Captify public launcher (captify-io)

Proprietary npm launcher for the Captify CLI. This package is not open source; see LICENSE.

Public entry

npx captify-io@latest init -t next
npx captify-io@latest create myApp
npx captify-io@latest add cyber
npx captify-io@latest scaffold-packages ./apps/cyber --id cyber

Both captify-io and captify bins forward argv unchanged to the embedded CLI.

Architecture

This launcher uses the self-contained bundle strategy (OpenSpec WF-1 / D-1):

• Vendored @captify-io/cli and @captify-io/sdk app-only payloads rebuilt from pinned source commits
• Exact audited runtime dependencies (commander, jiti, semver, zod) bundled under vendor/node_modules
• No runtime fetch from GitHub Packages or private registries
• No lifecycle scripts (preinstall, install, postinstall, prepare)
• One app is one package; feature folders do not become capability/plugin packages

Source pins live in captify.sources.json. The build fails on CLI/SDK commit or package-version drift. vendor/manifest.json records exact per-file bytes and SHA-256 digests plus aggregate CLI and SDK payload digests; validation rejects any mismatch.

Requirements

• Node.js >=20

Development

npm ci --ignore-scripts
npm run validate

npm run build bundles vendored artifacts, regenerates the tarball allowlist, and writes an SBOM.

security/tarball-allowlist.json and security/sbom.json are CI/release metadata checked into this repository but are not shipped inside the npm tarball.

Security

See SECURITY.md, security/threat-model.md, and security/provenance-enforcement.md.

License

UNLICENSED — Captify proprietary software. Redistribution prohibited except as published by Captify on the public npm registry.