience and explicitly imports the signer's public DID/key document into the receiver with trustIdentity. The receiver has no signing key for that agent. The public export is .openagent/identity.json. Private keys, challenge and replay state remain under .openagent/ and are excluded from git. Inspect public identity with npm run identity -- export. Never publish .openagent/ or serve it as static assets.
 
-import { tools } from '@/tools';
+Run npm test for real generated-key HTTP verification, restart/replay/revocation and transport refusals. No account, hosted identity service, private package or network identity lookup is involved. Installing the public SDK is the only dependency setup.
 
-export default async function HomePage() {
-  const agentName = process.env.OPENAGENT_AGENT_NAME ?? '${options.projectName}';
-  const parentDid = process.env.OPENAGENT_PARENT_DID ?? 'did:oas:l1fe:hmr:unconfigured';
+    npm run identity -- revoke
 
-  return (
-    <div>
-      <section style={{ marginBottom: '2rem' }}>
-        <h2>Agent Status</h2>
-        <table style={{ borderCollapse: 'collapse', width: '100%', maxWidth: '600px' }}>
-          <tbody>
-            <tr>
-              <td style={{ padding: '0.5rem', fontWeight: 'bold' }}>Name</td>
-              <td style={{ padding: '0.5rem' }}>{agentName}</td>
-            </tr>
-            <tr>
-              <td style={{ padding: '0.5rem', fontWeight: 'bold' }}>Parent DID</td>
-              <td style={{ padding: '0.5rem', fontFamily: 'monospace', fontSize: '0.85rem' }}>
-                {parentDid}
-              </td>
-            </tr>
-            <tr>
-              <td style={{ padding: '0.5rem', fontWeight: 'bold' }}>Status</td>
-              <td style={{ padding: '0.5rem', color: '#22c55e' }}>Active</td>
-            </tr>
-          </tbody>
-        </table>
-      </section>
+Revocation is the receiver's durable local trust decision. Restarting does not restore trust. A revoked starter will refuse further agent requests. Existing or incomplete state is preserved and never silently reset; deliberately choose a separate workspace if you want a new identity/receiver. This example does not claim global revocation, human ownership, application roles or a distributed database.
 
-      <section style={{ marginBottom: '2rem' }}>
-        <h2>Available Tools</h2>
-        <ul style={{ lineHeight: 2 }}>
-          {tools.map((tool) => (
-            <li key={tool.name}>
-              <code>{tool.name}</code> \u2014 {tool.description}
-            </li>
-          ))}
-        </ul>
-      </section>
+The HTTP service listens only on 127.0.0.1:3210. Set PORT consistently for the server and agent command to choose another port, or set OPENAGENT_RECEIVER_URL on the command to the exact printed numeric origin. Host checks prevent DNS rebinding, cross-origin browser controls are refused, and only fixed public assets are served. Trust/revoke are local operator actions, never HTTP controls. GET /state contains only public DID and transient request presentation metadata; it contains no message, output, token or key.
 
-      <section>
-        <h2>API Endpoints</h2>
-        <ul style={{ lineHeight: 2 }}>
-          <li><code>GET /api/agents</code> \u2014 List managed agents</li>
-          <li><code>POST /api/agents</code> \u2014 Create a new agent</li>
-          <li><code>POST /api/auth</code> \u2014 Authenticate request</li>
-        </ul>
-      </section>
-    </div>
-  );
-}
+This starter deliberately has no cloud-deployment, MCP, enterprise bridge or optional identity-stack dependency. Historical 0.1 templates need migration and are not generated by create-openagent 0.2.
 `;
-}
-function authRoute2() {
-  return `/**
- * POST /api/auth \u2014 Authenticate an incoming agent request.
- */
-
-import { NextResponse, type NextRequest } from 'next/server';
-import { getRuntime } from '@/lib/openagent';
-
-export async function POST(request: NextRequest): Promise<NextResponse> {
-  const runtime = getRuntime();
-
-  try {
-    const ctx = await runtime.authenticate(request as unknown as Request);
-    return NextResponse.json({
-      success: true,
-      data: {
-        did: ctx.did,
-        root: ctx.root,
-        scopes: ctx.scopes,
-        expiresAt: ctx.expiresAt,
-      },
+var tests = String.raw`import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, rm, readFile, realpath } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { request as httpRequest } from 'node:http';
+import { OpenAgentWorkspace } from '@openagentid/sdk/local';
+import { openStarter } from '../src/workspaces.mjs';
+import { startServer } from '../src/server.mjs';
+import { sendAgentRequest } from '../src/agent.mjs';
+
+async function fixture(t) {
+  const root = await realpath(await mkdtemp(join(tmpdir(), 'openagent-starter-test-')));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  let app = await startServer({ root, port: 0 });
+  t.after(async () => { if (app) await app.close(); });
+  return { root, get app() { return app; }, async restart() { await app.close(); app = await startServer({ root, port: 0 }); } };
+}
+async function post(app, route, body, extra = {}) {
+  return fetch(app.url + route, { method: 'POST', headers: { 'content-type': 'application/json', ...extra },
+    body: JSON.stringify(body), signal: AbortSignal.timeout(5000) });
+}
+async function signed(app, message = 'Real signed request') {
+  const response = await post(app, '/challenge', { did: app.did });
+  assert.equal(response.status, 200);
+  const challenge = await response.json();
+  const proof = await app.workspaces.signer.prove(app.did, { nonce: challenge.nonce, audience: challenge.audience });
+  return { nonce: challenge.nonce, proof, message };
+}
+test('separate persisted signer and explicit public receiver trust complete actual HTTP work', async t => {
+  const f = await fixture(t);
+  const agents = await f.app.workspaces.receiver.listAgents();
+  assert.equal(agents.find(value => value.did === f.app.did).hasPrivateKey, false);
+  const exported = JSON.parse(await readFile(join(f.root, '.openagent', 'identity.json'), 'utf8'));
+  assert.equal(exported.did, f.app.did); assert.equal('d' in exported.publicKeyJwk, false);
+  const message = 'Hello, actual receiver';
+  const output = await sendAgentRequest({ root: f.root, url: f.app.url, message });
+  assert.deepEqual(output, { schemaVersion: 1, did: f.app.did, message, digest: createHash('sha256').update(message).digest('hex') });
+  const state = await (await fetch(f.app.url + '/state')).json();
+  assert.equal(state.status, 'success'); assert.equal(state.completedRequests, 1);
+  assert.equal(state.revision, 2); assert.equal(typeof state.lastCompletedAtMs, 'number');
+  assert.equal('message' in state, false); assert.equal('proof' in state, false);
+});
+test('issued challenge, public key and replay consumption survive actual reopen', async t => {
+  const f = await fixture(t);
+  const did = f.app.did;
+  const audience = f.app.workspaces.audience;
+  const body = await signed(f.app);
+  await f.restart(); assert.equal(f.app.did, did); assert.equal(f.app.workspaces.audience, audience);
+  assert.equal((await post(f.app, '/request', body)).status, 200);
+  await f.restart(); assert.equal(f.app.did, did);
+  const replay = await post(f.app, '/request', body);
+  assert.equal(replay.status, 403); assert.deepEqual(await replay.json(), { error: 'identity_refused' });
+  assert.equal((await (await fetch(f.app.url + '/state')).json()).completedRequests, 0);
+});
+test('one issued proof has exactly one winner under concurrent real HTTP verification', async t => {
+  const f = await fixture(t);
+  const body = await signed(f.app);
+  const responses = await Promise.all([post(f.app, '/request', body), post(f.app, '/request', body)]);
+  assert.deepEqual(responses.map(response => response.status).sort(), [200, 403]);
+  assert.equal((await (await fetch(f.app.url + '/state')).json()).completedRequests, 1);
+});
+test('each installation pins a different durable intended audience and refuses valid signatures for another receiver', async t => {
+  const f = await fixture(t);
+  const other = await fixture(t);
+  assert.notEqual(f.app.workspaces.audience, other.app.workspaces.audience);
+  const body = await signed(f.app);
+  const wrongRecipient = await f.app.workspaces.signer.prove(f.app.did, { nonce: body.nonce, audience: other.app.workspaces.audience });
+  assert.equal((await post(f.app, '/request', { ...body, proof: wrongRecipient })).status, 403);
+  assert.equal((await post(f.app, '/request', body)).status, 200);
+});
+test('receiver revocation denies already issued proof and is never undone by restart', async t => {
+  const f = await fixture(t);
+  const body = await signed(f.app);
+  await f.app.workspaces.receiver.revoke(f.app.did);
+  await f.restart();
+  assert.equal((await post(f.app, '/request', body)).status, 403);
+  assert.equal((await post(f.app, '/challenge', { did: f.app.did })).status, 403);
+  assert.equal((await f.app.workspaces.receiver.listAgents()).find(agent => agent.did === f.app.did).revoked, true);
+});
+test('altered signature, never-issued nonce and unknown generated key fail without changing viewer state', async t => {
+  const f = await fixture(t);
+  const body = await signed(f.app);
+  const token = body.proof.token.split('.');
+  token[2] = (token[2][0] === 'A' ? 'B' : 'A') + token[2].slice(1);
+  assert.equal((await post(f.app, '/request', { ...body, proof: { ...body.proof, token: token.join('.') } })).status, 403);
+  assert.equal((await post(f.app, '/request', { ...body, nonce: 'never-issued' })).status, 403);
+  const audience = f.app.workspaces.audience;
+  const stranger = await OpenAgentWorkspace.initialize(join(f.root, 'stranger'), { audience });
+  const foreign = await stranger.createAgent('stranger');
+  const proof = await stranger.prove(foreign.did, { nonce: body.nonce, audience });
+  assert.equal((await post(f.app, '/request', { ...body, proof })).status, 403);
+  assert.equal((await (await fetch(f.app.url + '/state')).json()).completedRequests, 0);
+  assert.equal((await post(f.app, '/request', body)).status, 200);
+});
+test('host, browser-origin, closed-schema and private/static paths are refused', async t => {
+  const f = await fixture(t);
+  // fetch may replace Host with its URL's authority. Native HTTP sends the
+  // adversarial wire header while retaining the real loopback destination.
+  const rogueHost = await new Promise((accept, reject) => {
+    const body = JSON.stringify({ did: f.app.did });
+    const req = httpRequest(f.app.url + '/challenge', { method: 'POST', headers: {
+      host: 'attacker.example', 'content-type': 'application/json', 'content-length': Buffer.byteLength(body),
+    } }, response => {
+      const chunks = [];
+      response.on('data', chunk => chunks.push(chunk));
+      response.once('error', reject);
+      response.once('end', () => accept({ status: response.statusCode, body: Buffer.concat(chunks).toString('utf8') }));
     });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : 'Authentication failed';
-    return NextResponse.json({ success: false, error: message }, { status: 401 });
+    assert.equal(req.getHeader('host'), 'attacker.example');
+    req.once('error', reject); req.setTimeout(4500, () => req.destroy(new Error('Host refusal timed out.')));
+    req.end(body);
+  });
+  assert.equal(rogueHost.status, 403);
+  assert.deepEqual(JSON.parse(rogueHost.body), { error: 'loopback_only' });
+  assert.equal((await post(f.app, '/challenge', { did: f.app.did }, { origin: 'https://attacker.example' })).status, 403);
+  assert.equal((await post(f.app, '/challenge', { did: f.app.did }, { origin: f.app.url })).status, 403);
+  assert.equal((await post(f.app, '/challenge', { did: f.app.did, owner: 'invented' })).status, 400);
+  assert.equal((await post(f.app, '/challenge?did=x', { did: f.app.did })).status, 404);
+  assert.equal((await post(f.app, '/revoke', { did: f.app.did })).status, 404);
+  for (const path of ['/.openagent/identity.json', '/.openagent/signer/state.json', '/%2e%2e/src/workspaces.mjs']) {
+    assert.equal((await fetch(f.app.url + path)).status, 404);
   }
-}
-`;
-}
-function agentsRoute2() {
-  return `/**
- * GET /api/agents \u2014 List managed agents.
- * POST /api/agents \u2014 Create a new agent.
- */
-
-import { NextResponse, type NextRequest } from 'next/server';
-import { getRuntime } from '@/lib/openagent';
-
-const agents: Array<{ did: string; name: string; createdAt: string }> = [];
-
-export async function GET(): Promise<NextResponse> {
-  return NextResponse.json({ success: true, data: agents });
-}
-
-export async function POST(request: NextRequest): Promise<NextResponse> {
-  const runtime = getRuntime();
-
-  try {
-    const body = (await request.json()) as { name: string; scopes: string[] };
-
-    if (!body.name || !body.scopes?.length) {
-      return NextResponse.json(
-        { success: false, error: 'name and scopes are required' },
-        { status: 400 },
-      );
-    }
-
-    const parentDid = process.env.OPENAGENT_PARENT_DID ?? 'did:oas:l1fe:hmr:unconfigured';
-    const agent = await runtime.createAgent({
-      parent: parentDid,
-      name: body.name,
-      scopes: body.scopes,
+  const viewer = await fetch(f.app.url + '/');
+  assert.equal(viewer.status, 200); assert.equal(viewer.headers.get('cache-control'), 'no-store');
+  assert.match(viewer.headers.get('content-security-policy'), /frame-ancestors 'none'/);
+  assert.match(await viewer.text(), /Autos/);
+  const script = await fetch(f.app.url + '/character-player.js');
+  assert.equal(script.status, 200); assert.match(await script.text(), /mountCharacter/);
+  const huge = await post(f.app, '/request', { value: 'x'.repeat(25000) }); assert.equal(huge.status, 413);
+});
+test('chunked oversized and unfinished request bodies are bounded by the real HTTP server', async t => {
+  const f = await fixture(t);
+  async function raw(body, incomplete) {
+    return new Promise((accept, reject) => {
+      const req = httpRequest(f.app.url + '/challenge', { method: 'POST', headers: { 'content-type': 'application/json',
+        ...(incomplete ? { 'content-length': '20' } : {}) } }, response => {
+        response.resume(); response.once('end', () => accept(response.statusCode));
+      });
+      req.once('error', reject); req.setTimeout(4500, () => req.destroy(new Error('Body refusal timed out.')));
+      req.write(body); if (!incomplete) req.end();
     });
-
-    const record = {
-      did: agent.did,
-      name: body.name,
-      createdAt: new Date().toISOString(),
-    };
-    agents.push(record);
-
-    return NextResponse.json({ success: true, data: record }, { status: 201 });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : 'Agent creation failed';
-    return NextResponse.json({ success: false, error: message }, { status: 500 });
   }
-}
+  assert.equal(await raw('x'.repeat(25000), false), 413);
+  assert.equal(await raw('{', true), 408);
+});
+test('incomplete setup is retained rather than creating a replacement identity', async t => {
+  const f = await fixture(t);
+  const before = await f.app.workspaces.signer.exportIdentity(f.app.did);
+  await rm(join(f.root, '.openagent', 'starter.json'));
+  await assert.rejects(openStarter(f.root), /Incomplete starter setup/);
+  assert.deepEqual(await f.app.workspaces.signer.exportIdentity(f.app.did), before);
+});
 `;
-}
-function openagentLib2() {
-  return `/**
- * OpenAgent SDK setup \u2014 shared runtime instance.
- */
-
-import { OpenAgent, type OpenAgentRuntime } from '@openagentid/sdk';
-
-let runtime: OpenAgentRuntime | undefined;
 
-export function getRuntime(): OpenAgentRuntime {
-  if (!runtime) {
-    runtime = OpenAgent.configure({
-      endpoints: {
-        oasResolver: process.env.OAS_RESOLVER_URL,
-        arsenalBroker: process.env.ARSENAL_BROKER_URL,
-        aegisVerifier: process.env.AEGIS_VERIFIER_URL,
-      },
-    });
+// src/scaffold.ts
+async function scaffold(options, cwd = process.cwd()) {
+  const name = validateProjectName(options.projectName);
+  if (options.template !== "starter" || options.adapters.length !== 0 || options.bridge !== "none" || options.deploy !== "local" || options.bioagentic !== false || options.fabrics !== false) {
+    throw new Error("Only the local starter is supported in 0.2; historical template options require migration.");
   }
-  return runtime;
-}
-`;
-}
-function authLib2(options) {
-  const oidcPart = options.bridge === "oidc" ? `
-
-export const oidcConfig = {
-  issuerUrl: process.env.OIDC_ISSUER_URL,
-  clientId: process.env.OIDC_CLIENT_ID,
-  clientSecret: process.env.OIDC_CLIENT_SECRET,
-  redirectUri: process.env.OIDC_REDIRECT_URI ?? 'http://localhost:3000/api/auth/callback',
-} as const;
-
-export function isOidcConfigured(): boolean {
-  return Boolean(oidcConfig.issuerUrl && oidcConfig.clientId);
-}
-` : "";
-  return `/**
- * Authentication configuration \u2014 human + agent auth.
- */
-
-import { getRuntime } from './openagent.js';
-
-export async function authenticateRequest(request: Request) {
-  const runtime = getRuntime();
+  const files = generateStarterTemplate(name);
+  const names = /* @__PURE__ */ new Set();
+  for (const file of files) {
+    if (!/^(?:[a-zA-Z0-9._-]+\/)*[a-zA-Z0-9._-]+$/.test(file.path) || file.path.split("/").some((part) => part === "." || part === "..") || names.has(file.path)) {
+      throw new Error("Invalid starter file path.");
+    }
+    names.add(file.path);
+  }
+  const root = resolve(cwd, name);
   try {
-    return await runtime.authenticate(request);
-  } catch {
-    return null;
+    mkdirSync(root, { recursive: false });
+  } catch (error) {
+    if (error.code === "EEXIST") throw new Error("Destination already exists: " + name + ". Choose a new directory.");
+    throw error;
+  }
+  for (const file of files) {
+    const destination = join(root, file.path);
+    mkdirSync(dirname(destination), { recursive: true });
+    writeFileSync(destination, file.content, { encoding: "utf8", flag: "wx" });
   }
 }
-${oidcPart}`;
-}
-function echoToolTs2() {
-  return `/**
- * Echo tool \u2014 returns the input unchanged. Useful for testing.
- */
-
-import type { McpTool } from './index.js';
-
-export const echoTool: McpTool = {
-  name: 'echo',
-  description: 'Returns the input unchanged.',
-  inputSchema: {
-    type: 'object',
-    properties: {
-      message: { type: 'string', description: 'Message to echo back.' },
-    },
-    required: ['message'],
-  },
-  async execute(input) {
-    return { echoed: input };
-  },
-};
-`;
-}
-function toolsIndexTs2() {
-  return `/**
- * Tool registry \u2014 add your tools here.
- */
-
-import { echoTool } from './echo.js';
-
-export interface McpTool {
-  readonly name: string;
-  readonly description: string;
-  readonly inputSchema: Record<string, unknown>;
-  execute(input: Record<string, unknown>): Promise<unknown>;
-}
-
-export const tools: readonly McpTool[] = [echoTool];
-`;
-}
-function readme4(options) {
-  return `# ${options.projectName}
-
-A full-stack OpenAgent application: agent identity, MCP tools, and web dashboard.
-
-## Setup
-
-\`\`\`bash
-npm install
-cp .env.example .env
-\`\`\`
-
-## Development
-
-\`\`\`bash
-npm run dev
-\`\`\`
-
-Open [http://localhost:3000](http://localhost:3000).
-
-## Structure
 
-- \`src/app/\` \u2014 Next.js app directory (dashboard + API routes)
-- \`src/lib/\` \u2014 OpenAgent SDK setup and auth configuration
-- \`src/tools/\` \u2014 MCP tool implementations
-
-## Adding Tools
-
-1. Create a new file in \`src/tools/\`
-2. Export an \`McpTool\` object
-3. Add it to the \`tools\` array in \`src/tools/index.ts\`
+// src/index.ts
+var help = `create-openagent \u2014 local, open agent identity starter
 
-## Learn More
+Usage: create-openagent <project-name> [--yes] [--template starter]
 
-- [OpenAgent Docs](https://openagent.id/docs)
-- [MCP Specification](https://modelcontextprotocol.io)
-- [Next.js Docs](https://nextjs.org/docs)
-`;
-}
+  --yes, -y         Create without prompts (requires a name)
+  --template starter  The runnable Node 20+ starter (default)
+  --help, -h        Show help
+  --version, -v     Show version
 
-// src/templates/shared.ts
-function generateSharedFiles(options) {
-  return [
-    { path: "tsconfig.json", content: tsconfig(options) },
-    { path: ".gitignore", content: gitignore() },
-    { path: ".env.example", content: envExample(options) }
-  ];
-}
-function tsconfig(options) {
-  const jsx = options.template === "web-dashboard" || options.template === "full-stack";
-  return JSON.stringify(
-    {
-      compilerOptions: {
-        target: "ES2022",
-        module: "ESNext",
-        moduleResolution: "bundler",
-        lib: jsx ? ["ES2022", "DOM", "DOM.Iterable"] : ["ES2022"],
-        strict: true,
-        noEmit: true,
-        skipLibCheck: true,
-        forceConsistentCasingInFileNames: true,
-        isolatedModules: true,
-        resolveJsonModule: true,
-        esModuleInterop: true,
-        ...jsx ? { jsx: "preserve" } : {},
-        ...jsx ? { plugins: [{ name: "next" }] } : {},
-        ...jsx ? { paths: { "@/*": ["./src/*"] } } : {}
-      },
-      include: jsx ? ["src/**/*.ts", "src/**/*.tsx", ".next/types/**/*.ts"] : ["src/**/*.ts"],
-      exclude: ["node_modules", "dist"]
-    },
-    null,
-    2
-  );
-}
-function gitignore() {
-  return `node_modules/
-dist/
-.next/
-.env
-.env.local
-*.tsbuildinfo
-coverage/
+No account or hosted identity service is required.
+Historical templates, adapters, bridges and deployment flags need migration
+and are not generated by this release.
 `;
-}
-function envExample(options) {
-  const lines = [
-    "# OpenAgent Configuration",
-    "OPENAGENT_PARENT_DID=did:oas:l1fe:hmr:your-human-root",
-    "OPENAGENT_AGENT_NAME=my-agent",
-    "",
-    "# Endpoints (optional \u2014 SDK uses stubs when omitted)",
-    "# OAS_RESOLVER_URL=https://resolver.openagent.id",
-    "# ARSENAL_BROKER_URL=https://broker.arsenal.id",
-    "# AEGIS_VERIFIER_URL=https://verify.aegis.id"
-  ];
-  if (options.bridge === "oidc") {
-    lines.push(
-      "",
-      "# OIDC Bridge",
-      "# OIDC_ISSUER_URL=https://your-idp.example.com",
-      "# OIDC_CLIENT_ID=your-client-id",
-      "# OIDC_CLIENT_SECRET=your-client-secret"
-    );
-  }
-  if (options.bioagentic) {
-    lines.push("", "# Bioagentic", "# BIOAGENTIC_THRESHOLD=0.8");
-  }
-  lines.push("");
-  return lines.join("\n");
-}
-
-// src/scaffold.ts
-async function scaffold(options) {
-  const s = spinner();
-  s.start("Scaffolding project...");
-  const root = join(process.cwd(), options.projectName);
-  if (existsSync(root)) {
-    s.stop("Directory already exists.");
-    throw new Error(`Directory "${options.projectName}" already exists.`);
-  }
-  const files = [];
-  switch (options.template) {
-    case "agent":
-      files.push(...generateAgentTemplate(options));
-      break;
-    case "mcp-server":
-      files.push(...generateMcpServerTemplate(options));
-      break;
-    case "web-dashboard":
-      files.push(...generateWebDashboardTemplate(options));
-      break;
-    case "full-stack":
-      files.push(...generateFullStackTemplate(options));
-      break;
-  }
-  files.push(...generateSharedFiles(options));
-  for (const file of files) {
-    const fullPath = join(root, file.path);
-    const dir = dirname(fullPath);
-    mkdirSync(dir, { recursive: true });
-    writeFileSync(fullPath, file.content, "utf-8");
-  }
-  s.stop(`Created ${files.length} files in ${options.projectName}/`);
-}
-
-// src/index.ts
-async function main() {
-  const args = process.argv.slice(2);
-  const projectName = args.find((arg) => !arg.startsWith("-"));
-  intro(pc.bgCyan(pc.black(" create-openagent ")));
-  let options;
-  try {
-    options = await collectOptions(projectName, args);
-  } catch {
-    outro(pc.red("Cancelled."));
-    process.exit(1);
-  }
-  if (isCancel2(options)) {
-    outro(pc.red("Cancelled."));
-    process.exit(1);
-  }
+async function runCli(args = process.argv.slice(2)) {
   try {
+    const input = parseArguments(args);
+    if (input.kind !== "create") {
+      process.stdout.write(input.kind === "help" ? help : package_default.version + "\n");
+      return 0;
+    }
+    const options = await collectOptions(input);
     await scaffold(options);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Unknown error";
-    outro(pc.red(`Failed to scaffold project: ${message}`));
-    process.exit(1);
+    process.stdout.write("Created " + options.projectName + "/\n\n  cd " + options.projectName + '\n  npm install\n  npm run dev\n\nThen, in another terminal: npm run agent -- "Hello from my agent"\n');
+    return 0;
+  } catch (error) {
+    process.stderr.write("create-openagent: " + (error instanceof Error ? error.message : "Failed to create project.") + "\n");
+    return 1;
   }
-  outro(pc.green("Project created successfully!"));
-  const relativePath = options.projectName;
-  process.stdout.write("\n");
-  process.stdout.write(pc.bold("Next steps:\n"));
-  process.stdout.write(`  cd ${relativePath}
-`);
-  process.stdout.write("  npm install\n");
-  if (options.template === "web-dashboard" || options.template === "full-stack") {
-    process.stdout.write("  npm run dev\n");
-  } else {
-    process.stdout.write("  npm run build\n");
-    process.stdout.write("  npm start\n");
-  }
-  process.stdout.write("\n");
-  process.stdout.write(pc.dim(`Docs: https://openagent.id/docs
-`));
 }
-main().catch((err) => {
-  process.stderr.write(`Fatal: ${err instanceof Error ? err.message : String(err)}
-`);
-  process.exit(1);
-});
+if (process.argv[1] && existsSync(process.argv[1]) && realpathSync(resolve2(process.argv[1])) === fileURLToPath(import.meta.url)) {
+  process.exitCode = await runCli();
+}
+export {
+  collectOptions,
+  generateStarterTemplate,
+  parseArguments,
+  runCli,
+  scaffold,
+  validateProjectName
+};