# Local Package Guide

This package is intentionally local-only. Keep `"private": true` and `"license": "UNLICENSED"` in `package.json` unless the product owner explicitly approves a public npm release later.

## Local Metadata Policy

| Field | Required local value | Reason |
| --- | --- | --- |
| npm name | `jso-protector` | Local workspace/package name only; not reserved or published on npm. |
| registry access | `"private": true` | Blocks accidental `npm publish`. |
| license | `UNLICENSED` | Makes the package private/internal by default. |
| credentials | Environment variables only | Keeps API credentials out of package files and logs. |
| payment enforcement | Hosted API only | Keeps billing, account status, credits, and plan limits on the server. |

## Payment Model

Use npm only as the local developer workflow. Users still need a paid JavaScript Obfuscator account because protection calls go to the hosted HTTP API with dashboard credentials.

Do not add billing logic, shared API keys, account secrets, or plan-limit decisions to this package. The server must reject unpaid, expired, disabled, or over-limit accounts.

## Local Verification

Use the package from another local project with either a workspace path:

```bash
npm install --save-dev ../packages/jso-protector
```

or a `file:` dependency:

```json
{
  "devDependencies": {
    "jso-protector": "file:../packages/jso-protector"
  }
}
```

For internal handoff, create a tarball and install it directly in the consuming app:

```bash
npm pack --json
npm install --save-dev path/to/jso-protector-0.1.1.tgz
```

Run the offline test suite:

```bash
npm test
```

Run the package smoke check:

```bash
npm run smoke
npm run verify:package
```

Run the local-only metadata check:

```bash
npm run verify:publish-metadata
```

Run everything:

```bash
npm run verify
```

With test credentials only, run the live API preflight:

```bash
npm run smoke:api
jso-protector --config jso.config.example.json --doctor --check-api --json
```

## Publish Guard

The `prepublishOnly` script runs `ci/verify-publish-metadata.js` without the local-only allowance and blocks `npm publish`. `npm run verify:publish-ready` should fail while this package remains local-only.

If a public npm release is ever approved, treat that as a separate product decision: choose a final package name/scope, approve a public license, add repository and support metadata, remove `private:true`, and rerun `npm run verify:publish-ready`.
