appguard-runtime 0.0.1__tar.gz

appguard_runtime-0.0.1/CHANGELOG.md

@@ -0,0 +1,16 @@
+# Changelog
+
+## [0.0.1] - 2026-09-09
+
+First public PyPI release of AppGuard, supporting CPython 3.11.
+
+- Install the publisher toolkit with `pip install appguard-runtime==0.0.1`.
+- Encrypt complete Python modules and sign reusable offline product licenses.
+- Build a private native runtime for each product with `appguard build-runtime`.
+- Integrate licensing with Flask or WSGI, including offline activation and renewal.
+- Validate tests, public distributions, and Docker delivery before tagged releases.
+- Publish to official PyPI through GitHub Actions Trusted Publishing.
+
+The earlier repository-only version `0.3.0` was not a public PyPI release. The first
+public distribution starts at `0.0.1`; encrypted bundle and license formats remain
+at format 2.

appguard_runtime-0.0.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 baiyang
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

appguard_runtime-0.0.1/MANIFEST.in

@@ -0,0 +1,16 @@
+include README.md
+include CHANGELOG.md
+include LICENSE
+include appguard/_runtime/LICENSE
+include appguard/_runtime/pyproject.toml
+include appguard/_runtime/setup.py
+include appguard/_runtime/guard_runtime.pyx
+include appguard/_runtime/appguard_host.py
+include appguard/_runtime/appguard_flask.py
+recursive-include tests *.py
+recursive-include tools *.py
+recursive-include docs *.md
+recursive-include examples *.py *.toml *.txt *.md Dockerfile
+global-exclude *.pyc *.pyo *.so *.pyd *.c *.key *.pub *.license
+prune .data
+prune .github

appguard_runtime-0.0.1/PKG-INFO

@@ -0,0 +1,166 @@
+Metadata-Version: 2.4
+Name: appguard-runtime
+Version: 0.0.1
+Summary: Publisher tools for encrypted Python modules and offline product licensing
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/baiyang/AppGuard
+Project-URL: Repository, https://github.com/baiyang/AppGuard
+Project-URL: Issues, https://github.com/baiyang/AppGuard/issues
+Project-URL: Documentation, https://github.com/baiyang/AppGuard/blob/main/docs/first-release.md
+Classifier: Development Status :: 3 - Alpha
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: Implementation :: CPython
+Classifier: Topic :: Software Development :: Build Tools
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: <3.12,>=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cryptography==45.0.4
+Requires-Dist: build<2,>=1.2.2
+Provides-Extra: test
+Requires-Dist: pytest<10,>=8; extra == "test"
+Requires-Dist: Cython==3.1.2; extra == "test"
+Requires-Dist: setuptools==80.9.0; extra == "test"
+Requires-Dist: wheel==0.45.1; extra == "test"
+Requires-Dist: Flask<4,>=3.1; extra == "test"
+Requires-Dist: requests<3,>=2.32; extra == "test"
+Dynamic: license-file
+
+# AppGuard
+
+为 Python Web 项目提供整模块代码加密交付和离线产品授权。发行方交付镜像与许可证，客户导入许可证后即可使用后端接口。代码保护与授权判断独立，不需要额外部署授权服务器。
+
+当前支持 **CPython 3.11**，提供 **Flask 插件和 WSGI 中间件**。ASGI 需要另行适配；运行环境的系统、CPU 架构和 Python 版本必须与原生运行时匹配。
+
+## 安装
+
+```sh
+python3.11 -m pip install appguard-runtime==0.0.1
+appguard --help
+```
+
+PyPI 上的 `appguard-runtime` 是发行方工具包，包含密钥生成、模块加密、许可证签发和原生运行时编译模板。它不包含任何产品密钥，也不直接安装客户侧的 `guard_runtime`、`appguard_host` 或 `appguard_flask`。所有命令也可通过 `python -m appguard` 调用。
+
+为产品生成一次密钥，然后在与目标部署相同的系统、CPU 架构和 CPython 3.11 环境中编译客户运行时（需要 C 编译器和 Python 开发头文件）：
+
+```sh
+appguard keygen --out .data/issuer.key
+appguard code-keygen --out .data/code.key
+appguard build-runtime --public-key .data/issuer.pub \
+  --code-key .data/code.key --out .data/runtime
+```
+
+生成的 `appguard_product_runtime-0.0.1-*.whl` 包含客户侧插件和编入产品密钥的原生模块，仅随对应产品私下交付，不能上传到公共包仓库。客户使用 `python -m pip install /path/to/appguard_product_runtime-0.0.1-*.whl` 安装；不同产品应使用各自独立的容器或虚拟环境。应用加密和完整镜像交付步骤见[首次发行指南](https://github.com/baiyang/AppGuard/blob/main/docs/first-release.md)。
+
+## 从这里开始
+
+- **第一次制作交付包**：按[首次发行指南](https://github.com/baiyang/AppGuard/blob/main/docs/first-release.md)完成打包、测试和交付。
+- **已收到交付包**：按[示例部署说明](https://github.com/baiyang/AppGuard/blob/main/examples/flask/DEPLOY.md)启动应用并导入许可证。
+- **接入自己的后端**：参考下方接入配置；密钥保存与轮换见[密钥说明](https://github.com/baiyang/AppGuard/blob/main/docs/keys.md)。
+- **维护 AppGuard 版本**：见[版本与发布流程](https://github.com/baiyang/AppGuard/blob/main/docs/releases.md)。
+
+## 架构与边界
+
+```mermaid
+flowchart TB
+    subgraph publisher["发行方"]
+        source["Python 源码 + guard.toml"]
+        issuer["签名私钥 issuer.key"]
+        code_key["产品代码密钥 code.key"]
+        build["编译并加密整模块<br/>签署 manifest.json"]
+        issue["签发产品许可证"]
+        source --> build
+        issuer --> build
+        code_key --> build
+        issuer --> issue
+    end
+    subgraph customer["客户应用容器"]
+        web["Flask / WSGI 后端<br/>最外层授权中间件"]
+        portal["/_license/<br/>状态与许可证导入"]
+        runtime["Cython 运行时<br/>模块验签解密、许可证验签"]
+        bundle["加载入口 + 加密模块 + 签名清单"]
+        license[("授权卷<br/>license.json + 时钟记录")]
+        web --> runtime
+        web --> portal
+        bundle --> runtime
+        license --> runtime
+    end
+    build --> bundle
+    issue -.->|"离线交付许可证"| license
+```
+
+系统只维护三种长期密钥值：发行方签名私钥 `issuer.key`、对应验签公钥 `issuer.pub`、每产品固定的代码密钥 `code.key`。公钥和代码密钥编入运行时；签名私钥不交付。普通应用更新复用产品代码密钥和运行时，无需重新签发未到期的产品许可证。
+
+- **代码保护**：构建端用 `compile` / `marshal` 生成整模块字节码，再用 AES-GCM 加密为 `.agc`。镜像内的 `.py` 仅为加载入口；运行时验签、解密后在内存执行，不将明文字节码写回磁盘。
+- **后端授权**：中间件在每个业务请求进入应用之前验签并检查有效期。未授权、过期或许可证无效时，所有业务路径统一返回 **HTTP 403 JSON**，不依据 `Accept`、路径前缀或浏览器类型重定向。
+- **授权页面**：`/_license/`、状态与导入接口独立开放。应用未授权也能启动，客户可随时导入续期许可证，无需重启。
+- **前后端分离**：前端 HTML、JavaScript、CSS 不是加密目标。前端统一处理后端授权错误并跳转授权页；本项目不接管前端路由。不要把所有业务 403 都当作授权到期，应检查响应的授权错误码。
+
+加密让客户拿不到可直接阅读的业务 Python 源码，不保证抵抗主机管理员提取二进制密钥、内存代码或修改运行程序。代码密钥随运行时交付，许可证不承载解密密钥；移除授权中间件后可以调用业务逻辑。这是精简方案的明确边界。
+
+授权只控制新进入的 HTTP 业务请求，不控制 CLI、后台任务、直接函数调用，也不中断已开始的请求或流式响应。离线时钟回退检测只用于辅助发现异常，无法阻止管理员恢复整机或授权卷快照。产品许可证不绑定机器或构建版本，同一许可证可复制到同产品的其他部署。
+
+## 接入自己的后端
+
+Flask 项目在应用与其他中间件配置完成后，最后注册 AppGuard，使授权检查位于业务入口最外层：
+
+```python
+from appguard_flask import AppGuard
+
+AppGuard().init_app(app)
+```
+
+其他 WSGI 后端在完成应用组装后包装入口：
+
+```python
+from appguard_host import LicenseMiddleware
+
+application = LicenseMiddleware(application)
+```
+
+默认没有业务路径豁免。需要存活探针时，可显式配置 `AppGuard(exempt_paths=("/healthz",))` 或 `LicenseMiddleware(application, exempt_paths=("/healthz",))`；仅完全匹配路径的 GET/HEAD 请求免授权，不按目录前缀放行。探针应只报告进程存活，不暴露业务数据。
+
+在 `guard.toml` 中选择交付文件，不需要配置函数、检查点或改写业务函数：
+
+```toml
+product_id = "my-web-app"
+include = ["web_app.py", "service.py", "templates/", "static/"]
+exclude = ["**/__pycache__/", "**/.env*", "**/*.pyc"]
+```
+
+路径相对于 `build --source`，支持文件、目录和通配符。选中的 Python 模块整体加密；非 Python 文件原样复制，需排除私密配置、开发文件和生成的 C 源文件。依赖安装、数据库初始化及后台任务仍由业务项目自己的部署流程负责。
+
+## 签发、激活与续期
+
+发行方知道产品标识、客户标识和到期时间后即可签发，不再收集部署申请：
+
+```sh
+python -m appguard issue \
+  --product example-web --issuer-key .data/issuer.key \
+  --customer customer-001 --expires 2027-12-31T23:59:59Z \
+  --out .data/customer-001.license
+```
+
+客户在 `http://服务器地址:8000/_license/` 上传许可证。授权有效后，示例的 `/api/answer?value=8` 返回 `{"answer":50}`。缺失或过期授权时，该接口及其他业务路径均返回 403 JSON。
+
+续期时指定新的到期时间和输出文件，重新签发后导入即可。相同发行方和产品的新构建继续使用原有效许可证；不需要保存每个构建的秘密 `release.json`。授权卷只保存许可证和辅助时钟记录，重建容器时继续挂载。
+
+部署端也可使用命令行查看或导入授权：
+
+```sh
+python -m appguard_host status
+python -m appguard_host install /path/to/customer-001.license
+```
+
+## 配置与迁移
+
+| 环境变量 | 默认值 | 用途 |
+| --- | --- | --- |
+| `APPGUARD_BUNDLE` | `/opt/appguard/bundle` | 加密模块及签名清单目录 |
+| `APPGUARD_LICENSE_DIR` | `/var/lib/appguard` | 可写、持久化的授权目录 |
+| `APPGUARD_SECURE_COOKIE` | `0` | HTTPS 部署时设为 `1` |
+
+无法激活时查看 `/_license/` 的状态提示，确认许可证产品、发行方、有效期与系统时间。运行时需与产品代码密钥匹配，但不要求每次业务构建重新编译。
+
+旧版 `function-bodies-v1` 包和绑定 `build_id` 的许可证不能直接用于新版。首次迁移需要移除旧函数配置、生成产品代码密钥、重新构建镜像，并重新签发产品许可证。此后普通更新可复用许可证；迁移细节见[首次发行指南](https://github.com/baiyang/AppGuard/blob/main/docs/first-release.md#从旧版迁移)。

appguard_runtime-0.0.1/README.md

@@ -0,0 +1,137 @@
+# AppGuard
+
+为 Python Web 项目提供整模块代码加密交付和离线产品授权。发行方交付镜像与许可证，客户导入许可证后即可使用后端接口。代码保护与授权判断独立，不需要额外部署授权服务器。
+
+当前支持 **CPython 3.11**，提供 **Flask 插件和 WSGI 中间件**。ASGI 需要另行适配；运行环境的系统、CPU 架构和 Python 版本必须与原生运行时匹配。
+
+## 安装
+
+```sh
+python3.11 -m pip install appguard-runtime==0.0.1
+appguard --help
+```
+
+PyPI 上的 `appguard-runtime` 是发行方工具包，包含密钥生成、模块加密、许可证签发和原生运行时编译模板。它不包含任何产品密钥，也不直接安装客户侧的 `guard_runtime`、`appguard_host` 或 `appguard_flask`。所有命令也可通过 `python -m appguard` 调用。
+
+为产品生成一次密钥，然后在与目标部署相同的系统、CPU 架构和 CPython 3.11 环境中编译客户运行时（需要 C 编译器和 Python 开发头文件）：
+
+```sh
+appguard keygen --out .data/issuer.key
+appguard code-keygen --out .data/code.key
+appguard build-runtime --public-key .data/issuer.pub \
+  --code-key .data/code.key --out .data/runtime
+```
+
+生成的 `appguard_product_runtime-0.0.1-*.whl` 包含客户侧插件和编入产品密钥的原生模块，仅随对应产品私下交付，不能上传到公共包仓库。客户使用 `python -m pip install /path/to/appguard_product_runtime-0.0.1-*.whl` 安装；不同产品应使用各自独立的容器或虚拟环境。应用加密和完整镜像交付步骤见[首次发行指南](https://github.com/baiyang/AppGuard/blob/main/docs/first-release.md)。
+
+## 从这里开始
+
+- **第一次制作交付包**：按[首次发行指南](https://github.com/baiyang/AppGuard/blob/main/docs/first-release.md)完成打包、测试和交付。
+- **已收到交付包**：按[示例部署说明](https://github.com/baiyang/AppGuard/blob/main/examples/flask/DEPLOY.md)启动应用并导入许可证。
+- **接入自己的后端**：参考下方接入配置；密钥保存与轮换见[密钥说明](https://github.com/baiyang/AppGuard/blob/main/docs/keys.md)。
+- **维护 AppGuard 版本**：见[版本与发布流程](https://github.com/baiyang/AppGuard/blob/main/docs/releases.md)。
+
+## 架构与边界
+
+```mermaid
+flowchart TB
+    subgraph publisher["发行方"]
+        source["Python 源码 + guard.toml"]
+        issuer["签名私钥 issuer.key"]
+        code_key["产品代码密钥 code.key"]
+        build["编译并加密整模块<br/>签署 manifest.json"]
+        issue["签发产品许可证"]
+        source --> build
+        issuer --> build
+        code_key --> build
+        issuer --> issue
+    end
+    subgraph customer["客户应用容器"]
+        web["Flask / WSGI 后端<br/>最外层授权中间件"]
+        portal["/_license/<br/>状态与许可证导入"]
+        runtime["Cython 运行时<br/>模块验签解密、许可证验签"]
+        bundle["加载入口 + 加密模块 + 签名清单"]
+        license[("授权卷<br/>license.json + 时钟记录")]
+        web --> runtime
+        web --> portal
+        bundle --> runtime
+        license --> runtime
+    end
+    build --> bundle
+    issue -.->|"离线交付许可证"| license
+```
+
+系统只维护三种长期密钥值：发行方签名私钥 `issuer.key`、对应验签公钥 `issuer.pub`、每产品固定的代码密钥 `code.key`。公钥和代码密钥编入运行时；签名私钥不交付。普通应用更新复用产品代码密钥和运行时，无需重新签发未到期的产品许可证。
+
+- **代码保护**：构建端用 `compile` / `marshal` 生成整模块字节码，再用 AES-GCM 加密为 `.agc`。镜像内的 `.py` 仅为加载入口；运行时验签、解密后在内存执行，不将明文字节码写回磁盘。
+- **后端授权**：中间件在每个业务请求进入应用之前验签并检查有效期。未授权、过期或许可证无效时，所有业务路径统一返回 **HTTP 403 JSON**，不依据 `Accept`、路径前缀或浏览器类型重定向。
+- **授权页面**：`/_license/`、状态与导入接口独立开放。应用未授权也能启动，客户可随时导入续期许可证，无需重启。
+- **前后端分离**：前端 HTML、JavaScript、CSS 不是加密目标。前端统一处理后端授权错误并跳转授权页；本项目不接管前端路由。不要把所有业务 403 都当作授权到期，应检查响应的授权错误码。
+
+加密让客户拿不到可直接阅读的业务 Python 源码，不保证抵抗主机管理员提取二进制密钥、内存代码或修改运行程序。代码密钥随运行时交付，许可证不承载解密密钥；移除授权中间件后可以调用业务逻辑。这是精简方案的明确边界。
+
+授权只控制新进入的 HTTP 业务请求，不控制 CLI、后台任务、直接函数调用，也不中断已开始的请求或流式响应。离线时钟回退检测只用于辅助发现异常，无法阻止管理员恢复整机或授权卷快照。产品许可证不绑定机器或构建版本，同一许可证可复制到同产品的其他部署。
+
+## 接入自己的后端
+
+Flask 项目在应用与其他中间件配置完成后，最后注册 AppGuard，使授权检查位于业务入口最外层：
+
+```python
+from appguard_flask import AppGuard
+
+AppGuard().init_app(app)
+```
+
+其他 WSGI 后端在完成应用组装后包装入口：
+
+```python
+from appguard_host import LicenseMiddleware
+
+application = LicenseMiddleware(application)
+```
+
+默认没有业务路径豁免。需要存活探针时，可显式配置 `AppGuard(exempt_paths=("/healthz",))` 或 `LicenseMiddleware(application, exempt_paths=("/healthz",))`；仅完全匹配路径的 GET/HEAD 请求免授权，不按目录前缀放行。探针应只报告进程存活，不暴露业务数据。
+
+在 `guard.toml` 中选择交付文件，不需要配置函数、检查点或改写业务函数：
+
+```toml
+product_id = "my-web-app"
+include = ["web_app.py", "service.py", "templates/", "static/"]
+exclude = ["**/__pycache__/", "**/.env*", "**/*.pyc"]
+```
+
+路径相对于 `build --source`，支持文件、目录和通配符。选中的 Python 模块整体加密；非 Python 文件原样复制，需排除私密配置、开发文件和生成的 C 源文件。依赖安装、数据库初始化及后台任务仍由业务项目自己的部署流程负责。
+
+## 签发、激活与续期
+
+发行方知道产品标识、客户标识和到期时间后即可签发，不再收集部署申请：
+
+```sh
+python -m appguard issue \
+  --product example-web --issuer-key .data/issuer.key \
+  --customer customer-001 --expires 2027-12-31T23:59:59Z \
+  --out .data/customer-001.license
+```
+
+客户在 `http://服务器地址:8000/_license/` 上传许可证。授权有效后，示例的 `/api/answer?value=8` 返回 `{"answer":50}`。缺失或过期授权时，该接口及其他业务路径均返回 403 JSON。
+
+续期时指定新的到期时间和输出文件，重新签发后导入即可。相同发行方和产品的新构建继续使用原有效许可证；不需要保存每个构建的秘密 `release.json`。授权卷只保存许可证和辅助时钟记录，重建容器时继续挂载。
+
+部署端也可使用命令行查看或导入授权：
+
+```sh
+python -m appguard_host status
+python -m appguard_host install /path/to/customer-001.license
+```
+
+## 配置与迁移
+
+| 环境变量 | 默认值 | 用途 |
+| --- | --- | --- |
+| `APPGUARD_BUNDLE` | `/opt/appguard/bundle` | 加密模块及签名清单目录 |
+| `APPGUARD_LICENSE_DIR` | `/var/lib/appguard` | 可写、持久化的授权目录 |
+| `APPGUARD_SECURE_COOKIE` | `0` | HTTPS 部署时设为 `1` |
+
+无法激活时查看 `/_license/` 的状态提示，确认许可证产品、发行方、有效期与系统时间。运行时需与产品代码密钥匹配，但不要求每次业务构建重新编译。
+
+旧版 `function-bodies-v1` 包和绑定 `build_id` 的许可证不能直接用于新版。首次迁移需要移除旧函数配置、生成产品代码密钥、重新构建镜像，并重新签发产品许可证。此后普通更新可复用许可证；迁移细节见[首次发行指南](https://github.com/baiyang/AppGuard/blob/main/docs/first-release.md#从旧版迁移)。

appguard_runtime-0.0.1/appguard/__init__.py

@@ -0,0 +1 @@
+"""Publisher-side AppGuard build and license tools."""

appguard_runtime-0.0.1/appguard/__main__.py

@@ -0,0 +1,111 @@
+"""Publisher CLI for encrypted Python applications and offline licensing."""
+
+import argparse
+import base64
+import json
+import os
+import time
+import uuid
+from datetime import datetime, timezone
+from pathlib import Path
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+from .build import build
+from .crypto import private_write, product_id, signed, signer
+from .runtime import build_runtime
+
+
+def timestamp(value: str) -> int:
+    try:
+        parsed = datetime.fromisoformat(value.replace("Z", "+00:00"))
+        if parsed.tzinfo is None:
+            raise ValueError("missing timezone")
+        result = int(parsed.timestamp())
+        if not 0 <= result <= 253402300799:
+            raise ValueError("outside supported timestamp range")
+        return result
+    except (ValueError, OverflowError) as exc:
+        raise argparse.ArgumentTypeError("Use a date after 1970 with an explicit timezone, e.g. 2027-03-08T00:00:00Z") from exc
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    sub = parser.add_subparsers(dest="command", required=True)
+    keys = sub.add_parser("keygen", help="Generate an Ed25519 issuer key pair")
+    keys.add_argument("--out", type=Path, required=True)
+    code_keys = sub.add_parser("code-keygen", help="Generate a product AES-256 code key")
+    code_keys.add_argument("--out", type=Path, required=True)
+    runtime = sub.add_parser("build-runtime", help="Compile a private product runtime wheel (requires a C compiler)")
+    for name in ("public-key", "code-key", "out"):
+        runtime.add_argument("--" + name, type=Path, required=True)
+    package = sub.add_parser("build", help="Encrypt Python modules using a product code key")
+    for name in ("source", "config", "issuer-key", "code-key", "out"):
+        package.add_argument("--" + name, type=Path, required=True)
+    issue = sub.add_parser("issue", help="Issue a license valid across builds of one product")
+    for name in ("issuer-key", "out"):
+        issue.add_argument("--" + name, type=Path, required=True)
+    issue.add_argument("--product", required=True)
+    issue.add_argument("--customer", required=True)
+    issue.add_argument("--expires", required=True, type=timestamp)
+    issue.add_argument("--not-before", type=timestamp)
+    inspect = sub.add_parser("inspect", help="Display metadata without verifying its signature")
+    inspect.add_argument("path", type=Path)
+    args = parser.parse_args()
+    try:
+        if args.command == "keygen":
+            public_path = args.out.with_suffix(".pub")
+            if public_path == args.out:
+                raise ValueError("Private key output must not use the .pub extension")
+            if any(path.exists() or path.is_symlink() for path in (args.out, public_path)):
+                raise ValueError("Key output already exists")
+            key = Ed25519PrivateKey.generate()
+            private_write(args.out, key.private_bytes_raw().hex().encode() + b"\n")
+            try:
+                private_write(public_path, key.public_key().public_bytes_raw().hex().encode() + b"\n")
+            except OSError:
+                args.out.unlink()
+                raise
+            print(json.dumps({"private_key": str(args.out), "public_key": str(public_path)}))
+        elif args.command == "code-keygen":
+            private_write(args.out, os.urandom(32).hex().encode() + b"\n")
+            print(json.dumps({"code_key": str(args.out)}))
+        elif args.command == "build":
+            print(json.dumps(build(args.source, args.config, args.issuer_key, args.out, args.code_key)))
+        elif args.command == "build-runtime":
+            print(json.dumps(build_runtime(args.public_key, args.code_key, args.out)))
+        elif args.command == "issue":
+            product = product_id(args.product)
+            if (not args.customer or args.customer != args.customer.strip() or len(args.customer) > 512
+                    or any(ord(character) < 32 or ord(character) == 127 for character in args.customer)):
+                raise ValueError("customer must contain 1 to 512 characters without surrounding whitespace or control characters")
+            key = signer(args.issuer_key)
+            now = int(time.time())
+            start = args.not_before if args.not_before is not None else now
+            if start >= args.expires:
+                raise ValueError("not-before must precede expires")
+            if args.expires <= now:
+                raise ValueError("expires must be in the future")
+            payload = {
+                "format": 2, "kind": "license", "license_id": uuid.uuid4().hex,
+                "product_id": product, "customer": args.customer,
+                "issued_at": now, "not_before": start, "expires_at": args.expires,
+            }
+            private_write(args.out, signed(payload, key))
+            print(json.dumps({"license": str(args.out), "license_id": payload["license_id"],
+                              "expires_at": datetime.fromtimestamp(args.expires, timezone.utc).isoformat()}))
+        else:
+            envelope = json.loads(args.path.read_text(encoding="utf-8"))
+            if not isinstance(envelope, dict) or not isinstance(envelope.get("payload"), str):
+                raise ValueError("Expected a signed envelope with a base64 payload")
+            payload = json.loads(base64.b64decode(envelope["payload"], validate=True))
+            if not isinstance(payload, dict):
+                raise ValueError("Expected an object payload")
+            payload.pop("modules", None)
+            print(json.dumps({"verified": False, "metadata": payload}, indent=2))
+    except (ValueError, OSError, KeyError, SyntaxError, RuntimeError) as exc:
+        parser.exit(1, f"AppGuard: {exc}\n")
+
+
+if __name__ == "__main__":
+    main()

appguard_runtime-0.0.1/appguard/_runtime/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 baiyang
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

appguard_runtime-0.0.1/appguard/_runtime/appguard_flask.py

@@ -0,0 +1,17 @@
+"""Explicit Flask extension. Does not create, import or run the business app."""
+
+from appguard_host import LicenseMiddleware
+
+
+class AppGuard:
+    def __init__(self, app=None, *, exempt_paths=()):
+        self.exempt_paths = exempt_paths
+        if app is not None:
+            self.init_app(app)
+
+    def init_app(self, app):
+        if "appguard" in app.extensions:
+            return
+        middleware = LicenseMiddleware(app.wsgi_app, exempt_paths=self.exempt_paths)
+        app.wsgi_app = middleware
+        app.extensions["appguard"] = self