@catp-protocol/cli 0.2.1 → 0.3.0

package/dist/commands/log.js

@@ -1,4 +1,5 @@
-import { readFileSync, readdirSync, existsSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { readFileSync, readdirSync, existsSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { auditRoot } from "../audit/paths.js";
 import { findPolicyFile, loadPolicy } from "../policy/loader.js";
@@ -22,14 +23,14 @@ function latestLogFile(agentId) {
         return null;
     return join(base, dates[0], "actions.jsonl");
 }
-function allLogFiles(agentId) {
+export function auditLogFiles(agentId) {
     const base = auditRoot(agentId);
     if (!existsSync(base))
         return [];
     return readdirSync(base)
         .sort()
-        .map((date) => join(base, date, "actions.jsonl"))
-        .filter((file) => existsSync(file));
+        .map((date) => ({ date, file: join(base, date, "actions.jsonl") }))
+        .filter(({ file }) => existsSync(file));
 }
 export function cmdLogShow(opts) {
     const agentId = resolveAgentId(opts);
@@ -47,6 +48,9 @@ export function cmdLogShow(opts) {
             const icon = e.decision === "allow" ? "✓" : "✗";
             const rule = e.rule_matched ? ` [${e.rule_matched}]` : "";
             process.stdout.write(`${icon} ${e.ts}  ${e.tool}${rule}\n    ${e.input_summary}\n`);
+            if (opts.commitments) {
+                process.stdout.write(`    commitment=${e.commitment}\n`);
+            }
         }
         catch {
             process.stdout.write(`? ${line}\n`);
@@ -56,20 +60,91 @@ export function cmdLogShow(opts) {
 }
 export async function cmdLogVerify(opts) {
     const agentId = resolveAgentId(opts);
-    const logFiles = allLogFiles(agentId);
+    const logFiles = auditLogFiles(agentId);
     if (logFiles.length === 0) {
         process.stdout.write(`No audit log found for agent "${agentId}"\n`);
         return;
     }
     let checked = 0;
-    for (const logFile of logFiles) {
-        const result = await verifyChain(logFile);
+    for (const { file } of logFiles) {
+        const result = await verifyChain(file);
         checked += result.checked;
         if (!result.ok) {
-            process.stderr.write(`✗ Chain broken in ${logFile} at entry ${result.broken_at}: ${result.message}\n`);
+            process.stderr.write(`✗ Chain broken in ${file} at entry ${result.broken_at}: ${result.message}\n`);
             process.exit(1);
         }
     }
     process.stdout.write(`✓ Chain intact — ${checked} entries verified across ${logFiles.length} log file(s)\n`);
 }
+export function cmdLogExport(opts) {
+    if (!opts.commitment) {
+        throw new Error("missing --commitment <hex>");
+    }
+    assertCommitment(opts.commitment);
+    const agentId = resolveAgentId(opts);
+    const auditExport = buildAuditExport(agentId, opts.commitment);
+    const json = stableStringify(auditExport, 2) + "\n";
+    if (opts.out) {
+        writeFileSync(opts.out, json, "utf8");
+        process.stdout.write(`Wrote audit export to ${opts.out}\n`);
+        process.stdout.write(`commitment=${auditExport.commitment}\n`);
+        process.stdout.write(`entrySha256=${auditExport.entrySha256}\n`);
+        return;
+    }
+    process.stdout.write(json);
+}
+export function buildAuditExport(agentId, commitment) {
+    assertCommitment(commitment);
+    const found = findAuditEntry(agentId, commitment);
+    if (!found) {
+        throw new Error(`No audit entry found for commitment ${commitment}`);
+    }
+    return {
+        exportVersion: "catp_audit_export_v1",
+        agentId,
+        logDate: found.date,
+        entryIndex: found.index,
+        commitment: found.entry.commitment,
+        entrySha256: sha256Hex(stableStringify(found.entry)),
+        entry: found.entry,
+    };
+}
+function findAuditEntry(agentId, commitment) {
+    for (const { date, file } of auditLogFiles(agentId)) {
+        const lines = readFileSync(file, "utf8").split("\n").filter(Boolean);
+        for (const [index, line] of lines.entries()) {
+            try {
+                const entry = JSON.parse(line);
+                if (entry.commitment.toLowerCase() === commitment.toLowerCase()) {
+                    return { date, index, entry };
+                }
+            }
+            catch {
+                // skip malformed audit lines; chain verification reports them separately
+            }
+        }
+    }
+    return null;
+}
+function assertCommitment(commitment) {
+    if (!/^[0-9a-fA-F]{64}$/.test(commitment)) {
+        throw new Error("--commitment must be a 64-character hex commitment");
+    }
+}
+function sha256Hex(input) {
+    return createHash("sha256").update(input).digest("hex");
+}
+export function stableStringify(value, spaces = 0) {
+    return JSON.stringify(sortForJson(value), null, spaces);
+}
+function sortForJson(value) {
+    if (Array.isArray(value)) {
+        return value.map(sortForJson);
+    }
+    if (value && typeof value === "object") {
+        const record = value;
+        return Object.fromEntries(Object.keys(record).sort().map((key) => [key, sortForJson(record[key])]));
+    }
+    return value;
+}
 //# sourceMappingURL=log.js.map

package/dist/commands/log.js.map

@@ -1 +1 @@
-{"version":3,"file":"log.js","sourceRoot":"","sources":["../../src/commands/log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGnD,SAAS,cAAc,CAAC,IAAwB;IAC9C,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAClC,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,WAAW,CAAC,IAAI,CAAC;SACrB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;SAChD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAuC;IAChE,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,KAAK,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/E,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;YACzC,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAChD,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,SAAS,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,iBAAiB,OAAO,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAwB;IACzD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,KAAK,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,OAAO,aAAa,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;YACvG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,4BAA4B,QAAQ,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAC/G,CAAC"}
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../../src/commands/log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAanD,SAAS,cAAc,CAAC,IAAwB;IAC9C,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAClC,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;AACzC,CAAC;AAOD,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,WAAW,CAAC,IAAI,CAAC;SACrB,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;SAClE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAA8D;IACvF,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,KAAK,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/E,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;YACzC,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAChD,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,SAAS,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC;YACpF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,iBAAiB,OAAO,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAwB;IACzD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,OAAO,KAAK,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,aAAa,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;YACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,4BAA4B,QAAQ,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAC/G,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAA2D;IACtF,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAElC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAEpD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC;QAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,WAAW,CAAC,WAAW,IAAI,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,UAAkB;IAClE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO;QACL,aAAa,EAAE,sBAAsB;QACrC,OAAO;QACP,OAAO,EAAE,KAAK,CAAC,IAAI;QACnB,UAAU,EAAE,KAAK,CAAC,KAAK;QACvB,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;QAClC,WAAW,EAAE,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,UAAkB;IACzD,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrE,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;gBAC7C,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;oBAChE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;gBAChC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,MAAM,GAAG,CAAC;IACxD,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/commands/receipt.d.ts

@@ -0,0 +1,52 @@
+import { type AuditExport } from "./log.js";
+import type { CatpPolicy } from "../policy/types.js";
+export interface AuthorizationReceiptPayload {
+    receiptVersion: "catp_authorization_receipt_v1";
+    auditExportHash: string;
+    auditCommitment: string;
+    entrySha256: string;
+    agentId: string;
+    tool: string;
+    decision: "allow" | "deny";
+    timestamp: string;
+    policyCommitment: string | null;
+    signedAt: string;
+    signatureAlgorithm: "Ed25519";
+    publicKeyPem: string;
+}
+export interface AuthorizationReceipt extends AuthorizationReceiptPayload {
+    signature: string;
+}
+export declare function cmdReceiptKeygen(opts: {
+    privateKey?: string;
+    publicKey?: string;
+}): void;
+export declare function cmdReceiptSign(opts: {
+    auditExport?: string;
+    privateKey?: string;
+    out?: string;
+    file?: string;
+}): void;
+export declare function cmdReceiptIssue(opts: {
+    commitment?: string;
+    agent?: string;
+    privateKey?: string;
+    out?: string;
+    file?: string;
+    auditExportOut?: string;
+}): Promise<void>;
+export declare function cmdReceiptVerify(opts: {
+    receipt?: string;
+    publicKey?: string;
+    auditExport?: string;
+    file?: string;
+}): void;
+export declare function signAuthorizationReceipt(auditExport: AuditExport, privateKeyPem: string, publicKeyPem: string, opts?: {
+    signedAt?: string;
+    policyCommitment?: string | null;
+}): AuthorizationReceipt;
+export declare function verifyAuthorizationReceipt(receipt: AuthorizationReceipt, publicKeyPem?: string): void;
+export declare function verifyReceiptAuditExport(receipt: AuthorizationReceipt, auditExport: AuditExport): void;
+export declare function verifyReceiptPolicy(receipt: AuthorizationReceipt, policy: CatpPolicy): void;
+export declare function computePolicyCommitment(policy: CatpPolicy): string;
+//# sourceMappingURL=receipt.d.ts.map

package/dist/commands/receipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt.d.ts","sourceRoot":"","sources":["../../src/commands/receipt.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoD,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAG9F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,MAAM,WAAW,2BAA2B;IAC1C,cAAc,EAAE,+BAA+B,CAAC;IAChD,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,SAAS,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAqB,SAAQ,2BAA2B;IACvE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAYxF;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAyBrH;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB;AAoDD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAwB1H;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,WAAW,EACxB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACjE,oBAAoB,CAqBtB;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,oBAAoB,EAAE,YAAY,GAAE,MAA6B,GAAG,IAAI,CAO3H;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI,CAyBtG;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAS3F;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAElE"}

package/dist/commands/receipt.js

@@ -0,0 +1,255 @@
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify } from "node:crypto";
+import { readFileSync, writeFileSync } from "node:fs";
+import { auditLogFiles, buildAuditExport, stableStringify } from "./log.js";
+import { verifyChain } from "../audit/verifier.js";
+import { findPolicyFile, loadPolicy } from "../policy/loader.js";
+export function cmdReceiptKeygen(opts) {
+    const privateKeyPath = opts.privateKey ?? "catp-receipt-private.pem";
+    const publicKeyPath = opts.publicKey ?? "catp-receipt-public.pem";
+    const { privateKey, publicKey } = generateKeyPairSync("ed25519", {
+        privateKeyEncoding: { type: "pkcs8", format: "pem" },
+        publicKeyEncoding: { type: "spki", format: "pem" },
+    });
+    writeFileSync(privateKeyPath, privateKey, { encoding: "utf8", mode: 0o600 });
+    writeFileSync(publicKeyPath, publicKey, "utf8");
+    process.stdout.write(`Wrote private key to ${privateKeyPath}\n`);
+    process.stdout.write(`Wrote public key to ${publicKeyPath}\n`);
+}
+export function cmdReceiptSign(opts) {
+    if (!opts.auditExport) {
+        throw new Error("missing --audit-export <path>");
+    }
+    if (!opts.privateKey) {
+        throw new Error("missing --private-key <path>");
+    }
+    const auditExport = readAuditExport(opts.auditExport);
+    const privateKeyPem = readFileSync(opts.privateKey, "utf8");
+    const publicKeyPem = derivePublicKeyPem(privateKeyPem);
+    const policyCommitment = opts.file ? computePolicyCommitment(loadPolicy(opts.file)) : resolvePolicyCommitmentIfPresent();
+    const receipt = signAuthorizationReceipt(auditExport, privateKeyPem, publicKeyPem, { policyCommitment });
+    const json = stableStringify(receipt, 2) + "\n";
+    if (opts.out) {
+        writeFileSync(opts.out, json, "utf8");
+        process.stdout.write(`Wrote authorization receipt to ${opts.out}\n`);
+        process.stdout.write(`auditCommitment=${receipt.auditCommitment}\n`);
+        process.stdout.write(`auditExportHash=${receipt.auditExportHash}\n`);
+        process.stdout.write(`policyCommitment=${receipt.policyCommitment ?? "none"}\n`);
+        return;
+    }
+    process.stdout.write(json);
+}
+export function cmdReceiptIssue(opts) {
+    return issueReceipt(opts);
+}
+async function issueReceipt(opts) {
+    if (!opts.commitment) {
+        throw new Error("missing --commitment <hex>");
+    }
+    if (!opts.privateKey) {
+        throw new Error("missing --private-key <path>");
+    }
+    const policyPath = opts.file ?? findPolicyFile();
+    const policy = policyPath ? loadPolicy(policyPath) : null;
+    const agentId = opts.agent ?? policy?.agent.id;
+    if (!agentId) {
+        throw new Error("missing --agent <id>; no catp-policy.toml found");
+    }
+    await verifyAuditLogIntegrity(agentId);
+    const auditExport = buildAuditExport(agentId, opts.commitment);
+    const privateKeyPem = readFileSync(opts.privateKey, "utf8");
+    const publicKeyPem = derivePublicKeyPem(privateKeyPem);
+    const receipt = signAuthorizationReceipt(auditExport, privateKeyPem, publicKeyPem, {
+        policyCommitment: policy ? computePolicyCommitment(policy) : null,
+    });
+    if (opts.auditExportOut) {
+        writeFileSync(opts.auditExportOut, stableStringify(auditExport, 2) + "\n", "utf8");
+    }
+    const json = stableStringify(receipt, 2) + "\n";
+    if (opts.out) {
+        writeFileSync(opts.out, json, "utf8");
+        process.stdout.write(`Wrote authorization receipt to ${opts.out}\n`);
+        if (opts.auditExportOut) {
+            process.stdout.write(`Wrote audit export to ${opts.auditExportOut}\n`);
+        }
+        process.stdout.write(`auditCommitment=${receipt.auditCommitment}\n`);
+        process.stdout.write(`auditExportHash=${receipt.auditExportHash}\n`);
+        process.stdout.write(`policyCommitment=${receipt.policyCommitment ?? "none"}\n`);
+        return;
+    }
+    process.stdout.write(json);
+}
+export function cmdReceiptVerify(opts) {
+    if (!opts.receipt) {
+        throw new Error("missing --receipt <path>");
+    }
+    const receipt = readAuthorizationReceipt(opts.receipt);
+    const publicKeyPem = opts.publicKey ? readFileSync(opts.publicKey, "utf8") : receipt.publicKeyPem;
+    verifyAuthorizationReceipt(receipt, publicKeyPem);
+    if (opts.auditExport) {
+        const auditExport = readAuditExport(opts.auditExport);
+        verifyReceiptAuditExport(receipt, auditExport);
+    }
+    if (opts.file) {
+        verifyReceiptPolicy(receipt, loadPolicy(opts.file));
+    }
+    process.stdout.write("authorizationReceipt=valid\n");
+    if (opts.auditExport) {
+        process.stdout.write("auditExport=matched\n");
+    }
+    if (opts.file) {
+        process.stdout.write("policy=matched\n");
+    }
+    process.stdout.write(`auditCommitment=${receipt.auditCommitment}\n`);
+    process.stdout.write(`auditExportHash=${receipt.auditExportHash}\n`);
+    process.stdout.write(`policyCommitment=${receipt.policyCommitment ?? "none"}\n`);
+}
+export function signAuthorizationReceipt(auditExport, privateKeyPem, publicKeyPem, opts = {}) {
+    validateAuditExport(auditExport);
+    if (opts.policyCommitment !== undefined && opts.policyCommitment !== null) {
+        assertHex(opts.policyCommitment, "policyCommitment");
+    }
+    const payload = {
+        receiptVersion: "catp_authorization_receipt_v1",
+        auditExportHash: sha256Hex(stableStringify(auditExport)),
+        auditCommitment: auditExport.commitment,
+        entrySha256: auditExport.entrySha256,
+        agentId: auditExport.agentId,
+        tool: auditExport.entry.tool,
+        decision: auditExport.entry.decision,
+        timestamp: auditExport.entry.ts,
+        policyCommitment: opts.policyCommitment ?? null,
+        signedAt: opts.signedAt ?? new Date().toISOString(),
+        signatureAlgorithm: "Ed25519",
+        publicKeyPem,
+    };
+    const signature = sign(null, Buffer.from(stableStringify(payload)), privateKeyPem).toString("base64");
+    return { ...payload, signature };
+}
+export function verifyAuthorizationReceipt(receipt, publicKeyPem = receipt.publicKeyPem) {
+    validateReceipt(receipt);
+    const { signature, ...payload } = receipt;
+    const ok = verify(null, Buffer.from(stableStringify(payload)), publicKeyPem, Buffer.from(signature, "base64"));
+    if (!ok) {
+        throw new Error("authorization receipt signature is invalid");
+    }
+}
+export function verifyReceiptAuditExport(receipt, auditExport) {
+    validateReceipt(receipt);
+    validateAuditExport(auditExport);
+    const auditExportHash = sha256Hex(stableStringify(auditExport));
+    if (receipt.auditExportHash !== auditExportHash) {
+        throw new Error("receipt auditExportHash does not match audit export");
+    }
+    if (receipt.auditCommitment !== auditExport.commitment) {
+        throw new Error("receipt auditCommitment does not match audit export");
+    }
+    if (receipt.entrySha256 !== auditExport.entrySha256) {
+        throw new Error("receipt entrySha256 does not match audit export");
+    }
+    if (receipt.agentId !== auditExport.agentId) {
+        throw new Error("receipt agentId does not match audit export");
+    }
+    if (receipt.tool !== auditExport.entry.tool) {
+        throw new Error("receipt tool does not match audit export");
+    }
+    if (receipt.decision !== auditExport.entry.decision) {
+        throw new Error("receipt decision does not match audit export");
+    }
+    if (receipt.timestamp !== auditExport.entry.ts) {
+        throw new Error("receipt timestamp does not match audit export");
+    }
+}
+export function verifyReceiptPolicy(receipt, policy) {
+    validateReceipt(receipt);
+    const policyCommitment = computePolicyCommitment(policy);
+    if (receipt.policyCommitment === null) {
+        throw new Error("receipt has no policyCommitment");
+    }
+    if (receipt.policyCommitment !== policyCommitment) {
+        throw new Error("receipt policyCommitment does not match policy");
+    }
+}
+export function computePolicyCommitment(policy) {
+    return sha256Hex(stableStringify(policy));
+}
+function readAuditExport(path) {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    validateAuditExport(parsed);
+    return parsed;
+}
+function readAuthorizationReceipt(path) {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    validateReceipt(parsed);
+    return parsed;
+}
+function validateAuditExport(value) {
+    if (!value || typeof value !== "object") {
+        throw new Error("audit export must be an object");
+    }
+    const auditExport = value;
+    if (auditExport.exportVersion !== "catp_audit_export_v1") {
+        throw new Error("audit export version must be catp_audit_export_v1");
+    }
+    if (!auditExport.entry || typeof auditExport.entry !== "object") {
+        throw new Error("audit export entry must be an object");
+    }
+    assertHex(auditExport.commitment, "audit export commitment");
+    assertHex(auditExport.entrySha256, "audit export entrySha256");
+    if (auditExport.entry.commitment !== auditExport.commitment) {
+        throw new Error("audit export commitment must match entry commitment");
+    }
+    const expectedEntryHash = sha256Hex(stableStringify(auditExport.entry));
+    if (auditExport.entrySha256 !== expectedEntryHash) {
+        throw new Error("audit export entrySha256 does not match entry");
+    }
+}
+function validateReceipt(value) {
+    if (!value || typeof value !== "object") {
+        throw new Error("authorization receipt must be an object");
+    }
+    const receipt = value;
+    if (receipt.receiptVersion !== "catp_authorization_receipt_v1") {
+        throw new Error("receiptVersion must be catp_authorization_receipt_v1");
+    }
+    if (receipt.signatureAlgorithm !== "Ed25519") {
+        throw new Error("signatureAlgorithm must be Ed25519");
+    }
+    assertHex(receipt.auditExportHash, "auditExportHash");
+    assertHex(receipt.auditCommitment, "auditCommitment");
+    assertHex(receipt.entrySha256, "entrySha256");
+    if (receipt.decision !== "allow" && receipt.decision !== "deny") {
+        throw new Error("decision must be allow or deny");
+    }
+    for (const field of ["agentId", "tool", "timestamp", "signedAt", "publicKeyPem", "signature"]) {
+        if (typeof receipt[field] !== "string" || receipt[field] === "") {
+            throw new Error(`${field} must be a non-empty string`);
+        }
+    }
+    if (receipt.policyCommitment !== null) {
+        assertHex(receipt.policyCommitment, "policyCommitment");
+    }
+}
+function derivePublicKeyPem(privateKeyPem) {
+    return createPublicKey(createPrivateKey(privateKeyPem)).export({ type: "spki", format: "pem" }).toString();
+}
+function resolvePolicyCommitmentIfPresent() {
+    const policyPath = findPolicyFile();
+    return policyPath ? computePolicyCommitment(loadPolicy(policyPath)) : null;
+}
+async function verifyAuditLogIntegrity(agentId) {
+    for (const { file } of auditLogFiles(agentId)) {
+        const result = await verifyChain(file);
+        if (!result.ok) {
+            throw new Error(`audit log chain is broken in ${file} at entry ${result.broken_at}: ${result.message}`);
+        }
+    }
+}
+function assertHex(value, field) {
+    if (typeof value !== "string" || !/^[0-9a-fA-F]{64}$/.test(value)) {
+        throw new Error(`${field} must be a 64-character hex string`);
+    }
+}
+function sha256Hex(input) {
+    return createHash("sha256").update(input).digest("hex");
+}
+//# sourceMappingURL=receipt.js.map

package/dist/commands/receipt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt.js","sourceRoot":"","sources":["../../src/commands/receipt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC/G,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAoB,MAAM,UAAU,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAsBjE,MAAM,UAAU,gBAAgB,CAAC,IAAiD;IAChF,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,IAAI,0BAA0B,CAAC;IACrE,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,IAAI,yBAAyB,CAAC;IAClE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,SAAS,EAAE;QAC/D,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;KACnD,CAAC,CAAC;IAEH,aAAa,CAAC,cAAc,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,aAAa,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,cAAc,IAAI,CAAC,CAAC;IACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,aAAa,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAgF;IAC7G,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IACvD,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,gCAAgC,EAAE,CAAC;IACzH,MAAM,OAAO,GAAG,wBAAwB,CAAC,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACzG,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAEhD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC;QACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC;QACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,CAAC,gBAAgB,IAAI,MAAM,IAAI,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAO/B;IACC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAO3B;IACC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,wBAAwB,CAAC,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE;QACjF,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;KAClE,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAChD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC;QACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC;QACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,CAAC,gBAAgB,IAAI,MAAM,IAAI,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAmF;IAClH,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAClG,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtD,wBAAwB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,mBAAmB,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC;IACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC;IACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,CAAC,gBAAgB,IAAI,MAAM,IAAI,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,WAAwB,EACxB,aAAqB,EACrB,YAAoB,EACpB,OAAgE,EAAE;IAElE,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACjC,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC1E,SAAS,CAAC,IAAI,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,OAAO,GAAgC;QAC3C,cAAc,EAAE,+BAA+B;QAC/C,eAAe,EAAE,SAAS,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QACxD,eAAe,EAAE,WAAW,CAAC,UAAU;QACvC,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI;QAC5B,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,QAAQ;QACpC,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,IAAI;QAC/C,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnD,kBAAkB,EAAE,SAAS;QAC7B,YAAY;KACb,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtG,OAAO,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAA6B,EAAE,eAAuB,OAAO,CAAC,YAAY;IACnH,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC;IAC1C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/G,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAA6B,EAAE,WAAwB;IAC9F,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,eAAe,GAAG,SAAS,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,eAAe,KAAK,eAAe,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,KAAK,WAAW,CAAC,UAAU,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,WAAW,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAA6B,EAAE,MAAkB;IACnF,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAkB;IACxD,OAAO,SAAS,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;IACjE,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;IACjE,eAAe,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,WAAW,GAAG,KAAoB,CAAC;IACzC,IAAI,WAAW,CAAC,aAAa,KAAK,sBAAsB,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,OAAO,WAAW,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,SAAS,CAAC,WAAW,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;IAC7D,SAAS,CAAC,WAAW,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAC;IAC/D,IAAI,WAAW,CAAC,KAAK,CAAC,UAAU,KAAK,WAAW,CAAC,UAAU,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,iBAAiB,GAAG,SAAS,CAAC,eAAe,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,IAAI,WAAW,CAAC,WAAW,KAAK,iBAAiB,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,OAAO,GAAG,KAA6B,CAAC;IAC9C,IAAI,OAAO,CAAC,cAAc,KAAK,+BAA+B,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IACtD,SAAS,CAAC,OAAO,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IACtD,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,CAAU,EAAE,CAAC;QACvG,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACtC,SAAS,CAAC,OAAO,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,aAAqB;IAC/C,OAAO,eAAe,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC7G,CAAC;AAED,SAAS,gCAAgC;IACvC,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,OAAO,UAAU,CAAC,CAAC,CAAC,uBAAuB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,OAAe;IACpD,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,aAAa,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,KAAa;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC"}

package/dist/commands/validate.d.ts

@@ -1,4 +1,6 @@
+import type { CatpPolicy } from "../policy/types.js";
 export declare function cmdValidate(opts: {
     file?: string;
 }): void;
+export declare function formatValidationSummary(policyPath: string, policy: CatpPolicy): string;
 //# sourceMappingURL=validate.d.ts.map

package/dist/commands/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAEA,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAgBzD"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAczD;AAED,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,CAkBtF"}

package/dist/commands/validate.js

@@ -7,11 +7,22 @@ export function cmdValidate(opts) {
     }
     try {
         const policy = loadPolicy(policyPath);
-        process.stdout.write(`✓ ${policyPath}\n  agent: ${policy.agent.id} v${policy.agent.version}\n  rules: ${policy.rules.length}\n`);
+        process.stdout.write(formatValidationSummary(policyPath, policy));
     }
     catch (err) {
         process.stderr.write(`✗ ${policyPath}\n  ${err.message}\n`);
         process.exit(1);
     }
 }
+export function formatValidationSummary(policyPath, policy) {
+    const lines = [
+        `✓ ${policyPath}`,
+        `  agent: ${policy.agent.id} v${policy.agent.version}`,
+        `  rules: ${policy.rules.length}`,
+    ];
+    if (policy.authorization) {
+        lines.push("  authorization: authorization_groth16_v1-ready", `    allowedAction: ${policy.authorization.allowed_action}`, `    maxValuePerTx: ${policy.authorization.max_value_per_tx}`, `    maxValueTotal: ${policy.authorization.max_value_total}`, `    validFrom: ${policy.authorization.valid_from}`, `    validUntil: ${policy.authorization.valid_until}`, "    next: catp witness --action <action.json> --out <witness.json>");
+    }
+    return `${lines.join("\n")}\n`;
+}
 //# sourceMappingURL=validate.js.map

package/dist/commands/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjE,MAAM,UAAU,WAAW,CAAC,IAAuB;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;IACjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,UAAU,cAAc,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,cAAc,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,CAC3G,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,UAAU,OAAQ,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGjE,MAAM,UAAU,WAAW,CAAC,IAAuB;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;IACjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,UAAU,OAAQ,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,UAAkB,EAAE,MAAkB;IAC5E,MAAM,KAAK,GAAG;QACZ,KAAK,UAAU,EAAE;QACjB,YAAY,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;QACtD,YAAY,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE;KAClC,CAAC;IACF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CACR,iDAAiD,EACjD,sBAAsB,MAAM,CAAC,aAAa,CAAC,cAAc,EAAE,EAC3D,sBAAsB,MAAM,CAAC,aAAa,CAAC,gBAAgB,EAAE,EAC7D,sBAAsB,MAAM,CAAC,aAAa,CAAC,eAAe,EAAE,EAC5D,kBAAkB,MAAM,CAAC,aAAa,CAAC,UAAU,EAAE,EACnD,mBAAmB,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,EACrD,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/commands/witness.d.ts

@@ -28,6 +28,14 @@ export declare function cmdWitness(opts: {
     currentTimestamp?: string;
     cumulativeSpend?: string;
 }): void;
+export declare function formatGroth16WitnessSummary(witness: Groth16Witness, opts?: {
+    action?: string;
+    auditCommitment?: string;
+    agent?: string;
+    file?: string;
+    currentTimestamp?: string;
+    cumulativeSpend?: string;
+}): string;
 export declare function buildGroth16WitnessFromSources(opts: {
     action?: string;
     auditCommitment?: string;

package/dist/commands/witness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"witness.d.ts","sourceRoot":"","sources":["../../src/commands/witness.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAc,mBAAmB,EAAuB,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAW3G,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE;IAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAAO,GACnF,cAAc,CAyChB;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,IAAI,CAUP;AAED,wBAAgB,8BAA8B,CAAC,IAAI,EAAE;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,cAAc,CAsBjB"}
+{"version":3,"file":"witness.d.ts","sourceRoot":"","sources":["../../src/commands/witness.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAc,mBAAmB,EAAuB,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAW3G,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE;IAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAAO,GACnF,cAAc,CAyChB;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,IAAI,CAkBP;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE;IACJ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;CACrB,GACL,MAAM,CAkBR;AA8BD,wBAAgB,8BAA8B,CAAC,IAAI,EAAE;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,cAAc,CAsBjB"}

package/dist/commands/witness.js

@@ -51,11 +51,57 @@ export function cmdWitness(opts) {
     if (opts.out) {
         writeFileSync(opts.out, encoded, "utf8");
         process.stdout.write(`Wrote Groth16 witness to ${opts.out}\n`);
+        process.stdout.write(formatGroth16WitnessSummary(witness, {
+            action: opts.action,
+            auditCommitment: opts.auditCommitment,
+            agent: opts.agent,
+            file: opts.file,
+            currentTimestamp: opts.currentTimestamp,
+            cumulativeSpend: opts.cumulativeSpend,
+        }));
     }
     else {
         process.stdout.write(encoded);
     }
 }
+export function formatGroth16WitnessSummary(witness, opts = {}) {
+    const lines = [
+        "proofVersion=authorization_groth16_v1",
+        `actionType=${witness.actionType}`,
+        `value=${witness.value}`,
+        `currentTimestamp=${witness.currentTimestamp}`,
+        `cumulativeSpend=${witness.cumulativeSpend}`,
+        `maxValuePerTx=${witness.maxValuePerTx}`,
+        `maxValueTotal=${witness.maxValueTotal}`,
+        `validFrom=${witness.validFrom}`,
+        `validUntil=${witness.validUntil}`,
+        "next=Run catp prove authorization with the same policy/action inputs to generate a proof manifest.",
+    ];
+    const proveCommand = formatProveCommand(opts);
+    if (proveCommand) {
+        lines.push(`proveCommand=${proveCommand}`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+function formatProveCommand(opts) {
+    if (!opts.action && !opts.auditCommitment)
+        return null;
+    const args = ["catp", "prove", "authorization"];
+    if (opts.file)
+        args.push("--file", opts.file);
+    if (opts.action)
+        args.push("--action", opts.action);
+    if (opts.auditCommitment)
+        args.push("--audit-commitment", opts.auditCommitment);
+    if (opts.agent)
+        args.push("--agent", opts.agent);
+    if (opts.currentTimestamp)
+        args.push("--current-timestamp", opts.currentTimestamp);
+    if (opts.cumulativeSpend)
+        args.push("--cumulative-spend", opts.cumulativeSpend);
+    args.push("--artifact-out", "authorization_groth16_v1.json", "--deployment", "catp-contracts/deployments/sepolia-groth16.json", "--out", "catp-proof-manifest.json");
+    return args.map(shellQuote).join(" ");
+}
 export function buildGroth16WitnessFromSources(opts) {
     if (!opts.action && !opts.auditCommitment) {
         throw new Error("missing --action <path> or --audit-commitment <hex>");
@@ -142,6 +188,9 @@ function normalizeBytes32(value, field) {
     }
     return value;
 }
+function shellQuote(value) {
+    return /^[A-Za-z0-9_./:@%+=,-]+$/.test(value) ? value : `'${value.replace(/'/g, "'\\''")}'`;
+}
 function normalizeU64(value, field) {
     let parsed;
     if (typeof value === "number") {