Metadata-Version: 2.4
Name: shadow-stack
Version: 5.0.2
Summary: Inject production-ready modules into any Python or Node project. AI-adaptive, framework-aware, BSL Licensed.
Author-email: ShadowHunter89 <shadowhunter89@proton.me>
License: Business Source License 1.1
        
        Licensor:             ShadowHunter89
        Licensed Work:        shadow-stack v3
                              Copyright (c) 2025 ShadowHunter89. All rights reserved.
        Change Date:          Four years from each release date
        Change License:       Apache License, Version 2.0
        
        Additional Use Grant: You may use the Licensed Work in production provided
          that: (1) you are not offering it as a competing product or service that
          replaces or substitutes for shadow-stack; (2) you do not sell, resell,
          or sublicense the Licensed Work itself as a standalone product; and
          (3) you are using it solely to improve your own software projects.
        
          "Competing product or service" means any product or service that:
          - Scans codebases and injects pre-built production modules automatically
          - Is marketed or sold as a module injection or boilerplate injection tool
          - Directly competes with shadow-stack.dev
        
        You MAY:
          - Use shadow-stack to improve your own private or commercial projects
          - Modify shadow-stack for your own internal use
          - Contribute modules back under a Contributor License Agreement
          - Run shadow-stack CLI on your own projects without restriction
        
        You MAY NOT:
          - Sell shadow-stack or a derivative as a standalone product
          - Build a hosted SaaS offering of shadow-stack for third parties
          - Remove copyright notices or attribution
          - Re-license this code under any other license
        
        On the Change Date of each version, that version's license converts
        automatically to Apache 2.0 for that specific version only.
        
        For commercial licensing inquiries: shadowhunter89@proton.me
        
        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND.
        IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
        OTHER LIABILITY ARISING FROM THE USE OF THIS SOFTWARE.
        
Project-URL: Homepage, https://github.com/shadowhunter89/shadow-stack
Project-URL: Documentation, https://github.com/shadowhunter89/shadow-stack#readme
Project-URL: Repository, https://github.com/shadowhunter89/shadow-stack
Project-URL: Issues, https://github.com/shadowhunter89/shadow-stack/issues
Project-URL: Changelog, https://github.com/shadowhunter89/shadow-stack/releases
Keywords: fastapi,django,flask,express,nextjs,scaffolding,boilerplate,ai-tools,code-generation,production-ready,saas-toolkit
Classifier: Development Status :: 5 - Production/Stable
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: License :: Other/Proprietary License
Classifier: Intended Audience :: Developers
Classifier: Operating System :: OS Independent
Classifier: Topic :: Software Development :: Code Generators
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: click>=8.1.0
Requires-Dist: rich>=13.0.0
Requires-Dist: pynacl>=1.5.0
Provides-Extra: anthropic
Requires-Dist: anthropic>=0.28.0; extra == "anthropic"
Provides-Extra: openai
Requires-Dist: openai>=1.0.0; extra == "openai"
Provides-Extra: gemini
Requires-Dist: google-generativeai>=0.5.0; extra == "gemini"
Provides-Extra: groq
Requires-Dist: groq>=0.4.0; extra == "groq"
Provides-Extra: yaml
Requires-Dist: pyyaml>=6.0; extra == "yaml"
Provides-Extra: all
Requires-Dist: anthropic>=0.28.0; extra == "all"
Requires-Dist: openai>=1.0.0; extra == "all"
Requires-Dist: google-generativeai>=0.5.0; extra == "all"
Requires-Dist: groq>=0.4.0; extra == "all"
Requires-Dist: pyyaml>=6.0; extra == "all"
Provides-Extra: dev
Requires-Dist: pytest>=7.0; extra == "dev"
Requires-Dist: pytest-cov>=4.0; extra == "dev"
Requires-Dist: ruff>=0.1.0; extra == "dev"
Requires-Dist: mypy>=1.7.0; extra == "dev"
Dynamic: license-file

# shadow-stack v5

> **Inject production infrastructure into any Python or Node project in minutes.**
> Framework-aware · AI-adaptive · Multi-provider with fallback · Git-branch rollback · BSL Licensed

```bash
pip install shadow-stack
shadow-stack scan   ./myproject     # health score + what's missing  (FREE)
shadow-stack diff   ./myproject     # preview changes before inject  (FREE)
shadow-stack cost   ./myproject     # estimate AI cost first         (FREE)
shadow-stack audit  ./myproject     # security issues                (FREE)
shadow-stack inject ./myproject     # AI-adapted production modules  (PAID)
shadow-stack rollback ./myproject   # list/clean inject branches     (FREE)
```

---

## What's new in v5

| Feature | v4 | v5 |
|---|:-:|:-:|
| **Framework-aware scanner** (no false positives on JS/TS projects) | ❌ | ✅ |
| **AI provider fallback chain** (auto-retry on rate-limit / 5xx) | ❌ | ✅ |
| **Git-branch rollback** (every inject = its own branch) | ❌ | ✅ |
| **Node/Express module pack** (auth + security + monitoring + tests + docker) | ❌ | ✅ |
| **GitHub Action** for CI integration | ❌ | ✅ |
| **Freemium model** (free scans, paid inject) | ❌ | ✅ |
| **pyproject.toml** packaging | ❌ | ✅ |

---

## Free tier (always free)

`scan` · `audit` · `diff` · `cost` · `frameworks` · `providers` · `explain` · `license`

Run scans on any project, any time, no key required. This is the acquisition loop —
get a real production-readiness score before deciding if `inject` is worth paying for.

## Paid tier (license key required)

`inject` · `recipe apply` · `upgrade` · `sync` · `fix-wiring` · `install`

```bash
export SHADOW_STACK_LICENSE_KEY=solo_xxxxxxx
shadow-stack inject ./myproject --only auth payments monitoring
```

**Tiers:** `solo_*` ($29/mo) · `team_*` ($99/mo) · `ent_*` ($499/mo) · `lifetime_*` ($149)

---

## Framework support

| Framework | Detect | Inject | Modules |
|---|:-:|:-:|---|
| FastAPI    | ✅ | ✅ | All 16 Python modules |
| Django     | ✅ | ◑  | auth, monitoring, security, tests, docker, deployment |
| Flask      | ✅ | ◑  | auth, monitoring, security, tests, docker |
| **Express** | ✅ | ✅ | **v5 NEW** — node_auth/security/monitoring/tests/docker |
| **NestJS**  | ✅ | ✅ | **v5 NEW** — same Node module pack |
| **Next.js** | ✅ | ◑  | **v5 NEW** — node_auth, node_monitoring, node_tests |
| Fastify    | ✅ | ○  | Detection only |
| React/Vite | ✅ | ◑  | node_tests |
| Go (Gin)   | ○  | ○  | Planned v6 |

The scanner is **framework-aware**: a Next.js project no longer gets false-positive
"missing password hashing" warnings just because the FastAPI checker doesn't know JS.

---

## Git-branch rollback

Every `inject` in a git repo creates a dedicated branch:

```
shadow-stack/inject-auth-monitoring-20260510-153022
```

Review the diff, then **merge** or **rollback**:

```bash
git checkout main && git merge --no-ff <branch>   # accept
git checkout main && git branch -D <branch>       # discard
```

`shadow-stack rollback ./myproject --cleanup 14` cleans up branches older than 14 days.

---

## AI provider fallback (v5 reliability fix)

Default chain: `anthropic → openai → gemini → groq → deepseek → ollama`

If your primary rate-limits halfway through a 12-module inject, v5 auto-retries on
the next available provider. v4 used to fail the whole run.

Set `SHADOW_STACK_AI_PROVIDER=openai` to pin a specific primary; the chain still
applies on failure.

---

## GitHub Action

```yaml
# .github/workflows/health-score.yml
on: [pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: shadowhunter89/shadow-stack/.github/actions/scan@v5
        with:
          fail-below: 60      # fail the PR if score drops below 60
          comment-on-pr: true # post score as a PR comment
```

### What the comment looks like

On every pull request, the action posts a comment like this:

> ## 🟡 shadow-stack score: **62/100**
>
> | | |
> |--|--|
> | Framework | `fastapi` |
> | Missing modules | 6 |
> | Critical security issues | 2 |
>
> Run `shadow-stack inject` locally to fix the gaps. [Get a license](https://shadow-stack.dev/pricing) to enable inject.

Score emoji is colour-coded:
- 🟢 **80+** — production-ready
- 🟡 **60-79** — has gaps, but shippable
- 🔴 **< 60** — needs work before launch

### What you'll see in the GitHub Actions tab

The action also writes a Job Summary visible in the run page:

```
## shadow-stack scan

| Metric | Value |
|--------|------:|
| Health Score | 62/100 |
| Framework | fastapi |
| Missing modules | 6 |
| Critical issues | 2 |
```

### Outputs you can use in downstream steps

```yaml
- uses: shadowhunter89/shadow-stack/.github/actions/scan@v5
  id: scan
- run: echo "Health = ${{ steps.scan.outputs.health-score }}"
- run: echo "Framework = ${{ steps.scan.outputs.framework }}"
```

---

## License

Business Source License 1.1. You may use it on your projects (private or commercial).
You may not sell it as a standalone product or build a hosted SaaS of it. Converts to
Apache 2.0 four years after release.

Commercial licensing: shadowhunter89@proton.me · © 2026 ShadowHunter89.
