@catp-protocol/cli 0.2.1 → 0.2.2

package/dist/adapters/claude-code.d.ts

@@ -0,0 +1,3 @@
+import type { RuntimeAdapter } from "../runtime/types.js";
+export declare const claudeCodeAdapter: RuntimeAdapter;
+//# sourceMappingURL=claude-code.d.ts.map

package/dist/adapters/claude-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code.d.ts","sourceRoot":"","sources":["../../src/adapters/claude-code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAA4B,MAAM,qBAAqB,CAAC;AAQpF,eAAO,MAAM,iBAAiB,EAAE,cAQ/B,CAAC"}

package/dist/adapters/claude-code.js

@@ -0,0 +1,36 @@
+export const claudeCodeAdapter = {
+    runtime: "claude-code",
+    fromPreToolUse(input) {
+        return toToolAction(input, "pre");
+    },
+    fromPostToolUse(input) {
+        return toToolAction(input, "post");
+    },
+};
+function toToolAction(input, phase) {
+    if (!isClaudeCodeHookInput(input)) {
+        return null;
+    }
+    return {
+        runtime: claudeCodeAdapter.runtime,
+        phase,
+        sessionId: input.session_id,
+        toolName: input.tool_name,
+        toolInput: input.tool_input,
+        raw: input,
+    };
+}
+function isClaudeCodeHookInput(input) {
+    if (!input || typeof input !== "object" || Array.isArray(input)) {
+        return false;
+    }
+    const value = input;
+    return (typeof value.tool_name === "string" &&
+        !!value.tool_name &&
+        isRecord(value.tool_input) &&
+        (value.session_id === undefined || typeof value.session_id === "string"));
+}
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+//# sourceMappingURL=claude-code.js.map

package/dist/adapters/claude-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../src/adapters/claude-code.ts"],"names":[],"mappings":"AAQA,MAAM,CAAC,MAAM,iBAAiB,GAAmB;IAC/C,OAAO,EAAE,aAAa;IACtB,cAAc,CAAC,KAAc;QAC3B,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,eAAe,CAAC,KAAc;QAC5B,OAAO,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;CACF,CAAC;AAEF,SAAS,YAAY,CAAC,KAAc,EAAE,KAAmB;IACvD,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,OAAO,EAAE,iBAAiB,CAAC,OAAO;QAClC,KAAK;QACL,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,GAAG,EAAE,KAAK;KACX,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,OAAO,CACL,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,CAAC,CAAC,KAAK,CAAC,SAAS;QACjB,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;QAC1B,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CACzE,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC"}

package/dist/adapters/index.d.ts

@@ -0,0 +1,5 @@
+import type { RuntimeAdapter } from "../runtime/types.js";
+export declare function getRuntimeAdapter(runtime: string): RuntimeAdapter | null;
+export declare function supportedRuntimeAdapters(): string[];
+export declare function formatSupportedRuntimeAdapters(): string;
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAI1D,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAExE;AAED,wBAAgB,wBAAwB,IAAI,MAAM,EAAE,CAEnD;AAED,wBAAgB,8BAA8B,IAAI,MAAM,CAKvD"}

package/dist/adapters/index.js

@@ -0,0 +1,15 @@
+import { claudeCodeAdapter } from "./claude-code.js";
+const ADAPTERS = [claudeCodeAdapter];
+export function getRuntimeAdapter(runtime) {
+    return ADAPTERS.find((adapter) => adapter.runtime === runtime) ?? null;
+}
+export function supportedRuntimeAdapters() {
+    return ADAPTERS.map((adapter) => adapter.runtime);
+}
+export function formatSupportedRuntimeAdapters() {
+    return [
+        "Supported runtime adapters:",
+        ...supportedRuntimeAdapters().map((runtime) => `- ${runtime}`),
+    ].join("\n") + "\n";
+}
+//# sourceMappingURL=index.js.map

package/dist/adapters/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,MAAM,QAAQ,GAAG,CAAC,iBAAiB,CAAU,CAAC;AAE9C,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,8BAA8B;IAC5C,OAAO;QACL,6BAA6B;QAC7B,GAAG,wBAAwB,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC;KAC/D,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACtB,CAAC"}

package/dist/adapters/registry.d.ts

@@ -0,0 +1,5 @@
+import type { RuntimeAdapter, RuntimePhase, ToolAction } from "../runtime/types.js";
+export declare function listRuntimeAdapters(): string[];
+export declare function getRuntimeAdapter(name: string): RuntimeAdapter | null;
+export declare function adaptRuntimePayload(adapterName: string, phase: RuntimePhase, payload: unknown): ToolAction | null;
+//# sourceMappingURL=registry.d.ts.map

package/dist/adapters/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/adapters/registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAIpF,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAErE;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,OAAO,GACf,UAAU,GAAG,IAAI,CAQnB"}

package/dist/adapters/registry.js

@@ -0,0 +1,18 @@
+import { claudeCodeAdapter } from "./claude-code.js";
+const adapters = [claudeCodeAdapter];
+export function listRuntimeAdapters() {
+    return adapters.map((adapter) => adapter.runtime);
+}
+export function getRuntimeAdapter(name) {
+    return adapters.find((adapter) => adapter.runtime === name) ?? null;
+}
+export function adaptRuntimePayload(adapterName, phase, payload) {
+    const adapter = getRuntimeAdapter(adapterName);
+    if (!adapter) {
+        return null;
+    }
+    return phase === "post"
+        ? adapter.fromPostToolUse(payload)
+        : adapter.fromPreToolUse(payload);
+}
+//# sourceMappingURL=registry.js.map

package/dist/adapters/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/adapters/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,MAAM,QAAQ,GAAqB,CAAC,iBAAiB,CAAC,CAAC;AAEvD,MAAM,UAAU,mBAAmB;IACjC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,WAAmB,EACnB,KAAmB,EACnB,OAAgB;IAEhB,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,KAAK,MAAM;QACrB,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC;QAClC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC"}

package/dist/audit/logger.d.ts

@@ -1,9 +1,10 @@
-import type { AuditEntry, AuthorizationAction, HookInput } from "../policy/types.js";
+import type { AuditEntry, AuthorizationAction } from "../policy/types.js";
+import type { ToolAction } from "../runtime/types.js";
 export declare function computeCommitment(tool: string, decision: "allow" | "deny", ts: string, prev?: string, ruleMatched?: string | null, inputSummary?: string): string;
-export declare function summarizeInput(input: HookInput): string;
+export declare function summarizeInput(input: ToolAction): string;
 export declare function auditDir(agentId: string): string;
 export declare function getLastCommitment(agentId: string): string;
 export declare function appendAuditEntry(agentId: string, entry: AuditEntry): void;
-export declare function buildEntry(input: HookInput, decision: "allow" | "deny", ruleMatched: string | null, prevCommitment?: string): AuditEntry;
-export declare function extractAuthorizationAction(input: HookInput): AuthorizationAction | undefined;
+export declare function buildEntry(input: ToolAction, decision: "allow" | "deny", ruleMatched: string | null, prevCommitment?: string): AuditEntry;
+export declare function extractAuthorizationAction(input: ToolAction): AuthorizationAction | undefined;
 //# sourceMappingURL=logger.d.ts.map

package/dist/audit/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAMrF,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,GAAG,MAAM,EAC1B,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAY,EAClB,WAAW,GAAE,MAAM,GAAG,IAAW,EACjC,YAAY,GAAE,MAAW,GACxB,MAAM,CAIR;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAGvD;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGhD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAYzD;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAIzE;AAED,wBAAgB,UAAU,CACxB,KAAK,EAAE,SAAS,EAChB,QAAQ,EAAE,OAAO,GAAG,MAAM,EAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,cAAc,GAAE,MAAY,GAC3B,UAAU,CAgBZ;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,SAAS,GAAG,mBAAmB,GAAG,SAAS,CAsB5F"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAMtD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,GAAG,MAAM,EAC1B,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAY,EAClB,WAAW,GAAE,MAAM,GAAG,IAAW,EACjC,YAAY,GAAE,MAAW,GACxB,MAAM,CAIR;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAGxD;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGhD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAYzD;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAIzE;AAED,wBAAgB,UAAU,CACxB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,OAAO,GAAG,MAAM,EAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,cAAc,GAAE,MAAY,GAC3B,UAAU,CAgBZ;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,UAAU,GAAG,mBAAmB,GAAG,SAAS,CAsB7F"}

package/dist/audit/logger.js

@@ -2,17 +2,17 @@ import { createHash } from "node:crypto";
 import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { auditDirForDate } from "./paths.js";
-// Phase 0: SHA-256 commitment placeholder.
+// Phase 0: SHA-256 audit commitment.
 // Chains on fields stored in the log (tool, decision, ts, prev) so the chain
 // is verifiable from the JSONL file alone without replaying tool_input.
-// Phase 1 replaces this with a Poseidon hash over the full action witness via WASM.
+// A future proof bridge can add Poseidon commitments over the full action witness.
 export function computeCommitment(tool, decision, ts, prev = "0", ruleMatched = null, inputSummary = "") {
     return createHash("sha256")
         .update(JSON.stringify({ tool, decision, ts, ruleMatched, inputSummary, prev }))
         .digest("hex");
 }
 export function summarizeInput(input) {
-    const raw = JSON.stringify(input.tool_input);
+    const raw = JSON.stringify(input.toolInput);
     return raw.length > 200 ? raw.slice(0, 200) + "…" : raw;
 }
 export function auditDir(agentId) {
@@ -44,10 +44,10 @@ export function buildEntry(input, decision, ruleMatched, prevCommitment = "0") {
     const inputSummary = summarizeInput(input);
     const entry = {
         ts,
-        tool: input.tool_name,
+        tool: input.toolName,
         decision,
         rule_matched: ruleMatched,
-        commitment: computeCommitment(input.tool_name, decision, ts, prevCommitment, ruleMatched, inputSummary),
+        commitment: computeCommitment(input.toolName, decision, ts, prevCommitment, ruleMatched, inputSummary),
         input_summary: inputSummary,
     };
     const authorization = extractAuthorizationAction(input);
@@ -57,7 +57,7 @@ export function buildEntry(input, decision, ruleMatched, prevCommitment = "0") {
     return entry;
 }
 export function extractAuthorizationAction(input) {
-    const candidate = input.tool_input.catp_authorization ?? input.tool_input.authorization;
+    const candidate = input.toolInput.catp_authorization ?? input.toolInput.authorization;
     if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
         return undefined;
     }

package/dist/audit/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG7C,2CAA2C;AAC3C,6EAA6E;AAC7E,wEAAwE;AACxE,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,QAA0B,EAC1B,EAAU,EACV,OAAe,GAAG,EAClB,cAA6B,IAAI,EACjC,eAAuB,EAAE;IAEzB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;SAC/E,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAgB;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7C,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QACrD,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC;QACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAe,CAAC;QACjD,OAAO,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,KAAiB;IACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,KAAgB,EAChB,QAA0B,EAC1B,WAA0B,EAC1B,iBAAyB,GAAG;IAE5B,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAe;QACxB,EAAE;QACF,IAAI,EAAE,KAAK,CAAC,SAAS;QACrB,QAAQ;QACR,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,CAAC;QACvG,aAAa,EAAE,YAAY;KAC5B,CAAC;IACF,MAAM,aAAa,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAgB;IACzD,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,kBAAkB,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;IACxF,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,SAAoC,CAAC;IACnD,IACE,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC;QACnC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,EAC9B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AAChE,CAAC"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/audit/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAI7C,qCAAqC;AACrC,6EAA6E;AAC7E,wEAAwE;AACxE,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,QAA0B,EAC1B,EAAU,EACV,OAAe,GAAG,EAClB,cAA6B,IAAI,EACjC,eAAuB,EAAE;IAEzB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;SAC/E,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QACrD,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC;QACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAe,CAAC;QACjD,OAAO,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,KAAiB;IACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,KAAiB,EACjB,QAA0B,EAC1B,WAA0B,EAC1B,iBAAyB,GAAG;IAE5B,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAe;QACxB,EAAE;QACF,IAAI,EAAE,KAAK,CAAC,QAAQ;QACpB,QAAQ;QACR,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,CAAC;QACtG,aAAa,EAAE,YAAY;KAC5B,CAAC;IACF,MAAM,aAAa,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,aAAa,GAAG,aAAa,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAiB;IAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,kBAAkB,IAAI,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC;IACtF,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,SAAoC,CAAC;IACnD,IACE,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC;QACnC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,EAC9B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AAChE,CAAC"}

package/dist/cli.js

@@ -3,6 +3,7 @@ import { createRequire } from "node:module";
 import { Command } from "commander";
 import { runPreHook } from "./hook/pre.js";
 import { runPostHook } from "./hook/post.js";
+import { formatSupportedRuntimeAdapters, getRuntimeAdapter, supportedRuntimeAdapters } from "./adapters/index.js";
 import { cmdInit } from "./commands/init.js";
 import { cmdValidate } from "./commands/validate.js";
 import { cmdLogShow, cmdLogVerify } from "./commands/log.js";
@@ -19,6 +20,7 @@ program
 program
     .command("init")
     .description("Scaffold a catp-policy.toml in the current directory")
+    .option("--authorization", "include example authorization_groth16_v1 policy fields")
     .action(cmdInit);
 program
     .command("validate")
@@ -26,14 +28,34 @@ program
     .option("-f, --file <path>", "path to policy file (default: auto-discover)")
     .action(cmdValidate);
 const hook = program.command("hook").description("Hook handlers called by agent frameworks");
+function resolveHookAdapter(runtime) {
+    const adapter = getRuntimeAdapter(runtime);
+    if (!adapter) {
+        process.stderr.write(`catp: unsupported runtime adapter "${runtime}". Supported: ${supportedRuntimeAdapters().join(", ")}\n`);
+        process.exit(0);
+    }
+    return adapter;
+}
+hook
+    .command("runtimes")
+    .description("List supported runtime adapter ids")
+    .action(() => {
+    process.stdout.write(formatSupportedRuntimeAdapters());
+});
 hook
     .command("pre")
     .description("PreToolUse handler — reads stdin JSON, allows or blocks")
-    .action(() => { runPreHook().catch(() => process.exit(0)); });
+    .option("--runtime <id>", "runtime adapter id", "claude-code")
+    .action((opts) => {
+    runPreHook({ adapter: resolveHookAdapter(opts.runtime) }).catch(() => process.exit(0));
+});
 hook
     .command("post")
     .description("PostToolUse handler — reads stdin JSON, records to audit log")
-    .action(() => { runPostHook().catch(() => process.exit(0)); });
+    .option("--runtime <id>", "runtime adapter id", "claude-code")
+    .action((opts) => {
+    runPostHook({ adapter: resolveHookAdapter(opts.runtime) }).catch(() => process.exit(0));
+});
 const log = program.command("log").description("Audit log commands");
 log
     .command("show")

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAE5F,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAEtE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,MAAM,CAAC;KACZ,WAAW,CAAC,sEAAsE,CAAC;KACnF,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,sDAAsD,CAAC;KACnE,MAAM,CAAC,OAAO,CAAC,CAAC;AAEnB,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,kCAAkC,CAAC;KAC/C,MAAM,CAAC,mBAAmB,EAAE,8CAA8C,CAAC;KAC3E,MAAM,CAAC,WAAW,CAAC,CAAC;AAEvB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;AAE7F,IAAI;KACD,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,yDAAyD,CAAC;KACtE,MAAM,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhE,IAAI;KACD,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,8DAA8D,CAAC;KAC3E,MAAM,CAAC,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjE,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;AAErE,GAAG;KACA,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,kCAAkC,CAAC;KAC/C,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,IAAI,CAAC;KAC1D,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC;KAC9D,MAAM,CAAC,UAAU,CAAC,CAAC;AAEtB,GAAG;KACA,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,mCAAmC,CAAC;KAChD,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC;KAC9D,MAAM,CAAC,YAAY,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,gEAAgE,CAAC;KAC7E,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC;KAC9D,MAAM,CAAC,WAAW,EAAE,sDAAsD,CAAC;KAC3E,MAAM,CAAC,SAAS,CAAC,CAAC;AAErB,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,uEAAuE,CAAC;KACpF,MAAM,CAAC,iBAAiB,EAAE,gCAAgC,CAAC;KAC3D,MAAM,CAAC,0BAA0B,EAAE,4CAA4C,CAAC;KAChF,MAAM,CAAC,cAAc,EAAE,6DAA6D,CAAC;KACrF,MAAM,CAAC,mBAAmB,EAAE,mDAAmD,CAAC;KAChF,MAAM,CAAC,cAAc,EAAE,8CAA8C,CAAC;KACtE,MAAM,CAAC,2BAA2B,EAAE,kCAAkC,CAAC;KACvE,MAAM,CAAC,0BAA0B,EAAE,iCAAiC,CAAC;KACrE,MAAM,CAAC,UAAU,CAAC,CAAC;AAEtB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;AAE3F,KAAK;KACF,OAAO,CAAC,eAAe,CAAC;KACxB,WAAW,CAAC,qFAAqF,CAAC;KAClG,MAAM,CAAC,mBAAmB,EAAE,uDAAuD,CAAC;KACpF,MAAM,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;KAC5D,MAAM,CAAC,0BAA0B,EAAE,2CAA2C,CAAC;KAC/E,MAAM,CAAC,cAAc,EAAE,6DAA6D,CAAC;KACrF,MAAM,CAAC,mBAAmB,EAAE,mDAAmD,CAAC;KAChF,MAAM,CAAC,2BAA2B,EAAE,kCAAkC,CAAC;KACvE,MAAM,CAAC,0BAA0B,EAAE,iCAAiC,CAAC;KACrE,MAAM,CAAC,uBAAuB,EAAE,4CAA4C,CAAC;KAC7E,MAAM,CAAC,sBAAsB,EAAE,0CAA0C,CAAC;KAC1E,MAAM,CAAC,wBAAwB,EAAE,iCAAiC,CAAC;KACnE,MAAM,CAAC,qBAAqB,EAAE,iEAAiE,CAAC;KAChG,MAAM,CAAC,sBAAsB,EAAE,gDAAgD,CAAC;KAChF,MAAM,CAAC,8BAA8B,EAAE,yBAAyB,CAAC;KACjE,MAAM,CAAC,iBAAiB,EAAE,sCAAsC,CAAC;KACjE,MAAM,CAAC,mBAAmB,EAAE,uDAAuD,CAAC;KACpF,MAAM,CAAC,cAAc,EAAE,qDAAqD,CAAC;KAC7E,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAEjC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC;AAEpF,MAAM;KACH,OAAO,CAAC,eAAe,CAAC;KACxB,WAAW,CAAC,0CAA0C,CAAC;KACvD,cAAc,CAAC,mBAAmB,EAAE,mCAAmC,CAAC;KACxE,MAAM,CAAC,eAAe,EAAE,0DAA0D,CAAC;KACnF,MAAM,CAAC,oBAAoB,EAAE,mCAAmC,CAAC;KACjE,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAElC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAU,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;IAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAClH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAE5F,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAEtE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,MAAM,CAAC;KACZ,WAAW,CAAC,sEAAsE,CAAC;KACnF,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,sDAAsD,CAAC;KACnE,MAAM,CAAC,iBAAiB,EAAE,wDAAwD,CAAC;KACnF,MAAM,CAAC,OAAO,CAAC,CAAC;AAEnB,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,kCAAkC,CAAC;KAC/C,MAAM,CAAC,mBAAmB,EAAE,8CAA8C,CAAC;KAC3E,MAAM,CAAC,WAAW,CAAC,CAAC;AAEvB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;AAE7F,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,OAAO,iBAAiB,wBAAwB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9H,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,IAAI;KACD,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,oCAAoC,CAAC;KACjD,MAAM,CAAC,GAAG,EAAE;IACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,CAAC,CAAC;AACzD,CAAC,CAAC,CAAC;AAEL,IAAI;KACD,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,yDAAyD,CAAC;KACtE,MAAM,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,aAAa,CAAC;KAC7D,MAAM,CAAC,CAAC,IAAyB,EAAE,EAAE;IACpC,UAAU,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC;AAEL,IAAI;KACD,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,8DAA8D,CAAC;KAC3E,MAAM,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,aAAa,CAAC;KAC7D,MAAM,CAAC,CAAC,IAAyB,EAAE,EAAE;IACpC,WAAW,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC,CAAC,CAAC;AAEL,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;AAErE,GAAG;KACA,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,kCAAkC,CAAC;KAC/C,MAAM,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,IAAI,CAAC;KAC1D,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC;KAC9D,MAAM,CAAC,UAAU,CAAC,CAAC;AAEtB,GAAG;KACA,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,mCAAmC,CAAC;KAChD,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC;KAC9D,MAAM,CAAC,YAAY,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,gEAAgE,CAAC;KAC7E,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC;KAC9D,MAAM,CAAC,WAAW,EAAE,sDAAsD,CAAC;KAC3E,MAAM,CAAC,SAAS,CAAC,CAAC;AAErB,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,uEAAuE,CAAC;KACpF,MAAM,CAAC,iBAAiB,EAAE,gCAAgC,CAAC;KAC3D,MAAM,CAAC,0BAA0B,EAAE,4CAA4C,CAAC;KAChF,MAAM,CAAC,cAAc,EAAE,6DAA6D,CAAC;KACrF,MAAM,CAAC,mBAAmB,EAAE,mDAAmD,CAAC;KAChF,MAAM,CAAC,cAAc,EAAE,8CAA8C,CAAC;KACtE,MAAM,CAAC,2BAA2B,EAAE,kCAAkC,CAAC;KACvE,MAAM,CAAC,0BAA0B,EAAE,iCAAiC,CAAC;KACrE,MAAM,CAAC,UAAU,CAAC,CAAC;AAEtB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;AAE3F,KAAK;KACF,OAAO,CAAC,eAAe,CAAC;KACxB,WAAW,CAAC,qFAAqF,CAAC;KAClG,MAAM,CAAC,mBAAmB,EAAE,uDAAuD,CAAC;KACpF,MAAM,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;KAC5D,MAAM,CAAC,0BAA0B,EAAE,2CAA2C,CAAC;KAC/E,MAAM,CAAC,cAAc,EAAE,6DAA6D,CAAC;KACrF,MAAM,CAAC,mBAAmB,EAAE,mDAAmD,CAAC;KAChF,MAAM,CAAC,2BAA2B,EAAE,kCAAkC,CAAC;KACvE,MAAM,CAAC,0BAA0B,EAAE,iCAAiC,CAAC;KACrE,MAAM,CAAC,uBAAuB,EAAE,4CAA4C,CAAC;KAC7E,MAAM,CAAC,sBAAsB,EAAE,0CAA0C,CAAC;KAC1E,MAAM,CAAC,wBAAwB,EAAE,iCAAiC,CAAC;KACnE,MAAM,CAAC,qBAAqB,EAAE,iEAAiE,CAAC;KAChG,MAAM,CAAC,sBAAsB,EAAE,gDAAgD,CAAC;KAChF,MAAM,CAAC,8BAA8B,EAAE,yBAAyB,CAAC;KACjE,MAAM,CAAC,iBAAiB,EAAE,sCAAsC,CAAC;KACjE,MAAM,CAAC,mBAAmB,EAAE,uDAAuD,CAAC;KACpF,MAAM,CAAC,cAAc,EAAE,qDAAqD,CAAC;KAC7E,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAEjC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC;AAEpF,MAAM;KACH,OAAO,CAAC,eAAe,CAAC;KACxB,WAAW,CAAC,0CAA0C,CAAC;KACvD,cAAc,CAAC,mBAAmB,EAAE,mCAAmC,CAAC;KACxE,MAAM,CAAC,eAAe,EAAE,0DAA0D,CAAC;KACnF,MAAM,CAAC,oBAAoB,EAAE,mCAAmC,CAAC;KACjE,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAElC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAU,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;IAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/commands/anchor.js

@@ -54,21 +54,21 @@ export function merkleRoot(commitments) {
     if (commitments.length === 0) {
         return `0x${"00".repeat(32)}`;
     }
-    let layer = commitments.map((c) => {
+    let level = commitments.map((c) => {
         const b = Buffer.from(c, "hex");
         return b.length === 32 ? b : createHash("sha256").update(c).digest();
     });
-    while (layer.length > 1) {
-        if (layer.length % 2 !== 0) {
-            layer.push(layer[layer.length - 1]);
+    while (level.length > 1) {
+        if (level.length % 2 !== 0) {
+            level.push(level[level.length - 1]);
         }
         const next = [];
-        for (let i = 0; i < layer.length; i += 2) {
-            next.push(createHash("sha256").update(layer[i]).update(layer[i + 1]).digest());
+        for (let i = 0; i < level.length; i += 2) {
+            next.push(createHash("sha256").update(level[i]).update(level[i + 1]).digest());
         }
-        layer = next;
+        level = next;
     }
-    return `0x${layer[0].toString("hex")}`;
+    return `0x${level[0].toString("hex")}`;
 }
 async function submitOnChain(root, rpcUrl, privateKey, contractAddress) {
     const { createPublicClient, createWalletClient, http, defineChain } = await import("viem");

package/dist/commands/authorization.d.ts

@@ -65,4 +65,9 @@ export declare function cmdVerifyAuthorization(opts: {
     checkAudit?: boolean;
     auditAgent?: string;
 }): void;
+export declare function formatAuthorizationManifestSummary(manifest: AuthorizationProofManifest, opts?: {
+    extraLines?: string[];
+    includeStatus?: boolean;
+    manifestPath?: string;
+}): string;
 //# sourceMappingURL=authorization.d.ts.map

package/dist/commands/authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../src/commands/authorization.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC,eAAe,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,eAAe,EAAE,sCAAsC,CAAC;IACxD,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,0BAA0B,EACpC,IAAI,GAAE;IACJ,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACpB,GACL,0BAA0B,CAqC5B;AAED,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,0BAA0B,GAAG,IAAI,CA6B7F;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,IAAI,CA2CP;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAWA;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA8BnH"}
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../src/commands/authorization.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC,eAAe,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,eAAe,EAAE,sCAAsC,CAAC;IACxD,YAAY,EAAE,0BAA0B,CAAC;IACzC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,0BAA0B,EACpC,IAAI,GAAE;IACJ,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACpB,GACL,0BAA0B,CAwC5B;AAED,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,0BAA0B,GAAG,IAAI,CAgC7F;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,IAAI,CA4CP;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAeA;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA+BnH;AAED,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,0BAA0B,EACpC,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GACnF,MAAM,CA2BR"}

package/dist/commands/authorization.js

@@ -6,6 +6,12 @@ import { buildGroth16WitnessFromSources } from "./witness.js";
 import { auditRoot } from "../audit/paths.js";
 import { findPolicyFile, loadPolicy } from "../policy/loader.js";
 const PROOF_VERSION = "authorization_groth16_v1";
+const ACTION_TYPE = {
+    swap: "0",
+    transfer: "1",
+    deposit: "2",
+    withdraw: "3",
+};
 export function buildAuthorizationProofManifest(artifact, opts = {}) {
     validateGroth16Artifact(artifact);
     if (opts.auditCommitment !== undefined) {
@@ -23,6 +29,9 @@ export function buildAuthorizationProofManifest(artifact, opts = {}) {
     if (opts.chainId !== undefined && !/^[0-9]+$/.test(opts.chainId)) {
         throw new Error("chainId must be a decimal integer string");
     }
+    if (opts.proofUrl !== undefined) {
+        assertProofUrl(opts.proofUrl, "proofUrl");
+    }
     return {
         manifestVersion: "catp_authorization_proof_manifest_v1",
         proofVersion: PROOF_VERSION,
@@ -71,6 +80,9 @@ export function validateAuthorizationProofManifest(manifest) {
     if (manifest.chainId !== null && !/^[0-9]+$/.test(manifest.chainId)) {
         throw new Error("chainId must be a decimal integer string");
     }
+    if (manifest.proofUrl !== null) {
+        assertProofUrl(manifest.proofUrl, "proofUrl");
+    }
 }
 export function cmdProveAuthorization(opts) {
     if (opts.artifact && opts.action) {
@@ -104,6 +116,7 @@ export function cmdProveAuthorization(opts) {
         if (opts.out) {
             writeFileSync(opts.out, encoded, "utf8");
             process.stdout.write(`Wrote authorization proof manifest to ${opts.out}\n`);
+            process.stdout.write(formatAuthorizationManifestSummary(manifest, { includeStatus: false, manifestPath: opts.out }));
         }
         else {
             process.stdout.write(encoded);
@@ -123,10 +136,14 @@ export function readDeploymentMetadata(path) {
     const verifier = optionalString(parsed.groth16AuthorizationVerifier, "deployment.groth16AuthorizationVerifier");
     const agentAuthorizer = optionalString(parsed.agentAuthorizer, "deployment.agentAuthorizer");
     const chainId = optionalIntegerString(parsed.chainId, "deployment.chainId");
+    const proofVersion = optionalString(parsed.authorizationProofVersion, "deployment.authorizationProofVersion");
     if (verifier !== undefined)
         assertAddress(verifier, "deployment.groth16AuthorizationVerifier");
     if (agentAuthorizer !== undefined)
         assertAddress(agentAuthorizer, "deployment.agentAuthorizer");
+    if (proofVersion !== undefined && proofVersion !== PROOF_VERSION) {
+        throw new Error(`deployment.authorizationProofVersion must be ${PROOF_VERSION}`);
+    }
     return { verifier, agentAuthorizer, chainId };
 }
 export function cmdVerifyAuthorization(opts) {
@@ -138,12 +155,7 @@ export function cmdVerifyAuthorization(opts) {
     }
     const manifest = JSON.parse(readFileSync(opts.manifest, "utf8"));
     validateAuthorizationProofManifest(manifest);
-    const lines = [
-        "Authorization proof manifest is structurally valid.",
-        `proofVersion=${manifest.proofVersion}`,
-        `policyCommitment=${manifest.policyCommitment}`,
-        `auditCommitment=${manifest.auditCommitment ?? "none"}`,
-    ];
+    const extraLines = [];
     if (opts.checkAudit) {
         const auditAgent = opts.auditAgent ?? manifest.auditAgent;
         if (!manifest.auditCommitment) {
@@ -152,12 +164,47 @@ export function cmdVerifyAuthorization(opts) {
         if (!auditAgent) {
             throw new Error("missing --audit-agent <id>; manifest does not include auditAgent");
         }
-        if (!findAuditEntry(auditAgent, manifest.auditCommitment)) {
+        const entry = findAuditEntry(auditAgent, manifest.auditCommitment);
+        if (!entry) {
             throw new Error(`No audit entry found for commitment ${manifest.auditCommitment}`);
         }
-        lines.push(`auditEntry=found:${auditAgent}`);
+        validateAuditEntryMatchesManifest(entry, manifest);
+        extraLines.push(`auditEntry=found:${auditAgent}`);
+        extraLines.push("auditAction=matched");
+    }
+    process.stdout.write(formatAuthorizationManifestSummary(manifest, {
+        extraLines,
+        includeStatus: true,
+    }));
+}
+export function formatAuthorizationManifestSummary(manifest, opts = {}) {
+    const lines = [
+        ...(opts.includeStatus === false ? [] : ["Authorization proof manifest is structurally valid."]),
+        `proofVersion=${manifest.proofVersion}`,
+        `policyCommitment=${manifest.policyCommitment}`,
+        `value=${manifest.value}`,
+        `currentTimestamp=${manifest.currentTimestamp}`,
+        `cumulativeSpend=${manifest.cumulativeSpend}`,
+        `chainId=${manifest.chainId ?? "none"}`,
+        `verifier=${manifest.verifier ?? "none"}`,
+        `agentAuthorizer=${manifest.agentAuthorizer ?? "none"}`,
+        `auditCommitment=${manifest.auditCommitment ?? "none"}`,
+        `auditAgent=${manifest.auditAgent ?? "none"}`,
+        `sourceArtifact=${manifest.sourceArtifact ?? "none"}`,
+        `proofUrl=${manifest.proofUrl ?? "none"}`,
+        ...(opts.extraLines ?? []),
+        "cryptographicVerification=external:EVM-or-offchain-verifier",
+    ];
+    if (manifest.agentAuthorizer) {
+        lines.push("next=Use the proof artifact with AgentAuthorizer.executeAuthorized or npm run groth16:execute.");
     }
-    process.stdout.write(`${lines.join("\n")}\n`);
+    else {
+        lines.push("next=Attach deployment metadata to execute this proof on-chain.");
+    }
+    if (opts.manifestPath) {
+        lines.push(`verifyCommand=catp verify authorization --manifest ${opts.manifestPath}${manifest.auditCommitment ? " --check-audit" : ""}`);
+    }
+    return `${lines.join("\n")}\n`;
 }
 function validateGroth16Artifact(artifact) {
     if (artifact.proofVersion !== PROOF_VERSION) {
@@ -165,6 +212,9 @@ function validateGroth16Artifact(artifact) {
     }
     assertBytes32(artifact.policyCommitment, "policyCommitment");
     assertHex(artifact.actionData, "actionData");
+    if (hexByteLength(artifact.actionData) !== 128) {
+        throw new Error("actionData must be 128 bytes");
+    }
     assertHex(artifact.proof, "proof");
     if (hexByteLength(artifact.proof) !== 256) {
         throw new Error("proof must be 256 bytes");
@@ -190,6 +240,7 @@ function validateGroth16Artifact(artifact) {
     if (normalizeU64(artifact.publicInputs[12], "publicInputs[12]") !== cumulativeSpend) {
         throw new Error("publicInputs[12] must equal cumulativeSpend");
     }
+    validateActionDataMatchesPublicInputs(artifact.actionData, artifact.publicInputs);
 }
 function generateGroth16Artifact(opts) {
     if (!opts.action && !opts.auditCommitment) {
@@ -205,7 +256,10 @@ function generateGroth16Artifact(opts) {
     if (!existsSync(proverScript)) {
         if (cleanupDir)
             rmSync(cleanupDir, { recursive: true, force: true });
-        throw new Error(`prover script not found: ${proverScript}`);
+        throw new Error(`prover script not found: ${proverScript}. ` +
+            "Full Groth16 proof generation requires a CATP repository checkout; " +
+            "the npm CLI package only includes local enforcement, audit logs, witness generation, and manifest tooling. " +
+            "Run this command from the repository root or pass --prover-script <path>.");
     }
     const witness = buildGroth16WitnessFromSources({
         action: opts.action,
@@ -222,6 +276,7 @@ function generateGroth16Artifact(opts) {
         witnessPath,
         "--out",
         artifactPath,
+        "--proof-only",
     ], { stdio: "inherit" });
     return { artifactPath, cleanupDir };
 }
@@ -258,6 +313,91 @@ function findAuditEntry(agentId, commitment) {
     }
     return null;
 }
+function validateAuditEntryMatchesManifest(entry, manifest) {
+    if (!entry.authorization) {
+        throw new Error(`Audit entry ${entry.commitment} does not contain authorization action data`);
+    }
+    const expectedActionData = encodeAuthorizationAction(entry.authorization);
+    if (expectedActionData.toLowerCase() !== manifest.actionData.toLowerCase()) {
+        throw new Error("manifest actionData does not match audit authorization action");
+    }
+    const auditValue = normalizeU64(entry.authorization.value, "audit.authorization.value");
+    if (auditValue !== manifest.value) {
+        throw new Error("manifest value does not match audit authorization action");
+    }
+    if (entry.authorization.currentTimestamp !== undefined) {
+        const auditTimestamp = normalizeU64(entry.authorization.currentTimestamp, "audit.authorization.currentTimestamp");
+        if (auditTimestamp !== manifest.currentTimestamp) {
+            throw new Error("manifest currentTimestamp does not match audit authorization action");
+        }
+    }
+    if (entry.authorization.cumulativeSpend !== undefined) {
+        const auditSpend = normalizeU64(entry.authorization.cumulativeSpend, "audit.authorization.cumulativeSpend");
+        if (auditSpend !== manifest.cumulativeSpend) {
+            throw new Error("manifest cumulativeSpend does not match audit authorization action");
+        }
+    }
+}
+function validateActionDataMatchesPublicInputs(actionData, publicInputs) {
+    const decoded = decodeActionData(actionData);
+    if (decoded.actionType !== normalizeU64(publicInputs[1], "publicInputs[1]")) {
+        throw new Error("actionData actionType must equal publicInputs[1]");
+    }
+    for (const [index, limb] of decoded.protocol.entries()) {
+        if (limb !== normalizeU64(publicInputs[2 + index], `publicInputs[${2 + index}]`)) {
+            throw new Error(`actionData protocol limb ${index} must equal publicInputs[${2 + index}]`);
+        }
+    }
+    for (const [index, limb] of decoded.token.entries()) {
+        if (limb !== normalizeU64(publicInputs[6 + index], `publicInputs[${6 + index}]`)) {
+            throw new Error(`actionData token limb ${index} must equal publicInputs[${6 + index}]`);
+        }
+    }
+    if (decoded.value !== normalizeU64(publicInputs[10], "publicInputs[10]")) {
+        throw new Error("actionData value must equal publicInputs[10]");
+    }
+}
+function decodeActionData(actionData) {
+    const clean = actionData.slice(2);
+    const actionType = BigInt(`0x${clean.slice(0, 64)}`).toString();
+    const protocol = decodeLeU64Limbs(clean.slice(64, 128));
+    const token = decodeLeU64Limbs(clean.slice(128, 192));
+    const value = BigInt(`0x${clean.slice(192, 256)}`).toString();
+    return { actionType, protocol, token, value };
+}
+function decodeLeU64Limbs(wordHex) {
+    const limbs = [];
+    for (let limbIndex = 0; limbIndex < 4; limbIndex += 1) {
+        const offset = limbIndex * 16;
+        let value = 0n;
+        for (let byteIndex = 0; byteIndex < 8; byteIndex += 1) {
+            const byteHex = wordHex.slice(offset + byteIndex * 2, offset + byteIndex * 2 + 2);
+            value |= BigInt(`0x${byteHex}`) << BigInt(8 * byteIndex);
+        }
+        limbs.push(value.toString());
+    }
+    return limbs;
+}
+function encodeAuthorizationAction(action) {
+    const actionType = normalizeAuthorizationActionType(action.actionType, "audit.authorization.actionType");
+    const value = normalizeU64(action.value, "audit.authorization.value");
+    assertBytes32(action.protocol, "audit.authorization.protocol");
+    assertBytes32(action.token, "audit.authorization.token");
+    return `0x${u256Hex(actionType)}${action.protocol.slice(2)}${action.token.slice(2)}${u256Hex(value)}`;
+}
+function normalizeAuthorizationActionType(value, field) {
+    if (typeof value === "string" && ACTION_TYPE[value.toLowerCase()] !== undefined) {
+        return ACTION_TYPE[value.toLowerCase()];
+    }
+    const parsed = normalizeU64(value, field);
+    if (!["0", "1", "2", "3"].includes(parsed)) {
+        throw new Error(`${field} must be Swap, Transfer, Deposit, Withdraw, or 0..3`);
+    }
+    return parsed;
+}
+function u256Hex(value) {
+    return BigInt(value).toString(16).padStart(64, "0");
+}
 function normalizeIntegerString(value, field) {
     return normalizeU64(value, field);
 }
@@ -336,6 +476,23 @@ function assertAddress(value, field) {
         throw new Error(`${field} must be an EVM address`);
     }
 }
+function assertProofUrl(value, field) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new Error(`${field} must be a valid URL`);
+    }
+    if (parsed.protocol === "https:" || parsed.protocol === "ipfs:" || parsed.protocol === "ar:") {
+        return;
+    }
+    if (parsed.protocol === "http:" &&
+        (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "::1" || parsed.hostname === "[::1]")) {
+        return;
+    }
+    throw new Error(`${field} must use https, ipfs, ar, or localhost http`);
+}
 function hexByteLength(value) {
     return (value.length - 2) / 2;
 }