intentdna 1.7.4 → 1.8.0

package/dist/cli/commands/report.js

@@ -0,0 +1,1516 @@
+/**
+ * dna report — local evidence package and hidden transport staging.
+ */
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { createHash, generateKeyPairSync, createPrivateKey, createPublicKey, randomBytes, sign, verify } from "node:crypto";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { buildReportPackage } from "../../report/report-package.js";
+import { buildAccountEndpoint, isRejectedServiceRoleToken, resolveAuthToken, resolveSupabaseUserJwt } from "./auth.js";
+import { missingCliApiTokenReason } from "./cloud-auth-guidance.js";
+import { linkedSupabaseProjectUrl } from "./cloud.js";
+function defaultReportsDir(projectDir) {
+    return join(projectDir, ".dna", "reports");
+}
+function defaultPackagePath(projectDir) {
+    return join(defaultReportsDir(projectDir), "latest-report-package.json");
+}
+function defaultKeysDir(projectDir) {
+    return join(projectDir, ".dna", "keys");
+}
+function defaultOutboxPath(projectDir, generatedAt) {
+    const stamp = generatedAt.replace(/[:.]/g, "-");
+    return join(defaultReportsDir(projectDir), "outbox", `report-push-${stamp}.json`);
+}
+function defaultIngestEnvelopePath(projectDir, generatedAt) {
+    const stamp = generatedAt.replace(/[:.]/g, "-");
+    return join(defaultReportsDir(projectDir), "ingest", `report-ingest-${stamp}.json`);
+}
+function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+async function writeJson(path, value) {
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, JSON.stringify(value, null, 2) + "\n", "utf-8");
+}
+function resolveProjectPath(projectDir, path) {
+    return isAbsolute(path) ? path : resolve(projectDir, path);
+}
+function packageSummary(reportPackage, path) {
+    return [
+        `Report package written: ${path}`,
+        `Schema: ${reportPackage.schema_version}`,
+        `Runtime decisions: ${reportPackage.runtime_decisions.length}`,
+        `Traces: ${reportPackage.traces.length}`,
+        `Verifier results: ${reportPackage.verifier_results.length}`,
+        `Critical decisions: ${reportPackage.critical_decisions.length}`,
+        "Boundary: local report package is evidence projection input, not runtime enforcement.",
+    ].join("\n") + "\n";
+}
+function ingestBoundaries() {
+    return [
+        "Signed report ingest envelope is local verifier evidence only; it is not cloud trusted ingestion.",
+        "dna report sign and verify perform no network upload and create no backend, auth, storage, or SaaS state.",
+        "Receipt status describes local envelope verification, not runtime allow/warn/block/validate authority.",
+        "dna-hook and local runtime evidence remain the source for runtime decisions.",
+        "Online may project receipts, but browser-local import is not backend persistence.",
+        "MCP remains hidden transport and is not a visible product entry.",
+    ];
+}
+function packageBoundaries() {
+    return [
+        "Report package is local runtime evidence output; it is not runtime enforcement.",
+        "dna report package performs no network upload and creates no backend, auth, storage, or SaaS state.",
+        "Cloud trust requires a signed envelope and trusted ingestion receipt; browser-local package JSON is projection only.",
+        "dna-hook and local runtime evidence remain the source for runtime decisions.",
+    ];
+}
+function cloudUploadBoundaries() {
+    return [
+        "dna report upload sends signed report evidence to cloud ingestion only; it does not execute workflows.",
+        "Cloud ingestion may verify and persist evidence, but runtime_authority remains false.",
+        "dna-hook and local runtime evidence remain the source for allow/warn/block/validate decisions.",
+        "CLI API tokens are the user-facing auth path; MCP is not a visible auth route.",
+        "Service role keys are server-only and must not be stored in CLI config or browser code.",
+    ];
+}
+function buildReportPackageResult(params) {
+    return {
+        schema_version: "intentdna.report_package_result.v1",
+        mode: "intentdna_report_package_result",
+        generated_at: params.generatedAt,
+        status: params.status,
+        path: params.path,
+        package: params.reportPackage,
+        trusted_cloud_ingestion: false,
+        runtime_authority: false,
+        transport: {
+            network_performed: false,
+            hidden_transport: true,
+        },
+        boundaries: packageBoundaries(),
+    };
+}
+function cloudReceiptsBoundaries() {
+    return [
+        "dna report receipts lists cloud receipt projections with a Supabase user JWT; it is not MCP authorization.",
+        "Receipt listing is read-only account projection; it does not upload reports, read storage object contents, publish templates, or execute workflows.",
+        "Supabase receipt projection is persistence/auth/transport evidence only; runtime_authority remains false.",
+        "Report upload continues to use IntentDNA CLI API tokens; Supabase user JWTs are account onboarding/read credentials.",
+        "dna-hook and local runtime evidence remain the source for allow/warn/block/validate decisions.",
+    ];
+}
+function pushBoundaries() {
+    return [
+        "dna report push stages local evidence for transport; it does not execute workflows.",
+        "No network request is performed by this command in the current static/hidden-transport lane.",
+        "Online ingestion, when added, may project evidence summaries but must not become runtime truth.",
+        "dna-hook and local runtime evidence remain the source for allow/warn/block/validate decisions.",
+        "MCP remains hidden transport and is not a visible product entry.",
+    ];
+}
+function buildEnvelope(reportPackage, packagePath, outboxPath, packageJson, generatedAt, opts) {
+    return {
+        schema_version: "intentdna.report_push_envelope.v1",
+        generated_at: generatedAt,
+        status: opts.dryRun ? "dry_run" : "staged_for_transport",
+        transport: {
+            kind: "local_outbox",
+            endpoint: opts.endpoint,
+            network_performed: false,
+            hidden_transport: true,
+        },
+        source: reportPackage.source,
+        package_ref: {
+            schema_version: reportPackage.schema_version,
+            generated_at: reportPackage.generated_at,
+            sha256: sha256(packageJson),
+            runtime_decisions: reportPackage.runtime_decisions.length,
+            traces: reportPackage.traces.length,
+            verifier_results: reportPackage.verifier_results.length,
+            critical_decisions: reportPackage.critical_decisions.length,
+        },
+        files: {
+            report_package: packagePath,
+            outbox_envelope: outboxPath,
+        },
+        boundaries: pushBoundaries(),
+    };
+}
+function signedPayloadForEnvelope(envelope) {
+    return {
+        schema_version: "intentdna.report_ingest_payload.v1",
+        generated_at: envelope.generated_at,
+        idempotency_key: envelope.idempotency_key,
+        freshness: envelope.freshness,
+        package_ref: envelope.package_ref,
+        identity: envelope.identity,
+        visibility: envelope.visibility,
+        redaction_policy_version: envelope.redaction_policy_version,
+        transport: envelope.transport,
+    };
+}
+function freshnessWindow(generatedAt) {
+    const issuedAt = Date.parse(generatedAt);
+    const issuedDate = Number.isNaN(issuedAt) ? new Date() : new Date(issuedAt);
+    const expiresAt = new Date(issuedDate.getTime() + 7 * 24 * 60 * 60 * 1000);
+    return {
+        nonce: randomBytes(16).toString("hex"),
+        issued_at: issuedDate.toISOString(),
+        expires_at: expiresAt.toISOString(),
+        accepted_clock_skew_seconds: 300,
+    };
+}
+function idempotencyKey(params) {
+    return `intentdna-ingest:${sha256(canonicalJson({
+        org: params.identity.org,
+        project: params.identity.project,
+        package_sha256: params.packageHash,
+        package_generated_at: params.packageGeneratedAt,
+        envelope_generated_at: params.envelopeGeneratedAt,
+    }))}`;
+}
+function canonicalJson(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map((item) => canonicalJson(item)).join(",")}]`;
+    return `{${Object.keys(value)
+        .filter((key) => value[key] !== undefined)
+        .sort()
+        .map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`)
+        .join(",")}}`;
+}
+async function readOrCreateSigningKey(projectDir) {
+    const keyDir = defaultKeysDir(projectDir);
+    const privateKeyPath = join(keyDir, "report-ingest-ed25519-private.pem");
+    const publicKeyPath = join(keyDir, "report-ingest-ed25519-public.pem");
+    try {
+        const [privateKeyPem, publicKeyPem] = await Promise.all([
+            readFile(privateKeyPath, "utf-8"),
+            readFile(publicKeyPath, "utf-8"),
+        ]);
+        return {
+            privateKeyPem,
+            publicKeyPem,
+            keyId: `local-ed25519:${sha256(publicKeyPem).slice(0, 16)}`,
+        };
+    }
+    catch {
+        const pair = generateKeyPairSync("ed25519", {
+            privateKeyEncoding: { format: "pem", type: "pkcs8" },
+            publicKeyEncoding: { format: "pem", type: "spki" },
+        });
+        await mkdir(keyDir, { recursive: true });
+        await Promise.all([
+            writeFile(privateKeyPath, pair.privateKey, { encoding: "utf-8", mode: 0o600 }),
+            writeFile(publicKeyPath, pair.publicKey, "utf-8"),
+        ]);
+        return {
+            privateKeyPem: pair.privateKey,
+            publicKeyPem: pair.publicKey,
+            keyId: `local-ed25519:${sha256(pair.publicKey).slice(0, 16)}`,
+        };
+    }
+}
+function createEphemeralSigningKey() {
+    const pair = generateKeyPairSync("ed25519", {
+        privateKeyEncoding: { format: "pem", type: "pkcs8" },
+        publicKeyEncoding: { format: "pem", type: "spki" },
+    });
+    return {
+        privateKeyPem: pair.privateKey,
+        publicKeyPem: pair.publicKey,
+        keyId: `ephemeral-ed25519:${sha256(pair.publicKey).slice(0, 16)}`,
+    };
+}
+function buildIngestEnvelope(params) {
+    const packageHash = sha256(params.packageJson);
+    const identity = {
+        org: "local-org",
+        project: basename(params.reportPackage.source.project_dir) || "local-project",
+        actor: params.opts.actor?.trim() || process.env.USER || "local-actor",
+    };
+    const payload = {
+        schema_version: "intentdna.report_ingest_payload.v1",
+        generated_at: params.generatedAt,
+        idempotency_key: idempotencyKey({
+            identity,
+            packageHash,
+            packageGeneratedAt: params.reportPackage.generated_at,
+            envelopeGeneratedAt: params.generatedAt,
+        }),
+        freshness: freshnessWindow(params.generatedAt),
+        package_ref: {
+            schema_version: params.reportPackage.schema_version,
+            generated_at: params.reportPackage.generated_at,
+            sha256: packageHash,
+            path: params.packagePath,
+            runtime_decisions: params.reportPackage.runtime_decisions.length,
+            traces: params.reportPackage.traces.length,
+            verifier_results: params.reportPackage.verifier_results.length,
+            critical_decisions: params.reportPackage.critical_decisions.length,
+        },
+        identity,
+        visibility: params.opts.visibility ?? "runtime-local",
+        redaction_policy_version: params.opts.redactionPolicyVersion ?? "local-redaction-policy.v1",
+        transport: {
+            kind: "local_signed_envelope",
+            network_performed: false,
+            hidden_transport: true,
+        },
+    };
+    const payloadJson = canonicalJson(payload);
+    const signature = sign(null, Buffer.from(payloadJson), createPrivateKey(params.key.privateKeyPem)).toString("base64");
+    return {
+        schema_version: "intentdna.report_ingest_envelope.v1",
+        generated_at: payload.generated_at,
+        idempotency_key: payload.idempotency_key,
+        freshness: payload.freshness,
+        package_ref: payload.package_ref,
+        identity: payload.identity,
+        visibility: payload.visibility,
+        redaction_policy_version: payload.redaction_policy_version,
+        transport: payload.transport,
+        envelope_path: params.envelopePath,
+        signing: {
+            algorithm: "Ed25519",
+            key_id: params.key.keyId,
+            public_key_pem: params.key.publicKeyPem,
+            signed_payload_sha256: sha256(payloadJson),
+            signature,
+        },
+        files: {
+            report_package: params.packagePath,
+            envelope: params.envelopePath,
+        },
+        boundaries: ingestBoundaries(),
+    };
+}
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function removeSensitiveFields(value) {
+    if (Array.isArray(value))
+        return value.map((item) => removeSensitiveFields(item));
+    if (!value || typeof value !== "object")
+        return value;
+    const output = {};
+    for (const [key, item] of Object.entries(value)) {
+        const normalized = key.toLowerCase();
+        if (normalized === "raw_token"
+            || normalized === "token_hash"
+            || normalized === "hash"
+            || normalized === "supabase_user_jwt"
+            || normalized === "user_jwt"
+            || normalized === "service_role_key"
+            || normalized === "secret_key"
+            || normalized === "token_pepper") {
+            continue;
+        }
+        output[key] = removeSensitiveFields(item);
+    }
+    return output;
+}
+function sanitizeRecord(value) {
+    const sanitized = removeSensitiveFields(value);
+    return sanitized && typeof sanitized === "object" && !Array.isArray(sanitized)
+        ? sanitized
+        : undefined;
+}
+function sanitizeCloudReceipt(value) {
+    const sanitized = sanitizeRecord(value);
+    const packageRef = asRecord(sanitized?.package_ref);
+    if (!sanitized || !packageRef || typeof packageRef.path !== "string")
+        return sanitized;
+    return {
+        ...sanitized,
+        package_ref: {
+            ...packageRef,
+            path: "redacted:local-report-package-path",
+        },
+    };
+}
+function isPackageSchema(value) {
+    return value === "intentdna.report_package.v1";
+}
+function parseIngestEnvelope(value) {
+    const record = asRecord(value);
+    if (!record || record.schema_version !== "intentdna.report_ingest_envelope.v1")
+        return undefined;
+    const packageRef = asRecord(record.package_ref);
+    const identity = asRecord(record.identity);
+    const transport = asRecord(record.transport);
+    const signing = asRecord(record.signing);
+    const files = asRecord(record.files);
+    const freshness = asRecord(record.freshness);
+    if (!packageRef || !identity || !transport || !signing || !files)
+        return undefined;
+    if (!isPackageSchema(packageRef.schema_version))
+        return undefined;
+    if (typeof packageRef.generated_at !== "string" || typeof packageRef.sha256 !== "string" || typeof packageRef.path !== "string")
+        return undefined;
+    if (typeof packageRef.runtime_decisions !== "number" || typeof packageRef.traces !== "number" || typeof packageRef.verifier_results !== "number" || typeof packageRef.critical_decisions !== "number")
+        return undefined;
+    if (typeof identity.actor !== "string")
+        return undefined;
+    if (record.visibility !== "runtime-local" && record.visibility !== "personal" && record.visibility !== "internal")
+        return undefined;
+    if (typeof record.generated_at !== "string" || typeof record.redaction_policy_version !== "string")
+        return undefined;
+    if (typeof record.idempotency_key !== "string")
+        return undefined;
+    if (!freshness
+        || typeof freshness.nonce !== "string"
+        || typeof freshness.issued_at !== "string"
+        || typeof freshness.expires_at !== "string"
+        || typeof freshness.accepted_clock_skew_seconds !== "number")
+        return undefined;
+    if (transport.kind !== "local_signed_envelope" || transport.network_performed !== false || transport.hidden_transport !== true)
+        return undefined;
+    if (signing.algorithm !== "Ed25519" || typeof signing.key_id !== "string" || typeof signing.public_key_pem !== "string" || typeof signing.signed_payload_sha256 !== "string" || typeof signing.signature !== "string")
+        return undefined;
+    if (typeof files.report_package !== "string")
+        return undefined;
+    return {
+        schema_version: "intentdna.report_ingest_envelope.v1",
+        generated_at: record.generated_at,
+        idempotency_key: record.idempotency_key,
+        freshness: {
+            nonce: freshness.nonce,
+            issued_at: freshness.issued_at,
+            expires_at: freshness.expires_at,
+            accepted_clock_skew_seconds: freshness.accepted_clock_skew_seconds,
+        },
+        package_ref: {
+            schema_version: packageRef.schema_version,
+            generated_at: packageRef.generated_at,
+            sha256: packageRef.sha256,
+            path: packageRef.path,
+            runtime_decisions: packageRef.runtime_decisions,
+            traces: packageRef.traces,
+            verifier_results: packageRef.verifier_results,
+            critical_decisions: packageRef.critical_decisions,
+        },
+        identity: {
+            org: typeof identity.org === "string" ? identity.org : undefined,
+            project: typeof identity.project === "string" ? identity.project : undefined,
+            actor: identity.actor,
+        },
+        visibility: record.visibility,
+        redaction_policy_version: record.redaction_policy_version,
+        transport: {
+            kind: "local_signed_envelope",
+            network_performed: false,
+            hidden_transport: true,
+        },
+        envelope_path: typeof record.envelope_path === "string"
+            ? record.envelope_path
+            : typeof files.envelope === "string" ? files.envelope : undefined,
+        signing: {
+            algorithm: "Ed25519",
+            key_id: signing.key_id,
+            public_key_pem: signing.public_key_pem,
+            signed_payload_sha256: signing.signed_payload_sha256,
+            signature: signing.signature,
+        },
+        files: {
+            report_package: files.report_package,
+            envelope: typeof files.envelope === "string" ? files.envelope : undefined,
+        },
+        boundaries: Array.isArray(record.boundaries) ? record.boundaries.filter((item) => typeof item === "string") : ingestBoundaries(),
+    };
+}
+function invalidIngestEnvelopeReasons(value) {
+    const record = asRecord(value);
+    if (!record)
+        return ["rejected: envelope must be a JSON object"];
+    if (record.schema_version !== "intentdna.report_ingest_envelope.v1") {
+        return typeof record.schema_version === "string"
+            ? [`rejected: unsupported envelope schema ${record.schema_version}; expected intentdna.report_ingest_envelope.v1`]
+            : ["rejected: envelope schema_version is missing or not a string; expected intentdna.report_ingest_envelope.v1"];
+    }
+    const reasons = [];
+    const packageRef = asRecord(record.package_ref);
+    const identity = asRecord(record.identity);
+    const transport = asRecord(record.transport);
+    const signing = asRecord(record.signing);
+    const files = asRecord(record.files);
+    const freshness = asRecord(record.freshness);
+    if (!packageRef)
+        reasons.push("rejected: envelope package_ref must be an object");
+    if (!identity)
+        reasons.push("rejected: envelope identity must be an object");
+    if (!transport)
+        reasons.push("rejected: envelope transport must be an object");
+    if (!signing)
+        reasons.push("rejected: envelope signing must be an object");
+    if (!files)
+        reasons.push("rejected: envelope files must be an object");
+    if (packageRef) {
+        if (!isPackageSchema(packageRef.schema_version)) {
+            reasons.push(typeof packageRef.schema_version === "string"
+                ? `rejected: unsupported report package schema ${packageRef.schema_version}; expected intentdna.report_package.v1`
+                : "rejected: envelope package_ref.schema_version is missing or not supported");
+        }
+        if (typeof packageRef.generated_at !== "string")
+            reasons.push("rejected: envelope package_ref.generated_at must be a string");
+        if (typeof packageRef.sha256 !== "string")
+            reasons.push("rejected: envelope package_ref.sha256 must be a string");
+        if (typeof packageRef.path !== "string")
+            reasons.push("rejected: envelope package_ref.path must be a string");
+        if (typeof packageRef.runtime_decisions !== "number")
+            reasons.push("rejected: envelope package_ref.runtime_decisions must be a number");
+        if (typeof packageRef.traces !== "number")
+            reasons.push("rejected: envelope package_ref.traces must be a number");
+        if (typeof packageRef.verifier_results !== "number")
+            reasons.push("rejected: envelope package_ref.verifier_results must be a number");
+        if (typeof packageRef.critical_decisions !== "number")
+            reasons.push("rejected: envelope package_ref.critical_decisions must be a number");
+    }
+    if (identity && typeof identity.actor !== "string")
+        reasons.push("rejected: envelope identity.actor must be a string");
+    if (record.visibility !== "runtime-local" && record.visibility !== "personal" && record.visibility !== "internal") {
+        reasons.push("rejected: envelope visibility must be runtime-local, personal, or internal");
+    }
+    if (typeof record.generated_at !== "string")
+        reasons.push("rejected: envelope generated_at must be a string");
+    if (typeof record.idempotency_key !== "string")
+        reasons.push("rejected: envelope idempotency_key must be a string");
+    if (!freshness) {
+        reasons.push("rejected: envelope freshness must be an object");
+    }
+    else {
+        if (typeof freshness.nonce !== "string")
+            reasons.push("rejected: envelope freshness.nonce must be a string");
+        if (typeof freshness.issued_at !== "string")
+            reasons.push("rejected: envelope freshness.issued_at must be a string");
+        if (typeof freshness.expires_at !== "string")
+            reasons.push("rejected: envelope freshness.expires_at must be a string");
+        if (typeof freshness.accepted_clock_skew_seconds !== "number")
+            reasons.push("rejected: envelope freshness.accepted_clock_skew_seconds must be a number");
+    }
+    if (typeof record.redaction_policy_version !== "string")
+        reasons.push("rejected: envelope redaction_policy_version must be a string");
+    if (transport) {
+        if (transport.kind !== "local_signed_envelope")
+            reasons.push("rejected: envelope transport.kind must be local_signed_envelope");
+        if (transport.network_performed !== false)
+            reasons.push("rejected: envelope transport.network_performed must be false before trusted upload");
+        if (transport.hidden_transport !== true)
+            reasons.push("rejected: envelope transport.hidden_transport must be true for local signed envelopes");
+    }
+    if (signing) {
+        if (signing.algorithm !== "Ed25519")
+            reasons.push("rejected: envelope signing.algorithm must be Ed25519");
+        if (typeof signing.key_id !== "string")
+            reasons.push("rejected: envelope signing.key_id must be a string");
+        if (typeof signing.public_key_pem !== "string")
+            reasons.push("rejected: envelope signing.public_key_pem must be a string");
+        if (typeof signing.signed_payload_sha256 !== "string")
+            reasons.push("rejected: envelope signing.signed_payload_sha256 must be a string");
+        if (typeof signing.signature !== "string")
+            reasons.push("rejected: envelope signing.signature must be a string");
+    }
+    if (files && typeof files.report_package !== "string")
+        reasons.push("rejected: envelope files.report_package must be a string");
+    return reasons.length > 0
+        ? reasons
+        : ["rejected: envelope shape is invalid for intentdna.report_ingest_envelope.v1"];
+}
+function reportPackageShapeReasons(value) {
+    const record = asRecord(value);
+    if (!record)
+        return ["rejected: report package must be a JSON object"];
+    const reasons = [];
+    const source = asRecord(record.source);
+    if (!isPackageSchema(record.schema_version)) {
+        reasons.push(typeof record.schema_version === "string"
+            ? `rejected: unsupported report package schema ${record.schema_version}; expected intentdna.report_package.v1`
+            : "rejected: report package schema_version is missing or not supported; expected intentdna.report_package.v1");
+    }
+    if (typeof record.generated_at !== "string")
+        reasons.push("rejected: report package generated_at must be a string");
+    if (!source) {
+        reasons.push("rejected: report package source must be an object");
+    }
+    else if (typeof source.project_dir !== "string") {
+        reasons.push("rejected: report package source.project_dir must be a string");
+    }
+    if (!Array.isArray(record.runtime_decisions))
+        reasons.push("rejected: report package runtime_decisions must be an array");
+    if (!Array.isArray(record.traces))
+        reasons.push("rejected: report package traces must be an array");
+    if (!Array.isArray(record.verifier_results))
+        reasons.push("rejected: report package verifier_results must be an array");
+    if (!Array.isArray(record.critical_decisions))
+        reasons.push("rejected: report package critical_decisions must be an array");
+    return reasons;
+}
+function validateEnvelopeFreshness(envelope) {
+    const reasons = [];
+    const issuedAt = Date.parse(envelope.freshness.issued_at);
+    const expiresAt = Date.parse(envelope.freshness.expires_at);
+    const skewMs = Math.max(0, envelope.freshness.accepted_clock_skew_seconds) * 1000;
+    if (Number.isNaN(issuedAt))
+        reasons.push("rejected: envelope freshness.issued_at must be an ISO timestamp");
+    if (Number.isNaN(expiresAt)) {
+        reasons.push("rejected: envelope freshness.expires_at must be an ISO timestamp");
+    }
+    else if (expiresAt + skewMs < Date.now()) {
+        reasons.push("rejected: envelope freshness window has expired");
+    }
+    return reasons;
+}
+async function readReportPackageForSign(opts, projectDir, packagePath) {
+    if (opts.action === "sign" && opts.packagePath) {
+        let packageJson;
+        try {
+            packageJson = await readFile(packagePath, "utf-8");
+        }
+        catch {
+            return { ok: false, reasons: ["rejected: report package file is missing"] };
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(packageJson);
+        }
+        catch {
+            return { ok: false, reasons: ["rejected: report package is not valid JSON"] };
+        }
+        const reasons = reportPackageShapeReasons(parsed);
+        if (reasons.length > 0)
+            return { ok: false, reasons };
+        return { ok: true, reportPackage: parsed, packageJson };
+    }
+    const reportPackage = await buildReportPackage({
+        projectDir,
+        days: opts.days,
+        sessionId: opts.sessionId,
+        dnaId: opts.dnaId,
+        includeMarkerPreview: opts.includeMarkerPreview,
+    });
+    return { ok: true, reportPackage, packageJson: JSON.stringify(reportPackage, null, 2) + "\n" };
+}
+function buildReportSignRejection(params) {
+    return {
+        schema_version: "intentdna.report_sign_result.v1",
+        generated_at: params.generatedAt,
+        status: "rejected",
+        package_path: params.packagePath,
+        cloud_upload_allowed: false,
+        next_command: "dna report package --json",
+        runtime_authority: false,
+        transport: {
+            network_performed: false,
+            hidden_transport: true,
+        },
+        reasons: params.reasons,
+        boundaries: ingestBoundaries(),
+    };
+}
+function buildReceipt(params) {
+    const status = params.reasons.some((reason) => reason.startsWith("rejected:"))
+        ? "rejected"
+        : params.packageAvailable ? "verified" : "pending";
+    const cloudUploadEligible = status === "verified" && params.packageAvailable;
+    return {
+        schema_version: "intentdna.report_ingest_receipt.v1",
+        generated_at: params.generatedAt,
+        status,
+        envelope_ref: {
+            path: params.envelopePath,
+            schema_version: params.envelope?.schema_version,
+            sha256: params.envelopeRaw ? sha256(params.envelopeRaw) : undefined,
+            key_id: params.envelope?.signing.key_id,
+        },
+        package_ref: params.envelope?.package_ref,
+        identity: params.envelope?.identity,
+        visibility: params.envelope?.visibility,
+        local_verifier: {
+            checked_at: params.generatedAt,
+            signature_valid: params.signatureValid,
+            package_available: params.packageAvailable,
+            package_hash_valid: params.packageHashValid,
+            result: status,
+            reasons: params.reasons,
+        },
+        trusted_cloud_ingestion: false,
+        runtime_authority: false,
+        upload_gate: {
+            local_verified: status === "verified",
+            package_available: params.packageAvailable,
+            cloud_upload_eligible: cloudUploadEligible,
+            next_action: cloudUploadEligible
+                ? "Local evidence verified. Run upload dry-run before any live cloud upload."
+                : status === "pending"
+                    ? "Restore the referenced report package or re-sign a fresh package before upload."
+                    : "Fix the signed envelope or report package, then rerun local verification before upload.",
+            next_command: cloudUploadEligible
+                ? "dna report upload <envelope-path> --dry-run --json"
+                : status === "pending"
+                    ? "dna report sign --package .dna/reports/latest-report-package.json --output .dna/reports/ingest/local-envelope.json --json"
+                    : "dna report verify <envelope-path> --json",
+        },
+        transport: {
+            network_performed: false,
+            hidden_transport: true,
+        },
+        boundaries: ingestBoundaries(),
+    };
+}
+function isLocalHttpHost(hostname) {
+    return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+}
+function isSupportedUploadEndpoint(endpoint) {
+    if (!endpoint)
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(endpoint);
+    }
+    catch {
+        return false;
+    }
+    const protocolAllowed = parsed.protocol === "https:" || (parsed.protocol === "http:" && isLocalHttpHost(parsed.hostname));
+    return protocolAllowed
+        && parsed.pathname === "/functions/v1/ingest-report"
+        && parsed.search === ""
+        && parsed.hash === "";
+}
+function buildUploadEndpoint(opts) {
+    const normalize = (value) => {
+        const withoutTrailingSlash = value.trim().replace(/\/+$/, "");
+        if (withoutTrailingSlash.endsWith("/functions/v1/ingest-report"))
+            return withoutTrailingSlash;
+        if (withoutTrailingSlash.endsWith("/functions/v1"))
+            return `${withoutTrailingSlash}/ingest-report`;
+        try {
+            const parsed = new URL(withoutTrailingSlash);
+            if (parsed.protocol === "http:" && isLocalHttpHost(parsed.hostname) && parsed.pathname === "/") {
+                return `${withoutTrailingSlash}/functions/v1/ingest-report`;
+            }
+        }
+        catch {
+            // Leave unsupported endpoint strings unchanged so rejection output preserves the operator input.
+        }
+        if (/^https:\/\/[^/]+\.supabase\.co$/i.test(withoutTrailingSlash)) {
+            return `${withoutTrailingSlash}/functions/v1/ingest-report`;
+        }
+        return withoutTrailingSlash;
+    };
+    const explicitEndpoint = opts.endpoint?.trim();
+    if (explicitEndpoint) {
+        const endpoint = normalize(explicitEndpoint);
+        return { input: explicitEndpoint, endpoint, endpointSupported: isSupportedUploadEndpoint(endpoint) };
+    }
+    const env = opts.env ?? process.env;
+    const cloudUrl = env.INTENTDNA_CLOUD_URL?.trim() || env.SUPABASE_URL?.trim() || linkedSupabaseProjectUrl(env);
+    if (!cloudUrl)
+        return { endpointSupported: false };
+    const endpoint = normalize(cloudUrl);
+    return { input: cloudUrl, endpoint, endpointSupported: isSupportedUploadEndpoint(endpoint) };
+}
+function localUploadReady(localReceipt) {
+    return localReceipt?.status === "verified" && Boolean(localReceipt.package_ref);
+}
+function uploadReadinessAction(params) {
+    if (!params.localReady) {
+        return {
+            nextAction: "Fix the signed envelope or report package, then rerun local verification before upload.",
+            nextCommand: "dna report verify <envelope-path> --json",
+        };
+    }
+    if (!params.tokenPresent) {
+        return {
+            nextAction: "Issue or store an IntentDNA CLI API token before live upload.",
+            nextCommand: "dna auth onboard --project-id <id> --json",
+        };
+    }
+    if (!params.endpoint) {
+        return {
+            nextAction: "Set the Supabase project URL or pass the ingest endpoint before live upload.",
+            nextCommand: "INTENTDNA_CLOUD_URL=https://<project-ref>.supabase.co dna report upload <envelope-path> --dry-run --json",
+        };
+    }
+    if (!params.endpointSupported) {
+        return {
+            nextAction: "Use a Supabase project URL or an ingest-report Edge Function URL before live upload.",
+            nextCommand: "dna report upload <envelope-path> --endpoint https://<project-ref>.supabase.co/functions/v1/ingest-report --dry-run --json",
+        };
+    }
+    if (params.status === "dry_run") {
+        return {
+            nextAction: "Dry run is ready. Live cloud ingestion is optional; run upload without --dry-run only after the Supabase functions and secrets are deployed.",
+            nextCommand: `dna report upload <envelope-path> --endpoint ${params.endpoint} --json`,
+        };
+    }
+    if (params.networkPerformed && (params.status === "verified" || params.status === "pending")) {
+        return {
+            nextAction: `Cloud ingestion returned a trusted ${params.status} receipt. Inspect the cloud receipt and audit refs before making release claims.`,
+        };
+    }
+    if (params.networkPerformed) {
+        return {
+            nextAction: "Inspect the rejected cloud receipt and server audit, then retry after fixing the cloud-side rejection.",
+        };
+    }
+    return {
+        nextAction: "Resolve the rejection reason, then rerun upload dry-run before any live network upload.",
+        nextCommand: "dna report upload <envelope-path> --dry-run --json",
+    };
+}
+function normalizeReceiptLimit(value) {
+    if (!Number.isFinite(value))
+        return 25;
+    const parsed = Math.floor(Number(value));
+    if (parsed <= 0)
+        return 25;
+    return Math.min(parsed, 100);
+}
+function buildCloudReceiptsRequest(opts) {
+    return {
+        schema_version: "intentdna.cloud_receipts_list_request.v1",
+        organization_id: opts.organizationId?.trim() || undefined,
+        project_id: opts.projectId?.trim() || undefined,
+        status: opts.status,
+        limit: normalizeReceiptLimit(opts.limit),
+    };
+}
+function buildCloudReceiptsResult(params) {
+    return {
+        schema_version: "intentdna.report_cloud_receipts_result.v1",
+        generated_at: new Date().toISOString(),
+        status: params.status,
+        endpoint: params.endpoint,
+        request: params.request,
+        auth: {
+            supabase_user_jwt_present: Boolean(params.jwt.token),
+            source: params.jwt.source,
+        },
+        transport: {
+            network_performed: params.networkPerformed ?? false,
+            hidden_transport: false,
+        },
+        runtime_authority: false,
+        receipts_projection: sanitizeRecord(params.receiptsProjection),
+        missing: params.missing ?? [],
+        reasons: params.reasons,
+        boundaries: cloudReceiptsBoundaries(),
+    };
+}
+function buildUploadResult(params) {
+    const networkPerformed = params.networkPerformed ?? false;
+    const localReady = localUploadReady(params.localReceipt);
+    const readinessAction = uploadReadinessAction({
+        status: params.status,
+        localReady,
+        endpoint: params.endpoint,
+        endpointSupported: params.endpointSupported,
+        tokenPresent: params.tokenPresent,
+        networkPerformed,
+    });
+    const rejectionContext = uploadRejectionContext({
+        status: params.status,
+        localReady,
+        endpoint: params.endpoint,
+        endpointSupported: params.endpointSupported,
+        tokenPresent: params.tokenPresent,
+        networkPerformed,
+        cloudHttpOk: params.cloudHttpOk,
+        cloudReceipt: params.cloudReceipt,
+        nextAction: readinessAction.nextAction,
+        nextCommand: readinessAction.nextCommand,
+    });
+    return {
+        schema_version: "intentdna.report_upload_result.v1",
+        generated_at: params.generatedAt,
+        status: params.status,
+        envelope_path: params.envelopePath,
+        endpoint_input: params.endpointInput,
+        endpoint: params.endpoint,
+        endpoint_normalized_to: params.endpointSupported ? params.endpoint : undefined,
+        auth: {
+            token_present: params.tokenPresent,
+            source: params.authSource,
+        },
+        readiness: {
+            local_verifier: params.localReceipt?.status ?? "rejected",
+            local_verified: localReady,
+            package_available: Boolean(params.localReceipt?.package_ref),
+            endpoint_present: Boolean(params.endpoint),
+            endpoint_normalized: params.endpointSupported,
+            endpoint_supported: params.endpointSupported,
+            endpoint_rejection_reason: params.endpoint && !params.endpointSupported
+                ? "cloud ingest endpoint must be a Supabase project URL or an ingest-report Edge Function URL"
+                : undefined,
+            auth_token_present: params.tokenPresent,
+            auth_source: params.authSource,
+            upload_allowed: params.status === "dry_run" && localReady && params.endpointSupported && params.tokenPresent && !networkPerformed,
+            network_performed: networkPerformed,
+            next_action: readinessAction.nextAction,
+            next_command: readinessAction.nextCommand,
+        },
+        redaction: {
+            cloud_storage_projection: localReady ? "redacted_report_package_projection" : "not_prepared",
+            original_package_sha256: params.localReceipt?.package_ref?.sha256,
+            raw_runtime_payload_persisted: false,
+            runtime_authority: false,
+            note: localReady
+                ? "Cloud ingestion verifies the signed package hash, then persists a redacted storage projection."
+                : "Cloud storage projection is not prepared until local envelope verification passes.",
+        },
+        local_receipt: params.localReceipt,
+        cloud_receipt: params.cloudReceipt,
+        rejection_context: rejectionContext,
+        package_ref: params.localReceipt?.package_ref,
+        transport: {
+            network_performed: networkPerformed,
+            hidden_transport: false,
+        },
+        reasons: params.reasons,
+        boundaries: cloudUploadBoundaries(),
+    };
+}
+function uploadRejectionContext(params) {
+    if (params.status !== "rejected")
+        return undefined;
+    const cloudReceiptReasons = params.cloudReceipt ? cloudIngestReceiptRejectionReasons(params.cloudReceipt) : [];
+    const source = !params.localReady
+        ? "local_verification"
+        : !params.tokenPresent
+            ? "cli_auth"
+            : !params.endpoint || !params.endpointSupported
+                ? "endpoint"
+                : params.networkPerformed && params.cloudHttpOk === false
+                    ? "cloud_http"
+                    : params.networkPerformed && cloudReceiptReasons.length > 0
+                        ? "cloud_response_schema"
+                        : params.networkPerformed && params.cloudReceipt
+                            ? "cloud_rejected_receipt"
+                            : params.networkPerformed
+                                ? "cloud_http"
+                                : "unknown";
+    return {
+        source,
+        network_performed: params.networkPerformed,
+        trusted_cloud_ingestion: asRecord(params.cloudReceipt)?.trusted_cloud_ingestion === true,
+        runtime_authority: false,
+        next_action: params.nextAction,
+        next_command: params.nextCommand,
+    };
+}
+function cloudIngestReceiptRejectionReasons(value) {
+    const record = asRecord(value);
+    if (!record)
+        return ["rejected: cloud ingestion response must be a JSON object"];
+    const reasons = [];
+    if (record.schema_version !== "intentdna.report_ingest_receipt.v1") {
+        reasons.push(typeof record.schema_version === "string"
+            ? `rejected: cloud ingestion response schema ${record.schema_version} is unsupported; expected intentdna.report_ingest_receipt.v1`
+            : "rejected: cloud ingestion response schema_version is missing; expected intentdna.report_ingest_receipt.v1");
+    }
+    if (record.trusted_cloud_ingestion !== true) {
+        reasons.push("rejected: cloud ingestion receipt must declare trusted_cloud_ingestion=true");
+    }
+    if (record.runtime_authority !== false) {
+        reasons.push("rejected: cloud ingestion receipt must declare runtime_authority=false");
+    }
+    if (record.status !== "verified" && record.status !== "pending" && record.status !== "rejected") {
+        reasons.push("rejected: cloud ingestion receipt status must be verified, pending, or rejected");
+    }
+    return reasons;
+}
+function localUploadVerificationReasons(localReceipt) {
+    if (localReceipt.status === "verified" && localReceipt.package_ref)
+        return [];
+    return [
+        `rejected: local envelope verification returned ${localReceipt.status}; cloud upload requires a verified local envelope and available package`,
+        ...localReceipt.local_verifier.reasons,
+    ];
+}
+async function uploadIngestEnvelope(opts, projectDir, envelopePath) {
+    const generatedAt = new Date().toISOString();
+    const uploadEndpoint = buildUploadEndpoint(opts);
+    const endpoint = uploadEndpoint.endpoint;
+    const auth = await resolveAuthToken({ env: opts.env, configDir: opts.configDir });
+    const localReceipt = await verifyIngestEnvelope(envelopePath);
+    const localVerificationReasons = localUploadVerificationReasons(localReceipt);
+    if (localVerificationReasons.length > 0) {
+        const result = buildUploadResult({
+            generatedAt,
+            status: "rejected",
+            envelopePath,
+            endpointInput: uploadEndpoint.input,
+            endpoint,
+            endpointSupported: uploadEndpoint.endpointSupported,
+            tokenPresent: Boolean(auth.token),
+            authSource: auth.source,
+            localReceipt,
+            reasons: localVerificationReasons,
+        });
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return 1;
+    }
+    if (!auth.token) {
+        const result = buildUploadResult({
+            generatedAt,
+            status: "rejected",
+            envelopePath,
+            endpointInput: uploadEndpoint.input,
+            endpoint,
+            endpointSupported: uploadEndpoint.endpointSupported,
+            tokenPresent: false,
+            authSource: auth.source,
+            localReceipt,
+            reasons: [missingCliApiTokenReason()],
+        });
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return 2;
+    }
+    if (isRejectedServiceRoleToken(auth.token, opts.env ?? process.env)) {
+        const result = buildUploadResult({
+            generatedAt,
+            status: "rejected",
+            envelopePath,
+            endpointInput: uploadEndpoint.input,
+            endpoint,
+            endpointSupported: uploadEndpoint.endpointSupported,
+            tokenPresent: true,
+            authSource: auth.source,
+            localReceipt,
+            reasons: ["rejected: Supabase service role keys are server-only and cannot be used for report upload CLI auth."],
+        });
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return 1;
+    }
+    if (!endpoint) {
+        const result = buildUploadResult({
+            generatedAt,
+            status: "rejected",
+            envelopePath,
+            endpointInput: uploadEndpoint.input,
+            endpointSupported: uploadEndpoint.endpointSupported,
+            tokenPresent: true,
+            authSource: auth.source,
+            localReceipt,
+            reasons: ["rejected: missing cloud ingest endpoint; set INTENTDNA_CLOUD_URL, SUPABASE_URL, or pass --endpoint"],
+        });
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return 2;
+    }
+    if (!uploadEndpoint.endpointSupported) {
+        const result = buildUploadResult({
+            generatedAt,
+            status: "rejected",
+            envelopePath,
+            endpointInput: uploadEndpoint.input,
+            endpoint,
+            endpointSupported: false,
+            tokenPresent: true,
+            authSource: auth.source,
+            localReceipt,
+            reasons: ["rejected: cloud ingest endpoint must be a Supabase project URL or an ingest-report Edge Function URL"],
+        });
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return 2;
+    }
+    if (opts.dryRun) {
+        const result = buildUploadResult({
+            generatedAt,
+            status: "dry_run",
+            envelopePath,
+            endpointInput: uploadEndpoint.input,
+            endpoint,
+            endpointSupported: uploadEndpoint.endpointSupported,
+            tokenPresent: true,
+            authSource: auth.source,
+            localReceipt,
+            reasons: ["dry_run: upload request is ready but no network request was performed"],
+        });
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return 0;
+    }
+    const packageRef = localReceipt.package_ref;
+    if (!packageRef) {
+        throw new Error("verified local receipt is missing package_ref");
+    }
+    const [envelopeRaw, packageRaw] = await Promise.all([
+        readFile(envelopePath, "utf-8"),
+        readFile(resolveProjectPath(projectDir, packageRef.path), "utf-8"),
+    ]);
+    const fetchImpl = opts.fetch ?? globalThis.fetch;
+    const response = await fetchImpl(endpoint, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${auth.token}`,
+            "x-intentdna-cli": "dna report upload",
+        },
+        body: JSON.stringify({
+            schema_version: "intentdna.cloud_ingest_request.v1",
+            envelope: JSON.parse(envelopeRaw),
+            package_json: packageRaw,
+            local_receipt: localReceipt,
+            transport: {
+                kind: "https_edge_function",
+                network_performed: true,
+                hidden_transport: false,
+            },
+        }),
+    });
+    const text = await response.text();
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        parsed = undefined;
+    }
+    if (!parsed) {
+        const result = buildUploadResult({
+            generatedAt,
+            status: "rejected",
+            envelopePath,
+            endpointInput: uploadEndpoint.input,
+            endpoint,
+            endpointSupported: uploadEndpoint.endpointSupported,
+            tokenPresent: true,
+            authSource: auth.source,
+            localReceipt,
+            networkPerformed: true,
+            cloudHttpOk: false,
+            reasons: [`rejected: cloud ingestion endpoint returned HTTP ${response.status}`],
+        });
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return 1;
+    }
+    const cloudReceiptReasons = cloudIngestReceiptRejectionReasons(parsed);
+    if (cloudReceiptReasons.length > 0) {
+        const sanitizedReceipt = sanitizeCloudReceipt(parsed);
+        const result = buildUploadResult({
+            generatedAt,
+            status: "rejected",
+            envelopePath,
+            endpointInput: uploadEndpoint.input,
+            endpoint,
+            endpointSupported: uploadEndpoint.endpointSupported,
+            tokenPresent: true,
+            authSource: auth.source,
+            localReceipt,
+            cloudReceipt: sanitizedReceipt,
+            networkPerformed: true,
+            cloudHttpOk: response.ok,
+            reasons: cloudReceiptReasons,
+        });
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return 1;
+    }
+    const sanitizedReceipt = sanitizeCloudReceipt(parsed) ?? parsed;
+    const receipt = asRecord(sanitizedReceipt);
+    if (!response.ok) {
+        const cloudReasons = reasonsFromProjection(receipt?.cloud_verifier);
+        const result = buildUploadResult({
+            generatedAt,
+            status: "rejected",
+            envelopePath,
+            endpointInput: uploadEndpoint.input,
+            endpoint,
+            endpointSupported: uploadEndpoint.endpointSupported,
+            tokenPresent: true,
+            authSource: auth.source,
+            localReceipt,
+            cloudReceipt: receipt,
+            networkPerformed: true,
+            cloudHttpOk: false,
+            reasons: [
+                `rejected: cloud ingestion endpoint returned HTTP ${response.status}`,
+                ...cloudReasons,
+            ],
+        });
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return 1;
+    }
+    if (receipt?.status === "rejected") {
+        const cloudReasons = reasonsFromProjection(receipt.cloud_verifier);
+        const result = buildUploadResult({
+            generatedAt,
+            status: "rejected",
+            envelopePath,
+            endpointInput: uploadEndpoint.input,
+            endpoint,
+            endpointSupported: uploadEndpoint.endpointSupported,
+            tokenPresent: true,
+            authSource: auth.source,
+            localReceipt,
+            cloudReceipt: receipt,
+            networkPerformed: true,
+            cloudHttpOk: true,
+            reasons: cloudReasons.length > 0 ? cloudReasons : ["rejected: cloud ingestion returned a rejected receipt"],
+        });
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return 1;
+    }
+    const cloudReasons = reasonsFromProjection(receipt?.cloud_verifier);
+    const result = buildUploadResult({
+        generatedAt,
+        status: receipt?.status === "pending" ? "pending" : "verified",
+        envelopePath,
+        endpointInput: uploadEndpoint.input,
+        endpoint,
+        endpointSupported: uploadEndpoint.endpointSupported,
+        tokenPresent: true,
+        authSource: auth.source,
+        localReceipt,
+        cloudReceipt: receipt,
+        networkPerformed: true,
+        cloudHttpOk: true,
+        reasons: cloudReasons.length > 0 ? cloudReasons : [`${receipt?.status ?? "verified"}: cloud ingestion returned a trusted receipt`],
+    });
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    return 0;
+}
+function statusFromCloudReceiptsProjection(value) {
+    const record = asRecord(value);
+    const status = record?.status;
+    return status === "ready" || status === "pending" || status === "rejected" ? status : undefined;
+}
+function reasonsFromProjection(value) {
+    const record = asRecord(value);
+    const reasons = record?.reasons;
+    return Array.isArray(reasons) ? reasons.map((reason) => String(reason)) : [];
+}
+async function listCloudReceipts(opts) {
+    const env = opts.env ?? process.env;
+    const endpoint = buildAccountEndpoint({
+        subcommand: "report-receipts",
+        endpoint: opts.endpoint,
+        env,
+    }, "list-receipts");
+    const request = buildCloudReceiptsRequest(opts);
+    const jwt = await resolveSupabaseUserJwt({
+        userJwt: opts.userJwt,
+        env,
+        configDir: opts.configDir,
+    });
+    const missing = [
+        !endpoint ? "INTENTDNA_CLOUD_URL or --endpoint <list-receipts-url>" : undefined,
+        !jwt.token
+            ? "INTENTDNA_SUPABASE_USER_JWT, --user-jwt <supabase-user-access-token>, or dna auth user-jwt set <token>"
+            : jwt.expired
+                ? "fresh Supabase user JWT from dna auth user-jwt set <token>"
+                : undefined,
+        !request.project_id ? "--project-id <supabase-project-uuid>" : undefined,
+    ].filter((item) => Boolean(item));
+    if (jwt.token && isRejectedServiceRoleToken(jwt.token, env)) {
+        const result = buildCloudReceiptsResult({
+            status: "rejected",
+            endpoint,
+            request,
+            jwt,
+            missing: ["Supabase user JWT"],
+            reasons: ["rejected: Supabase service role keys are server-only and cannot be used for cloud receipt listing."],
+        });
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return 1;
+    }
+    if (opts.dryRun) {
+        const result = buildCloudReceiptsResult({
+            status: "dry_run",
+            endpoint,
+            request,
+            jwt,
+            missing,
+            reasons: missing.length > 0
+                ? ["dry_run: cloud receipt listing request shape was built; live listing still needs missing inputs"]
+                : ["dry_run: cloud receipt listing request is ready but no network request was performed"],
+        });
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return 0;
+    }
+    if (missing.length > 0) {
+        const result = buildCloudReceiptsResult({
+            status: "rejected",
+            endpoint,
+            request,
+            jwt,
+            missing,
+            reasons: ["rejected: missing inputs for live cloud receipt listing"],
+        });
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return 1;
+    }
+    const fetchImpl = opts.fetch ?? globalThis.fetch;
+    const response = await fetchImpl(endpoint, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${jwt.token}`,
+            "x-intentdna-cli": "dna report receipts",
+        },
+        body: JSON.stringify(request),
+    });
+    const text = await response.text();
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        parsed = undefined;
+    }
+    if (!response.ok || !parsed) {
+        const result = buildCloudReceiptsResult({
+            status: "rejected",
+            endpoint,
+            request,
+            jwt,
+            networkPerformed: true,
+            reasons: [`rejected: list-receipts endpoint returned HTTP ${response.status}`],
+        });
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return 1;
+    }
+    const projectionStatus = statusFromCloudReceiptsProjection(parsed) ?? "rejected";
+    const result = buildCloudReceiptsResult({
+        status: projectionStatus,
+        endpoint,
+        request,
+        jwt,
+        networkPerformed: true,
+        receiptsProjection: parsed,
+        reasons: reasonsFromProjection(parsed).length > 0
+            ? reasonsFromProjection(parsed)
+            : [`${projectionStatus}: cloud receipt projection response returned`],
+    });
+    process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    return projectionStatus === "ready" || projectionStatus === "pending" ? 0 : 1;
+}
+async function verifyIngestEnvelope(envelopePath) {
+    const generatedAt = new Date().toISOString();
+    let raw;
+    try {
+        raw = await readFile(envelopePath, "utf-8");
+    }
+    catch {
+        return buildReceipt({
+            envelopePath,
+            signatureValid: false,
+            packageAvailable: false,
+            packageHashValid: "unchecked",
+            reasons: ["rejected: envelope file is missing"],
+            generatedAt,
+        });
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return buildReceipt({
+            envelopePath,
+            envelopeRaw: raw,
+            signatureValid: false,
+            packageAvailable: false,
+            packageHashValid: "unchecked",
+            reasons: ["rejected: envelope is not valid JSON"],
+            generatedAt,
+        });
+    }
+    const envelope = parseIngestEnvelope(parsed);
+    if (!envelope) {
+        return buildReceipt({
+            envelopePath,
+            envelopeRaw: raw,
+            signatureValid: false,
+            packageAvailable: false,
+            packageHashValid: "unchecked",
+            reasons: invalidIngestEnvelopeReasons(parsed),
+            generatedAt,
+        });
+    }
+    const payload = signedPayloadForEnvelope(envelope);
+    const payloadJson = canonicalJson(payload);
+    const reasons = [];
+    const payloadHashValid = sha256(payloadJson) === envelope.signing.signed_payload_sha256;
+    let signatureValid = false;
+    try {
+        signatureValid = payloadHashValid && verify(null, Buffer.from(payloadJson), createPublicKey(envelope.signing.public_key_pem), Buffer.from(envelope.signing.signature, "base64"));
+    }
+    catch {
+        signatureValid = false;
+    }
+    if (!payloadHashValid)
+        reasons.push("rejected: signed payload hash does not match envelope fields");
+    if (!signatureValid)
+        reasons.push("rejected: Ed25519 signature is invalid");
+    reasons.push(...validateEnvelopeFreshness(envelope));
+    let packageAvailable = false;
+    let packageHashValid = "unchecked";
+    try {
+        const packageRaw = await readFile(envelope.package_ref.path, "utf-8");
+        packageAvailable = true;
+        packageHashValid = sha256(packageRaw) === envelope.package_ref.sha256;
+        if (!packageHashValid)
+            reasons.push("rejected: report package hash does not match envelope package_ref");
+    }
+    catch {
+        reasons.push("pending: referenced report package file is unavailable");
+    }
+    if (reasons.length === 0)
+        reasons.push("verified: local envelope signature and package hash match");
+    return buildReceipt({
+        envelopePath,
+        envelopeRaw: raw,
+        envelope,
+        signatureValid,
+        packageAvailable,
+        packageHashValid,
+        reasons,
+        generatedAt,
+    });
+}
+export async function runReport(opts) {
+    const projectDir = resolve(opts.projectDir ?? process.cwd());
+    if (opts.action === "receipts") {
+        return listCloudReceipts(opts);
+    }
+    if (opts.action === "upload") {
+        const envelopePath = opts.envelopePath ? resolveProjectPath(projectDir, opts.envelopePath) : "";
+        if (!envelopePath) {
+            process.stderr.write("Usage: dna report upload <envelope-path> [--json] [--endpoint <url>] [--dry-run]\n");
+            return 2;
+        }
+        return uploadIngestEnvelope(opts, projectDir, envelopePath);
+    }
+    if (opts.action === "verify") {
+        const envelopePath = opts.envelopePath ? resolveProjectPath(projectDir, opts.envelopePath) : "";
+        if (!envelopePath) {
+            process.stderr.write("Usage: dna report verify <envelope-path> [--json]\n");
+            return 2;
+        }
+        const receipt = await verifyIngestEnvelope(envelopePath);
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(receipt, null, 2) + "\n");
+        }
+        else {
+            process.stderr.write([
+                `Report ingest receipt: ${receipt.status}`,
+                `Envelope: ${receipt.envelope_ref.path}`,
+                `Package: ${receipt.package_ref?.path ?? "(unavailable)"}`,
+                `Signature valid: ${String(receipt.local_verifier.signature_valid)}`,
+                `Package available: ${String(receipt.local_verifier.package_available)}`,
+                `Package hash valid: ${String(receipt.local_verifier.package_hash_valid)}`,
+                `Cloud upload eligible: ${String(receipt.upload_gate.cloud_upload_eligible)}`,
+                `Next action: ${receipt.upload_gate.next_action}`,
+                `Next command: ${receipt.upload_gate.next_command}`,
+                ...receipt.local_verifier.reasons.map((reason) => `Reason: ${reason}`),
+                ...receipt.boundaries.map((boundary) => `Boundary: ${boundary}`),
+            ].join("\n") + "\n");
+        }
+        return receipt.status === "rejected" ? 1 : 0;
+    }
+    const packagePath = opts.action === "sign" && opts.packagePath
+        ? resolveProjectPath(projectDir, opts.packagePath)
+        : opts.action === "sign" && !opts.packagePath
+            ? defaultPackagePath(projectDir)
+            : opts.output ? resolveProjectPath(projectDir, opts.output) : defaultPackagePath(projectDir);
+    const packageInput = await readReportPackageForSign(opts, projectDir, packagePath);
+    if (!packageInput.ok) {
+        const generatedAt = new Date().toISOString();
+        const result = buildReportSignRejection({
+            generatedAt,
+            packagePath,
+            reasons: packageInput.reasons,
+        });
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        }
+        else {
+            process.stderr.write([
+                "Report package rejected before signing.",
+                `Report package: ${packagePath}`,
+                "Cloud upload allowed: false",
+                "Next command: dna report package --json",
+                ...result.reasons.map((reason) => `Reason: ${reason}`),
+                ...result.boundaries.map((boundary) => `Boundary: ${boundary}`),
+            ].join("\n") + "\n");
+        }
+        return 1;
+    }
+    const { reportPackage, packageJson } = packageInput;
+    if (opts.action === "package") {
+        if (!opts.dryRun) {
+            await mkdir(dirname(packagePath), { recursive: true });
+            await writeFile(packagePath, packageJson, "utf-8");
+        }
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(buildReportPackageResult({
+                generatedAt: new Date().toISOString(),
+                status: opts.dryRun ? "dry_run" : "written",
+                path: packagePath,
+                reportPackage,
+            }), null, 2) + "\n");
+        }
+        else {
+            process.stderr.write(opts.dryRun ? packageSummary(reportPackage, `${packagePath} (dry-run)`) : packageSummary(reportPackage, packagePath));
+        }
+        return 0;
+    }
+    if (opts.action === "sign") {
+        const generatedAt = new Date().toISOString();
+        const envelopePath = opts.dryRun
+            ? undefined
+            : opts.output ? resolveProjectPath(projectDir, opts.output) : defaultIngestEnvelopePath(projectDir, generatedAt);
+        const key = opts.dryRun ? createEphemeralSigningKey() : await readOrCreateSigningKey(projectDir);
+        const envelope = buildIngestEnvelope({
+            reportPackage,
+            packagePath,
+            envelopePath,
+            packageJson,
+            generatedAt,
+            key,
+            opts,
+        });
+        if (!opts.dryRun) {
+            if (!opts.packagePath) {
+                await mkdir(dirname(packagePath), { recursive: true });
+                await writeFile(packagePath, packageJson, "utf-8");
+            }
+            await writeJson(envelopePath, envelope);
+        }
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(envelope, null, 2) + "\n");
+        }
+        else {
+            process.stderr.write([
+                `Report ingest envelope signed: ${envelopePath ?? "(dry-run)"}`,
+                `Report package: ${packagePath}`,
+                `Package hash: ${envelope.package_ref.sha256}`,
+                `Key id: ${envelope.signing.key_id}`,
+                `Network performed: ${String(envelope.transport.network_performed)}`,
+                ...envelope.boundaries.map((boundary) => `Boundary: ${boundary}`),
+            ].join("\n") + "\n");
+        }
+        return 0;
+    }
+    const generatedAt = new Date().toISOString();
+    const outboxPath = opts.dryRun ? undefined : defaultOutboxPath(projectDir, generatedAt);
+    const envelope = buildEnvelope(reportPackage, packagePath, outboxPath, packageJson, generatedAt, opts);
+    if (!opts.dryRun) {
+        await mkdir(dirname(packagePath), { recursive: true });
+        await writeFile(packagePath, packageJson, "utf-8");
+        await writeJson(outboxPath, envelope);
+    }
+    if (opts.json) {
+        process.stdout.write(JSON.stringify(envelope, null, 2) + "\n");
+    }
+    else {
+        process.stderr.write([
+            `Report push staged: ${outboxPath ?? "(dry-run)"}`,
+            `Report package: ${packagePath}`,
+            `Runtime decisions: ${envelope.package_ref.runtime_decisions}`,
+            `Network performed: ${String(envelope.transport.network_performed)}`,
+            ...envelope.boundaries.map((boundary) => `Boundary: ${boundary}`),
+        ].join("\n") + "\n");
+    }
+    return 0;
+}