@enactprotocol/shared 1.0.14 → 1.2.1

package/dist/core/EnactCore.js

@@ -1,15 +1,11 @@
 import { EnactApiClient } from "../api/enact-api.js";
-import { verifyCommandSafety, sanitizeEnvironmentVariables, } from "../security/security.js";
-import { validateToolStructure, validateInputs, validateOutput, } from "../exec/validate.js";
+import { validateToolStructure, validateInputs, } from "../exec/validate.js";
 import { DirectExecutionProvider } from "./DirectExecutionProvider.js";
 import { DaggerExecutionProvider } from "./DaggerExecutionProvider.js";
 import { resolveToolEnvironmentVariables } from "../utils/env-loader.js";
 import logger from "../exec/logger.js";
 import yaml from "yaml";
-import { verifyTool as verifyToolSignatureWithPolicy, VERIFICATION_POLICIES, } from "../security/sign.js";
-import { enforceSignatureVerification, createVerificationFailureResult, logSecurityAudit, } from "../security/verification-enforcer.js";
-import fs from "fs";
-import path from "path";
+import { CryptoUtils, KeyManager, SecurityConfigManager, SigningService } from "@enactprotocol/security";
 export class EnactCore {
     constructor(options = {}) {
         this.options = {
@@ -17,7 +13,6 @@ export class EnactCore {
             supabaseUrl: "https://xjnhhxwxovjifdxdwzih.supabase.co",
             executionProvider: "dagger",
             defaultTimeout: "30s",
-            verificationPolicy: "permissive",
             ...options,
         };
         this.apiClient = new EnactApiClient(this.options.apiUrl, this.options.supabaseUrl);
@@ -31,9 +26,10 @@ export class EnactCore {
         this.options.authToken = token;
     }
     /**
-     * Search for tools
+     * Static method to search for tools (no execution provider needed)
      */
-    async searchTools(options) {
+    static async searchTools(options, coreOptions = {}) {
+        const apiClient = new EnactApiClient(coreOptions.apiUrl || "https://enact.tools", coreOptions.supabaseUrl || "https://xjnhhxwxovjifdxdwzih.supabase.co");
         try {
             logger.info(`Searching for tools with query: "${options.query}"`);
             const searchParams = {
@@ -41,13 +37,13 @@ export class EnactCore {
                 limit: options.limit,
                 tags: options.tags,
             };
-            const results = await this.apiClient.searchTools(searchParams);
+            const results = await apiClient.searchTools(searchParams);
             // Parse and validate results
             const tools = [];
             for (const result of results) {
                 if (result.name) {
                     try {
-                        const tool = await this.getToolByName(result.name);
+                        const tool = await EnactCore.getToolByName(result.name, undefined, coreOptions);
                         if (tool) {
                             tools.push(tool);
                         }
@@ -65,19 +61,26 @@ export class EnactCore {
             // If it's a 502 error (API server issue), try fallback to local filtering
             if (error instanceof Error && error.message.includes("502")) {
                 logger.info("Search API unavailable, trying fallback to local filtering...");
-                return this.searchToolsFallback(options);
+                return EnactCore.searchToolsFallback(options, coreOptions);
             }
             throw new Error(`Search failed: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
     /**
-     * Fallback search method that gets all tools and filters locally
+     * Instance method wrapper for backward compatibility
+     */
+    async searchTools(options) {
+        return EnactCore.searchTools(options, this.options);
+    }
+    /**
+     * Static fallback search method that gets all tools and filters locally
      */
-    async searchToolsFallback(options) {
+    static async searchToolsFallback(options, coreOptions = {}) {
+        const apiClient = new EnactApiClient(coreOptions.apiUrl || "https://enact.tools", coreOptions.supabaseUrl || "https://xjnhhxwxovjifdxdwzih.supabase.co");
         try {
             logger.info("Using fallback search method...");
             // Get all tools (limited to avoid overwhelming the API)
-            const allTools = await this.apiClient.getTools({
+            const allTools = await apiClient.getTools({
                 limit: options.limit || 100,
             });
             // Filter tools locally based on search criteria
@@ -86,7 +89,7 @@ export class EnactCore {
             for (const result of allTools) {
                 if (result.name) {
                     try {
-                        const tool = await this.getToolByName(result.name);
+                        const tool = await EnactCore.getToolByName(result.name, undefined, coreOptions);
                         if (tool) {
                             // Check if tool matches search criteria
                             const matchesQuery = tool.name.toLowerCase().includes(query) ||
@@ -127,37 +130,61 @@ export class EnactCore {
         }
     }
     /**
-     * Get a specific tool by name
+     * Static method to get a specific tool by name
      */
-    async getToolByName(name, version) {
+    static async getToolByName(name, version, coreOptions = {}) {
+        const apiClient = new EnactApiClient(coreOptions.apiUrl || "https://enact.tools", coreOptions.supabaseUrl || "https://xjnhhxwxovjifdxdwzih.supabase.co");
         try {
             logger.info(`Fetching tool: ${name}${version ? `@${version}` : ""}`);
-            const response = await this.apiClient.getTool(name);
+            const response = await apiClient.getTool(name);
             if (!response) {
                 logger.info(`Tool not found: ${name}`);
                 return null;
             }
-            // Parse tool from response
+            // Parse tool from response - prefer raw_content for signature compatibility
             let tool;
-            if (response.content && typeof response.content === "string") {
-                tool = yaml.parse(response.content);
-            }
-            else if (response.raw_content &&
-                typeof response.raw_content === "string") {
+            // Try raw_content first (contains original tool definition with correct field names for signatures)
+            if (response.raw_content && typeof response.raw_content === "string") {
                 try {
                     tool = JSON.parse(response.raw_content);
                 }
                 catch {
                     tool = yaml.parse(response.raw_content);
                 }
+                // Merge signature information from response if not already in raw content
+                if (!tool.signature && response.signature) {
+                    tool.signature = response.signature;
+                }
+                if (!tool.signatures && response.signatures) {
+                    // Convert object format to array format
+                    if (Array.isArray(response.signatures)) {
+                        tool.signatures = response.signatures;
+                    }
+                    else {
+                        // Convert object format {keyId: signatureData} to array format
+                        tool.signatures = Object.values(response.signatures);
+                    }
+                }
+            }
+            else if (response.content && typeof response.content === "string") {
+                tool = yaml.parse(response.content);
                 // Merge signature information
-                if (response.signature || response.signatures) {
+                if (!tool.signature && response.signature) {
                     tool.signature = response.signature;
-                    tool.signatures = response.signatures;
+                }
+                if (!tool.signatures && response.signatures) {
+                    // Convert object format to array format
+                    if (Array.isArray(response.signatures)) {
+                        tool.signatures = response.signatures;
+                    }
+                    else {
+                        // Convert object format {keyId: signatureData} to array format
+                        tool.signatures = Object.values(response.signatures);
+                    }
                 }
             }
             else {
-                // Map database fields to tool format
+                // Fallback: map database fields to tool format (may cause signature verification issues)
                 tool = {
                     name: response.name,
                     description: response.description,
@@ -174,7 +201,7 @@ export class EnactCore {
                     env: response.env_vars || response.env,
                     resources: response.resources,
                     signature: response.signature,
-                    signatures: response.signatures,
+                    signatures: response.signatures ? (Array.isArray(response.signatures) ? response.signatures : Object.values(response.signatures)) : undefined,
                     namespace: response.namespace,
                 };
             }
@@ -190,6 +217,12 @@ export class EnactCore {
             throw error;
         }
     }
+    /**
+     * Instance method wrapper for backward compatibility
+     */
+    async getToolByName(name, version) {
+        return EnactCore.getToolByName(name, version, this.options);
+    }
     /**
      * Execute a tool by name
      */
@@ -232,6 +265,50 @@ export class EnactCore {
             };
         }
     }
+    async verifyTool(tool, dangerouslySkipVerification = false) {
+        if (dangerouslySkipVerification) {
+            logger.warn(`Skipping signature verification for tool: ${tool.name}`);
+            return;
+        }
+        try {
+            if (!tool.signatures || tool.signatures.length === 0) {
+                throw new Error(`Tool ${tool.name} does not have any signatures`);
+            }
+            const documentForVerification = {
+                command: tool.command
+            };
+            const referenceSignature = {
+                signature: tool.signatures[0].value,
+                publicKey: tool.signatures[0].signer,
+                algorithm: tool.signatures[0].algorithm,
+                timestamp: new Date(tool.signatures[0].created).getTime()
+            };
+            // Check what canonical document looks like
+            const canonicalDoc = SigningService.getCanonicalDocument(documentForVerification, { includeFields: ['command'] });
+            // console.log("Canonical document:", JSON.stringify(canonicalDoc));
+            const docString = JSON.stringify(canonicalDoc);
+            const messageHash = CryptoUtils.hash(docString);
+            // console.log("Document string:", docString);
+            // console.log("Message hash:", messageHash);
+            // Test direct crypto verification
+            const directVerify = CryptoUtils.verify(referenceSignature.publicKey, messageHash, referenceSignature.signature);
+            console.log("Direct crypto verification result:", directVerify);
+            // Check trusted keys
+            const trustedKeys = KeyManager.getAllTrustedPublicKeys();
+            console.log("Trusted keys:", trustedKeys);
+            console.log("Is our public key trusted?", trustedKeys.includes(referenceSignature.publicKey));
+            const isValid = SigningService.verifyDocument(documentForVerification, referenceSignature, { includeFields: ['command'] });
+            console.log("Final verification result:", isValid);
+            if (!isValid) {
+                throw new Error(`Tool ${tool.name} has invalid signatures`);
+            }
+            logger.info(`Tool ${tool.name} signature verification passed`);
+        }
+        catch (error) {
+            logger.error(`Signature verification failed for tool ${tool.name}:`, error);
+            throw new Error(`Signature verification failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
     /**
      * Execute a tool directly
      */
@@ -241,129 +318,43 @@ export class EnactCore {
             logger.info(`Executing tool: ${tool.name}`);
             // Validate tool structure
             validateToolStructure(tool);
-            // MANDATORY SIGNATURE VERIFICATION - All tools must be verified before execution
-            const verificationResult = await enforceSignatureVerification(tool, {
-                skipVerification: options.skipVerification,
-                verifyPolicy: options.verifyPolicy,
-                force: options.force,
-                allowUnsigned: false, // Never allow unsigned tools in production
-            });
-            // Log security audit information
-            logSecurityAudit(tool, verificationResult, verificationResult.allowed, {
-                skipVerification: options.skipVerification,
-                verifyPolicy: options.verifyPolicy,
-                force: options.force,
-            });
-            // Block execution if verification fails
-            if (!verificationResult.allowed) {
-                return createVerificationFailureResult(tool, verificationResult, executionId);
-            }
             // Validate inputs
             const validatedInputs = validateInputs(tool, inputs);
-            // Check command safety
-            const safetyCheck = verifyCommandSafety(tool.command, tool);
-            if (!safetyCheck.isSafe && !options.force) {
-                return {
-                    success: false,
-                    error: {
-                        message: `Unsafe command blocked: ${safetyCheck.blocked?.join(", ")}`,
-                        code: "COMMAND_UNSAFE",
-                        details: safetyCheck,
-                    },
-                    metadata: {
-                        executionId,
-                        toolName: tool.name,
-                        version: tool.version,
-                        executedAt: new Date().toISOString(),
-                        environment: "direct",
-                        command: tool.command,
-                    },
-                };
-            }
-            // Log warnings
-            if (safetyCheck.warnings.length > 0) {
-                safetyCheck.warnings.forEach((warning) => logger.warn(warning));
-            }
-            // Dry run - just validate and return
-            if (options.dryRun) {
-                return {
-                    success: true,
-                    output: {
-                        dryRun: true,
-                        tool: tool.name,
-                        command: tool.command,
-                        inputs: validatedInputs,
-                        safetyCheck,
-                    },
-                    metadata: {
-                        executionId,
-                        toolName: tool.name,
-                        version: tool.version,
-                        executedAt: new Date().toISOString(),
-                        environment: "direct",
-                        command: tool.command,
-                    },
-                };
+            const config = SecurityConfigManager.loadConfig();
+            if (options.isLocalFile && config.allowLocalUnsigned) {
+                logger.warn(`Executing local file without signature verification: ${tool.name} (you can disallow in your security config)`);
             }
-            // Setup execution environment
-            // Load package environment variables from .env files
-            const envResult = await resolveToolEnvironmentVariables(tool.name, tool.env);
-            // Log any missing required environment variables
-            if (envResult.missing.length > 0) {
-                logger.warn(`Missing required environment variables: ${envResult.missing.join(", ")}`);
+            if (options.dangerouslySkipVerification) {
+                logger.warn(`Skipping signature verification for tool: ${tool.name} because of dangerouslySkipVerification option`);
             }
-            const environment = {
-                vars: {
-                    ...envResult.resolved,
-                    ...sanitizeEnvironmentVariables(validatedInputs),
+            const skipVerification = (options.isLocalFile && config.allowLocalUnsigned) || Boolean(options.dangerouslySkipVerification);
+            // Verify tool signatures (unless explicitly skipped)
+            await this.verifyTool(tool, skipVerification);
+            // Resolve environment variables
+            const { resolved: envVars } = await resolveToolEnvironmentVariables(tool.name, tool.env || {});
+            // Execute the tool via the execution provider
+            return await this.executionProvider.execute(tool, { ...validatedInputs, ...envVars }, {
+                vars: { ...envVars, ...validatedInputs },
+                resources: {
+                    timeout: options.timeout || tool.timeout || this.options.defaultTimeout,
                 },
-                resources: tool.resources,
-                namespace: tool.namespace,
-            };
-            // Setup execution provider
-            await this.executionProvider.setup(tool);
-            // Execute the tool
-            const result = await this.executionProvider.execute(tool, validatedInputs, environment);
-            // Validate output if schema is provided
-            if (result.success && result.output && tool.outputSchema) {
-                try {
-                    result.output = validateOutput(tool, result.output);
-                }
-                catch (error) {
-                    logger.warn(`Output validation failed: ${error.message}`);
-                }
-            }
-            logger.info(`Tool execution completed: ${tool.name} (success: ${result.success})`);
-            return result;
+            });
         }
         catch (error) {
-            logger.error(`Error executing tool: ${error.message}`);
             return {
                 success: false,
                 error: {
                     message: error.message,
                     code: "EXECUTION_ERROR",
-                    details: error,
                 },
                 metadata: {
                     executionId,
                     toolName: tool.name,
-                    version: tool.version,
                     executedAt: new Date().toISOString(),
                     environment: "direct",
-                    command: tool.command,
                 },
             };
         }
-        finally {
-            // Cleanup
-            try {
-                await this.executionProvider.cleanup();
-            }
-            catch (cleanupError) {
-                logger.error("Error during cleanup:", cleanupError);
-            }
-        }
     }
     /**
      * Execute a tool from raw YAML definition
@@ -401,113 +392,56 @@ export class EnactCore {
         }
     }
     /**
-     * Verify a tool's signature
+     * Static method to check if a tool exists
      */
-    async verifyTool(name, policy) {
+    static async toolExists(name, coreOptions = {}) {
         try {
-            const tool = await this.getToolByName(name);
-            if (!tool) {
-                return {
-                    verified: false,
-                    signatures: [],
-                    policy: policy || "permissive",
-                    errors: [`Tool not found: ${name}`],
-                };
-            }
-            // Load public key from keys/file-public.pem
-            let publicKey;
-            try {
-                const keyPath = path.resolve(__dirname, "../../keys/file-public.pem");
-                publicKey = fs.readFileSync(keyPath, "utf8");
-            }
-            catch (e) {
-                logger.warn("Could not load public key for signature verification:", e);
-            }
-            if (!publicKey) {
-                return {
-                    verified: false,
-                    signatures: [],
-                    policy: policy || "permissive",
-                    errors: ["Public key not found for signature verification"],
-                };
-            }
-            const policyKey = (policy || "permissive").toUpperCase();
-            const policyObj = VERIFICATION_POLICIES[policyKey];
-            const verificationResult = await verifyToolSignatureWithPolicy(tool, policyObj);
-            if (!verificationResult.isValid) {
-                return {
-                    verified: false,
-                    signatures: [],
-                    policy: policy || "permissive",
-                    errors: verificationResult.errors,
-                };
-            }
-            const signatures = [];
-            if (tool.signature) {
-                signatures.push(tool.signature);
-            }
-            if (tool.signatures) {
-                signatures.push(...Object.values(tool.signatures));
-            }
-            return {
-                verified: verificationResult.isValid,
-                signatures,
-                policy: policy || "permissive",
-            };
+            const tool = await EnactCore.getToolByName(name, undefined, coreOptions);
+            return tool !== null;
         }
         catch (error) {
-            return {
-                verified: false,
-                signatures: [],
-                policy: policy || "permissive",
-                errors: [`Verification error: ${error.message}`],
-            };
+            return false;
         }
     }
     /**
-     * Check if a tool exists
+     * Instance method wrapper for backward compatibility
      */
     async toolExists(name) {
-        try {
-            const tool = await this.getToolByName(name);
-            return tool !== null;
-        }
-        catch (error) {
-            return false;
-        }
+        return EnactCore.toolExists(name, this.options);
     }
     /**
      * Get tools by tags
      */
     async getToolsByTags(tags, limit = 20) {
-        return this.searchTools({
+        return EnactCore.searchTools({
             query: tags.join(" "),
             tags,
             limit,
-        });
+        }, this.options);
     }
     /**
      * Get tools by author
      */
     async getToolsByAuthor(author, limit = 20) {
-        return this.searchTools({
+        return EnactCore.searchTools({
             query: `author:${author}`,
             author,
             limit,
-        });
+        }, this.options);
     }
     /**
-     * Get all tools with filters
+     * Static method to get all tools with filters
      */
-    async getTools(options = {}) {
+    static async getTools(options = {}, coreOptions = {}) {
+        const apiClient = new EnactApiClient(coreOptions.apiUrl || "https://enact.tools", coreOptions.supabaseUrl || "https://xjnhhxwxovjifdxdwzih.supabase.co");
         try {
-            const apiResults = await this.apiClient.getTools(options);
+            const apiResults = await apiClient.getTools(options);
             // Parse and validate results
             const tools = [];
             for (const result of apiResults) {
                 if (result.name) {
                     try {
-                        const tool = await this.getToolByName(result.name);
+                        const tool = await EnactCore.getToolByName(result.name, undefined, coreOptions);
                         if (tool) {
                             tools.push(tool);
                         }
@@ -524,6 +458,12 @@ export class EnactCore {
             throw new Error(`Failed to get tools: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
+    /**
+     * Instance method wrapper for backward compatibility
+     */
+    async getTools(options = {}) {
+        return EnactCore.getTools(options, this.options);
+    }
     /**
      * Get authentication status (placeholder - would need actual auth implementation)
      */
@@ -536,18 +476,13 @@ export class EnactCore {
         };
     }
     /**
-     * Publish a tool (requires authentication)
+     * Static method to publish a tool
      */
-    async publishTool(tool) {
-        if (!this.options.authToken) {
-            return {
-                success: false,
-                message: "Authentication required to publish tools",
-            };
-        }
+    static async publishTool(tool, authToken, coreOptions = {}) {
+        const apiClient = new EnactApiClient(coreOptions.apiUrl || "https://enact.tools", coreOptions.supabaseUrl || "https://xjnhhxwxovjifdxdwzih.supabase.co");
         try {
             validateToolStructure(tool);
-            await this.apiClient.publishTool(tool, this.options.authToken);
+            await apiClient.publishTool(tool, authToken);
             return {
                 success: true,
                 message: `Successfully published tool: ${tool.name}`,
@@ -560,11 +495,23 @@ export class EnactCore {
             };
         }
     }
+    /**
+     * Instance method wrapper for backward compatibility
+     */
+    async publishTool(tool) {
+        if (!this.options.authToken) {
+            return {
+                success: false,
+                message: "Authentication required to publish tools",
+            };
+        }
+        return EnactCore.publishTool(tool, this.options.authToken, this.options);
+    }
     /**
      * Get tool information (alias for getToolByName for consistency)
      */
     async getToolInfo(name, version) {
-        return this.getToolByName(name, version);
+        return EnactCore.getToolByName(name, version, this.options);
     }
     /**
      * Get core library status
@@ -574,7 +521,6 @@ export class EnactCore {
         return {
             executionProvider: this.options.executionProvider || "direct",
             apiUrl: this.options.apiUrl || "https://enact.tools",
-            verificationPolicy: this.options.verificationPolicy || "permissive",
             defaultTimeout: this.options.defaultTimeout || "30s",
             authenticated: authStatus.authenticated,
         };
@@ -605,5 +551,4 @@ export class EnactCore {
         return `exec_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
     }
 }
-// Export a default instance
-export const enactCore = new EnactCore();
+// No default instance to avoid eager initialization of Dagger

package/dist/core/NativeExecutionProvider.d.ts

@@ -0,0 +1,9 @@
+import { ExecutionProvider, type EnactTool, type ExecutionEnvironment, type ExecutionResult } from "../types.js";
+/**
+ * Native execution provider that throws an error if used for actual execution.
+ * This is for CLI commands that use Core for API operations only.
+ */
+export declare class NativeExecutionProvider extends ExecutionProvider {
+    resolveEnvironmentVariables(envConfig: Record<string, any>, namespace?: string): Promise<Record<string, any>>;
+    execute(tool: EnactTool, input: Record<string, any>, environment: ExecutionEnvironment): Promise<ExecutionResult>;
+}

package/dist/core/NativeExecutionProvider.js

@@ -0,0 +1,16 @@
+// src/core/NativeExecutionProvider.ts - No-op execution provider for CLI commands
+import { ExecutionProvider, } from "../types.js";
+/**
+ * Native execution provider that throws an error if used for actual execution.
+ * This is for CLI commands that use Core for API operations only.
+ */
+export class NativeExecutionProvider extends ExecutionProvider {
+    async resolveEnvironmentVariables(envConfig, namespace) {
+        // This should never be called for native CLI commands
+        throw new Error("Native execution provider cannot resolve environment variables");
+    }
+    async execute(tool, input, environment) {
+        // This should never be called for native CLI commands
+        throw new Error(`Native execution provider cannot execute tools. Tool "${tool.name}" should be executed via direct or dagger provider.`);
+    }
+}

package/dist/index.d.ts

@@ -14,10 +14,6 @@ export { showVersion as utilsShowVersion } from './utils/version';
 export * from './utils/logger';
 export * from './utils/silent-monitor';
 export * from './utils/timeout';
-export * from './security/security';
-export { verifyTool, shouldExecuteTool, VERIFICATION_POLICIES } from './security/sign';
-export type { VerificationPolicy as SecurityVerificationPolicy } from './security/sign';
-export * from './security/verification-enforcer';
 export * from './services/McpCoreService';
 export * from './web/env-manager-server';
 export * from './api/enact-api';

package/dist/index.js

@@ -15,10 +15,6 @@ export { showVersion as utilsShowVersion } from './utils/version';
 export * from './utils/logger';
 export * from './utils/silent-monitor';
 export * from './utils/timeout';
-// Security
-export * from './security/security';
-export { verifyTool, shouldExecuteTool, VERIFICATION_POLICIES } from './security/sign';
-export * from './security/verification-enforcer';
 // Services
 export * from './services/McpCoreService';
 // Web