@atlasauth/pca-cli 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,33 @@
-# Temporary Holding Version
+# @atlasauth/pca-cli
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The pca dev CLI: decode and explain a PCActn (why it passed or failed each check), mint a dev grant/key, and simulate a policy over actions.
+
+## Install
+
+```sh
+npm i -g @atlasauth/pca-cli
+# or: npx @atlasauth/pca-cli <command>
+```
+
+Installs the `pca` binary. Depends on the core `@atlasauth/pca`.
+
+## Usage
+
+```sh
+# Summarize a PCActn (JSON or base64url; '-' reads STDIN).
+pca decode action.json
+pca decode -
+
+# Run the REAL verifier and explain each check (PASS / FAIL / —), with a final ALLOW/DENY.
+pca explain action.json --aud ins_acme
+
+# Mint a throwaway Ed25519 dev keypair.
+pca keygen
+
+# Replay actions against a compiled policy (auto / step_up / deny + budget).
+pca simulate policy.json actions.json
+```
+
+The programmatic functions (`cmdDecode`, `cmdExplain`, `cmdKeygen`, `cmdSimulate`) are also exported. `decode` / `explain` are read-only inspectors — `explain` runs `verifyPCActnCore` against the grant in the PCActn's own capability chain, so its verdict is the local, grant-relative view. Nothing here authorizes anything; the resource server's verifier, with its stored counter / revocation state, remains the authority.
+
+Part of Proof-Carrying Authority — see `@atlasauth/pca`.

package/dist/cli.d.ts

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+/**
+ * `pca` — the PCA developer CLI entrypoint.
+ *
+ * A tiny, dependency-free argv parser dispatches to the pure command functions in `./index`. Input
+ * that is a PCActn / JSON is read from a file path argument, or from STDIN when the argument is `-`.
+ * Errors print to stderr and set a non-zero `process.exitCode` (we never call `process.exit`, so
+ * buffered stdout always flushes first).
+ */
+export {};

package/dist/cli.js

@@ -0,0 +1,138 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * `pca` — the PCA developer CLI entrypoint.
+ *
+ * A tiny, dependency-free argv parser dispatches to the pure command functions in `./index`. Input
+ * that is a PCActn / JSON is read from a file path argument, or from STDIN when the argument is `-`.
+ * Errors print to stderr and set a non-zero `process.exitCode` (we never call `process.exit`, so
+ * buffered stdout always flushes first).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_fs_1 = require("node:fs");
+const index_1 = require("./index");
+const USAGE = `pca — Proof-Carrying Authority dev CLI
+
+Usage:
+  pca decode <file|->                 Summarize a PCActn (JSON or base64url).
+  pca explain <file|-> [--aud <id>]   Run the real verifier and explain each check (PASS/FAIL/—).
+  pca keygen                          Mint a throwaway Ed25519 dev keypair (base64url).
+  pca simulate <policy.json> <actions.json>
+                                      Replay actions against a compiled policy (auto/step_up/deny).
+  pca discovery --aud <id> [--suites a,b] [--stepup <url>] [--revocation <url>] [--beacon <url>] [--attest <url>]
+                                      Emit a .well-known/pca-configuration document.
+
+Notes:
+  <-> reads from STDIN. Nothing here authorizes anything — the resource server's verifier decides.
+`;
+/** Read a positional file argument, or STDIN when it is '-'. */
+function readSource(arg) {
+    if (arg === '-')
+        return (0, node_fs_1.readFileSync)(0, 'utf8');
+    return (0, node_fs_1.readFileSync)(arg, 'utf8');
+}
+/**
+ * Minimal hand-rolled parser (no dependency): everything after the sub-command, splitting
+ * `--flag value` and `--flag=value` out of the positionals. A bare `--flag` with no value is treated
+ * as the empty string.
+ */
+function parseArgs(argv) {
+    const positionals = [];
+    const flags = {};
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === undefined)
+            continue;
+        if (a.startsWith('--')) {
+            const body = a.slice(2);
+            const eq = body.indexOf('=');
+            if (eq >= 0) {
+                flags[body.slice(0, eq)] = body.slice(eq + 1);
+            }
+            else {
+                const next = argv[i + 1];
+                if (next !== undefined && !next.startsWith('--')) {
+                    flags[body] = next;
+                    i++;
+                }
+                else {
+                    flags[body] = '';
+                }
+            }
+        }
+        else {
+            positionals.push(a);
+        }
+    }
+    return { positionals, flags };
+}
+async function main() {
+    const argv = process.argv.slice(2);
+    const command = argv[0];
+    if (command === undefined || command === '--help' || command === '-h' || command === 'help') {
+        process.stdout.write(USAGE);
+        return;
+    }
+    const { positionals, flags } = parseArgs(argv.slice(1));
+    switch (command) {
+        case 'decode': {
+            const src = positionals[0];
+            if (src === undefined)
+                throw new Error("decode: expected a file path or '-' for STDIN");
+            process.stdout.write((0, index_1.cmdDecode)(readSource(src)) + '\n');
+            return;
+        }
+        case 'explain': {
+            const src = positionals[0];
+            if (src === undefined)
+                throw new Error("explain: expected a file path or '-' for STDIN");
+            const opts = {};
+            if (flags.aud !== undefined && flags.aud !== '')
+                opts.audience = flags.aud;
+            const res = await (0, index_1.cmdExplain)(readSource(src), opts);
+            process.stdout.write(res.text + '\n');
+            if (!res.allow)
+                process.exitCode = 1;
+            return;
+        }
+        case 'keygen': {
+            process.stdout.write((0, index_1.cmdKeygen)().text + '\n');
+            return;
+        }
+        case 'simulate': {
+            const policyPath = positionals[0];
+            const actionsPath = positionals[1];
+            if (policyPath === undefined || actionsPath === undefined) {
+                throw new Error('simulate: expected <policy.json> <actions.json>');
+            }
+            process.stdout.write((0, index_1.cmdSimulate)(readSource(policyPath), readSource(actionsPath)) + '\n');
+            return;
+        }
+        case 'discovery': {
+            if (flags.aud === undefined || flags.aud === '')
+                throw new Error('discovery: --aud <id> is required');
+            const endpoints = {};
+            if (flags.attest)
+                endpoints.attestation_challenge = flags.attest;
+            if (flags.revocation)
+                endpoints.revocation_epoch = flags.revocation;
+            if (flags.beacon)
+                endpoints.liveness_beacon = flags.beacon;
+            if (flags.stepup)
+                endpoints.stepup = flags.stepup;
+            process.stdout.write((0, index_1.cmdDiscovery)({
+                audience: flags.aud,
+                ...(flags.suites ? { suites: flags.suites.split(',').map((s) => s.trim()).filter(Boolean) } : {}),
+                ...(Object.keys(endpoints).length ? { endpoints } : {}),
+            }) + '\n');
+            break;
+        }
+        default:
+            throw new Error(`unknown command '${command}'\n\n${USAGE}`);
+    }
+}
+main().catch((e) => {
+    process.stderr.write(`pca: ${e instanceof Error ? e.message : String(e)}\n`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;AACA;;;;;;;GAOG;;AAEH,qCAAuC;AAEvC,mCAAsF;AAEtF,MAAM,KAAK,GAAG;;;;;;;;;;;;;CAab,CAAC;AAEF,gEAAgE;AAChE,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,IAAA,sBAAY,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAChD,OAAO,IAAA,sBAAY,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC;AAOD;;;;GAIG;AACH,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBACZ,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;oBACnB,CAAC,EAAE,CAAC;gBACN,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAExB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QAC5F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAExD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,GAAG,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACxF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,iBAAS,EAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,GAAG,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACzF,MAAM,IAAI,GAA0B,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,EAAE;gBAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC;YAC3E,MAAM,GAAG,GAAG,MAAM,IAAA,kBAAU,EAAC,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;YACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,GAAG,CAAC,KAAK;gBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,iBAAS,GAAE,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,UAAU,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,mBAAW,EAAC,UAAU,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACtG,MAAM,SAAS,GAA6G,EAAE,CAAC;YAC/H,IAAI,KAAK,CAAC,MAAM;gBAAE,SAAS,CAAC,qBAAqB,GAAG,KAAK,CAAC,MAAM,CAAC;YACjE,IAAI,KAAK,CAAC,UAAU;gBAAE,SAAS,CAAC,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAC;YACpE,IAAI,KAAK,CAAC,MAAM;gBAAE,SAAS,CAAC,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC;YAC3D,IAAI,KAAK,CAAC,MAAM;gBAAE,SAAS,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAA,oBAAY,EAAC;gBACX,QAAQ,EAAE,KAAK,CAAC,GAAG;gBACnB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CAAC,GAAG,IAAI,CACV,CAAC;YACF,MAAM;QACR,CAAC;QACD;YACE,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,QAAQ,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;IAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,76 @@
+/**
+ * The `pca` developer CLI — the honest inspector for Proof-Carrying Authority.
+ *
+ * Four pure command functions, each taking parsed arguments and returning a string (or a small
+ * structured result) so they are unit-testable without spawning a process. They lean ENTIRELY on
+ * `@atlasauth/pca`'s own primitives — the same decode / verify / compile / simulate code the
+ * resource server and the facade use — so what the CLI prints is what the verifier actually does.
+ *
+ * HONEST about scope: nothing here authorizes anything. `decode` and `explain` are read-only
+ * inspectors; `explain` runs the REAL `verifyPCActnCore` against a grant it reads straight out of
+ * the PCActn's own capability chain, so a "verdict" it prints is the local, grant-relative view —
+ * the resource server, with its stored counter / revocation / attestation state, remains the
+ * authority. `keygen` mints a throwaway dev keypair (never a production holder). `simulate` is a
+ * pure offline planning replay: it mutates nothing, signs nothing, and reaches no network.
+ */
+import { decodePCActn } from '@atlasauth/pca';
+/**
+ * Parse CLI input that is EITHER PCActn JSON text or its base64url wire form. Detection is
+ * structural: a leading `{` (after trimming) is JSON; anything else is tried as base64url whose
+ * decoded bytes must be UTF-8 PCActn JSON. Either way the bytes go through the strict
+ * `decodePCActn` parser, so a malformed object throws a clear Error.
+ */
+export declare function parsePCActnInput(input: string): ReturnType<typeof decodePCActn>;
+/**
+ * Decode a PCActn (JSON or base64url) and return a readable summary: verb, resource, audience, the
+ * issued/expiry window (ISO + raw ms), counter, capability-chain depth, the claimed risk, and
+ * whether a threshold or zk-compliance field rides along. Throws a clear Error on malformed input.
+ */
+export declare function cmdDecode(input: string): string;
+export interface ExplainResult {
+    allow: boolean;
+    checks: Record<string, string>;
+    reasons: string[];
+    text: string;
+}
+/**
+ * The "why did it (not) verify?" explainer. Decodes the PCActn, takes its `cap_chain[0]` as the root
+ * grant (the capability the whole chain descends from), and runs the REAL `verifyPCActnCore` against
+ * it, then formats each check as PASS / FAIL / — (not enforced at this milestone) with a final
+ * verdict line. `--aud` supplies this verifier's audience; omit it to accept any audience.
+ */
+export declare function cmdExplain(input: string, opts: {
+    audience?: string;
+    now?: number;
+}): Promise<ExplainResult>;
+export interface KeygenResult {
+    publicKey: string;
+    secretKey: string;
+    text: string;
+}
+/**
+ * Mint a throwaway Ed25519 dev keypair and return both keys base64url-encoded plus a clearly labelled
+ * block. This is a DEV convenience — not a production holder key. The secret signs PCActns as this
+ * holder and must stay private; the public key is what a grant binds to (`holder`).
+ */
+export declare function cmdKeygen(): KeygenResult;
+export interface DiscoveryCmdOptions {
+    audience: string;
+    suites?: string[];
+    endpoints?: {
+        attestation_challenge?: string;
+        revocation_epoch?: string;
+        liveness_beacon?: string;
+        stepup?: string;
+        grant?: string;
+    };
+}
+/** Emit a `.well-known/pca-configuration` document for a resource server to publish. */
+export declare function cmdDiscovery(opts: DiscoveryCmdOptions): string;
+/**
+ * Compile a policy spec `{ permissions, limits? }` and replay an actions array against it, printing a
+ * per-action table (auto / step_up / deny + the trust budget remaining after each), the static lints
+ * `lintPolicy` found, and the autonomy bound (the most this grant can spend/risk between human
+ * co-signs). Pure and offline — the resource server's verifier remains the authority at run time.
+ */
+export declare function cmdSimulate(policyJson: string, actionsJson: string): string;

package/dist/index.js

@@ -0,0 +1,280 @@
+"use strict";
+/**
+ * The `pca` developer CLI — the honest inspector for Proof-Carrying Authority.
+ *
+ * Four pure command functions, each taking parsed arguments and returning a string (or a small
+ * structured result) so they are unit-testable without spawning a process. They lean ENTIRELY on
+ * `@atlasauth/pca`'s own primitives — the same decode / verify / compile / simulate code the
+ * resource server and the facade use — so what the CLI prints is what the verifier actually does.
+ *
+ * HONEST about scope: nothing here authorizes anything. `decode` and `explain` are read-only
+ * inspectors; `explain` runs the REAL `verifyPCActnCore` against a grant it reads straight out of
+ * the PCActn's own capability chain, so a "verdict" it prints is the local, grant-relative view —
+ * the resource server, with its stored counter / revocation / attestation state, remains the
+ * authority. `keygen` mints a throwaway dev keypair (never a production holder). `simulate` is a
+ * pure offline planning replay: it mutates nothing, signs nothing, and reaches no network.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePCActnInput = parsePCActnInput;
+exports.cmdDecode = cmdDecode;
+exports.cmdExplain = cmdExplain;
+exports.cmdKeygen = cmdKeygen;
+exports.cmdDiscovery = cmdDiscovery;
+exports.cmdSimulate = cmdSimulate;
+const pca_1 = require("@atlasauth/pca");
+// ---- small helpers --------------------------------------------------------------------------------
+/** Message of an unknown throwable without an `any`/suppression cast. */
+function errMessage(e) {
+    return e instanceof Error ? e.message : String(e);
+}
+function isRecord(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+/** Parse JSON into `unknown` (never `any`) with a labelled error. */
+function parseJson(s, label) {
+    try {
+        return JSON.parse(s);
+    }
+    catch (e) {
+        throw new Error(`${label}: invalid JSON: ${errMessage(e)}`);
+    }
+}
+/** Epoch-ms → ISO 8601, or a clear marker when the value is not a finite instant. */
+function iso(ms) {
+    if (typeof ms !== 'number' || !Number.isFinite(ms))
+        return '(none)';
+    const d = new Date(ms);
+    return Number.isNaN(d.getTime()) ? '(invalid)' : d.toISOString();
+}
+/** Right-pad to `width` for simple fixed-column tables. */
+function pad(s, width) {
+    return s.length >= width ? s : s + ' '.repeat(width - s.length);
+}
+// ---- decode ---------------------------------------------------------------------------------------
+/**
+ * Parse CLI input that is EITHER PCActn JSON text or its base64url wire form. Detection is
+ * structural: a leading `{` (after trimming) is JSON; anything else is tried as base64url whose
+ * decoded bytes must be UTF-8 PCActn JSON. Either way the bytes go through the strict
+ * `decodePCActn` parser, so a malformed object throws a clear Error.
+ */
+function parsePCActnInput(input) {
+    const trimmed = input.trim();
+    if (trimmed.length === 0)
+        throw new Error('empty input: expected a PCActn as JSON text or base64url');
+    if (trimmed.startsWith('{')) {
+        try {
+            return (0, pca_1.decodePCActn)(trimmed);
+        }
+        catch (e) {
+            throw new Error(`not a valid PCActn (JSON): ${errMessage(e)}`);
+        }
+    }
+    let bytes;
+    try {
+        bytes = (0, pca_1.unb64u)(trimmed);
+    }
+    catch (e) {
+        throw new Error(`input is neither JSON (no leading '{') nor valid base64url: ${errMessage(e)}`);
+    }
+    let text;
+    try {
+        text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw new Error('base64url decoded to bytes that are not valid UTF-8; not a PCActn');
+    }
+    try {
+        return (0, pca_1.decodePCActn)(text);
+    }
+    catch (e) {
+        throw new Error(`base64url decoded but is not a valid PCActn: ${errMessage(e)}`);
+    }
+}
+/**
+ * Decode a PCActn (JSON or base64url) and return a readable summary: verb, resource, audience, the
+ * issued/expiry window (ISO + raw ms), counter, capability-chain depth, the claimed risk, and
+ * whether a threshold or zk-compliance field rides along. Throws a clear Error on malformed input.
+ */
+function cmdDecode(input) {
+    const p = parsePCActnInput(input);
+    const chainDepth = Array.isArray(p.cap_chain) ? p.cap_chain.length : 0;
+    const riskR = isRecord(p.risk_claim) && typeof p.risk_claim.r === 'number' ? String(p.risk_claim.r) : '(none)';
+    const lines = [
+        'PCActn summary',
+        `  verb          ${p.action.verb}`,
+        `  resource      ${p.action.resource}`,
+        `  reversibility ${p.action.reversibility_class}`,
+        `  audience      ${p.aud || '(none)'}`,
+        `  issued (iat)  ${iso(p.iat)}  [${p.iat}]`,
+        `  expires (exp) ${iso(p.exp)}  [${p.exp}]`,
+        `  counter       ${p.counter}`,
+        `  cap-chain     depth ${chainDepth}`,
+        `  risk_claim.r  ${riskR}`,
+        `  threshold     ${p.threshold !== undefined ? 'present' : 'absent'}`,
+        `  zk_compliance ${p.zk_compliance !== undefined ? 'present' : 'absent'}`,
+    ];
+    return lines.join('\n');
+}
+// ---- explain --------------------------------------------------------------------------------------
+const STATUS_LABEL = { pass: 'PASS', fail: 'FAIL', 'not-enforced': '—' };
+/**
+ * The "why did it (not) verify?" explainer. Decodes the PCActn, takes its `cap_chain[0]` as the root
+ * grant (the capability the whole chain descends from), and runs the REAL `verifyPCActnCore` against
+ * it, then formats each check as PASS / FAIL / — (not enforced at this milestone) with a final
+ * verdict line. `--aud` supplies this verifier's audience; omit it to accept any audience.
+ */
+async function cmdExplain(input, opts) {
+    const p = parsePCActnInput(input);
+    const grant = Array.isArray(p.cap_chain) ? p.cap_chain[0] : undefined;
+    if (!grant)
+        throw new Error('cannot explain: the PCActn has an empty capability chain (no root grant)');
+    const result = await (0, pca_1.verifyPCActnCore)(p, {
+        grant,
+        audience: opts.audience ?? null,
+        nowEpoch: opts.now,
+    });
+    const checks = {};
+    for (const [name, status] of Object.entries(result.checks)) {
+        checks[name] = STATUS_LABEL[status] ?? status;
+    }
+    const reasons = [];
+    if (result.reason)
+        reasons.push(result.reason);
+    const audLine = opts.audience === undefined ? 'any (not supplied)' : opts.audience;
+    const width = Math.max(...Object.keys(checks).map((k) => k.length), 0) + 2;
+    const checkLines = Object.entries(result.checks).map(([name, status]) => {
+        const label = STATUS_LABEL[status] ?? status;
+        const note = status === 'not-enforced' ? ' (not enforced at this milestone)' : '';
+        return `  ${pad(name, width)}${label}${note}`;
+    });
+    const text = [
+        'PCActn verification (explain)',
+        `  verb            ${p.action.verb}`,
+        `  resource        ${p.action.resource}`,
+        `  action audience ${p.aud || '(none)'}`,
+        `  verifier aud    ${audLine}`,
+        '',
+        ...checkLines,
+        '',
+        `  VERDICT: ${result.allow ? 'ALLOW' : 'DENY'}`,
+        ...(reasons.length ? ['', '  reasons:', ...reasons.map((r) => `    - ${r}`)] : []),
+    ].join('\n');
+    return { allow: result.allow, checks, reasons, text };
+}
+/**
+ * Mint a throwaway Ed25519 dev keypair and return both keys base64url-encoded plus a clearly labelled
+ * block. This is a DEV convenience — not a production holder key. The secret signs PCActns as this
+ * holder and must stay private; the public key is what a grant binds to (`holder`).
+ */
+function cmdKeygen() {
+    const kp = (0, pca_1.generateKeyPair)();
+    const publicKey = (0, pca_1.b64u)(kp.publicKey);
+    const secretKey = (0, pca_1.b64u)(kp.secretKey);
+    const text = [
+        'PCA dev keypair (Ed25519)',
+        `  public  ${publicKey}`,
+        `  secret  ${secretKey}`,
+        '',
+        '  Keep the SECRET key private — it signs PCActns as this holder.',
+        '  Share only the public key (a grant binds to it as `holder`).',
+    ].join('\n');
+    return { publicKey, secretKey, text };
+}
+/** Emit a `.well-known/pca-configuration` document for a resource server to publish. */
+function cmdDiscovery(opts) {
+    const doc = (0, pca_1.buildDiscoveryDocument)({
+        audience: opts.audience,
+        ...(opts.suites && opts.suites.length ? { signatureSuites: opts.suites } : {}),
+        ...(opts.endpoints && Object.keys(opts.endpoints).length ? { endpoints: opts.endpoints } : {}),
+    });
+    return JSON.stringify(doc, null, 2);
+}
+function parsePolicySpec(policyJson) {
+    const spec = parseJson(policyJson, 'policy');
+    if (!isRecord(spec))
+        throw new Error('policy must be a JSON object { permissions, limits? }');
+    if (!isRecord(spec.permissions))
+        throw new Error('policy.permissions must be an object { connector: [action, ...] }');
+    const permissions = {};
+    for (const [connector, acts] of Object.entries(spec.permissions)) {
+        if (!Array.isArray(acts))
+            throw new Error(`policy.permissions.${connector} must be an array of action names`);
+        const names = [];
+        for (const a of acts) {
+            if (typeof a !== 'string')
+                throw new Error(`policy.permissions.${connector} must contain only strings`);
+            names.push(a);
+        }
+        permissions[connector] = names;
+    }
+    if (spec.limits === undefined)
+        return { permissions };
+    if (!isRecord(spec.limits))
+        throw new Error('policy.limits must be an object { action: "$X/period" }');
+    const limits = {};
+    for (const [k, v] of Object.entries(spec.limits)) {
+        if (typeof v !== 'string')
+            throw new Error(`policy.limits.${k} must be a string like "$500/day"`);
+        limits[k] = v;
+    }
+    return { permissions, limits };
+}
+function parseSimActions(actionsJson) {
+    const arr = parseJson(actionsJson, 'actions');
+    if (!Array.isArray(arr))
+        throw new Error('actions must be a JSON array of { verb, resource, params?, at? }');
+    return arr.map((raw, i) => {
+        if (!isRecord(raw))
+            throw new Error(`actions[${i}] must be an object`);
+        if (typeof raw.verb !== 'string')
+            throw new Error(`actions[${i}].verb must be a string`);
+        if (typeof raw.resource !== 'string')
+            throw new Error(`actions[${i}].resource must be a string`);
+        const out = { verb: raw.verb, resource: raw.resource };
+        if (raw.params !== undefined) {
+            if (!isRecord(raw.params))
+                throw new Error(`actions[${i}].params must be an object`);
+            out.params = raw.params;
+        }
+        if (raw.at !== undefined) {
+            if (typeof raw.at !== 'number' || !Number.isFinite(raw.at))
+                throw new Error(`actions[${i}].at must be a number (epoch ms)`);
+            out.at = raw.at;
+        }
+        return out;
+    });
+}
+/**
+ * Compile a policy spec `{ permissions, limits? }` and replay an actions array against it, printing a
+ * per-action table (auto / step_up / deny + the trust budget remaining after each), the static lints
+ * `lintPolicy` found, and the autonomy bound (the most this grant can spend/risk between human
+ * co-signs). Pure and offline — the resource server's verifier remains the authority at run time.
+ */
+function cmdSimulate(policyJson, actionsJson) {
+    const { permissions, limits } = parsePolicySpec(policyJson);
+    const policy = (0, pca_1.compilePolicy)({ permissions, ...(limits !== undefined ? { limits } : {}) });
+    const actions = parseSimActions(actionsJson);
+    const report = (0, pca_1.simulate)(policy, actions);
+    const lints = (0, pca_1.lintPolicy)(policy);
+    const { bMax, kappa } = policy.riskPolicy;
+    const safety = kappa > 0 ? Math.max(0, bMax) / kappa : 0;
+    const autonomyBound = safety * kappa;
+    const header = `  ${pad('#', 3)}${pad('verb', 18)}${pad('resource', 20)}${pad('outcome', 10)}budgetAfter`;
+    const rows = report.results.map((r, i) => `  ${pad(String(i + 1), 3)}${pad(r.action.verb, 18)}${pad(r.action.resource, 20)}${pad(r.outcome, 10)}${r.budgetAfter.toFixed(2)}`);
+    const lintLines = lints.length
+        ? lints.map((l) => `  [${l.level}] ${l.code}: ${l.message}`)
+        : ['  (none)'];
+    return [
+        `Policy simulation (${report.results.length} action${report.results.length === 1 ? '' : 's'})`,
+        '',
+        header,
+        ...rows,
+        '',
+        `  auto=${report.auto}  step_up=${report.stepUp}  deny=${report.deny}  endBudget=${report.endBudget.toFixed(2)}  peakRisk=${report.peakRisk.toFixed(3)}`,
+        `  autonomy bound: ${autonomyBound.toFixed(2)} (most this grant can spend/risk between human co-signs)`,
+        '',
+        'Lints:',
+        ...lintLines,
+    ].join('\n');
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAsDH,4CA6BC;AAOD,8BAoBC;AAmBD,gCA4CC;AAeD,8BAaC;AASD,oCAOC;AA+DD,kCAiCC;AAvTD,wCAUwB;AAExB,sGAAsG;AAEtG,yEAAyE;AACzE,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,qEAAqE;AACrE,SAAS,SAAS,CAAC,CAAS,EAAE,KAAa;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAY,CAAC;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,GAAG,CAAC,EAAW;IACtB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,QAAQ,CAAC;IACpE,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACnE,CAAC;AAED,2DAA2D;AAC3D,SAAS,GAAG,CAAC,CAAS,EAAE,KAAa;IACnC,OAAO,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AAClE,CAAC;AAED,sGAAsG;AAEtG;;;;;GAKG;AACH,SAAgB,gBAAgB,CAAC,KAAa;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAEtG,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,IAAA,kBAAY,EAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,YAAM,EAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,+DAA+D,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAA,kBAAY,EAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gDAAgD,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,SAAS,CAAC,KAAa;IACrC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GACT,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnG,MAAM,KAAK,GAAG;QACZ,gBAAgB;QAChB,mBAAmB,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QAClC,mBAAmB,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE;QACtC,mBAAmB,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE;QACjD,mBAAmB,CAAC,CAAC,GAAG,IAAI,QAAQ,EAAE;QACtC,mBAAmB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,GAAG;QAC3C,mBAAmB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,GAAG;QAC3C,mBAAmB,CAAC,CAAC,OAAO,EAAE;QAC9B,yBAAyB,UAAU,EAAE;QACrC,mBAAmB,KAAK,EAAE;QAC1B,mBAAmB,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrE,mBAAmB,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC1E,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,sGAAsG;AAEtG,MAAM,YAAY,GAA2B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC;AASjG;;;;;GAKG;AACI,KAAK,UAAU,UAAU,CAC9B,KAAa,EACb,IAAyC;IAEzC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAExG,MAAM,MAAM,GAAG,MAAM,IAAA,sBAAgB,EAAC,CAAC,EAAE;QACvC,KAAK;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;QAC/B,QAAQ,EAAE,IAAI,CAAC,GAAG;KACnB,CAAC,CAAC;IAEH,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;IAChD,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IACnF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;QACtE,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,OAAO,KAAK,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,KAAK,GAAG,IAAI,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG;QACX,+BAA+B;QAC/B,qBAAqB,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QACpC,qBAAqB,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE;QACxC,qBAAqB,CAAC,CAAC,GAAG,IAAI,QAAQ,EAAE;QACxC,qBAAqB,OAAO,EAAE;QAC9B,EAAE;QACF,GAAG,UAAU;QACb,EAAE;QACF,cAAc,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE;QAC/C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACnF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACxD,CAAC;AAUD;;;;GAIG;AACH,SAAgB,SAAS;IACvB,MAAM,EAAE,GAAG,IAAA,qBAAe,GAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAA,UAAI,EAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAA,UAAI,EAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG;QACX,2BAA2B;QAC3B,aAAa,SAAS,EAAE;QACxB,aAAa,SAAS,EAAE;QACxB,EAAE;QACF,kEAAkE;QAClE,gEAAgE;KACjE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAQD,wFAAwF;AACxF,SAAgB,YAAY,CAAC,IAAyB;IACpD,MAAM,GAAG,GAAG,IAAA,4BAAsB,EAAC;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACtC,CAAC;AAWD,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC9F,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAEtH,MAAM,WAAW,GAA6B,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,mCAAmC,CAAC,CAAC;QAC9G,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,4BAA4B,CAAC,CAAC;YACxG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,WAAW,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IACjC,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACtD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACvG,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,mCAAmC,CAAC,CAAC;QAClG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,WAAmB;IAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IAC7G,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;QACvE,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;QACzF,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC;QACjG,MAAM,GAAG,GAAoB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxE,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC;YACrF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,CAAC;QACD,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,kCAAkC,CAAC,CAAC;YAC5H,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,UAAkB,EAAE,WAAmB;IACjE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAA,mBAAa,EAAC,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,IAAA,cAAQ,EAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAA,gBAAU,EAAC,MAAM,CAAC,CAAC;IAEjC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,MAAM,GAAG,KAAK,CAAC;IAErC,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC;IAC1G,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACvC,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CACnI,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM;QAC5B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5D,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAEjB,OAAO;QACL,sBAAsB,MAAM,CAAC,OAAO,CAAC,MAAM,UAAU,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;QAC9F,EAAE;QACF,MAAM;QACN,GAAG,IAAI;QACP,EAAE;QACF,UAAU,MAAM,CAAC,IAAI,aAAa,MAAM,CAAC,MAAM,UAAU,MAAM,CAAC,IAAI,eAAe,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACxJ,qBAAqB,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,0DAA0D;QACvG,EAAE;QACF,QAAQ;QACR,GAAG,SAAS;KACb,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,36 @@
 {
   "name": "@atlasauth/pca-cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "The pca dev CLI: decode and explain a PCActn (why it passed or failed each check), mint a dev grant/key, and simulate a policy over actions.",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "pca": "./dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@atlasauth/pca": "0.1.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.4"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
 }