feat: community export workflow — strip script, leak-check hardening, CLA docs

- scripts/strip-commercial.sh: removes agor-pro/, commercial files, SPDX headers
- leak-check.yml: added LICENSE-COMMERCIAL, SPDX header, and feature flag checks
- CONTRIBUTING.md: external contributor guide, commercial content table, sync docs

scripts/strip-commercial.sh

@@ -0,0 +1,127 @@
+#!/usr/bin/env bash
+# strip-commercial.sh — Remove all commercial content from the repository.
+# Safe to run locally to preview what would be stripped.
+# Used by .github/workflows/community-sync.yml for automated sync.
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$REPO_ROOT"
+
+removed=()
+echo "=== Stripping commercial content from: $REPO_ROOT ==="
+
+# 1. Remove commercial directories
+for dir in agor-pro; do
+  if [ -d "$dir" ]; then
+    rm -rf "$dir"
+    removed+=("$dir/ (directory)")
+    echo "Removed directory: $dir/"
+  fi
+done
+
+# 2. Remove commercial files in src/lib/commercial/ (keep .gitkeep)
+if [ -d "src/lib/commercial" ]; then
+  while IFS= read -r -d '' file; do
+    rm -f "$file"
+    removed+=("$file")
+    echo "Removed file: $file"
+  done < <(find src/lib/commercial/ -type f ! -name '.gitkeep' -print0 2>/dev/null)
+fi
+
+# 3. Remove commercial files in tests/commercial/ (keep .gitkeep)
+if [ -d "tests/commercial" ]; then
+  while IFS= read -r -d '' file; do
+    rm -f "$file"
+    removed+=("$file")
+    echo "Removed file: $file"
+  done < <(find tests/commercial/ -type f ! -name '.gitkeep' -print0 2>/dev/null)
+fi
+
+# 4. Remove LICENSE-COMMERCIAL
+if [ -f "LICENSE-COMMERCIAL" ]; then
+  rm -f "LICENSE-COMMERCIAL"
+  removed+=("LICENSE-COMMERCIAL")
+  echo "Removed file: LICENSE-COMMERCIAL"
+fi
+
+# 5. Remove files with LicenseRef-Commercial SPDX headers (outside node_modules)
+while IFS= read -r -d '' file; do
+  if head -5 "$file" | grep -q "LicenseRef-Commercial"; then
+    rm -f "$file"
+    removed+=("$file")
+    echo "Removed SPDX-commercial file: $file"
+  fi
+done < <(find . -type f \( -name '*.ts' -o -name '*.svelte' -o -name '*.rs' -o -name '*.css' \) \
+  ! -path '*/node_modules/*' ! -path '*/target/*' -print0 2>/dev/null)
+
+# 6. Strip commercial references from package.json (pro scripts/deps)
+if [ -f "package.json" ]; then
+  if command -v node >/dev/null 2>&1; then
+    node -e "
+      const fs = require('fs');
+      const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+      let changed = false;
+      if (pkg.scripts) {
+        for (const key of Object.keys(pkg.scripts)) {
+          if (key.includes('commercial') || key.includes(':pro')) {
+            delete pkg.scripts[key];
+            changed = true;
+          }
+        }
+      }
+      if (pkg.dependencies) {
+        for (const key of Object.keys(pkg.dependencies)) {
+          if (key.includes('agor-pro')) {
+            delete pkg.dependencies[key];
+            changed = true;
+          }
+        }
+      }
+      if (pkg.devDependencies) {
+        for (const key of Object.keys(pkg.devDependencies)) {
+          if (key.includes('agor-pro')) {
+            delete pkg.devDependencies[key];
+            changed = true;
+          }
+        }
+      }
+      if (changed) {
+        fs.writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n');
+        console.log('Cleaned commercial references from package.json');
+      }
+    "
+  else
+    echo "Warning: node not available, skipping package.json cleanup"
+  fi
+fi
+
+# Summary
+echo ""
+echo "=== Strip complete ==="
+echo "Files removed: ${#removed[@]}"
+for f in "${removed[@]}"; do
+  echo "  - $f"
+done
+
+# Final verification
+echo ""
+echo "=== Verification ==="
+remaining=$(grep -rl "LicenseRef-Commercial" --include="*.ts" --include="*.svelte" \
+  --include="*.rs" --include="*.toml" --include="*.css" \
+  . 2>/dev/null | grep -v node_modules | grep -v target || true)
+
+if [ -n "$remaining" ]; then
+  echo "WARNING: LicenseRef-Commercial references still found in:"
+  echo "$remaining"
+  exit 1
+else
+  echo "No LicenseRef-Commercial references remain."
+fi
+
+if [ -d "agor-pro" ]; then
+  echo "WARNING: agor-pro/ directory still exists"
+  exit 1
+fi
+
+echo "All commercial content stripped successfully."