@promptframe/cli 0.1.31 → 0.1.33

package/dist/index.js

@@ -20,6 +20,20 @@ const SECURITY_EVALUATOR_MODE = 'ast';
 const LOCKFILE_EVIDENCE_SCHEMA_VERSION = 'promptframe.lockfile-evidence.v0.1.0';
 const LOCKFILE_EVIDENCE_FILE_NAME = 'promptframe-lockfile-evidence.json';
 const PROMPTFRAME_WORKSPACE_SCHEMA_VERSION = 'promptframe-workspace.v0.1.0';
+const PROMPTFRAME_PROJECT_CONTEXT_SCHEMA_VERSION = 'promptframe-project-context.v0.1.0';
+const PROMPTFRAME_PROJECT_CONTEXT_FILE_NAME = '.promptframerc';
+const PROJECT_CONTEXT_FORBIDDEN_KEY_NAMES = new Set([
+    'apikey',
+    'auth0subject',
+    'authorization',
+    'citokensecret',
+    'clientsecret',
+    'cookie',
+    'oauthcode',
+    'password',
+    'token',
+    'tokensecret',
+]);
 const PACKAGE_MANAGER_LOCKFILE_NAMES = [
     'package-lock.json',
     'npm-shrinkwrap.json',
@@ -84,12 +98,19 @@ async function run(name, argv) {
         case 'discovery':
             await discovery(argv);
             break;
+        case 'init':
+            await initProjectContext(argv);
+            break;
         case 'project':
             await project(argv);
             break;
         case 'projects':
             await project(['list', ...argv]);
             break;
+        case 'component':
+        case 'components':
+            await component(argv);
+            break;
         case 'ci-token':
         case 'token':
             await ciToken(argv);
@@ -406,14 +427,7 @@ function evaluateDirectoryDependencyPolicy(dir) {
     });
 }
 function hasPackageManagerLockfile(dir) {
-    return [
-        'pnpm-lock.yaml',
-        'package-lock.json',
-        'npm-shrinkwrap.json',
-        'yarn.lock',
-        'bun.lock',
-        'bun.lockb',
-    ].some((fileName) => existsSync(join(dir, fileName)));
+    return collectPackageManagerLockfileEvidence(dir).length > 0;
 }
 function assertDependencyPolicyAccepted(receipt) {
     if (receipt.status !== 'reject')
@@ -495,8 +509,9 @@ async function uploadComponent(argv) {
             'x-promptframe-upload-target': uploadTarget,
         },
     }, 'upload.http.failed');
-    const output = {
-        ...payload,
+    const safePayload = sanitizePublicUploadPayload(payload);
+    const output = sanitizePublicUploadPayload({
+        ...safePayload,
         command: 'upload',
         endpoint,
         uploadTarget,
@@ -505,7 +520,7 @@ async function uploadComponent(argv) {
         source: input.source,
         ...(localReusability ? { localReusability, diagnostics: localDiagnostics } : {}),
         diagnostic: diagnostic('upload.completed', 'info', 'Component upload accepted by platform.'),
-    };
+    });
     if (hasFlag(argv, '--json')) {
         printJson(output);
         return;
@@ -513,10 +528,56 @@ async function uploadComponent(argv) {
     console.log('Upload accepted by PromptFrame platform.');
     console.log(`Build: ${output.jobId ?? 'unknown'}`);
     console.log(`Status: ${stringValue(payload.status) ?? stringValue(asRecord(payload.build)?.status) ?? 'queued'}`);
+    if (output.jobId) {
+        console.log(`Next: promptframe status ${output.jobId} --endpoint ${endpoint}`);
+    }
     if (localDiagnostics)
         printDiagnostics(localDiagnostics);
     printStatusUrl(endpoint, payload);
 }
+const PUBLIC_UPLOAD_JSON_OMIT_KEYS = new Set([
+    'providerUsageReceipt',
+    'providerUsageReceipts',
+    'vectorRef',
+    'retryKey',
+    'sourceHash',
+    'sourceHashDetails',
+    'internalSourceHash',
+    'schemaHash',
+    'manifestHash',
+    'bundleHash',
+    'evidence',
+    'evidenceRecords',
+    'evidenceItems',
+    'rawEvidence',
+]);
+function sanitizePublicUploadPayload(value) {
+    return asRecord(sanitizePublicUploadValue(value)) ?? {};
+}
+function sanitizePublicUploadValue(value) {
+    if (typeof value === 'string') {
+        return scrubInternalReferences(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => sanitizePublicUploadValue(item));
+    }
+    const record = asRecord(value);
+    if (!record)
+        return value;
+    const output = {};
+    for (const [key, entry] of Object.entries(record)) {
+        if (PUBLIC_UPLOAD_JSON_OMIT_KEYS.has(key))
+            continue;
+        output[key] = sanitizePublicUploadValue(entry);
+    }
+    return output;
+}
+function scrubInternalReferences(value) {
+    return value
+        .replace(/\bREQ-\d+\b/g, 'internal reference')
+        .replace(/\bTASK-\d+(?:-[A-Za-z0-9-]+)?\b/g, 'internal task')
+        .replace(/\bBUG-\d+\b/g, 'internal bug');
+}
 function resolveUploadTarget(argv) {
     const raw = normalizeUploadTargetAlias(valueAfter(argv, '--target') ?? valueAfter(argv, '--upload-target') ?? 'marketplace_authoring');
     const parsed = authoringUploadTargetSchema.safeParse(raw);
@@ -874,7 +935,10 @@ const POSITIONAL_VALUE_FLAGS = new Set([
     '--auth-permissions',
     '--auth-roles',
     '--component-path',
+    '--component-id',
     '--config',
+    '--description',
+    '--display-name',
     '--endpoint',
     '--expires-at',
     '--host',
@@ -887,6 +951,9 @@ const POSITIONAL_VALUE_FLAGS = new Set([
     '--provider',
     '--provider-kind',
     '--provider-name',
+    '--project-id',
+    '--project-context',
+    '--project-namespace',
     '--reason',
     '--scope',
     '--session-id',
@@ -896,6 +963,7 @@ const POSITIONAL_VALUE_FLAGS = new Set([
     '--token',
     '--upload-target',
     '--user-id',
+    '--workspace-config',
     '--workspace-component',
 ]);
 function componentPathArg(argv) {
@@ -934,9 +1002,13 @@ async function showStatus(argv) {
     };
     if (hasFlag(argv, '--json')) {
         printJson(output);
-        return;
     }
-    printBuildSummary(output);
+    else {
+        printBuildSummary(output);
+    }
+    if (hasFlag(argv, '--fail-on-build-failed')) {
+        failIfBuildFailed(output);
+    }
 }
 async function reindexEvidence(argv) {
     const buildId = requiredArg(argv[0], 'reindex requires a build id', 'reindex.build_id.missing');
@@ -1158,6 +1230,54 @@ async function discovery(argv) {
     if (uploadTargets.length > 0)
         console.log(`Upload targets: ${uploadTargets.join(', ')}`);
 }
+async function initProjectContext(argv) {
+    const root = resolve(componentPathArg(argv) ?? '.');
+    const contextPath = join(root, PROMPTFRAME_PROJECT_CONTEXT_FILE_NAME);
+    if (existsSync(contextPath) && !hasFlag(argv, '--force')) {
+        fail(`PromptFrame project context already exists at ${contextPath}. Use --force to overwrite.`, 'project_context.exists', 2);
+    }
+    const endpoint = resolveEndpoint('init', argv);
+    const payload = await fetchProjects(endpoint, argv);
+    const projects = arrayValue(payload.projects).map((item) => asRecord(item)).filter((item) => Boolean(item));
+    const requestedProjectId = valueAfter(argv, '--project-id');
+    const currentProjectId = requestedProjectId ?? stringValue(payload.currentProjectId);
+    const project = projects.find((item) => stringValue(item.projectId) === currentProjectId || (!requestedProjectId && item.isCurrent === true));
+    if (!project) {
+        fail(requestedProjectId
+            ? `PromptFrame project ${requestedProjectId} is not available for this credential.`
+            : 'PromptFrame did not report an active project for this credential.', 'project_context.project_missing', 2);
+    }
+    const projectId = requiredArg(stringValue(project.projectId), 'PromptFrame project response did not include projectId.', 'project_context.project_id_missing');
+    const tenantId = stringValue(project.tenantId);
+    const context = buildProjectContext({
+        endpoint,
+        tenantId,
+        projectId,
+        projectNamespace: valueAfter(argv, '--project-namespace')
+            ?? stringValue(project.projectNamespace)
+            ?? normalizeProjectNamespace(projectId),
+        defaultUploadTarget: valueAfter(argv, '--target')
+            ?? valueAfter(argv, '--upload-target')
+            ?? 'marketplace_authoring',
+        workspaceConfig: valueAfter(argv, '--workspace-config') ?? 'promptframe-workspace.json',
+    });
+    mkdirSync(root, { recursive: true });
+    writeFileSync(contextPath, `${JSON.stringify(context, null, 2)}\n`, 'utf8');
+    const output = {
+        command: 'init',
+        endpoint,
+        contextPath,
+        context,
+        project,
+        diagnostic: diagnostic('project_context.init.completed', 'info', 'PromptFrame project context written.'),
+    };
+    if (hasFlag(argv, '--json')) {
+        printJson(output);
+        return;
+    }
+    console.log(`Wrote PromptFrame project context: ${contextPath}`);
+    console.log(`Project: ${projectId}`);
+}
 async function project(argv) {
     const subcommand = argv[0] && !argv[0].startsWith('--') ? argv[0] : 'list';
     if (subcommand !== 'list' && subcommand !== 'current') {
@@ -1214,6 +1334,84 @@ async function fetchProjects(endpoint, argv) {
         headers: buildRemoteHeaders(endpoint, argv),
     }, 'project.http.failed');
 }
+async function component(argv) {
+    const subcommand = argv[0] && !argv[0].startsWith('--') ? argv[0] : 'list';
+    const rest = argv.slice(argv[0] && !argv[0].startsWith('--') ? 1 : 0);
+    switch (subcommand) {
+        case 'list':
+            await componentList(rest);
+            break;
+        case 'create':
+            await componentCreate(rest);
+            break;
+        default:
+            fail(`Unknown component command: ${subcommand}`, 'component.command.unknown', 2);
+    }
+}
+async function componentList(argv) {
+    const endpoint = resolveEndpoint('component', argv);
+    const params = new URLSearchParams();
+    const componentId = valueAfter(argv, '--component-id') ?? positionalArgs(argv)[0];
+    if (componentId)
+        params.set('componentId', assertComponentId(componentId));
+    const query = params.toString();
+    const payload = await fetchJson(`${endpoint}/components/marketplace/self/components${query ? `?${query}` : ''}`, {
+        headers: buildRemoteHeaders(endpoint, argv),
+    }, 'component.list.http.failed');
+    const output = {
+        ...payload,
+        command: 'component.list',
+        endpoint,
+        diagnostic: diagnostic('component.list.completed', 'info', 'PromptFrame project components listed.'),
+    };
+    if (hasFlag(argv, '--json')) {
+        printJson(output);
+        return;
+    }
+    for (const item of arrayValue(payload.declarations)) {
+        const declaration = asRecord(item);
+        if (declaration)
+            printComponentDeclarationLine(declaration);
+    }
+}
+async function componentCreate(argv) {
+    const endpoint = resolveEndpoint('component', argv);
+    const componentId = assertComponentId(requiredArg(positionalArgs(argv)[0], 'component create requires <component-id>.', 'component.id_missing'));
+    const displayName = requiredArg(valueAfter(argv, '--display-name') ?? valueAfter(argv, '--name') ?? displayNameFromComponentId(componentId), 'component create requires --display-name <name>.', 'component.display_name_missing');
+    const description = valueAfter(argv, '--description');
+    const payload = compactRecord({
+        componentId,
+        displayName,
+        description,
+    });
+    const response = await fetchJson(`${endpoint}/components/marketplace/self/components`, {
+        method: 'POST',
+        headers: {
+            ...buildRemoteHeaders(endpoint, argv),
+            'content-type': 'application/json',
+        },
+        body: JSON.stringify(payload),
+    }, 'component.create.http.failed');
+    const output = {
+        ...response,
+        command: 'component.create',
+        endpoint,
+        diagnostic: diagnostic('component.create.completed', 'info', 'PromptFrame project component declared.'),
+    };
+    if (hasFlag(argv, '--json')) {
+        printJson(output);
+        return;
+    }
+    const declaration = asRecord(response.declaration);
+    if (declaration)
+        printComponentDeclarationLine(declaration);
+}
+function printComponentDeclarationLine(declaration) {
+    const componentId = stringValue(declaration.componentId) ?? 'unknown';
+    const status = stringValue(declaration.status) ?? 'unknown';
+    const displayName = stringValue(declaration.displayName) ?? componentId;
+    console.log(`${componentId}\t${status}\t${displayName}`);
+}
 function printProjectLine(project, current) {
     const prefix = current ? '*' : '-';
     const projectId = stringValue(project.projectId) ?? 'unknown';
@@ -1428,6 +1626,7 @@ function setupCi(argv) {
         workflowPath,
         requiredSecrets: ['PROMPTFRAME_CI_TOKEN'],
         requiredVariables: ['PROMPTFRAME_API_BASE'],
+        ...(workspaceMode ? { optionalVariables: ['RUNNER_LABELS'] } : {}),
         pullRequestMode: 'check_only',
         pushMode: 'upload',
         diagnostic: diagnostic('setup_ci.github.completed', 'info', 'PromptFrame GitHub Actions workflow written.'),
@@ -1451,18 +1650,20 @@ function setupCiTargetDir(argv) {
     }
     return '.';
 }
-function promptFrameGithubWorkspaceWorkflow(components) {
+function promptFrameGithubWorkspaceWorkflow(_components) {
     const apiBaseVariable = '$' + '{{ vars.PROMPTFRAME_API_BASE }}';
     const ciTokenSecret = '$' + '{{ secrets.PROMPTFRAME_CI_TOKEN }}';
     const matrixComponentId = '$' + '{{ matrix.component.componentId }}';
     const matrixComponentPath = '$' + '{{ matrix.component.componentPath }}';
     const matrixArtifactName = '$' + '{{ matrix.component.artifactName }}';
-    const matrixItems = components.map((component) => [
-        '          - componentId: ' + JSON.stringify(component.id),
-        '            componentPath: ' + JSON.stringify(component.path),
-        '            artifactName: ' + JSON.stringify(githubMatrixArtifactName(component.id)),
-    ].join('\n')).join('\n');
-    return `name: PromptFrame Component Workspace
+    const runnerLabels = '$' + '{{ vars.RUNNER_LABELS && fromJSON(vars.RUNNER_LABELS) || fromJSON(\'["ubuntu-latest"]\') }}';
+    const workspaceMatrixOutput = '$' + '{{ steps.workspace.outputs.matrix }}';
+    const workspaceCountOutput = '$' + '{{ steps.workspace.outputs.count }}';
+    const discoverMatrix = '$' + '{{ fromJSON(needs.discover.outputs.matrix) }}';
+    return `# promptframe-workflow-version: 1
+# Generated by promptframe setup-ci --workspace. Keep this header when editing manually.
+
+name: PromptFrame Component Workspace
 
 on:
   pull_request:
@@ -1477,36 +1678,98 @@ permissions:
   contents: read
 
 jobs:
+  discover:
+    name: Discover PromptFrame components
+    runs-on: ${runnerLabels}
+    outputs:
+      matrix: ${workspaceMatrixOutput}
+      count: ${workspaceCountOutput}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - id: workspace
+        name: Read promptframe-workspace.json
+        run: |
+          node <<'NODE'
+          const fs = require('node:fs');
+          const path = require('node:path');
+          const configPath = 'promptframe-workspace.json';
+          function fail(message) {
+            console.error(message);
+            process.exit(1);
+          }
+          function artifactName(value) {
+            return String(value || 'component')
+              .replace(/^@/, '')
+              .replace(/[^A-Za-z0-9_.-]+/g, '-')
+              .replace(/^-+|-+$/g, '') || 'component';
+          }
+          if (!fs.existsSync(configPath)) {
+            fail('promptframe-workspace.json is required for promptframe workspace CI.');
+          }
+          const workspace = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+          const components = Array.isArray(workspace.components) ? workspace.components : [];
+          const include = components.map((component, index) => {
+            if (!component || typeof component.id !== 'string' || typeof component.path !== 'string') {
+              fail('promptframe-workspace.json components[' + index + '] must include string id and path.');
+            }
+            const manifestPath = path.join(component.path, 'manifest.json');
+            if (!fs.existsSync(manifestPath)) {
+              fail('Workspace component manifest not found: ' + manifestPath);
+            }
+            return {
+              componentId: component.id,
+              componentPath: component.path,
+              artifactName: artifactName(component.id),
+            };
+          });
+          const output = process.env.GITHUB_OUTPUT;
+          if (!output) fail('GITHUB_OUTPUT is not available.');
+          fs.appendFileSync(output, 'matrix=' + JSON.stringify({ include }) + '\\n');
+          fs.appendFileSync(output, 'count=' + String(include.length) + '\\n');
+          const summary = process.env.GITHUB_STEP_SUMMARY;
+          if (summary) {
+            const rows = include.map((item) => '- \`' + item.componentId + '\` -> \`' + item.componentPath + '\`');
+            fs.appendFileSync(summary, ['### PromptFrame workspace discover', '', '- Components: \`' + include.length + '\`', ...rows, ''].join('\\n'));
+          }
+          NODE
+
   check:
     name: PromptFrame check (${matrixComponentId})
-    runs-on: ubuntu-latest
+    needs: discover
+    if: needs.discover.outputs.count != '0'
+    runs-on: ${runnerLabels}
     strategy:
       fail-fast: false
-      matrix:
-        component:
-${matrixItems}
+      matrix: ${discoverMatrix}
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: '20'
-          cache: npm
-      - run: npm install
+          cache: pnpm
+      - run: npm install -g pnpm@10
+      - run: pnpm install --no-frozen-lockfile
       - name: Validate workspace
-        run: npx promptframe workspace validate . --json | tee promptframe-workspace-report.json
+        env:
+          ARTIFACT_NAME: ${matrixArtifactName}
+        run: npx promptframe workspace validate . --json | tee "promptframe-workspace-report-$ARTIFACT_NAME.json"
       - name: Validate component package
         env:
           PROMPTFRAME_API_BASE: ${apiBaseVariable}
           COMPONENT_ID: ${matrixComponentId}
           COMPONENT_PATH: ${matrixComponentPath}
+          ARTIFACT_NAME: ${matrixArtifactName}
         run: |
           set +e
-          npx promptframe check . --workspace-component "$COMPONENT_ID" --json > promptframe-check.json
+          npx promptframe check . --workspace-component "$COMPONENT_ID" --json > "promptframe-check-$ARTIFACT_NAME.json"
           CHECK_EXIT=$?
           set -e
           node <<'NODE'
           const fs = require('node:fs');
-          const payload = JSON.parse(fs.readFileSync('promptframe-check.json', 'utf8'));
+          const payload = JSON.parse(fs.readFileSync('promptframe-check-' + process.env.ARTIFACT_NAME + '.json', 'utf8'));
           const diagnostics = Array.isArray(payload.diagnostics) ? payload.diagnostics : [];
           for (const item of diagnostics) {
             const code = String(item.code || 'promptframe.diagnostic');
@@ -1535,40 +1798,40 @@ ${matrixItems}
       - uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: promptframe-check-report-${matrixArtifactName}
+          name: promptframe-check-${matrixArtifactName}
           path: |
-            promptframe-workspace-report.json
-            promptframe-check.json
+            promptframe-workspace-report-${matrixArtifactName}.json
+            promptframe-check-${matrixArtifactName}.json
 
   upload:
     name: PromptFrame upload (${matrixComponentId})
-    if: github.event_name == 'push'
-    needs: check
-    runs-on: ubuntu-latest
+    if: github.event_name == 'push' && needs.discover.outputs.count != '0'
+    needs: [discover, check]
+    runs-on: ${runnerLabels}
     strategy:
       fail-fast: false
-      matrix:
-        component:
-${matrixItems}
+      matrix: ${discoverMatrix}
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: '20'
-          cache: npm
-      - run: npm install
+          cache: pnpm
+      - run: npm install -g pnpm@10
+      - run: pnpm install --no-frozen-lockfile
       - name: Upload component to PromptFrame
         env:
           PROMPTFRAME_API_BASE: ${apiBaseVariable}
           PROMPTFRAME_CI_TOKEN: ${ciTokenSecret}
           COMPONENT_ID: ${matrixComponentId}
           COMPONENT_PATH: ${matrixComponentPath}
+          ARTIFACT_NAME: ${matrixArtifactName}
         run: |
           set -euo pipefail
-          npx promptframe upload . --workspace-component "$COMPONENT_ID" --endpoint "$PROMPTFRAME_API_BASE" --json | tee promptframe-upload.json
+          npx promptframe upload . --workspace-component "$COMPONENT_ID" --endpoint "$PROMPTFRAME_API_BASE" --json | tee "promptframe-upload-$ARTIFACT_NAME.json"
           BUILD_ID=$(node <<'NODE'
           const fs = require('node:fs');
-          const payload = JSON.parse(fs.readFileSync('promptframe-upload.json', 'utf8'));
+          const payload = JSON.parse(fs.readFileSync('promptframe-upload-' + process.env.ARTIFACT_NAME + '.json', 'utf8'));
           process.stdout.write(String(payload.jobId || payload.buildId || payload.build?.buildId || ''));
           NODE
           )
@@ -1576,11 +1839,28 @@ ${matrixItems}
             echo "PromptFrame upload response did not include a build id." >&2
             exit 1
           fi
-          npx promptframe status "$BUILD_ID" --endpoint "$PROMPTFRAME_API_BASE" --json | tee promptframe-status.json
+          set +e
+          npx promptframe status "$BUILD_ID" --endpoint "$PROMPTFRAME_API_BASE" --json --fail-on-build-failed | tee "promptframe-status-$ARTIFACT_NAME.json"
+          STATUS_EXIT=\${PIPESTATUS[0]}
+          set -e
           node <<'NODE'
           const fs = require('node:fs');
-          const payload = JSON.parse(fs.readFileSync('promptframe-upload.json', 'utf8'));
-          const status = JSON.parse(fs.readFileSync('promptframe-status.json', 'utf8'));
+          const payload = JSON.parse(fs.readFileSync('promptframe-upload-' + process.env.ARTIFACT_NAME + '.json', 'utf8'));
+          const status = JSON.parse(fs.readFileSync('promptframe-status-' + process.env.ARTIFACT_NAME + '.json', 'utf8'));
+          const build = status.build || {};
+          const buildId = payload.jobId || payload.buildId || build.buildId || 'unknown';
+          const buildStatus = String(build.status || status.status || payload.status || 'queued');
+          const diagnostics = Array.isArray(build.diagnostics) ? build.diagnostics : [];
+          const firstError = diagnostics.find((item) => item && item.severity === 'error') || diagnostics[0] || {};
+          if (['failed', 'cancelled', 'canceled'].includes(buildStatus.toLowerCase())) {
+            const message = [
+              \`buildId=\${buildId}\`,
+              \`status=\${buildStatus}\`,
+              firstError.code ? \`code=\${firstError.code}\` : '',
+              firstError.message ? \`message=\${String(firstError.message).replace(/\\r?\\n/g, ' ').slice(0, 300)}\` : '',
+            ].filter(Boolean).join(' ');
+            console.log(\`::error title=PromptFrame platform build failed::\${message}\`);
+          }
           const summary = process.env.GITHUB_STEP_SUMMARY;
           if (summary) {
             fs.appendFileSync(summary, [
@@ -1589,28 +1869,24 @@ ${matrixItems}
               \`- Component ID: \\\`\${process.env.COMPONENT_ID || payload.source?.workspaceComponentId || 'unknown'}\\\`\`,
               \`- Component path: \\\`\${process.env.COMPONENT_PATH || payload.source?.componentPath || 'unknown'}\\\`\`,
               \`- Diagnostic: \\\`\${payload.diagnostic?.code || 'unknown'}\\\`\`,
-              \`- Build ID: \\\`\${payload.jobId || payload.buildId || 'unknown'}\\\`\`,
-              \`- Admission status: \\\`\${status.build?.status || status.status || payload.status || 'queued'}\\\`\`,
+              \`- Build ID: \\\`\${buildId}\\\`\`,
+              \`- Platform build status: \\\`\${buildStatus}\\\`\`,
+              firstError.code ? \`- Top diagnostic: \\\`\${firstError.code}\\\`\` : '- Top diagnostic: none',
+              firstError.message ? \`- Message: \${String(firstError.message).replace(/\\r?\\n/g, ' ').slice(0, 300)}\` : '',
               '',
-            ].join('\\n'));
+            ].filter(Boolean).join('\\n'));
           }
           NODE
+          exit "$STATUS_EXIT"
       - uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: promptframe-upload-report-${matrixArtifactName}
+          name: promptframe-upload-${matrixArtifactName}
           path: |
-            promptframe-upload.json
-            promptframe-status.json
+            promptframe-upload-${matrixArtifactName}.json
+            promptframe-status-${matrixArtifactName}.json
 `;
 }
-function githubMatrixArtifactName(componentId) {
-    return componentId
-        .replace(/^@/, '')
-        .replace(/[^A-Za-z0-9_.-]+/g, '-')
-        .replace(/^-+|-+$/g, '')
-        || 'component';
-}
 function promptFrameGithubWorkflow() {
     const apiBaseVariable = '$' + '{{ vars.PROMPTFRAME_API_BASE }}';
     const ciTokenSecret = '$' + '{{ secrets.PROMPTFRAME_CI_TOKEN }}';
@@ -1707,23 +1983,43 @@ jobs:
             echo "PromptFrame upload response did not include a build id." >&2
             exit 1
           fi
-          npx promptframe status "$BUILD_ID" --endpoint "$PROMPTFRAME_API_BASE" --json | tee promptframe-status.json
+          set +e
+          npx promptframe status "$BUILD_ID" --endpoint "$PROMPTFRAME_API_BASE" --json --fail-on-build-failed | tee promptframe-status.json
+          STATUS_EXIT=\${PIPESTATUS[0]}
+          set -e
           node <<'NODE'
           const fs = require('node:fs');
           const payload = JSON.parse(fs.readFileSync('promptframe-upload.json', 'utf8'));
           const status = JSON.parse(fs.readFileSync('promptframe-status.json', 'utf8'));
+          const build = status.build || {};
+          const buildId = payload.jobId || payload.buildId || build.buildId || 'unknown';
+          const buildStatus = String(build.status || status.status || payload.status || 'queued');
+          const diagnostics = Array.isArray(build.diagnostics) ? build.diagnostics : [];
+          const firstError = diagnostics.find((item) => item && item.severity === 'error') || diagnostics[0] || {};
+          if (['failed', 'cancelled', 'canceled'].includes(buildStatus.toLowerCase())) {
+            const message = [
+              \`buildId=\${buildId}\`,
+              \`status=\${buildStatus}\`,
+              firstError.code ? \`code=\${firstError.code}\` : '',
+              firstError.message ? \`message=\${String(firstError.message).replace(/\\r?\\n/g, ' ').slice(0, 300)}\` : '',
+            ].filter(Boolean).join(' ');
+            console.log(\`::error title=PromptFrame platform build failed::\${message}\`);
+          }
           const summary = process.env.GITHUB_STEP_SUMMARY;
           if (summary) {
             fs.appendFileSync(summary, [
               '### PromptFrame upload',
               '',
               \`- Diagnostic: \\\`\${payload.diagnostic?.code || 'unknown'}\\\`\`,
-              \`- Build ID: \\\`\${payload.jobId || payload.buildId || 'unknown'}\\\`\`,
-              \`- Admission status: \\\`\${status.build?.status || status.status || payload.status || 'queued'}\\\`\`,
+              \`- Build ID: \\\`\${buildId}\\\`\`,
+              \`- Platform build status: \\\`\${buildStatus}\\\`\`,
+              firstError.code ? \`- Top diagnostic: \\\`\${firstError.code}\\\`\` : '- Top diagnostic: none',
+              firstError.message ? \`- Message: \${String(firstError.message).replace(/\\r?\\n/g, ' ').slice(0, 300)}\` : '',
               '',
-            ].join('\\n'));
+            ].filter(Boolean).join('\\n'));
           }
           NODE
+          exit "$STATUS_EXIT"
       - uses: actions/upload-artifact@v4
         if: always()
         with:
@@ -1735,21 +2031,29 @@ jobs:
 }
 function resolveEndpoint(commandName, argv) {
     const config = readConfig(argv);
+    const credential = asRecord(config.credential);
+    const projectContext = readProjectContext(argv);
     const endpoint = valueAfter(argv, '--endpoint')
         ?? process.env.PROMPTFRAME_API_BASE
         ?? process.env.REMOTION_MEDIA_API_BASE
-        ?? stringValue(config.endpoint);
+        ?? stringValue(config.endpoint)
+        ?? stringValue(credential?.endpoint)
+        ?? projectContext?.endpoint;
     if (!endpoint) {
-        fail(`${commandName} requires --endpoint, PROMPTFRAME_API_BASE, REMOTION_MEDIA_API_BASE, or local config. No default production endpoint is embedded in the public CLI.`, `${commandName}.endpoint.missing`, 2);
+        fail(`${commandName} requires --endpoint, PROMPTFRAME_API_BASE, REMOTION_MEDIA_API_BASE, local config, or .promptframerc. No default production endpoint is embedded in the public CLI.`, `${commandName}.endpoint.missing`, 2);
     }
     return normalizeEndpoint(endpoint);
 }
 function resolveOptionalEndpoint(argv) {
     const config = readConfig(argv);
+    const credential = asRecord(config.credential);
+    const projectContext = readProjectContext(argv);
     const endpoint = valueAfter(argv, '--endpoint')
         ?? stringValue(process.env.PROMPTFRAME_API_BASE)
         ?? stringValue(process.env.REMOTION_MEDIA_API_BASE)
-        ?? stringValue(config.endpoint);
+        ?? stringValue(config.endpoint)
+        ?? stringValue(credential?.endpoint)
+        ?? projectContext?.endpoint;
     return endpoint ? normalizeEndpoint(endpoint) : undefined;
 }
 function buildContextHeaders(argv) {
@@ -1778,7 +2082,7 @@ function buildRemoteHeaders(endpoint, argv, options = {}) {
         'x-auth-permissions',
     ].includes(name));
     if (isFormalEndpoint(endpoint) && hasDevHeaders) {
-        fail('Formal PromptFrame endpoints do not accept dev identity headers. Use promptframe login or a scoped CI token.', 'cli.auth.dev_header_formal_endpoint_forbidden');
+        fail(`Formal PromptFrame endpoints do not accept dev identity headers. Run promptframe login --endpoint ${endpoint}, or set PROMPTFRAME_CI_TOKEN to a scoped CI token and retry without --auth-roles/--auth-permissions.`, 'cli.auth.dev_header_formal_endpoint_forbidden');
     }
     if (isFormalEndpoint(endpoint) && options.requireAuth !== false) {
         fail('No PromptFrame CLI credential found for this endpoint. Run promptframe login --endpoint <url> or provide PROMPTFRAME_CI_TOKEN.', 'cli.auth.login_required', 2);
@@ -1918,6 +2222,110 @@ function writeConfig(argv, config) {
 function resolveConfigPath(argv) {
     return resolve(valueAfter(argv, '--config') ?? process.env.PROMPTFRAME_CONFIG ?? join(os.homedir(), '.promptframe', 'component-authoring.json'));
 }
+function readProjectContext(argv) {
+    const explicitPath = valueAfter(argv, '--project-context');
+    const contextPath = explicitPath
+        ? resolve(explicitPath)
+        : findProjectContextPath(process.cwd());
+    if (!contextPath || !existsSync(contextPath))
+        return undefined;
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(contextPath, 'utf8'));
+    }
+    catch {
+        fail(`PromptFrame project context is not valid JSON: ${contextPath}`, 'project_context.invalid_json', 2);
+    }
+    return parseProjectContext(raw, contextPath);
+}
+function findProjectContextPath(startDir) {
+    let current = resolve(startDir);
+    for (;;) {
+        const candidate = join(current, PROMPTFRAME_PROJECT_CONTEXT_FILE_NAME);
+        if (existsSync(candidate))
+            return candidate;
+        const parent = dirname(current);
+        if (parent === current)
+            return undefined;
+        current = parent;
+    }
+}
+function parseProjectContext(value, sourcePath) {
+    const record = asRecord(value);
+    if (!record) {
+        fail(`PromptFrame project context must be a JSON object: ${sourcePath}`, 'project_context.invalid', 2);
+    }
+    assertProjectContextSecretFree(record, sourcePath);
+    const schemaVersion = stringValue(record.schemaVersion);
+    if (schemaVersion && schemaVersion !== PROMPTFRAME_PROJECT_CONTEXT_SCHEMA_VERSION) {
+        fail(`Unsupported PromptFrame project context schemaVersion ${schemaVersion}. Expected ${PROMPTFRAME_PROJECT_CONTEXT_SCHEMA_VERSION}.`, 'project_context.schema_unsupported', 2);
+    }
+    return {
+        schemaVersion: PROMPTFRAME_PROJECT_CONTEXT_SCHEMA_VERSION,
+        ...(stringValue(record.endpoint) ? { endpoint: normalizeEndpoint(stringValue(record.endpoint)) } : {}),
+        ...(stringValue(record.tenantId) ? { tenantId: stringValue(record.tenantId) } : {}),
+        ...(stringValue(record.projectId) ? { projectId: stringValue(record.projectId) } : {}),
+        ...(stringValue(record.projectNamespace) ? { projectNamespace: stringValue(record.projectNamespace) } : {}),
+        ...(stringValue(record.defaultUploadTarget) ? { defaultUploadTarget: stringValue(record.defaultUploadTarget) } : {}),
+        ...(stringValue(record.workspaceConfig) ? { workspaceConfig: stringValue(record.workspaceConfig) } : {}),
+    };
+}
+function buildProjectContext(input) {
+    const context = {
+        schemaVersion: PROMPTFRAME_PROJECT_CONTEXT_SCHEMA_VERSION,
+        endpoint: normalizeEndpoint(input.endpoint),
+        ...(input.tenantId ? { tenantId: input.tenantId } : {}),
+        projectId: input.projectId,
+        ...(input.projectNamespace ? { projectNamespace: normalizeProjectNamespace(input.projectNamespace) } : {}),
+        ...(input.defaultUploadTarget ? { defaultUploadTarget: input.defaultUploadTarget } : {}),
+        ...(input.workspaceConfig ? { workspaceConfig: input.workspaceConfig } : {}),
+    };
+    assertProjectContextSecretFree(context, PROMPTFRAME_PROJECT_CONTEXT_FILE_NAME);
+    return context;
+}
+function assertProjectContextSecretFree(value, sourcePath) {
+    if (!value || typeof value !== 'object')
+        return;
+    if (Array.isArray(value)) {
+        for (const item of value)
+            assertProjectContextSecretFree(item, sourcePath);
+        return;
+    }
+    for (const [key, child] of Object.entries(value)) {
+        const normalizedKey = key.toLowerCase().replace(/[^a-z0-9]/g, '');
+        if (PROJECT_CONTEXT_FORBIDDEN_KEY_NAMES.has(normalizedKey)) {
+            fail(`PromptFrame project context must not contain secret-bearing field "${key}" in ${sourcePath}. Store tokens in the local CLI config or CI secret store instead.`, 'project_context.secret_field_forbidden', 2);
+        }
+        assertProjectContextSecretFree(child, sourcePath);
+    }
+}
+function assertComponentId(value) {
+    if (!/^@[a-z0-9][a-z0-9-]{1,62}\/[a-z0-9][a-z0-9-]{1,62}$/.test(value)) {
+        fail(`Invalid component id "${value}". Expected @project-namespace/component-slug.`, 'component.id_invalid', 2);
+    }
+    return value;
+}
+function normalizeProjectNamespace(value) {
+    const normalized = value
+        .trim()
+        .toLowerCase()
+        .replace(/^@/, '')
+        .replace(/[^a-z0-9-]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 63);
+    if (!/^[a-z0-9][a-z0-9-]{1,62}$/.test(normalized)) {
+        fail(`Invalid project namespace "${value}".`, 'project_context.namespace_invalid', 2);
+    }
+    return normalized;
+}
+function displayNameFromComponentId(componentId) {
+    const slug = componentId.split('/').at(-1) ?? componentId;
+    return slug
+        .split('-')
+        .filter(Boolean)
+        .map((part) => `${part[0]?.toUpperCase() ?? ''}${part.slice(1)}`)
+        .join(' ');
+}
 async function fetchJson(url, init, code) {
     const response = await fetch(url, init);
     const payload = await response.json().catch(() => ({}));
@@ -2385,7 +2793,7 @@ function collectPackageFiles(root) {
     return files.sort((a, b) => a.name.localeCompare(b.name));
 }
 function buildLockfileEvidenceFile(root) {
-    const lockfiles = collectRootPackageManagerLockfiles(root);
+    const lockfiles = collectPackageManagerLockfileEvidence(root);
     if (lockfiles.length === 0)
         return undefined;
     const packageJson = readFileSync(join(root, 'package.json'));
@@ -2394,6 +2802,8 @@ function buildLockfileEvidenceFile(root) {
         packageJsonSha256: sha256Buffer(packageJson),
         lockfiles: lockfiles.map((lockfile) => ({
             fileName: lockfile.name,
+            source: lockfile.source,
+            relativePath: lockfile.relativePath,
             sizeBytes: lockfile.data.byteLength,
             sha256: sha256Buffer(lockfile.data),
         })),
@@ -2403,16 +2813,47 @@ function buildLockfileEvidenceFile(root) {
         data: Buffer.from(`${JSON.stringify(receipt)}\n`, 'utf8'),
     };
 }
-function collectRootPackageManagerLockfiles(root) {
+function collectPackageManagerLockfileEvidence(root) {
+    const directLockfiles = collectDirectPackageManagerLockfiles(root);
+    if (directLockfiles.length > 0)
+        return directLockfiles;
+    const workspaceLockfile = findPnpmWorkspaceRootLockfile(root);
+    return workspaceLockfile ? [workspaceLockfile] : [];
+}
+function collectDirectPackageManagerLockfiles(root) {
     const lockfiles = [];
     for (const name of PACKAGE_MANAGER_LOCKFILE_NAMES) {
         const full = join(root, name);
         if (!existsSync(full))
             continue;
-        lockfiles.push({ name, data: readFileSync(full) });
+        lockfiles.push({
+            name,
+            data: readFileSync(full),
+            source: 'component',
+            relativePath: name,
+        });
     }
     return lockfiles;
 }
+function findPnpmWorkspaceRootLockfile(root) {
+    let current = resolve(root);
+    while (true) {
+        const workspaceConfig = join(current, 'pnpm-workspace.yaml');
+        const lockfile = join(current, 'pnpm-lock.yaml');
+        if (existsSync(workspaceConfig) && existsSync(lockfile)) {
+            return {
+                name: 'pnpm-lock.yaml',
+                data: readFileSync(lockfile),
+                source: 'workspace_root',
+                relativePath: relative(root, lockfile).replace(/\\/g, '/'),
+            };
+        }
+        const parent = dirname(current);
+        if (parent === current)
+            return undefined;
+        current = parent;
+    }
+}
 function sha256Buffer(data) {
     return `sha256:${createHash('sha256').update(data).digest('hex')}`;
 }
@@ -2602,6 +3043,26 @@ function printBuildSummary(payload) {
         console.log(`${stringValue(diagnosticItem?.severity)?.toUpperCase() ?? 'INFO'} ${stringValue(diagnosticItem?.code) ?? 'unknown'}: ${stringValue(diagnosticItem?.message) ?? ''}`);
     }
 }
+function failIfBuildFailed(payload) {
+    const status = getBuildStatus(payload);
+    if (!status || !['failed', 'cancelled', 'canceled'].includes(status.toLowerCase()))
+        return;
+    const buildId = getBuildId(payload) ?? 'unknown';
+    const diagnosticItem = firstBuildDiagnostic(payload);
+    const diagnosticText = diagnosticItem
+        ? `${stringValue(diagnosticItem.code) ?? 'unknown'}: ${stringValue(diagnosticItem.message) ?? ''}`.trim()
+        : 'no diagnostic';
+    fail(`PromptFrame platform build failed: buildId=${buildId} status=${status} diagnostic=${diagnosticText}`, 'status.build.failed', 1);
+}
+function getBuildStatus(payload) {
+    return stringValue(asRecord(payload.build)?.status) ?? stringValue(payload.status);
+}
+function firstBuildDiagnostic(payload) {
+    const diagnostics = arrayValue(asRecord(payload.build)?.diagnostics)
+        .map((item) => asRecord(item))
+        .filter((item) => Boolean(item));
+    return diagnostics.find((item) => item.severity === 'error') ?? diagnostics[0];
+}
 function printStatusUrl(endpoint, payload) {
     const statusUrl = stringValue(payload.statusUrl) ?? stringValue(asRecord(payload.build)?.statusUrl);
     if (!statusUrl)
@@ -2650,6 +3111,7 @@ Commands:
     --target <target>              marketplace_authoring or project_private_generation
     --target marketplace --strict  Alias for strict external marketplace authoring
   status <buildId>                 Fetch component build status
+    --fail-on-build-failed         Exit nonzero when platform build status is failed/cancelled
   reindex <buildId>                Rebuild component search/evidence indexes
   probe <buildId> --level <level>  Rerun component layout/security probe
   login --endpoint <url>             Start browser login code flow and store a CLI token
@@ -2657,13 +3119,15 @@ Commands:
   whoami                            Show the current PromptFrame CLI identity
   logout                            Revoke the current CLI token and clear local config
   discovery                         Fetch platform endpoint and self-service capabilities
+  init [dir]                        Write secret-free .promptframerc project context
   project list|current              List accessible projects or show the active project
+  component list|create             List or declare Project-scoped components
   ci-token create|list|revoke       Manage self-service CI tokens for the current project
   setup-ci [dir] --provider github   Write a GitHub Actions workflow skeleton
   configure --endpoint <url>       Write local CLI endpoint/context config
 
 Endpoint resolution:
-  --endpoint, PROMPTFRAME_API_BASE, REMOTION_MEDIA_API_BASE, then local config.
+  --endpoint, PROMPTFRAME_API_BASE, REMOTION_MEDIA_API_BASE, local config, then .promptframerc.
   The public CLI embeds no production/private endpoint defaults.
 Auth context:
   promptframe login, PROMPTFRAME_CI_TOKEN, or PROMPTFRAME_CLI_TOKEN for formal endpoints.