@attest-ai/core 0.6.0 → 1.0.0-rc.1

package/dist/esm/cli.js

@@ -1,154 +1,516 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import * as fs from "fs";
-import * as path from "path";
-import * as os from "os";
+import { spawnSync as spawnSync2 } from "child_process";
+import * as fs3 from "fs";
+import * as os2 from "os";
+import { fileURLToPath } from "url";
 
 // src/version.ts
-var VERSION = "0.6.0";
+var VERSION = "1.0.0-rc.1";
+var ENGINE_VERSION = "1.0.0-rc.1";
 
-// src/cli.ts
-function cacheDir() {
-  const envOverride = process.env["ATTEST_CACHE_DIR"];
-  if (envOverride) return envOverride;
-  return path.join(os.homedir(), ".attest", "cache");
-}
-function cacheDbPath() {
-  return path.join(cacheDir(), "attest.db");
-}
-function cmdCacheStats() {
-  const dbPath = cacheDbPath();
-  const exists = fs.existsSync(dbPath);
-  let fileSize = 0;
-  if (exists) {
-    fileSize = fs.statSync(dbPath).size;
-  }
-  const stats = { exists, file_size: fileSize, path: dbPath };
-  process.stdout.write(JSON.stringify(stats) + "\n");
-}
-function cmdCacheClear() {
-  const dbPath = cacheDbPath();
-  if (fs.existsSync(dbPath)) {
-    fs.unlinkSync(dbPath);
-    process.stdout.write(`Cleared cache: ${dbPath}
+// src/engine-manager.ts
+import { spawn, spawnSync } from "child_process";
+import { createInterface } from "readline";
+import { existsSync, accessSync, statSync as statSync2, constants as fsConstants } from "fs";
+import { delimiter, join as join2 } from "path";
+
+// src/engine-downloader.ts
+import * as https from "https";
+import * as http from "http";
+import * as fs from "fs";
+import * as path from "path";
+import * as os from "os";
+import * as crypto from "crypto";
+var RELEASE_BASE = `https://github.com/attest-framework/attest/releases/download/v${ENGINE_VERSION}`;
+var CHECKSUMS_URL = `${RELEASE_BASE}/checksums-sha256.txt`;
+var MAX_REDIRECTS = 5;
+function versionedBinDir() {
+  return path.join(os.homedir(), ".attest", "bin", ENGINE_VERSION);
+}
+function platformKey() {
+  const platform2 = os.platform();
+  const arch2 = os.arch();
+  const mapping = {
+    darwin: { arm64: "darwin-arm64", x64: "darwin-amd64" },
+    linux: { arm64: "linux-arm64", x64: "linux-amd64" },
+    win32: { x64: "windows-amd64", arm64: "windows-arm64" }
+  };
+  const osMap = mapping[platform2];
+  if (!osMap) {
+    throw new Error(
+      `Unsupported platform: ${platform2}. Supported: darwin, linux, win32.`
+    );
+  }
+  const key = osMap[arch2];
+  if (!key) {
+    throw new Error(
+      `Unsupported architecture '${arch2}' on platform '${platform2}'. Supported architectures: ${Object.keys(osMap).join(", ")}.`
+    );
+  }
+  return key;
+}
+function binaryFilename() {
+  return os.platform() === "win32" ? "attest-engine.exe" : "attest-engine";
+}
+function cachedEnginePath() {
+  const binPath = path.join(versionedBinDir(), binaryFilename());
+  return fs.statSync(binPath, { throwIfNoEntry: false })?.isFile() ? binPath : null;
+}
+function parseChecksums(text) {
+  const checksums = /* @__PURE__ */ new Map();
+  for (const line of text.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const match = trimmed.match(/^([a-f0-9]{64})\s+(.+)$/);
+    if (match) {
+      checksums.set(match[2], match[1]);
+    }
+  }
+  return checksums;
+}
+function httpsGet(url, redirectCount = 0) {
+  if (redirectCount > MAX_REDIRECTS) {
+    return Promise.reject(
+      new Error(`Too many redirects (>${MAX_REDIRECTS}) following ${url}`)
+    );
+  }
+  return new Promise((resolve, reject) => {
+    const client = url.startsWith("https:") ? https : http;
+    client.get(url, (res) => {
+      const status = res.statusCode ?? 0;
+      if (status === 301 || status === 302) {
+        const location = res.headers.location;
+        if (!location) {
+          reject(new Error(`Redirect ${status} without Location header from ${url}`));
+          return;
+        }
+        res.resume();
+        resolve(httpsGet(location, redirectCount + 1));
+        return;
+      }
+      if (status < 200 || status >= 300) {
+        res.resume();
+        reject(new Error(`HTTP ${status} fetching ${url}`));
+        return;
+      }
+      const chunks = [];
+      res.on("data", (chunk) => chunks.push(chunk));
+      res.on("end", () => resolve(Buffer.concat(chunks)));
+      res.on("error", reject);
+    }).on("error", reject);
+  });
+}
+async function downloadEngine() {
+  const key = platformKey();
+  const filename = `attest-engine-${key}${os.platform() === "win32" ? ".exe" : ""}`;
+  const binaryUrl = `${RELEASE_BASE}/${filename}`;
+  process.stderr.write(`[attest] Downloading engine v${ENGINE_VERSION} for ${key}...
 `);
-  } else {
-    process.stdout.write(`No cache to clear: ${dbPath}
+  process.stderr.write(`[attest] Fetching checksums...
 `);
+  const checksumsText = (await httpsGet(CHECKSUMS_URL)).toString("utf-8");
+  const checksums = parseChecksums(checksumsText);
+  const expectedHash = checksums.get(filename);
+  if (!expectedHash) {
+    throw new Error(
+      `No checksum found for '${filename}' in checksums-sha256.txt. Available files: ${[...checksums.keys()].join(", ")}`
+    );
   }
+  process.stderr.write(`[attest] Downloading ${binaryUrl}...
+`);
+  const data = await httpsGet(binaryUrl);
+  const actualHash = crypto.createHash("sha256").update(data).digest("hex");
+  if (actualHash !== expectedHash) {
+    throw new Error(
+      `SHA256 mismatch for ${filename}. Expected: ${expectedHash}, got: ${actualHash}. The download may be corrupted. Retry or download manually.`
+    );
+  }
+  process.stderr.write(`[attest] Checksum verified.
+`);
+  const dir = versionedBinDir();
+  fs.mkdirSync(dir, { recursive: true });
+  const destPath = path.join(dir, binaryFilename());
+  const suffix = `${String(process.pid)}.${crypto.randomBytes(8).toString("hex")}`;
+  const tmpPath = path.join(dir, `.${binaryFilename()}.tmp.${suffix}`);
+  try {
+    fs.writeFileSync(tmpPath, data, { flag: "wx", mode: 493 });
+    fs.chmodSync(tmpPath, 493);
+    fs.renameSync(tmpPath, destPath);
+  } catch (err) {
+    if (err.code !== "EEXIST") fs.rmSync(tmpPath, { force: true });
+    throw err;
+  }
+  process.stderr.write(`[attest] Engine installed at ${destPath}
+`);
+  return destPath;
 }
-var CONFTEST_TEMPLATE = `import { describe, it, expect } from "vitest";
-import { attestExpect, TraceBuilder } from "@attest-ai/core";
-
-describe("my agent", () => {
-  it("returns expected output", async () => {
-    const trace = new TraceBuilder("my-agent")
-      .setInput({ user_message: "hello" })
-      .setOutput({ message: "world" })
-      .build();
 
-    attestExpect(trace).outputContains("world");
+// src/engine-manager.ts
+var ENGINE_BINARY_NAME = "attest-engine";
+var VERSION_PROBE_TIMEOUT_MS = 1e4;
+var EngineVersionMismatchError = class extends Error {
+  enginePath;
+  source;
+  found;
+  required;
+  constructor(enginePath, source, found, required) {
+    const reported = found === null ? "reports no version" : `reports version ${found}`;
+    super(
+      `attest-engine at ${enginePath} (from ${source}) ${reported}; this SDK requires attest-engine ${required}. Point ATTEST_ENGINE_PATH at a matching engine, or remove the mismatched one from PATH so the SDK can download ${required} into ~/.attest/bin/${required}/.`
+    );
+    this.name = "EngineVersionMismatchError";
+    this.enginePath = enginePath;
+    this.source = source;
+    this.found = found;
+    this.required = required;
+  }
+};
+function engineVersion(enginePath) {
+  const proc = spawnSync(enginePath, ["version"], {
+    stdio: ["ignore", "pipe", "pipe"],
+    encoding: "utf-8",
+    timeout: VERSION_PROBE_TIMEOUT_MS
   });
+  if (proc.error) throw proc.error;
+  const out = proc.stdout.trim();
+  const prefix = `${ENGINE_BINARY_NAME} `;
+  if (proc.status !== 0 || !out.startsWith(prefix)) return null;
+  return out.slice(prefix.length).trim();
+}
+function onPath() {
+  for (const dir of (process.env["PATH"] ?? "").split(delimiter)) {
+    if (!dir) continue;
+    const candidate = join2(dir, binaryFilename());
+    try {
+      accessSync(candidate, fsConstants.X_OK);
+    } catch {
+      continue;
+    }
+    if (statSync2(candidate).isFile()) return candidate;
+  }
+  return null;
+}
+function requireFile(enginePath, label) {
+  if (!existsSync(enginePath) || !statSync2(enginePath).isFile()) {
+    throw new Error(`${label}=${enginePath} does not exist or is not a file.`);
+  }
+}
+async function locateEngine(explicitPath, allowDownload) {
+  if (explicitPath) {
+    requireFile(explicitPath, "Engine path");
+    return [explicitPath, "explicit engine path"];
+  }
+  const envPath = process.env["ATTEST_ENGINE_PATH"];
+  if (envPath) {
+    requireFile(envPath, "ATTEST_ENGINE_PATH");
+    return [envPath, "ATTEST_ENGINE_PATH"];
+  }
+  const found = onPath();
+  if (found) return [found, "PATH"];
+  const cached = cachedEnginePath();
+  if (cached) return [cached, "engine cache"];
+  if (!allowDownload) {
+    throw new Error(
+      `No '${ENGINE_BINARY_NAME}' ${ENGINE_VERSION} in ATTEST_ENGINE_PATH, PATH or ~/.attest/bin/${ENGINE_VERSION}/.`
+    );
+  }
+  const noDownload = process.env["ATTEST_ENGINE_NO_DOWNLOAD"]?.toLowerCase();
+  if (noDownload === "1" || noDownload === "true" || noDownload === "yes") {
+    throw new Error(
+      `Cannot find '${ENGINE_BINARY_NAME}' ${ENGINE_VERSION} and ATTEST_ENGINE_NO_DOWNLOAD is set.
+Install options:
+  1. Build from source: make engine, then set ATTEST_ENGINE_PATH
+  2. Download release v${ENGINE_VERSION}: https://github.com/attest-framework/attest/releases
+  3. Allow auto-download by unsetting ATTEST_ENGINE_NO_DOWNLOAD`
+    );
+  }
+  return [await downloadEngine(), "download"];
+}
+async function resolveEngine(explicitPath, options = {}) {
+  const [enginePath, source] = await locateEngine(explicitPath, options.allowDownload ?? true);
+  const found = engineVersion(enginePath);
+  if (found !== ENGINE_VERSION) {
+    throw new EngineVersionMismatchError(enginePath, source, found, ENGINE_VERSION);
+  }
+  return enginePath;
+}
+
+// src/scaffold.ts
+import * as fs2 from "fs";
+import * as path2 from "path";
+var DEMO_MARKER = "ATTEST-DEMO";
+var SAMPLE_TEST_TEMPLATE = `// Sample Attest test written by \`attest init\`. Run it with \`npx vitest run\`.
+import { it } from "vitest";
+import { attestExpect, TraceBuilder, type Trace } from "@attest-ai/core";
+import { evaluate } from "@attest-ai/vitest";
+
+// The trace of one agent run, built by hand so the sample needs no model, API key
+// or network. Replace it with a trace from your agent: wrap the agent with
+// \`new Agent(...)\` or record it with an adapter such as OpenAIAdapter.
+function myAgentResult(): Trace {
+  return new TraceBuilder("refund-agent")
+    .setInput({ user_message: "Please refund order ORD-1001." })
+    .addToolCall("lookup_order", {
+      args: { order_id: "ORD-1001" },
+      result: { status: "delivered", amount: 42.0 },
+    })
+    .addToolCall("issue_refund", {
+      args: { order_id: "ORD-1001", amount: 42.0 },
+      result: { refund_id: "RF-1001" },
+    })
+    .setOutput({
+      message: "Your refund of $42.00 has been issued.",
+      structured: { refund_id: "RF-1001", amount: 42.0 },
+    })
+    .setMetadata({ total_tokens: 180, cost_usd: 0.002, latency_ms: 900 })
+    .build();
+}
+
+it("my agent issues the refund", async (context) => {
+  const chain = attestExpect(myAgentResult())
+    .outputMatchesSchema({ type: "object", required: ["refund_id"] }) // layer 1: schema
+    .costUnder(0.01) // layer 2: constraint
+    .toolsCalledInOrder(["lookup_order", "issue_refund"]) // layer 3: trace
+    .outputContains("refund"); // ${DEMO_MARKER}: change "refund" to "store credit"
+  await evaluate(chain, { context });
 });
 `;
-function cmdInit(targetDir) {
-  const testsDir = path.join(targetDir, "tests");
-  fs.mkdirSync(testsDir, { recursive: true });
-  process.stdout.write(`Directory: ${testsDir}
+var REPORT_ARGS = "--reporter=default --reporter=@attest-ai/vitest/reporter --outputFile.attest=attest-report.json";
+var POLICY_TEMPLATE = `# Merge policy for \`attest policy evaluate --report <report> --policy attest.policy.yaml\`.
+# Exit 0: pass. Exit 1: a blocking rule failed. Exit 2: warnings only.
+layers:
+  0:  # layer 0 caps every layer together
+    max_hard_fails: 0
+# Assertions that could not run (no judge configured, simulation) warn instead of block.
+not_evaluated: warn
+`;
+var GITHUB_WORKFLOW_TEMPLATE = `# Written by \`attest init --ci github\`.
+# The test step records its outcome and continues so the report is always uploaded,
+# the policy evaluated and the pull request annotated; the last step fails the job
+# when the tests failed. A policy warning (exit 2) does not fail the job.
+name: attest
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  attest:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+      - name: Install dependencies
+        run: npm ci
+      - name: Run tests
+        id: tests
+        continue-on-error: true
+        run: npx vitest run ${REPORT_ARGS}
+      - name: Upload the Attest report
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: attest-report
+          path: attest-report.json
+          if-no-files-found: error
+      - name: Evaluate the merge policy
+        if: always()
+        run: |
+          set +e
+          npx attest policy evaluate --report attest-report.json --policy attest.policy.yaml
+          code=$?
+          if [ "$code" -eq 2 ]; then
+            echo "::warning::attest policy: warnings only (exit 2)"
+            exit 0
+          fi
+          exit "$code"
+      - name: Annotate the pull request
+        # Fork pull requests get a read-only token that cannot post reviews; the last step
+        # still fails the job when tests failed.
+        if: >-
+          always() && github.event_name == 'pull_request' &&
+          github.event.pull_request.head.repo.full_name == github.repository
+        uses: attest-framework/attest/.github/actions/pr-annotate@v${VERSION}
+        with:
+          report: attest-report.json
+      - name: Fail the job when tests failed
+        if: always() && steps.tests.outcome == 'failure'
+        run: |
+          echo "::error::vitest failed; see the Run tests step"
+          exit 1
+`;
+function write(file, content) {
+  if (fs2.existsSync(file)) {
+    process.stderr.write(`Skipped (exists): ${file}
 `);
-  const sampleTestPath = path.join(testsDir, "test_my_agent.test.ts");
-  if (fs.existsSync(sampleTestPath)) {
-    process.stderr.write(`Skipped (exists): ${sampleTestPath}
+    return;
+  }
+  fs2.mkdirSync(path2.dirname(file), { recursive: true });
+  fs2.writeFileSync(file, content);
+  process.stdout.write(`Created: ${file}
+`);
+}
+function scaffoldProject(targetDir, options = {}) {
+  write(path2.join(targetDir, "tests", "my-agent.test.ts"), SAMPLE_TEST_TEMPLATE);
+  write(path2.join(targetDir, "attest.policy.yaml"), POLICY_TEMPLATE);
+  if (options.ci === "github") {
+    write(path2.join(targetDir, ".github", "workflows", "attest.yml"), GITHUB_WORKFLOW_TEMPLATE);
+  }
+  process.stdout.write(
+    `
+Next: run \`npx vitest run\`. Then change the line marked ${DEMO_MARKER} in tests/my-agent.test.ts and run it again to see a failure.
+`
+  );
+}
+
+// src/cli.ts
+var HELP_FLAGS = /* @__PURE__ */ new Set(["-h", "--help"]);
+var SDK_USAGE = "usage: attest <command> [args]\n\nSDK commands:\n  init [--ci github]  scaffold a sample test and merge policy here\n                      (--ci github also writes .github/workflows/attest.yml)\n\noptions:\n  --version  print the SDK version and the engine version it requires\n  --help     print this help\n";
+var INIT_USAGE = "usage: attest init [--ci github]  (scaffolds into the current directory)";
+function cmdInit(args) {
+  if (args.some((a) => HELP_FLAGS.has(a))) {
+    process.stdout.write(`${INIT_USAGE}
 `);
-  } else {
-    fs.writeFileSync(sampleTestPath, CONFTEST_TEMPLATE);
-    process.stdout.write(`Created: ${sampleTestPath}
+    return 0;
+  }
+  const joined = args.join(" ");
+  if (args.length > 0 && joined !== "--ci github" && joined !== "--ci=github") {
+    process.stderr.write(`${INIT_USAGE}
 `);
+    return 2;
   }
+  scaffoldProject(process.cwd(), args.length > 0 ? { ci: "github" } : {});
+  return 0;
+}
+var HELP_PROBE_TIMEOUT_MS = 1e4;
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
 }
-function cmdValidate(targetDir) {
-  const testsDir = path.join(targetDir, "tests");
-  let testFiles = [];
-  if (fs.existsSync(testsDir)) {
-    testFiles = fs.readdirSync(testsDir).filter((f) => f.endsWith(".test.ts") || f.endsWith(".test.js"));
+function engineCommands(engine, timeoutMs = HELP_PROBE_TIMEOUT_MS) {
+  const proc = spawnSync2(engine, ["help"], {
+    stdio: ["ignore", "pipe", "pipe"],
+    encoding: "utf-8",
+    timeout: timeoutMs
+  });
+  if (proc.error || proc.status !== 0) return null;
+  const lines = proc.stdout.split("\n");
+  const start = lines.indexOf("commands:");
+  if (start === -1) return null;
+  const commands = /* @__PURE__ */ new Map();
+  for (const line of lines.slice(start + 1)) {
+    const match = /^\s*(\S+)\s*(.*)$/.exec(line);
+    if (match?.[1]) commands.set(match[1], (match[2] ?? "").trim());
   }
-  if (testFiles.length === 0) {
-    process.stderr.write(
-      `Warning: no test files (*.test.ts / *.test.js) found in ${testsDir}.
+  return commands;
+}
+async function printHelp() {
+  process.stdout.write(`${SDK_USAGE}
+`);
+  let engine;
+  try {
+    engine = await resolveEngine(void 0, { allowDownload: false });
+  } catch (err) {
+    const firstLine = (errorMessage(err).split("\n")[0] ?? "").replace(/\.$/, "");
+    process.stdout.write(
+      `engine commands: not available (${firstLine}). Run \`attest doctor\` to download attest-engine ${ENGINE_VERSION}, or set ATTEST_ENGINE_PATH.
 `
     );
-  } else {
-    process.stdout.write(`Found ${testFiles.length} test file(s) in ${testsDir}
-`);
+    return 0;
   }
-  const STALE_DAYS = 30;
-  const now = Date.now();
-  const goldenFiles = findGoldenFiles(targetDir);
-  for (const golden of goldenFiles) {
-    const mtime = fs.statSync(golden).mtimeMs;
-    const ageDays = Math.floor((now - mtime) / (1e3 * 60 * 60 * 24));
-    if (ageDays > STALE_DAYS) {
-      process.stderr.write(
-        `Warning: golden trace ${golden} is ${ageDays} days old (>${STALE_DAYS} days). Consider regenerating.
+  const commands = engineCommands(engine);
+  if (commands === null) {
+    process.stdout.write(
+      `engine commands: not available (attest-engine at ${engine} lists no commands; it predates the command registry).
 `
-      );
-    }
+    );
+    return 0;
   }
-}
-function findGoldenFiles(dir) {
-  const results = [];
-  if (!fs.existsSync(dir)) return results;
-  const entries = fs.readdirSync(dir, { withFileTypes: true });
-  for (const entry of entries) {
-    const fullPath = path.join(dir, entry.name);
-    if (entry.isDirectory() && entry.name !== "node_modules") {
-      results.push(...findGoldenFiles(fullPath));
-    } else if (entry.isFile() && entry.name.endsWith(".golden")) {
-      results.push(fullPath);
-    }
+  const width = Math.max(0, ...[...commands.keys()].map((name) => name.length));
+  process.stdout.write(`engine commands (attest-engine ${ENGINE_VERSION}, ${engine}):
+`);
+  for (const [name, summary] of commands) {
+    process.stdout.write(`  ${name.padEnd(width)}  ${summary}
+`);
   }
-  return results;
+  return 0;
+}
+function exitStatus(status, signal) {
+  if (status !== null) return status;
+  if (signal !== null) return 128 + (os2.constants.signals[signal] ?? 0);
+  return 1;
 }
-function main(argv = process.argv.slice(2)) {
-  const args = argv;
-  if (args[0] === "--version") {
-    process.stdout.write(`attest ${VERSION}
+async function forward(args) {
+  let engine;
+  try {
+    engine = await resolveEngine();
+  } catch (err) {
+    process.stderr.write(`attest: ${errorMessage(err)}
 `);
-    process.exit(0);
-  }
-  if (args[0] === "cache" && args.length >= 2) {
-    if (args[1] === "stats") {
-      cmdCacheStats();
-      process.exit(0);
-    } else if (args[1] === "clear") {
-      cmdCacheClear();
-      process.exit(0);
-    } else {
-      process.stderr.write(`Unknown cache subcommand: ${args[1]}
+    return 1;
+  }
+  const command = args[0] ?? "";
+  const commands = engineCommands(engine);
+  if (commands === null || command !== "help" && !commands.has(command)) {
+    process.stderr.write(
+      `attest: attest-engine at ${engine} (version ${ENGINE_VERSION}) predates \`attest ${command}\`: its help does not list that command. Set ATTEST_ENGINE_PATH to an engine built from this release (make engine), or install a release whose engine provides it.
+`
+    );
+    return 1;
+  }
+  const proc = spawnSync2(engine, args, { stdio: "inherit" });
+  if (proc.error) throw proc.error;
+  return exitStatus(proc.status, proc.signal);
+}
+async function main(argv = process.argv.slice(2)) {
+  const [command] = argv;
+  if (command === void 0 || HELP_FLAGS.has(command) || command === "help" && argv.length === 1) {
+    return printHelp();
+  }
+  if (command === "--version") {
+    process.stdout.write(`attest ${VERSION} (requires attest-engine ${ENGINE_VERSION})
 `);
-      process.stderr.write("Available: cache stats, cache clear\n");
-      process.exit(1);
-    }
+    return 0;
   }
-  if (args[0] === "init") {
-    cmdInit(process.cwd());
-    process.exit(0);
+  if (command === "init") {
+    return cmdInit(argv.slice(1));
   }
-  if (args[0] === "validate") {
-    cmdValidate(process.cwd());
-    process.exit(0);
+  if (command.startsWith("-")) {
+    process.stderr.write(`attest: unknown option ${command}
+
+${SDK_USAGE}`);
+    return 2;
   }
-  process.stderr.write(
-    "Usage: attest <command>\n\nCommands:\n  --version       Print version\n  init            Scaffold a test project\n  validate        Validate test suite\n  cache stats     Show cache statistics\n  cache clear     Clear cache database\n"
-  );
-  process.exit(args.length === 0 ? 0 : 1);
+  return forward(argv);
+}
+function isDirectExecution() {
+  const script = process.argv[1];
+  if (script === void 0 || !fs3.existsSync(script)) return false;
+  return fs3.realpathSync(script) === fs3.realpathSync(fileURLToPath(import.meta.url));
 }
-var isDirectExecution = typeof import.meta.url === "string" && import.meta.url.startsWith("file:") && process.argv[1] !== void 0 && import.meta.url.endsWith(path.basename(process.argv[1]));
-if (isDirectExecution) {
-  main();
+if (isDirectExecution()) {
+  main().then(
+    (code) => process.exit(code),
+    (err) => {
+      process.stderr.write(`attest: ${errorMessage(err)}
+`);
+      process.exit(1);
+    }
+  );
 }
 export {
+  engineCommands,
+  exitStatus,
   main
 };
 //# sourceMappingURL=cli.js.map