@catp-protocol/cli 0.1.0

package/dist/audit/logger.d.ts

@@ -0,0 +1,8 @@
+import type { AuditEntry, HookInput } from "../policy/types.js";
+export declare function computeCommitment(tool: string, decision: "allow" | "deny", ts: string, prev?: string): string;
+export declare function summarizeInput(input: HookInput): string;
+export declare function auditDir(agentId: string): string;
+export declare function getLastCommitment(agentId: string): string;
+export declare function appendAuditEntry(agentId: string, entry: AuditEntry): void;
+export declare function buildEntry(input: HookInput, decision: "allow" | "deny", ruleMatched: string | null, prevCommitment?: string): AuditEntry;
+//# sourceMappingURL=logger.d.ts.map

package/dist/audit/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAMhE,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,GAAG,MAAM,EAC1B,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAY,GACjB,MAAM,CAOR;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAGvD;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGhD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAYzD;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAIzE;AAED,wBAAgB,UAAU,CACxB,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,OAAO,GAAG,MAAM,EAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,cAAc,GAAE,MAAY,GAC3B,UAAU,CAUZ"}

package/dist/audit/logger.js

@@ -0,0 +1,56 @@
+import { createHash } from "node:crypto";
+import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+// Phase 0: SHA-256 commitment placeholder.
+// Chains on fields stored in the log (tool, decision, ts, prev) so the chain
+// is verifiable from the JSONL file alone without replaying tool_input.
+// Phase 1 replaces this with a Poseidon hash over the full action witness via WASM.
+export function computeCommitment(tool, decision, ts, prev = "0") {
+    return createHash("sha256")
+        .update(tool)
+        .update(decision)
+        .update(ts)
+        .update(prev)
+        .digest("hex");
+}
+export function summarizeInput(input) {
+    const raw = JSON.stringify(input.tool_input);
+    return raw.length > 200 ? raw.slice(0, 200) + "…" : raw;
+}
+export function auditDir(agentId) {
+    const date = new Date().toISOString().slice(0, 10);
+    return join(homedir(), ".catp", "audit", agentId, date);
+}
+export function getLastCommitment(agentId) {
+    const dir = auditDir(agentId);
+    const file = join(dir, "actions.jsonl");
+    try {
+        const content = readFileSync(file, "utf8").trimEnd();
+        if (!content)
+            return "0";
+        const lastLine = content.split("\n").pop() ?? "";
+        const entry = JSON.parse(lastLine);
+        return entry.commitment;
+    }
+    catch {
+        return "0";
+    }
+}
+export function appendAuditEntry(agentId, entry) {
+    const dir = auditDir(agentId);
+    mkdirSync(dir, { recursive: true });
+    appendFileSync(join(dir, "actions.jsonl"), JSON.stringify(entry) + "\n", "utf8");
+}
+export function buildEntry(input, decision, ruleMatched, prevCommitment = "0") {
+    const ts = new Date().toISOString();
+    return {
+        ts,
+        tool: input.tool_name,
+        decision,
+        rule_matched: ruleMatched,
+        commitment: computeCommitment(input.tool_name, decision, ts, prevCommitment),
+        input_summary: summarizeInput(input),
+    };
+}
+//# sourceMappingURL=logger.js.map

package/dist/audit/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGlC,2CAA2C;AAC3C,6EAA6E;AAC7E,wEAAwE;AACxE,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,QAA0B,EAC1B,EAAU,EACV,OAAe,GAAG;IAElB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,QAAQ,CAAC;SAChB,MAAM,CAAC,EAAE,CAAC;SACV,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAgB;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7C,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QACrD,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC;QACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAe,CAAC;QACjD,OAAO,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,KAAiB;IACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,KAAgB,EAChB,QAA0B,EAC1B,WAA0B,EAC1B,iBAAyB,GAAG;IAE5B,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO;QACL,EAAE;QACF,IAAI,EAAE,KAAK,CAAC,SAAS;QACrB,QAAQ;QACR,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,CAAC;QAC5E,aAAa,EAAE,cAAc,CAAC,KAAK,CAAC;KACrC,CAAC;AACJ,CAAC"}

package/dist/audit/verifier.d.ts

@@ -0,0 +1,8 @@
+export interface VerifyResult {
+    ok: boolean;
+    checked: number;
+    broken_at: number | null;
+    message: string;
+}
+export declare function verifyChain(logFile: string): Promise<VerifyResult>;
+//# sourceMappingURL=verifier.d.ts.map

package/dist/audit/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../src/audit/verifier.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CA6BxE"}

package/dist/audit/verifier.js

@@ -0,0 +1,42 @@
+import { createReadStream } from "node:fs";
+import { createInterface } from "node:readline";
+import { computeCommitment } from "./logger.js";
+export async function verifyChain(logFile) {
+    const lines = await readLines(logFile);
+    if (lines.length === 0) {
+        return { ok: true, checked: 0, broken_at: null, message: "empty log" };
+    }
+    let prev = "0";
+    for (let i = 0; i < lines.length; i++) {
+        let entry;
+        try {
+            entry = JSON.parse(lines[i]);
+        }
+        catch {
+            return { ok: false, checked: i, broken_at: i, message: `line ${i + 1}: invalid JSON` };
+        }
+        const decision = entry.decision;
+        const expected = computeCommitment(entry.tool, decision, entry.ts, prev);
+        if (entry.commitment !== expected) {
+            return {
+                ok: false,
+                checked: i,
+                broken_at: i,
+                message: `line ${i + 1}: commitment mismatch (chain broken or tampered)`,
+            };
+        }
+        prev = entry.commitment;
+    }
+    return { ok: true, checked: lines.length, broken_at: null, message: "chain intact" };
+}
+async function readLines(file) {
+    return new Promise((resolve, reject) => {
+        const lines = [];
+        const rl = createInterface({ input: createReadStream(file), crlfDelay: Infinity });
+        rl.on("line", (l) => { if (l.trim())
+            lines.push(l); });
+        rl.on("close", () => resolve(lines));
+        rl.on("error", reject);
+    });
+}
+//# sourceMappingURL=verifier.js.map

package/dist/audit/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../src/audit/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAUhD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe;IAC/C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACzE,CAAC;IAED,IAAI,IAAI,GAAG,GAAG,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAiB,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAe,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACzF,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,QAA4B,CAAC;QACpD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzE,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,CAAC;gBACV,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,kDAAkD;aACzE,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AACvF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnF,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import { runPreHook } from "./hook/pre.js";
+import { runPostHook } from "./hook/post.js";
+import { cmdInit } from "./commands/init.js";
+import { cmdValidate } from "./commands/validate.js";
+import { cmdLogShow, cmdLogVerify } from "./commands/log.js";
+const program = new Command();
+program
+    .name("catp")
+    .description("CATP enforcement plugin — policy enforcement and audit for AI agents")
+    .version("0.1.0");
+program
+    .command("init")
+    .description("Scaffold a catp-policy.toml in the current directory")
+    .action(cmdInit);
+program
+    .command("validate")
+    .description("Validate catp-policy.toml syntax")
+    .option("-f, --file <path>", "path to policy file (default: auto-discover)")
+    .action(cmdValidate);
+const hook = program.command("hook").description("Hook handlers called by agent frameworks");
+hook
+    .command("pre")
+    .description("PreToolUse handler — reads stdin JSON, allows or blocks")
+    .action(() => { runPreHook().catch(() => process.exit(0)); });
+hook
+    .command("post")
+    .description("PostToolUse handler — reads stdin JSON, records to audit log")
+    .action(() => { runPostHook().catch(() => process.exit(0)); });
+const log = program.command("log").description("Audit log commands");
+log
+    .command("show")
+    .description("Display recent audit log entries")
+    .option("-n, --lines <n>", "number of lines to show", "50")
+    .option("--agent <id>", "agent id (default: from policy file)")
+    .action(cmdLogShow);
+log
+    .command("verify")
+    .description("Verify commitment chain integrity")
+    .option("--agent <id>", "agent id (default: from policy file)")
+    .action(cmdLogVerify);
+program.parseAsync(process.argv).catch((err) => {
+    process.stderr.write(`catp: ${err.message}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE7D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,MAAM,CAAC;KACZ,WAAW,CAAC,sEAAsE,CAAC;KACnF,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,sDAAsD,CAAC;KACnE,MAAM,CAAC,OAAO,CAAC,CAAC;AAEnB,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,kCAAkC,CAAC;KAC/C,MAAM,CAAC,mBAAmB,EAAE,8CAA8C,CAAC;KAC3E,MAAM,CAAC,WAAW,CAAC,CAAC;AAEvB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;AAE7F,IAAI;KACD,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,yDAAyD,CAAC;KACtE,MAAM,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhE,IAAI;KACD,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,8DAA8D,CAAC;KAC3E,MAAM,CAAC,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjE,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;AAErE,GAAG;KACA,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,kCAAkC,CAAC;KAC/C,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,IAAI,CAAC;KAC1D,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC;KAC9D,MAAM,CAAC,UAAU,CAAC,CAAC;AAEtB,GAAG;KACA,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,mCAAmC,CAAC;KAChD,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC;KAC9D,MAAM,CAAC,YAAY,CAAC,CAAC;AAExB,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAU,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;IAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/commands/init.d.ts

@@ -0,0 +1,2 @@
+export declare function cmdInit(): void;
+//# sourceMappingURL=init.d.ts.map

package/dist/commands/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AA+BA,wBAAgB,OAAO,IAAI,IAAI,CAa9B"}

package/dist/commands/init.js

@@ -0,0 +1,42 @@
+import { writeFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+const TEMPLATE = `[agent]
+id = "my-agent"
+version = "1"
+
+# Rules are evaluated top-to-bottom; first match wins.
+# Omit pattern/path fields to match any invocation of that tool.
+
+[[rules]]
+tool = "Bash"
+allow = false
+pattern = ["rm -rf*", "*--force*", "*git push*prod*"]
+reason = "Destructive or production-affecting shell commands are blocked"
+
+[[rules]]
+tool = "Bash"
+allow = true
+
+[[rules]]
+tool = "Write"
+allow = true
+path_allowlist = ["./src/**", "./tests/**", "./docs/**"]
+
+[[rules]]
+tool = "WebFetch"
+allow = false
+reason = "External network calls require explicit approval"
+`;
+export function cmdInit() {
+    const dest = join(process.cwd(), "catp-policy.toml");
+    if (existsSync(dest)) {
+        process.stdout.write("catp-policy.toml already exists — skipping.\n");
+        return;
+    }
+    writeFileSync(dest, TEMPLATE, "utf8");
+    process.stdout.write("Created catp-policy.toml\n\nNext steps:\n" +
+        "  1. Edit catp-policy.toml to match your agent's requirements\n" +
+        "  2. Run: catp validate\n" +
+        "  3. Add CATP hooks to ~/.claude/settings.json (see README)\n");
+}
+//# sourceMappingURL=init.js.map

package/dist/commands/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BhB,CAAC;AAEF,MAAM,UAAU,OAAO;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2CAA2C;QAC3C,iEAAiE;QACjE,2BAA2B;QAC3B,+DAA+D,CAChE,CAAC;AACJ,CAAC"}

package/dist/commands/log.d.ts

@@ -0,0 +1,8 @@
+export declare function cmdLogShow(opts: {
+    lines: string;
+    agent?: string;
+}): void;
+export declare function cmdLogVerify(opts: {
+    agent?: string;
+}): Promise<void>;
+//# sourceMappingURL=log.d.ts.map

package/dist/commands/log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../../src/commands/log.ts"],"names":[],"mappings":"AAyBA,wBAAgB,UAAU,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAuBxE;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAe1E"}

package/dist/commands/log.js

@@ -0,0 +1,64 @@
+import { readFileSync, readdirSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { findPolicyFile, loadPolicy } from "../policy/loader.js";
+import { verifyChain } from "../audit/verifier.js";
+function resolveAgentId(opts) {
+    if (opts.agent)
+        return opts.agent;
+    const policyPath = findPolicyFile();
+    if (!policyPath) {
+        process.stderr.write("catp: no --agent id and no catp-policy.toml found\n");
+        process.exit(1);
+    }
+    return loadPolicy(policyPath).agent.id;
+}
+function latestLogFile(agentId) {
+    const base = join(homedir(), ".catp", "audit", agentId);
+    if (!existsSync(base))
+        return null;
+    const dates = readdirSync(base).sort().reverse();
+    if (dates.length === 0)
+        return null;
+    return join(base, dates[0], "actions.jsonl");
+}
+export function cmdLogShow(opts) {
+    const agentId = resolveAgentId(opts);
+    const logFile = latestLogFile(agentId);
+    if (!logFile || !existsSync(logFile)) {
+        process.stdout.write(`No audit log found for agent "${agentId}"\n`);
+        return;
+    }
+    const lines = readFileSync(logFile, "utf8").trim().split("\n").filter(Boolean);
+    const n = Math.min(parseInt(opts.lines, 10) || 50, lines.length);
+    const recent = lines.slice(-n);
+    for (const line of recent) {
+        try {
+            const e = JSON.parse(line);
+            const icon = e.decision === "allow" ? "✓" : "✗";
+            const rule = e.rule_matched ? ` [${e.rule_matched}]` : "";
+            process.stdout.write(`${icon} ${e.ts}  ${e.tool}${rule}\n    ${e.input_summary}\n`);
+        }
+        catch {
+            process.stdout.write(`? ${line}\n`);
+        }
+    }
+    process.stdout.write(`\n${recent.length} entries from ${logFile}\n`);
+}
+export async function cmdLogVerify(opts) {
+    const agentId = resolveAgentId(opts);
+    const logFile = latestLogFile(agentId);
+    if (!logFile || !existsSync(logFile)) {
+        process.stdout.write(`No audit log found for agent "${agentId}"\n`);
+        return;
+    }
+    const result = await verifyChain(logFile);
+    if (result.ok) {
+        process.stdout.write(`✓ Chain intact — ${result.checked} entries verified\n`);
+    }
+    else {
+        process.stderr.write(`✗ Chain broken at entry ${result.broken_at}: ${result.message}\n`);
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=log.js.map

package/dist/commands/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../../src/commands/log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGnD,SAAS,cAAc,CAAC,IAAwB;IAC9C,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAClC,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAuC;IAChE,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,KAAK,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/E,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;YACzC,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAChD,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,SAAS,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,iBAAiB,OAAO,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAwB;IACzD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,KAAK,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;IAChF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACzF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/commands/validate.d.ts

@@ -0,0 +1,4 @@
+export declare function cmdValidate(opts: {
+    file?: string;
+}): void;
+//# sourceMappingURL=validate.d.ts.map

package/dist/commands/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAEA,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAgBzD"}

package/dist/commands/validate.js

@@ -0,0 +1,17 @@
+import { findPolicyFile, loadPolicy } from "../policy/loader.js";
+export function cmdValidate(opts) {
+    const policyPath = opts.file ?? findPolicyFile();
+    if (!policyPath) {
+        process.stderr.write("catp: no catp-policy.toml found in current directory or any parent\n");
+        process.exit(1);
+    }
+    try {
+        const policy = loadPolicy(policyPath);
+        process.stdout.write(`✓ ${policyPath}\n  agent: ${policy.agent.id} v${policy.agent.version}\n  rules: ${policy.rules.length}\n`);
+    }
+    catch (err) {
+        process.stderr.write(`✗ ${policyPath}\n  ${err.message}\n`);
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=validate.js.map

package/dist/commands/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjE,MAAM,UAAU,WAAW,CAAC,IAAuB;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;IACjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,UAAU,cAAc,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,cAAc,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,CAC3G,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,UAAU,OAAQ,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/hook/post.d.ts

@@ -0,0 +1,2 @@
+export declare function runPostHook(): Promise<void>;
+//# sourceMappingURL=post.d.ts.map

package/dist/hook/post.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.d.ts","sourceRoot":"","sources":["../../src/hook/post.ts"],"names":[],"mappings":"AAIA,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CA6BjD"}

package/dist/hook/post.js

@@ -0,0 +1,42 @@
+import { findPolicyFile, loadPolicy } from "../policy/loader.js";
+import { buildEntry, appendAuditEntry, getLastCommitment } from "../audit/logger.js";
+export async function runPostHook() {
+    const raw = await readStdin();
+    let input;
+    try {
+        input = JSON.parse(raw);
+    }
+    catch {
+        process.exit(0);
+    }
+    const policyPath = findPolicyFile();
+    if (!policyPath)
+        process.exit(0);
+    let policy;
+    try {
+        policy = loadPolicy(policyPath);
+    }
+    catch {
+        process.exit(0);
+    }
+    // PostToolUse always records allow — the action already executed
+    const prev = getLastCommitment(policy.agent.id);
+    const entry = buildEntry(input, "allow", null, prev);
+    try {
+        appendAuditEntry(policy.agent.id, entry);
+    }
+    catch {
+        // Audit log failure must not block the agent
+    }
+    process.exit(0);
+}
+async function readStdin() {
+    return new Promise((resolve) => {
+        let data = "";
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", (chunk) => { data += chunk; });
+        process.stdin.on("end", () => resolve(data));
+        process.stdin.on("error", () => resolve(""));
+    });
+}
+//# sourceMappingURL=post.js.map

package/dist/hook/post.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"post.js","sourceRoot":"","sources":["../../src/hook/post.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGrF,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;IAC9B,IAAI,KAAgB,CAAC;IACrB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAEjC,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,iEAAiE;IACjE,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/hook/pre.d.ts

@@ -0,0 +1,2 @@
+export declare function runPreHook(): Promise<void>;
+//# sourceMappingURL=pre.d.ts.map

package/dist/hook/pre.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre.d.ts","sourceRoot":"","sources":["../../src/hook/pre.ts"],"names":[],"mappings":"AAKA,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CA2ChD"}

package/dist/hook/pre.js

@@ -0,0 +1,52 @@
+import { findPolicyFile, loadPolicy } from "../policy/loader.js";
+import { evaluate } from "../policy/engine.js";
+import { buildEntry, appendAuditEntry, getLastCommitment } from "../audit/logger.js";
+export async function runPreHook() {
+    const raw = await readStdin();
+    let input;
+    try {
+        input = JSON.parse(raw);
+    }
+    catch {
+        process.exit(0);
+    }
+    const policyPath = findPolicyFile();
+    if (!policyPath) {
+        process.exit(0);
+    }
+    let policy;
+    try {
+        policy = loadPolicy(policyPath);
+    }
+    catch (err) {
+        process.stderr.write(`catp: policy error: ${err.message}\n`);
+        process.exit(0);
+    }
+    const decision = evaluate(policy, input);
+    const ruleName = decision.rule
+        ? `${decision.rule.tool}:${decision.rule.allow ? "allow" : "deny"}`
+        : null;
+    const prev = getLastCommitment(policy.agent.id);
+    const entry = buildEntry(input, decision.allow ? "allow" : "deny", ruleName, prev);
+    try {
+        appendAuditEntry(policy.agent.id, entry);
+    }
+    catch {
+        // Audit log failure must not block the agent
+    }
+    if (!decision.allow) {
+        process.stdout.write(JSON.stringify({ decision: "block", reason: decision.reason }) + "\n");
+        process.exit(2);
+    }
+    process.exit(0);
+}
+async function readStdin() {
+    return new Promise((resolve) => {
+        let data = "";
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", (chunk) => { data += chunk; });
+        process.stdin.on("end", () => resolve(data));
+        process.stdin.on("error", () => resolve(""));
+    });
+}
+//# sourceMappingURL=pre.js.map

package/dist/hook/pre.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre.js","sourceRoot":"","sources":["../../src/hook/pre.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGrF,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;IAC9B,IAAI,KAAgB,CAAC;IACrB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAwB,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI;QAC5B,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE;QACnE,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnF,IAAI,CAAC;QACH,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CACtE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/policy/engine.d.ts

@@ -0,0 +1,8 @@
+import type { CatpPolicy, Rule, HookInput } from "./types.js";
+export interface Decision {
+    allow: boolean;
+    rule: Rule | null;
+    reason: string;
+}
+export declare function evaluate(policy: CatpPolicy, input: HookInput): Decision;
+//# sourceMappingURL=engine.d.ts.map

package/dist/policy/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/policy/engine.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE9D,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,GAAG,QAAQ,CAiBvE"}

package/dist/policy/engine.js

@@ -0,0 +1,52 @@
+import micromatch from "micromatch";
+export function evaluate(policy, input) {
+    const toolRules = policy.rules.filter((r) => r.tool === "*" || r.tool === input.tool_name);
+    for (const rule of toolRules) {
+        if (matchesRule(rule, input)) {
+            return {
+                allow: rule.allow,
+                rule,
+                reason: rule.reason ?? (rule.allow ? "allowed by policy" : "denied by policy"),
+            };
+        }
+    }
+    // Default allow if no rule matches
+    return { allow: true, rule: null, reason: "no matching rule — default allow" };
+}
+function matchesRule(rule, input) {
+    if (rule.pattern && rule.pattern.length > 0) {
+        const command = extractCommand(input);
+        if (command === null)
+            return false;
+        return rule.pattern.some((p) => micromatch.isMatch(command, p) || command.includes(p));
+    }
+    if (rule.path_allowlist || rule.path_denylist) {
+        const filePath = extractPath(input);
+        if (filePath === null)
+            return false;
+        if (rule.path_denylist && rule.path_denylist.length > 0) {
+            if (micromatch.isMatch(filePath, rule.path_denylist))
+                return true;
+        }
+        if (rule.path_allowlist && rule.path_allowlist.length > 0) {
+            return !micromatch.isMatch(filePath, rule.path_allowlist);
+        }
+        // path condition present but file didn't match denylist and no allowlist — no match
+        return false;
+    }
+    // No pattern/path conditions — matches any invocation of this tool
+    return true;
+}
+function extractCommand(input) {
+    const cmd = input.tool_input["command"];
+    return typeof cmd === "string" ? cmd : null;
+}
+function extractPath(input) {
+    for (const key of ["file_path", "path", "filePath"]) {
+        const v = input.tool_input[key];
+        if (typeof v === "string")
+            return v;
+    }
+    return null;
+}
+//# sourceMappingURL=engine.js.map

package/dist/policy/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/policy/engine.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,YAAY,CAAC;AASpC,MAAM,UAAU,QAAQ,CAAC,MAAkB,EAAE,KAAgB;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,SAAS,CACpD,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI;gBACJ,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,kBAAkB,CAAC;aAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,WAAW,CAAC,IAAU,EAAE,KAAgB;IAC/C,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACnC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAEpC,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC;gBAAE,OAAO,IAAI,CAAC;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAC5D,CAAC;QACD,oFAAoF;QACpF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mEAAmE;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAgB;IACtC,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACxC,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,WAAW,CAAC,KAAgB;IACnC,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/policy/loader.d.ts

@@ -0,0 +1,4 @@
+import type { CatpPolicy } from "./types.js";
+export declare function findPolicyFile(startDir?: string): string | null;
+export declare function loadPolicy(policyPath: string): CatpPolicy;
+//# sourceMappingURL=loader.d.ts.map

package/dist/policy/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/policy/loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,wBAAgB,cAAc,CAAC,QAAQ,GAAE,MAAsB,GAAG,MAAM,GAAG,IAAI,CAS9E;AAED,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAIzD"}

package/dist/policy/loader.js

@@ -0,0 +1,69 @@
+import { readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { parse } from "smol-toml";
+const POLICY_FILENAME = "catp-policy.toml";
+export function findPolicyFile(startDir = process.cwd()) {
+    let dir = startDir;
+    while (true) {
+        const candidate = join(dir, POLICY_FILENAME);
+        if (existsSync(candidate))
+            return candidate;
+        const parent = join(dir, "..");
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+export function loadPolicy(policyPath) {
+    const raw = readFileSync(policyPath, "utf8");
+    const parsed = parse(raw);
+    return validate(parsed, policyPath);
+}
+function validate(raw, path) {
+    if (typeof raw !== "object" || raw === null) {
+        throw new Error(`${path}: policy must be a TOML object`);
+    }
+    const obj = raw;
+    if (!obj.agent || typeof obj.agent !== "object") {
+        throw new Error(`${path}: missing [agent] section`);
+    }
+    const agent = obj.agent;
+    if (typeof agent.id !== "string" || !agent.id) {
+        throw new Error(`${path}: agent.id must be a non-empty string`);
+    }
+    if (typeof agent.version !== "string" || !agent.version) {
+        throw new Error(`${path}: agent.version must be a non-empty string`);
+    }
+    if (!Array.isArray(obj.rules)) {
+        throw new Error(`${path}: [[rules]] must be an array`);
+    }
+    const rules = obj.rules.map((r, i) => {
+        if (typeof r !== "object" || r === null) {
+            throw new Error(`${path}: rules[${i}] must be an object`);
+        }
+        const rule = r;
+        if (typeof rule.tool !== "string" || !rule.tool) {
+            throw new Error(`${path}: rules[${i}].tool must be a non-empty string`);
+        }
+        if (typeof rule.allow !== "boolean") {
+            throw new Error(`${path}: rules[${i}].allow must be a boolean`);
+        }
+        return {
+            tool: rule.tool,
+            allow: rule.allow,
+            pattern: toStringArray(rule.pattern),
+            path_allowlist: toStringArray(rule.path_allowlist),
+            path_denylist: toStringArray(rule.path_denylist),
+            reason: typeof rule.reason === "string" ? rule.reason : undefined,
+        };
+    });
+    return { agent: { id: agent.id, version: agent.version }, rules };
+}
+function toStringArray(v) {
+    if (v === undefined || v === null)
+        return undefined;
+    if (!Array.isArray(v))
+        return undefined;
+    return v.filter((x) => typeof x === "string");
+}
+//# sourceMappingURL=loader.js.map

package/dist/policy/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/policy/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAGlC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAE3C,MAAM,UAAU,cAAc,CAAC,WAAmB,OAAO,CAAC,GAAG,EAAE;IAC7D,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,UAAkB;IAC3C,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAY,CAAC;IACrC,OAAO,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY,EAAE,IAAY;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gCAAgC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2BAA2B,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAgC,CAAC;IACnD,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4CAA4C,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,CAAS,EAAE,EAAE;QACpD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,WAAW,CAAC,qBAAqB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,IAAI,GAAG,CAA4B,CAAC;QAC1C,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,WAAW,CAAC,mCAAmC,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,WAAW,CAAC,2BAA2B,CAAC,CAAC;QAClE,CAAC;QACD,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAc;YACzB,KAAK,EAAE,IAAI,CAAC,KAAgB;YAC5B,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;YACpC,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC;YAClD,aAAa,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC;YAChD,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SAClE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAY,EAAE,OAAO,EAAE,KAAK,CAAC,OAAiB,EAAE,EAAE,KAAK,EAAE,CAAC;AACxF,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC7D,CAAC"}

package/dist/policy/types.d.ts

@@ -0,0 +1,30 @@
+export interface AgentMeta {
+    id: string;
+    version: string;
+}
+export interface Rule {
+    tool: string;
+    allow: boolean;
+    pattern?: string[];
+    path_allowlist?: string[];
+    path_denylist?: string[];
+    reason?: string;
+}
+export interface CatpPolicy {
+    agent: AgentMeta;
+    rules: Rule[];
+}
+export interface HookInput {
+    session_id?: string;
+    tool_name: string;
+    tool_input: Record<string, unknown>;
+}
+export interface AuditEntry {
+    ts: string;
+    tool: string;
+    decision: "allow" | "deny";
+    rule_matched: string | null;
+    commitment: string;
+    input_summary: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/policy/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/policy/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,IAAI,EAAE,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB"}

package/dist/policy/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/policy/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/policy/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@catp-protocol/cli",
+  "version": "0.1.0",
+  "description": "Cryptographic Agent Trust Protocol — local enforcement plugin for Claude Code with TOML policy and tamper-evident audit log",
+  "keywords": ["claude-code", "ai-agents", "policy", "audit", "hooks", "trust", "zk"],
+  "license": "MIT",
+  "homepage": "https://github.com/lfzkoala/catp#readme",
+  "bugs": "https://github.com/lfzkoala/catp/issues",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/lfzkoala/catp.git"
+  },
+  "type": "module",
+  "bin": {
+    "catp": "./dist/cli.js"
+  },
+  "files": ["dist"],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "node --experimental-vm-modules node_modules/.bin/jest",
+    "test:coverage": "node --experimental-vm-modules node_modules/.bin/jest --coverage --ci"
+  },
+  "dependencies": {
+    "commander": "^12.0.0",
+    "micromatch": "^4.0.5",
+    "smol-toml": "^1.3.0"
+  },
+  "devDependencies": {
+    "@types/micromatch": "^4.0.6",
+    "@types/node": "^20.0.0",
+    "jest": "^29.0.0",
+    "ts-jest": "^29.0.0",
+    "typescript": "^5.4.0"
+  }
+}