@enactprotocol/cli 2.0.0 → 2.0.1

package/dist/commands/list/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/list/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAGnF,OAAO,EAEL,GAAG,EACH,KAAK,EACL,WAAW,EACX,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,KAAK,GACN,MAAM,aAAa,CAAC;AAerB;;GAEG;AACH,SAAS,qBAAqB,CAAC,KAA2B,EAAE,GAAY;IACtE,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,cAAc,GAAG,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEtD,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,8CAA8C;QAC9C,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,WAAW,IAAI,GAAG;YAChD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,WAAW,CAAC,OAAoB,EAAE,GAAmB;IAClE,MAAM,QAAQ,GAAe,EAAE,CAAC;IAEhC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,yCAAyC;QACzC,MAAM,WAAW,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,wCAAwC;QACxC,MAAM,YAAY,GAAG,qBAAqB,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/D,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IACjC,CAAC;IAED,SAAS;IACT,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,QAAQ,CAAC,CAAC;QACf,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,4BAA4B,CAAC,CAAC;YACnC,GAAG,CAAC,iDAAiD,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,6BAA6B,CAAC,CAAC;YACpC,GAAG,CAAC,4DAA4D,CAAC,CAAC;QACpE,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IAC1D,OAAO,EAAE,CAAC;IAEV,MAAM,OAAO,GAAkB;QAC7B,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;QAC1C,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE;KACzD,CAAC;IAEF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzB,OAAO,EAAE,CAAC;IACV,GAAG,CAAC,UAAU,QAAQ,CAAC,MAAM,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,sBAAsB,CAAC;SACnC,MAAM,CAAC,cAAc,EAAE,6CAA6C,CAAC;SACrE,MAAM,CAAC,eAAe,EAAE,sCAAsC,CAAC;SAC/D,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAoB,EAAE,EAAE;QACrC,MAAM,GAAG,GAAmB;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;YAClB,OAAO;YACP,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,KAAK;SAC7C,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/publish/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * enact publish command
+ *
+ * Publish a tool to the Enact registry using v2 multipart upload.
+ */
+import type { Command } from "commander";
+/**
+ * Configure the publish command
+ */
+export declare function configurePublishCommand(program: Command): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/publish/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/publish/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAcH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA+SzC;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAyB9D"}

package/dist/commands/publish/index.js

@@ -0,0 +1,274 @@
+/**
+ * enact publish command
+ *
+ * Publish a tool to the Enact registry using v2 multipart upload.
+ */
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { createApiClient, publishTool } from "@enactprotocol/api";
+import { getSecret } from "@enactprotocol/secrets";
+import { loadConfig, loadManifest, loadManifestFromDir, validateManifest, } from "@enactprotocol/shared";
+import { dim, error, formatError, header, info, json, keyValue, newline, success, warning, withSpinner, } from "../../utils";
+import { loadGitignore, shouldIgnore } from "../../utils/ignore";
+/** Auth namespace for token storage */
+const AUTH_NAMESPACE = "enact:auth";
+const ACCESS_TOKEN_KEY = "access_token";
+/**
+ * Recursively collect all files in a directory
+ */
+function collectFiles(dir, baseDir, files = [], ignorePatterns = []) {
+    const entries = readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+        const fullPath = join(dir, entry.name);
+        const relativePath = relative(baseDir, fullPath);
+        // Check if file should be ignored
+        if (shouldIgnore(relativePath, entry.name, ignorePatterns)) {
+            continue;
+        }
+        if (entry.isDirectory()) {
+            collectFiles(fullPath, baseDir, files, ignorePatterns);
+        }
+        else if (entry.isFile()) {
+            files.push({ path: fullPath, relativePath });
+        }
+    }
+    return files;
+}
+/**
+ * Create a tar.gz bundle from the tool directory
+ */
+async function createBundleFromDir(toolDir) {
+    // Load gitignore patterns (ALWAYS_IGNORE is already checked in shouldIgnore)
+    const gitignorePatterns = loadGitignore(toolDir);
+    // Collect all files to include (respecting ignore patterns)
+    const files = collectFiles(toolDir, toolDir, [], gitignorePatterns);
+    // Use tar to create the bundle (available on all supported platforms)
+    const tempDir = join(process.env.TMPDIR ?? "/tmp", `enact-bundle-${Date.now()}`);
+    const tempBundle = join(tempDir, "bundle.tar.gz");
+    const { mkdirSync, rmSync } = await import("node:fs");
+    mkdirSync(tempDir, { recursive: true });
+    try {
+        // Create tar.gz using tar command
+        const fileList = files.map((f) => f.relativePath).join("\n");
+        const fileListPath = join(tempDir, "files.txt");
+        const { writeFileSync } = await import("node:fs");
+        writeFileSync(fileListPath, fileList);
+        // Use COPYFILE_DISABLE=1 to prevent macOS from adding AppleDouble (._) files
+        const proc = Bun.spawn(["tar", "-czf", tempBundle, "-C", toolDir, "-T", fileListPath], {
+            stdout: "pipe",
+            stderr: "pipe",
+            env: {
+                ...process.env,
+                COPYFILE_DISABLE: "1", // Prevents macOS extended attributes/resource forks
+            },
+        });
+        const exitCode = await proc.exited;
+        if (exitCode !== 0) {
+            const stderr = await new Response(proc.stderr).text();
+            throw new Error(`Failed to create bundle: ${stderr}`);
+        }
+        // Read the bundle
+        const bundleData = readFileSync(tempBundle);
+        return new Uint8Array(bundleData);
+    }
+    finally {
+        // Clean up temp files
+        try {
+            rmSync(tempDir, { recursive: true, force: true });
+        }
+        catch {
+            // Ignore cleanup errors
+        }
+    }
+}
+/**
+ * Load README from tool directory
+ */
+function loadReadme(toolDir) {
+    const readmeNames = ["README.md", "readme.md", "README", "readme"];
+    for (const name of readmeNames) {
+        const readmePath = join(toolDir, name);
+        if (existsSync(readmePath)) {
+            return readFileSync(readmePath, "utf-8");
+        }
+    }
+    return undefined;
+}
+/**
+ * Load and validate manifest from file or directory
+ */
+async function loadAndValidateManifest(pathArg, ctx) {
+    const fullPath = resolve(ctx.cwd, pathArg);
+    if (!existsSync(fullPath)) {
+        throw new Error(`Path not found: ${fullPath}`);
+    }
+    // Load manifest - handle both files and directories
+    let loaded;
+    const stats = statSync(fullPath);
+    if (stats.isDirectory()) {
+        loaded = loadManifestFromDir(fullPath);
+    }
+    else {
+        loaded = loadManifest(fullPath);
+    }
+    if (!loaded) {
+        throw new Error(`Could not load manifest from: ${fullPath}`);
+    }
+    // Validate manifest
+    const validation = validateManifest(loaded.manifest);
+    if (!validation.valid) {
+        const errors = validation.errors?.map((e) => `  - ${e}`).join("\n");
+        throw new Error(`Invalid manifest:\n${errors}`);
+    }
+    return {
+        manifest: loaded.manifest,
+        toolDir: dirname(loaded.filePath),
+    };
+}
+/**
+ * Publish command handler
+ */
+async function publishHandler(pathArg, options, ctx) {
+    // Load and validate manifest
+    const { manifest, toolDir } = await loadAndValidateManifest(pathArg, ctx);
+    const toolName = manifest.name;
+    const version = manifest.version ?? "0.0.0";
+    header(`Publishing ${toolName}@${version}`);
+    newline();
+    // Show what we're publishing
+    keyValue("Name", toolName);
+    keyValue("Version", version);
+    keyValue("Description", manifest.description);
+    if (manifest.tags && manifest.tags.length > 0) {
+        keyValue("Tags", manifest.tags.join(", "));
+    }
+    newline();
+    // Get registry URL from config or environment
+    const config = loadConfig();
+    const registryUrl = process.env.ENACT_REGISTRY_URL ??
+        config.registry?.url ??
+        "https://siikwkfgsmouioodghho.supabase.co/functions/v1";
+    if (options.verbose) {
+        keyValue("Registry", registryUrl);
+    }
+    // Check for auth token from keyring (skip in local dev mode)
+    let authToken;
+    if (options.skipAuth) {
+        warning("Skipping authentication (local development mode)");
+        // For local dev, use the Supabase anon key from environment or default local key
+        authToken =
+            process.env.SUPABASE_ANON_KEY ??
+                "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZS1kZW1vIiwicm9sZSI6ImFub24iLCJleHAiOjE5ODM4MTI5OTZ9.CRXP1A7WOeoJeXxjNni43kdQwgnWNReilDMblYTn_I0";
+    }
+    else {
+        const secretToken = await getSecret(AUTH_NAMESPACE, ACCESS_TOKEN_KEY);
+        authToken = secretToken ?? undefined;
+        if (!authToken) {
+            // Check config registry authToken
+            authToken = config.registry?.authToken;
+        }
+        if (!authToken) {
+            // Also check environment variable for CI/local dev
+            authToken = process.env.ENACT_AUTH_TOKEN;
+        }
+        if (!authToken) {
+            // Fallback to official registry anon key if using official registry
+            if (registryUrl.includes("siikwkfgsmouioodghho.supabase.co")) {
+                authToken =
+                    "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InNpaWt3a2Znc21vdWlvb2RnaGhvIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NjQ2MTkzMzksImV4cCI6MjA4MDE5NTMzOX0.kxnx6-IPFhmGx6rzNx36vbyhFMFZKP_jFqaDbKnJ_E0";
+            }
+        }
+        if (!authToken) {
+            error("Not authenticated. Please run: enact auth login");
+            dim("Or set ENACT_AUTH_TOKEN environment variable");
+            dim("Or use --skip-auth for local development");
+            process.exit(1);
+        }
+    }
+    const client = createApiClient({ baseUrl: registryUrl });
+    if (authToken) {
+        client.setAuthToken(authToken);
+    }
+    // Dry run mode
+    if (options.dryRun) {
+        warning("Dry run mode - not actually publishing");
+        newline();
+        info("Would publish to registry:");
+        keyValue("Tool", toolName);
+        keyValue("Version", version);
+        keyValue("Source", toolDir);
+        // Show files that would be bundled
+        const files = collectFiles(toolDir, toolDir);
+        info(`Would bundle ${files.length} files`);
+        if (options.verbose) {
+            for (const file of files.slice(0, 10)) {
+                dim(`  ${file.relativePath}`);
+            }
+            if (files.length > 10) {
+                dim(`  ... and ${files.length - 10} more`);
+            }
+        }
+        return;
+    }
+    // Load README if available
+    const readme = loadReadme(toolDir);
+    if (readme) {
+        info("Found README.md");
+    }
+    // Create bundle
+    const bundle = await withSpinner("Creating bundle...", async () => {
+        return await createBundleFromDir(toolDir);
+    });
+    info(`Bundle size: ${(bundle.length / 1024).toFixed(1)} KB`);
+    // Publish to registry using v2 multipart API
+    const result = await withSpinner("Publishing to registry...", async () => {
+        return await publishTool(client, {
+            name: toolName,
+            manifest: manifest,
+            bundle,
+            readme,
+        });
+    });
+    // JSON output
+    if (options.json) {
+        json(result);
+        return;
+    }
+    // Success output
+    newline();
+    success(`Published ${result.name}@${result.version}`);
+    keyValue("Bundle Hash", result.bundleHash);
+    keyValue("Published At", result.publishedAt.toISOString());
+    newline();
+    dim(`Install with: enact install ${toolName}`);
+}
+/**
+ * Configure the publish command
+ */
+export function configurePublishCommand(program) {
+    program
+        .command("publish [path]")
+        .description("Publish a tool to the Enact registry")
+        .option("-n, --dry-run", "Show what would be published without publishing")
+        .option("-t, --tag <tag>", "Add a release tag (e.g., latest, beta)")
+        .option("-v, --verbose", "Show detailed output")
+        .option("--skip-auth", "Skip authentication (for local development)")
+        .option("--json", "Output as JSON")
+        .action(async (pathArg, options) => {
+        const resolvedPath = pathArg ?? ".";
+        const ctx = {
+            cwd: process.cwd(),
+            options,
+            isCI: Boolean(process.env.CI),
+            isInteractive: process.stdout.isTTY ?? false,
+        };
+        try {
+            await publishHandler(resolvedPath, options, ctx);
+        }
+        catch (err) {
+            error(formatError(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/commands/publish/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/publish/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAGL,UAAU,EACV,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,GAAG,EACH,KAAK,EACL,WAAW,EACX,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,OAAO,EACP,OAAO,EACP,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEjE,uCAAuC;AACvC,MAAM,cAAc,GAAG,YAAY,CAAC;AACpC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAQxC;;GAEG;AACH,SAAS,YAAY,CACnB,GAAW,EACX,OAAe,EACf,QAAuD,EAAE,EACzD,iBAA2B,EAAE;IAE7B,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEjD,kCAAkC;QAClC,IAAI,YAAY,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;YAC3D,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;QACzD,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,mBAAmB,CAAC,OAAe;IAChD,6EAA6E;IAC7E,MAAM,iBAAiB,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAEjD,4DAA4D;IAC5D,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAEpE,sEAAsE;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,MAAM,EAAE,gBAAgB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAElD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAExC,IAAI,CAAC;QACH,kCAAkC;QAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAChD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QAClD,aAAa,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAEtC,6EAA6E;QAC7E,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE;YACrF,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,gBAAgB,EAAE,GAAG,EAAE,oDAAoD;aAC5E;SACF,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;QAEnC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,kBAAkB;QAClB,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QAC5C,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;YAAS,CAAC;QACT,sBAAsB;QACtB,IAAI,CAAC;YACH,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,WAAW,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEnE,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,OAAO,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,uBAAuB,CACpC,OAAe,EACf,GAAmB;IAEnB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAE3C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,oDAAoD;IACpD,IAAI,MAAkC,CAAC;IACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,MAAM,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,oBAAoB;IACpB,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,cAAc,CAC3B,OAAe,EACf,OAAuB,EACvB,GAAmB;IAEnB,6BAA6B;IAC7B,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAE1E,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC;IAE5C,MAAM,CAAC,cAAc,QAAQ,IAAI,OAAO,EAAE,CAAC,CAAC;IAC5C,OAAO,EAAE,CAAC;IAEV,6BAA6B;IAC7B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,CAAC;IAEV,8CAA8C;IAC9C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,WAAW,GACf,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,MAAM,CAAC,QAAQ,EAAE,GAAG;QACpB,uDAAuD,CAAC;IAE1D,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACpC,CAAC;IAED,6DAA6D;IAC7D,IAAI,SAA6B,CAAC;IAClC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,CAAC,kDAAkD,CAAC,CAAC;QAC5D,iFAAiF;QACjF,SAAS;YACP,OAAO,CAAC,GAAG,CAAC,iBAAiB;gBAC7B,2JAA2J,CAAC;IAChK,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtE,SAAS,GAAG,WAAW,IAAI,SAAS,CAAC;QACrC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,kCAAkC;YAClC,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,mDAAmD;YACnD,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,oEAAoE;YACpE,IAAI,WAAW,CAAC,QAAQ,CAAC,kCAAkC,CAAC,EAAE,CAAC;gBAC7D,SAAS;oBACP,kNAAkN,CAAC;YACvN,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACzD,GAAG,CAAC,8CAA8C,CAAC,CAAC;YACpD,GAAG,CAAC,0CAA0C,CAAC,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;IACzD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,eAAe;IACf,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,wCAAwC,CAAC,CAAC;QAClD,OAAO,EAAE,CAAC;QACV,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACnC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAE5B,mCAAmC;QACnC,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,gBAAgB,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;gBACtC,GAAG,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;YAChC,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBACtB,GAAG,CAAC,aAAa,KAAK,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,OAAO;IACT,CAAC;IAED,2BAA2B;IAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC1B,CAAC;IAED,gBAAgB;IAChB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;QAChE,OAAO,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAE7D,6CAA6C;IAC7C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACvE,OAAO,MAAM,WAAW,CAAC,MAAM,EAAE;YAC/B,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,QAA8C;YACxD,MAAM;YACN,MAAM;SACP,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,cAAc;IACd,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,CAAC;QACb,OAAO;IACT,CAAC;IAED,iBAAiB;IACjB,OAAO,EAAE,CAAC;IACV,OAAO,CAAC,aAAa,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACtD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAC3C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,OAAO,EAAE,CAAC;IACV,GAAG,CAAC,+BAA+B,QAAQ,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,OAAO;SACJ,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,sCAAsC,CAAC;SACnD,MAAM,CAAC,eAAe,EAAE,iDAAiD,CAAC;SAC1E,MAAM,CAAC,iBAAiB,EAAE,wCAAwC,CAAC;SACnE,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC;SAC/C,MAAM,CAAC,aAAa,EAAE,6CAA6C,CAAC;SACpE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAA2B,EAAE,OAAuB,EAAE,EAAE;QACrE,MAAM,YAAY,GAAG,OAAO,IAAI,GAAG,CAAC;QACpC,MAAM,GAAG,GAAmB;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;YAClB,OAAO;YACP,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,KAAK;SAC7C,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,YAAY,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/report/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * enact report command
+ *
+ * Report security vulnerabilities or issues with a tool.
+ * Creates a signed attestation with result "failed" and submits to the registry.
+ */
+import type { Command } from "commander";
+/**
+ * Configure the report command
+ */
+export declare function configureReportCommand(program: Command): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/report/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/report/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuTzC;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAoC7D"}

package/dist/commands/report/index.js

@@ -0,0 +1,279 @@
+/**
+ * enact report command
+ *
+ * Report security vulnerabilities or issues with a tool.
+ * Creates a signed attestation with result "failed" and submits to the registry.
+ */
+import { createApiClient, getToolVersion, submitAttestation } from "@enactprotocol/api";
+import { getSecret } from "@enactprotocol/secrets";
+import { loadConfig } from "@enactprotocol/shared";
+import { createEnactAuditStatement, signAttestation, } from "@enactprotocol/trust";
+import { colors, dim, error, formatError, info, json, keyValue, newline, success, warning, withSpinner, } from "../../utils";
+/** Auth namespace for token storage */
+const AUTH_NAMESPACE = "enact:auth";
+const ACCESS_TOKEN_KEY = "access_token";
+/** Valid severity levels */
+const SEVERITY_LEVELS = ["critical", "high", "medium", "low"];
+/** Valid categories */
+const CATEGORIES = ["security", "malware", "quality", "license", "other"];
+/**
+ * Parse tool@version format
+ */
+function parseToolVersion(toolArg) {
+    const atIndex = toolArg.lastIndexOf("@");
+    // Check if @ is part of the tool name (like @scope/package) or version separator
+    if (atIndex <= 0 || toolArg.startsWith("@")) {
+        // Could be @scope/package or @scope/package@version
+        const scopedMatch = toolArg.match(/^(@[^/]+\/[^@]+)(?:@(.+))?$/);
+        if (scopedMatch) {
+            return {
+                name: scopedMatch[1] ?? toolArg,
+                version: scopedMatch[2],
+            };
+        }
+        return { name: toolArg, version: undefined };
+    }
+    return {
+        name: toolArg.slice(0, atIndex),
+        version: toolArg.slice(atIndex + 1),
+    };
+}
+/**
+ * Display report preview (dry run)
+ */
+function displayDryRun(tool, version, options) {
+    newline();
+    info(colors.bold("Dry Run Preview - Report Submission"));
+    newline();
+    keyValue("Tool", tool);
+    if (version) {
+        keyValue("Version", version);
+    }
+    keyValue("Reason", options.reason);
+    keyValue("Severity", options.severity ?? "medium");
+    keyValue("Category", options.category ?? "other");
+    keyValue("Submit to registry", options.local ? "No (local only)" : "Yes");
+    newline();
+    info("Actions that would be performed:");
+    dim("  1. Authenticate via OIDC (browser-based OAuth flow)");
+    dim("  2. Create audit attestation with result 'failed'");
+    dim("  3. Request signing certificate from Fulcio");
+    dim("  4. Sign attestation with ephemeral keypair");
+    dim("  5. Log signature to Rekor transparency log");
+    if (!options.local) {
+        dim("  6. Submit signed report to Enact registry");
+    }
+    newline();
+    warning("Note: False reports may result in account suspension.");
+    dim("Your identity will be cryptographically bound to this report.");
+}
+/**
+ * Display report result
+ */
+function displayResult(tool, version, options, registryResult) {
+    if (options.json) {
+        json({
+            success: true,
+            tool,
+            version: version ?? "latest",
+            reason: options.reason,
+            severity: options.severity ?? "medium",
+            category: options.category ?? "other",
+            registry: registryResult
+                ? {
+                    submitted: true,
+                    auditor: registryResult.auditor,
+                    rekorLogIndex: registryResult.rekorLogIndex,
+                }
+                : { submitted: false },
+        });
+        return;
+    }
+    newline();
+    success(`Report submitted for ${tool}${version ? `@${version}` : ""}`);
+    newline();
+    keyValue("Severity", options.severity ?? "medium");
+    keyValue("Category", options.category ?? "other");
+    if (registryResult) {
+        keyValue("Auditor identity", registryResult.auditor);
+        if (registryResult.rekorLogIndex !== undefined) {
+            keyValue("Rekor log index", String(registryResult.rekorLogIndex));
+        }
+    }
+    newline();
+    info("What happens next:");
+    dim("  • Your signed report is recorded on the Rekor transparency log");
+    dim("  • Registry moderators will review your report");
+    dim("  • The tool publisher will be notified");
+    dim("  • You may be contacted for additional information");
+    newline();
+    warning("Note: Your identity is cryptographically bound to this report.");
+    warning("False reports may result in account suspension.");
+}
+/**
+ * Report command handler
+ */
+async function reportHandler(toolArg, options, _ctx) {
+    // Parse tool@version
+    const { name: toolName, version: parsedVersion } = parseToolVersion(toolArg);
+    // Validate required options
+    if (!options.reason || options.reason.trim().length === 0) {
+        error("--reason is required. Please provide a description of the issue.");
+        process.exit(1);
+    }
+    // Validate severity if provided
+    if (options.severity && !SEVERITY_LEVELS.includes(options.severity)) {
+        error(`Invalid severity. Must be one of: ${SEVERITY_LEVELS.join(", ")}`);
+        process.exit(1);
+    }
+    // Validate category if provided
+    if (options.category && !CATEGORIES.includes(options.category)) {
+        error(`Invalid category. Must be one of: ${CATEGORIES.join(", ")}`);
+        process.exit(1);
+    }
+    // Dry run mode
+    if (options.dryRun) {
+        displayDryRun(toolName, parsedVersion, options);
+        return;
+    }
+    // Create API client to fetch tool info
+    const config = loadConfig();
+    const registryUrl = config.registry?.url ?? "https://registry.enact.tools";
+    const client = createApiClient({ baseUrl: registryUrl });
+    // Get version to report - either specified or latest
+    let version = parsedVersion;
+    if (!version) {
+        try {
+            const toolInfo = await withSpinner(`Fetching ${toolName} info...`, async () => getToolVersion(client, toolName, "latest"), `Found ${toolName}`);
+            version = toolInfo.version;
+        }
+        catch (err) {
+            error(`Failed to find tool ${toolName}: ${formatError(err)}`);
+            process.exit(1);
+        }
+    }
+    // Create the audit notes with severity and category
+    const notes = `[${(options.category ?? "other").toUpperCase()}] [${(options.severity ?? "medium").toUpperCase()}] ${options.reason}`;
+    // Create audit statement with result "failed"
+    const auditOptions = {
+        toolName,
+        toolVersion: version,
+        auditor: "unknown", // Will be filled by OIDC
+        result: "failed",
+        timestamp: new Date(),
+        notes,
+    };
+    // Create a simple manifest placeholder for the subject hash
+    // In a full implementation, we would fetch the actual manifest from registry
+    const manifestPlaceholder = JSON.stringify({
+        name: toolName,
+        version,
+        reported: true,
+    });
+    const statement = createEnactAuditStatement(manifestPlaceholder, auditOptions);
+    if (options.verbose) {
+        info("Created report attestation statement:");
+        dim(JSON.stringify(statement, null, 2));
+        newline();
+    }
+    // Sign the attestation using Sigstore
+    info("Starting OIDC signing flow...");
+    dim("A browser window will open for authentication.");
+    newline();
+    const result = await withSpinner("Signing report...", async () => {
+        try {
+            return await signAttestation(statement, {
+                timeout: 120000, // 2 minutes for OIDC flow
+            });
+        }
+        catch (err) {
+            if (err instanceof Error) {
+                if (err.message.includes("OIDC") || err.message.includes("token")) {
+                    throw new Error(`OIDC authentication failed: ${err.message}\nMake sure you complete the browser authentication flow.`);
+                }
+                if (err.message.includes("Fulcio") || err.message.includes("certificate")) {
+                    throw new Error(`Certificate issuance failed: ${err.message}\nThis may be a temporary issue with the Sigstore infrastructure.`);
+                }
+                if (err.message.includes("Rekor") || err.message.includes("transparency")) {
+                    throw new Error(`Transparency log failed: ${err.message}\nThis may be a temporary issue with the Sigstore infrastructure.`);
+                }
+            }
+            throw err;
+        }
+    });
+    // Submit attestation to registry (unless --local)
+    let registryResult;
+    if (!options.local) {
+        // Check for auth token from keyring
+        const authToken = await getSecret(AUTH_NAMESPACE, ACCESS_TOKEN_KEY);
+        if (!authToken) {
+            warning("Not authenticated with registry - report not submitted");
+            dim("Run 'enact auth login' to authenticate, then report again");
+            dim("Your report is still recorded on the Rekor transparency log.");
+        }
+        else {
+            client.setAuthToken(authToken);
+            try {
+                const attestationResult = await withSpinner("Submitting report to registry...", async () => {
+                    return await submitAttestation(client, {
+                        name: toolName,
+                        version: version,
+                        sigstoreBundle: result.bundle,
+                    });
+                });
+                registryResult = {
+                    auditor: attestationResult.auditor,
+                    rekorLogIndex: attestationResult.rekorLogIndex,
+                };
+            }
+            catch (err) {
+                warning("Failed to submit report to registry");
+                if (err instanceof Error) {
+                    dim(`  ${err.message}`);
+                }
+                dim("Your report is still recorded on the Rekor transparency log.");
+            }
+        }
+    }
+    else {
+        dim("Report signed locally only (--local flag)");
+        dim("The signature is recorded on the Rekor transparency log.");
+    }
+    // Display result
+    displayResult(toolName, version, options, registryResult);
+}
+/**
+ * Configure the report command
+ */
+export function configureReportCommand(program) {
+    program
+        .command("report")
+        .description("Report security vulnerabilities or issues with a tool (creates signed attestation)")
+        .argument("<tool>", "Tool to report (name or name@version)")
+        .requiredOption("-r, --reason <description>", "Issue description (required)")
+        .option("-s, --severity <level>", "Severity level: critical, high, medium, low", "medium")
+        .option("-c, --category <type>", "Issue type: security, malware, quality, license, other", "other")
+        .option("--dry-run", "Show what would be submitted without submitting")
+        .option("--local", "Sign locally only, do not submit to registry")
+        .option("-v, --verbose", "Show detailed output")
+        .option("--json", "Output result as JSON")
+        .action(async (toolArg, options) => {
+        const ctx = {
+            cwd: process.cwd(),
+            options,
+            isCI: Boolean(process.env.CI),
+            isInteractive: process.stdout.isTTY ?? false,
+        };
+        try {
+            await reportHandler(toolArg, options, ctx);
+        }
+        catch (err) {
+            error(formatError(err));
+            if (options.verbose && err instanceof Error && err.stack) {
+                dim(err.stack);
+            }
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/commands/report/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/report/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAEL,yBAAyB,EACzB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,MAAM,EACN,GAAG,EACH,KAAK,EACL,WAAW,EACX,IAAI,EACJ,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,OAAO,EACP,OAAO,EACP,WAAW,GACZ,MAAM,aAAa,CAAC;AAErB,uCAAuC;AACvC,MAAM,cAAc,GAAG,YAAY,CAAC;AACpC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAUxC,4BAA4B;AAC5B,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAU,CAAC;AAEvE,uBAAuB;AACvB,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAU,CAAC;AAEnF;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAEzC,iFAAiF;IACjF,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,oDAAoD;QACpD,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjE,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO;gBACL,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO;gBAC/B,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;aACxB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,OAA2B,EAAE,OAAsB;IACtF,OAAO,EAAE,CAAC;IACV,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,CAAC;IACzD,OAAO,EAAE,CAAC;IAEV,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvB,IAAI,OAAO,EAAE,CAAC;QACZ,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC;IAClD,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1E,OAAO,EAAE,CAAC;IAEV,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACzC,GAAG,CAAC,uDAAuD,CAAC,CAAC;IAC7D,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAC1D,GAAG,CAAC,8CAA8C,CAAC,CAAC;IACpD,GAAG,CAAC,8CAA8C,CAAC,CAAC;IACpD,GAAG,CAAC,8CAA8C,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,GAAG,CAAC,6CAA6C,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,CAAC;IAEV,OAAO,CAAC,uDAAuD,CAAC,CAAC;IACjE,GAAG,CAAC,+DAA+D,CAAC,CAAC;AACvE,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CACpB,IAAY,EACZ,OAA2B,EAC3B,OAAsB,EACtB,cAAuE;IAEvE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,EAAE,IAAI;YACb,IAAI;YACJ,OAAO,EAAE,OAAO,IAAI,QAAQ;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ;YACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO;YACrC,QAAQ,EAAE,cAAc;gBACtB,CAAC,CAAC;oBACE,SAAS,EAAE,IAAI;oBACf,OAAO,EAAE,cAAc,CAAC,OAAO;oBAC/B,aAAa,EAAE,cAAc,CAAC,aAAa;iBAC5C;gBACH,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE;SACzB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,OAAO,EAAE,CAAC;IACV,OAAO,CAAC,wBAAwB,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvE,OAAO,EAAE,CAAC;IAEV,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC;IAElD,IAAI,cAAc,EAAE,CAAC;QACnB,QAAQ,CAAC,kBAAkB,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,cAAc,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAC/C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC;IAEV,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC3B,GAAG,CAAC,kEAAkE,CAAC,CAAC;IACxE,GAAG,CAAC,iDAAiD,CAAC,CAAC;IACvD,GAAG,CAAC,yCAAyC,CAAC,CAAC;IAC/C,GAAG,CAAC,qDAAqD,CAAC,CAAC;IAC3D,OAAO,EAAE,CAAC;IAEV,OAAO,CAAC,gEAAgE,CAAC,CAAC;IAC1E,OAAO,CAAC,iDAAiD,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa,CAC1B,OAAe,EACf,OAAsB,EACtB,IAAoB;IAEpB,qBAAqB;IACrB,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE7E,4BAA4B;IAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,gCAAgC;IAChC,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpE,KAAK,CAAC,qCAAqC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,gCAAgC;IAChC,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,KAAK,CAAC,qCAAqC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,eAAe;IACf,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IAED,uCAAuC;IACvC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,8BAA8B,CAAC;IAC3E,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;IAEzD,qDAAqD;IACrD,IAAI,OAAO,GAAG,aAAa,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAChC,YAAY,QAAQ,UAAU,EAC9B,KAAK,IAAI,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EACtD,SAAS,QAAQ,EAAE,CACpB,CAAC;YACF,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,uBAAuB,QAAQ,KAAK,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;IAErI,8CAA8C;IAC9C,MAAM,YAAY,GAAiC;QACjD,QAAQ;QACR,WAAW,EAAE,OAAO;QACpB,OAAO,EAAE,SAAS,EAAE,yBAAyB;QAC7C,MAAM,EAAE,QAAQ;QAChB,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,KAAK;KACN,CAAC;IAEF,4DAA4D;IAC5D,6EAA6E;IAC7E,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC;QACzC,IAAI,EAAE,QAAQ;QACd,OAAO;QACP,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,yBAAyB,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;IAE/E,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC,uCAAuC,CAAC,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACxC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,sCAAsC;IACtC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACtC,GAAG,CAAC,gDAAgD,CAAC,CAAC;IACtD,OAAO,EAAE,CAAC;IAEV,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE;QAC/D,IAAI,CAAC;YACH,OAAO,MAAM,eAAe,CAAC,SAA+C,EAAE;gBAC5E,OAAO,EAAE,MAAM,EAAE,0BAA0B;aAC5C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;gBACzB,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAClE,MAAM,IAAI,KAAK,CACb,+BAA+B,GAAG,CAAC,OAAO,2DAA2D,CACtG,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC1E,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,CAAC,OAAO,mEAAmE,CAC/G,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;oBAC1E,MAAM,IAAI,KAAK,CACb,4BAA4B,GAAG,CAAC,OAAO,mEAAmE,CAC3G,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,kDAAkD;IAClD,IAAI,cAAkF,CAAC;IAEvF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,oCAAoC;QACpC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QAEpE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,wDAAwD,CAAC,CAAC;YAClE,GAAG,CAAC,2DAA2D,CAAC,CAAC;YACjE,GAAG,CAAC,8DAA8D,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YAE/B,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,MAAM,WAAW,CACzC,kCAAkC,EAClC,KAAK,IAAI,EAAE;oBACT,OAAO,MAAM,iBAAiB,CAAC,MAAM,EAAE;wBACrC,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE,OAAQ;wBACjB,cAAc,EAAE,MAAM,CAAC,MAA4C;qBACpE,CAAC,CAAC;gBACL,CAAC,CACF,CAAC;gBAEF,cAAc,GAAG;oBACf,OAAO,EAAE,iBAAiB,CAAC,OAAO;oBAClC,aAAa,EAAE,iBAAiB,CAAC,aAAa;iBAC/C,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,qCAAqC,CAAC,CAAC;gBAC/C,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;oBACzB,GAAG,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1B,CAAC;gBACD,GAAG,CAAC,8DAA8D,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACjD,GAAG,CAAC,0DAA0D,CAAC,CAAC;IAClE,CAAC;IAED,iBAAiB;IACjB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;AAC5D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CACV,oFAAoF,CACrF;SACA,QAAQ,CAAC,QAAQ,EAAE,uCAAuC,CAAC;SAC3D,cAAc,CAAC,4BAA4B,EAAE,8BAA8B,CAAC;SAC5E,MAAM,CAAC,wBAAwB,EAAE,6CAA6C,EAAE,QAAQ,CAAC;SACzF,MAAM,CACL,uBAAuB,EACvB,wDAAwD,EACxD,OAAO,CACR;SACA,MAAM,CAAC,WAAW,EAAE,iDAAiD,CAAC;SACtE,MAAM,CAAC,SAAS,EAAE,8CAA8C,CAAC;SACjE,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC;SAC/C,MAAM,CAAC,QAAQ,EAAE,uBAAuB,CAAC;SACzC,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,OAAsB,EAAE,EAAE;QACxD,MAAM,GAAG,GAAmB;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;YAClB,OAAO;YACP,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,KAAK;SAC7C,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YACxB,IAAI,OAAO,CAAC,OAAO,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBACzD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/run/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * enact run command
+ *
+ * Execute a tool in its container environment with the manifest-defined command.
+ *
+ * Resolution order:
+ * 1. Check local sources (project → user → cache)
+ * 2. If not found and --local not set, fetch from registry to cache
+ * 3. Run from resolved location (never copies to installed tools)
+ */
+import type { Command } from "commander";
+/**
+ * Configure the run command
+ */
+export declare function configureRunCommand(program: Command): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/run/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/run/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA8BH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAumBzC;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA4B1D"}