@peac/cli 0.10.9 → 0.10.10

package/dist/index.mjs

@@ -0,0 +1,2236 @@
+#!/usr/bin/env node
+import { Command, CommanderError } from 'commander';
+import { verifyReceipt, fetchIssuerConfig, parseIssuerConfig } from '@peac/protocol';
+import { generateKeypair, base64urlEncode, sign, decode, canonicalize } from '@peac/crypto';
+import * as fs6 from 'fs';
+import { existsSync, readFileSync } from 'fs';
+import * as path6 from 'path';
+import { join } from 'path';
+import { loadProfile, serializePolicyJson, serializePolicyYaml, ProfileError, createExamplePolicy, loadPolicy, PolicyValidationError, PolicyLoadError, compilePeacTxt, compileRobotsSnippet, compileAiprefTemplates, renderPolicyMarkdown, explainMatches, evaluate, listProfiles, getProfileSummary } from '@peac/policy-kit';
+import { execSync } from 'child_process';
+import { createHash } from 'crypto';
+import { validateWorkflowContextOrdered, isValidPurposeToken, isCanonicalPurpose, validateObligationsExtension, validateInteractionOrdered, validateDisputeAttestation, validateAttributionAttestation, validateAgentIdentityAttestation, ReceiptClaimsSchema, parseReceiptClaims } from '@peac/schema';
+import { parse } from '@peac/disc';
+
+function getGlobalOptions(cmd) {
+  const parent = cmd.parent;
+  if (!parent) return {};
+  return parent.opts();
+}
+function output(data, opts, humanMessage) {
+  if (opts.json) {
+    console.log(JSON.stringify(data, null, 2));
+  }
+}
+function outputError(error, details, opts) {
+  if (opts.json) {
+    console.log(JSON.stringify({ success: false, error, ...details }, null, 2));
+  } else {
+    console.error(`Error: ${error}`);
+  }
+}
+var policy = new Command("policy").description("Policy file operations").option("--json", "Output in machine-readable JSON format").option("--yes", "Skip confirmation prompts (auto-confirm)").option("--strict", "Exit non-zero on warnings");
+policy.command("init").description("Create a new PEAC policy file").option("-f, --format <format>", "Output format (yaml or json)", "yaml").option("-o, --output <file>", "Output file path").option("--force", "Overwrite existing file").option("--profile <id>", "Use a pre-built profile as template").action(
+  (options, cmd) => {
+    const globalOpts = getGlobalOptions(cmd);
+    try {
+      const format = options.format?.toLowerCase() || "yaml";
+      const outputPath = options.output || (format === "json" ? "peac-policy.json" : "peac-policy.yaml");
+      if (fs6.existsSync(outputPath) && !options.force && !globalOpts.yes) {
+        outputError(
+          `File already exists: ${outputPath}`,
+          { path: outputPath, hint: "Use --force or --yes to overwrite" },
+          globalOpts
+        );
+        process.exit(1);
+      }
+      let content;
+      let policyName;
+      if (options.profile) {
+        try {
+          const profile = loadProfile(options.profile);
+          const policyDoc = profile.policy;
+          content = format === "json" ? serializePolicyJson(policyDoc) : serializePolicyYaml(policyDoc);
+          policyName = profile.name;
+        } catch (err) {
+          if (err instanceof ProfileError) {
+            outputError(err.message, { code: err.code, profile: options.profile }, globalOpts);
+            process.exit(1);
+          }
+          throw err;
+        }
+      } else {
+        const example = createExamplePolicy();
+        content = format === "json" ? serializePolicyJson(example) : serializePolicyYaml(example);
+        policyName = "Example Policy";
+      }
+      fs6.writeFileSync(outputPath, content, "utf-8");
+      if (globalOpts.json) {
+        output(
+          {
+            success: true,
+            file: outputPath,
+            format,
+            profile: options.profile || null,
+            policyName
+          },
+          globalOpts
+        );
+      } else {
+        console.log(`Created policy file: ${outputPath}`);
+        if (options.profile) {
+          console.log(`Based on profile: ${options.profile}`);
+        }
+        console.log("");
+        console.log("Next steps:");
+        console.log("  1. Edit the policy file to define your access rules");
+        console.log("  2. Validate with: peac policy validate " + outputPath);
+        console.log("  3. Generate artifacts with: peac policy generate " + outputPath);
+      }
+      process.exit(0);
+    } catch (err) {
+      outputError(err instanceof Error ? err.message : String(err), {}, globalOpts);
+      process.exit(1);
+    }
+  }
+);
+policy.command("validate").description("Validate a PEAC policy file (YAML or JSON)").argument("<file>", "Path to policy file").option("-v, --verbose", "Show detailed validation output").action((file, options, cmd) => {
+  const globalOpts = getGlobalOptions(cmd);
+  const warnings = [];
+  try {
+    const policyDoc = loadPolicy(file);
+    const result = {
+      success: true,
+      file,
+      valid: true,
+      warnings,
+      policy: {
+        version: policyDoc.version,
+        name: policyDoc.name || null,
+        defaultDecision: policyDoc.defaults.decision,
+        ruleCount: policyDoc.rules.length,
+        rules: options.verbose ? policyDoc.rules.map((r) => ({
+          name: r.name,
+          decision: r.decision,
+          subject: r.subject || null,
+          purpose: r.purpose || null,
+          licensingMode: r.licensing_mode || null
+        })) : void 0
+      }
+    };
+    if (globalOpts.json) {
+      output(result, globalOpts);
+    } else {
+      console.log(`Validating policy file: ${file}
+`);
+      console.log("Policy is valid!\n");
+      console.log("Policy Information:");
+      console.log(`   Version:  ${policyDoc.version}`);
+      if (policyDoc.name) {
+        console.log(`   Name:     ${policyDoc.name}`);
+      }
+      console.log(`   Default:  ${policyDoc.defaults.decision}`);
+      console.log(`   Rules:    ${policyDoc.rules.length}`);
+      if (options.verbose && policyDoc.rules.length > 0) {
+        console.log("\nRules:");
+        for (const rule of policyDoc.rules) {
+          console.log(`   - ${rule.name}: ${rule.decision}`);
+          if (rule.subject) {
+            const parts = [];
+            if (rule.subject.type) {
+              const types = Array.isArray(rule.subject.type) ? rule.subject.type.join("|") : rule.subject.type;
+              parts.push(`type=${types}`);
+            }
+            if (rule.subject.labels) {
+              parts.push(`labels=[${rule.subject.labels.join(",")}]`);
+            }
+            if (rule.subject.id) {
+              parts.push(`id=${rule.subject.id}`);
+            }
+            if (parts.length > 0) {
+              console.log(`       subject: ${parts.join(", ")}`);
+            }
+          }
+          if (rule.purpose) {
+            const purposes = Array.isArray(rule.purpose) ? rule.purpose.join("|") : rule.purpose;
+            console.log(`       purpose: ${purposes}`);
+          }
+          if (rule.licensing_mode) {
+            const modes = Array.isArray(rule.licensing_mode) ? rule.licensing_mode.join("|") : rule.licensing_mode;
+            console.log(`       licensing_mode: ${modes}`);
+          }
+        }
+      }
+      if (warnings.length > 0) {
+        console.log("\nWarnings:");
+        for (const warning of warnings) {
+          console.log(`   - ${warning}`);
+        }
+      }
+    }
+    if (globalOpts.strict && warnings.length > 0) {
+      process.exit(1);
+    }
+    process.exit(0);
+  } catch (err) {
+    if (err instanceof PolicyValidationError) {
+      const issues = err.issues.map((i) => ({
+        path: i.path.join("."),
+        message: i.message
+      }));
+      if (globalOpts.json) {
+        output(
+          {
+            success: false,
+            file,
+            valid: false,
+            error: "Validation failed",
+            issues
+          },
+          globalOpts
+        );
+      } else {
+        console.error("Policy validation failed:\n");
+        for (const issue of err.issues) {
+          console.error(`   - ${issue.path.join(".")}: ${issue.message}`);
+        }
+      }
+      process.exit(1);
+    } else if (err instanceof PolicyLoadError) {
+      outputError(`Failed to load policy: ${err.message}`, { file }, globalOpts);
+      process.exit(1);
+    } else {
+      outputError(err instanceof Error ? err.message : String(err), {}, globalOpts);
+      process.exit(1);
+    }
+  }
+});
+policy.command("generate").description("Generate deployment artifacts from a policy file").argument("<file>", "Path to policy file").option("-o, --out <dir>", 'Output directory (use "-" for stdout)', "dist").option("--well-known", "Output peac.txt to .well-known/ subdirectory").option("--dry-run", "Show what would be generated without writing files").option("--peac-version <version>", "PEAC protocol version (default: 0.9)").option("--site-url <url>", "Site URL for peac.txt").option("--contact <email>", "Contact email for policy questions").option("--attribution <mode>", "Attribution requirement (required, optional, none)").option("--receipts <mode>", "Receipts requirement (required, optional, omit)").option("--rate-limit <limit>", 'Rate limit string (e.g., "100/hour", "unlimited")').option("--negotiate <url>", "Negotiate endpoint URL").option("--no-comments", "Omit comments from generated files").action(
+  (file, options, cmd) => {
+    const globalOpts = getGlobalOptions(cmd);
+    const isStdout = options.out === "-";
+    try {
+      if (!globalOpts.json && !isStdout) {
+        console.log(`Loading policy: ${file}
+`);
+      }
+      const policyDoc = loadPolicy(file);
+      const compileOptions = {
+        peacVersion: options.peacVersion,
+        siteUrl: options.siteUrl,
+        contact: options.contact,
+        attribution: options.attribution,
+        receipts: options.receipts,
+        rateLimit: options.rateLimit,
+        negotiateUrl: options.negotiate,
+        includeComments: options.comments !== false
+      };
+      const peacTxt = compilePeacTxt(policyDoc, compileOptions);
+      const robotsTxt = compileRobotsSnippet(policyDoc, compileOptions);
+      const aiprefTemplates = compileAiprefTemplates(policyDoc, compileOptions);
+      const markdown = renderPolicyMarkdown(policyDoc, compileOptions);
+      if (isStdout || globalOpts.json) {
+        const result = {
+          success: true,
+          source: file,
+          artifacts: {
+            "peac.txt": peacTxt,
+            "robots-ai-snippet.txt": robotsTxt,
+            "aipref-headers.json": aiprefTemplates,
+            "ai-policy.md": markdown
+          }
+        };
+        if (isStdout && !globalOpts.json) {
+          console.log(peacTxt);
+        } else {
+          output(result, { json: true });
+        }
+        process.exit(0);
+      }
+      const outDir = options.out;
+      let peacTxtPath;
+      if (options.wellKnown) {
+        peacTxtPath = path6.join(outDir, ".well-known", "peac.txt");
+      } else {
+        peacTxtPath = path6.join(outDir, "peac.txt");
+      }
+      const robotsPath = path6.join(outDir, "robots-ai-snippet.txt");
+      const aiprefPath = path6.join(outDir, "aipref-headers.json");
+      const mdPath = path6.join(outDir, "ai-policy.md");
+      if (options.dryRun) {
+        console.log("Dry run - files that would be generated:\n");
+        console.log(`--- ${peacTxtPath} ---`);
+        console.log(peacTxt);
+        console.log(`--- ${robotsPath} ---`);
+        console.log(robotsTxt);
+        console.log(`--- ${aiprefPath} ---`);
+        console.log(JSON.stringify(aiprefTemplates, null, 2));
+        console.log(`
+--- ${mdPath} ---`);
+        console.log(markdown);
+        process.exit(0);
+      }
+      if (!fs6.existsSync(outDir)) {
+        fs6.mkdirSync(outDir, { recursive: true });
+      }
+      if (options.wellKnown) {
+        const wellKnownDir = path6.join(outDir, ".well-known");
+        if (!fs6.existsSync(wellKnownDir)) {
+          fs6.mkdirSync(wellKnownDir, { recursive: true });
+        }
+      }
+      fs6.writeFileSync(peacTxtPath, peacTxt, "utf-8");
+      console.log(`Generated: ${peacTxtPath}`);
+      fs6.writeFileSync(robotsPath, robotsTxt, "utf-8");
+      console.log(`Generated: ${robotsPath}`);
+      fs6.writeFileSync(aiprefPath, JSON.stringify(aiprefTemplates, null, 2), "utf-8");
+      console.log(`Generated: ${aiprefPath}`);
+      fs6.writeFileSync(mdPath, markdown, "utf-8");
+      console.log(`Generated: ${mdPath}`);
+      console.log("");
+      console.log("Deployment instructions:");
+      if (options.wellKnown) {
+        console.log(`  1. Deploy ${peacTxtPath} to serve at /.well-known/peac.txt`);
+      } else {
+        console.log(`  1. Copy ${peacTxtPath} to /.well-known/peac.txt`);
+      }
+      console.log(`  2. Append ${robotsPath} to your robots.txt`);
+      console.log(`  3. Add headers from ${aiprefPath} to your server config`);
+      console.log(`  4. Publish ${mdPath} for human reference`);
+      process.exit(0);
+    } catch (err) {
+      if (err instanceof PolicyLoadError) {
+        outputError(`Failed to load policy: ${err.message}`, { file }, globalOpts);
+        process.exit(1);
+      } else {
+        outputError(err instanceof Error ? err.message : String(err), {}, globalOpts);
+        process.exit(1);
+      }
+    }
+  }
+);
+policy.command("explain").description("Explain which rule would apply for a given context").argument("<file>", "Path to policy file").option("-t, --type <type>", "Subject type (human, org, agent)").option("-l, --labels <labels>", "Subject labels (comma-separated)").option("-i, --id <id>", "Subject ID").option(
+  "-p, --purpose <purpose>",
+  "Access purpose (crawl, index, train, inference, ai_input, ai_index, search)"
+).option(
+  "-m, --licensing-mode <mode>",
+  "Licensing mode (subscription, pay_per_crawl, pay_per_inference)"
+).option("--all-matches", "Show all matching rules, not just the first").action(
+  (file, options, cmd) => {
+    const globalOpts = getGlobalOptions(cmd);
+    try {
+      const policyDoc = loadPolicy(file);
+      const context = {};
+      if (options.type || options.labels || options.id) {
+        context.subject = {};
+        if (options.type) {
+          context.subject.type = options.type;
+        }
+        if (options.labels) {
+          context.subject.labels = options.labels.split(",").map((l) => l.trim());
+        }
+        if (options.id) {
+          context.subject.id = options.id;
+        }
+      }
+      if (options.purpose) {
+        context.purpose = options.purpose;
+      }
+      if (options.licensingMode) {
+        context.licensing_mode = options.licensingMode;
+      }
+      if (options.allMatches) {
+        const matches = explainMatches(policyDoc, context);
+        if (globalOpts.json) {
+          output(
+            {
+              success: true,
+              context,
+              matches: matches.map((m) => {
+                if (m === "[default]") {
+                  return {
+                    rule: "[default]",
+                    decision: policyDoc.defaults.decision
+                  };
+                }
+                const rule = policyDoc.rules.find((r) => r.name === m);
+                return rule ? { rule: rule.name, decision: rule.decision } : { rule: m, decision: null };
+              })
+            },
+            globalOpts
+          );
+        } else {
+          console.log("Evaluation Context:");
+          if (context.subject) {
+            console.log(`   Subject: ${JSON.stringify(context.subject)}`);
+          } else {
+            console.log("   Subject: (any)");
+          }
+          console.log(`   Purpose: ${context.purpose || "(any)"}`);
+          console.log(`   Licensing Mode: ${context.licensing_mode || "(any)"}`);
+          console.log();
+          console.log(`Matching Rules (${matches.length}):`);
+          for (const match of matches) {
+            if (match === "[default]") {
+              console.log(`   - [default] -> ${policyDoc.defaults.decision}`);
+            } else {
+              const rule = policyDoc.rules.find((r) => r.name === match);
+              if (rule) {
+                console.log(`   - ${rule.name} -> ${rule.decision}`);
+              }
+            }
+          }
+        }
+      } else {
+        const result = evaluate(policyDoc, context);
+        if (globalOpts.json) {
+          output(
+            {
+              success: true,
+              context,
+              result: {
+                decision: result.decision,
+                matchedRule: result.matched_rule || "[default]",
+                reason: result.reason || null
+              }
+            },
+            globalOpts
+          );
+        } else {
+          console.log("Evaluation Context:");
+          if (context.subject) {
+            console.log(`   Subject: ${JSON.stringify(context.subject)}`);
+          } else {
+            console.log("   Subject: (any)");
+          }
+          console.log(`   Purpose: ${context.purpose || "(any)"}`);
+          console.log(`   Licensing Mode: ${context.licensing_mode || "(any)"}`);
+          console.log();
+          console.log("Result:");
+          console.log(`   Decision: ${result.decision}`);
+          if (result.matched_rule) {
+            console.log(`   Matched Rule: ${result.matched_rule}`);
+          } else {
+            console.log("   Matched Rule: (default)");
+          }
+          if (result.reason) {
+            console.log(`   Reason: ${result.reason}`);
+          }
+        }
+      }
+      process.exit(0);
+    } catch (err) {
+      if (err instanceof PolicyLoadError) {
+        outputError(`Failed to load policy: ${err.message}`, { file }, globalOpts);
+        process.exit(1);
+      } else {
+        outputError(err instanceof Error ? err.message : String(err), {}, globalOpts);
+        process.exit(1);
+      }
+    }
+  }
+);
+policy.command("list-profiles").description("List available pre-built policy profiles").action((options, cmd) => {
+  const globalOpts = getGlobalOptions(cmd);
+  try {
+    const profileIds = listProfiles();
+    const profiles = profileIds.map((id) => getProfileSummary(id));
+    if (globalOpts.json) {
+      output(
+        {
+          success: true,
+          profiles: profiles.map((p) => ({
+            id: p.id,
+            name: p.name,
+            description: p.description,
+            defaultDecision: p.defaultDecision,
+            ruleCount: p.ruleCount,
+            requiresReceipt: p.requiresReceipt,
+            requiredParams: p.requiredParams,
+            optionalParams: p.optionalParams
+          }))
+        },
+        globalOpts
+      );
+    } else {
+      console.log("Available Policy Profiles:\n");
+      for (const profile of profiles) {
+        console.log(`  ${profile.id}`);
+        console.log(`    Name: ${profile.name}`);
+        console.log(`    Default: ${profile.defaultDecision}`);
+        console.log(`    Rules: ${profile.ruleCount}`);
+        if (profile.requiresReceipt) {
+          console.log("    Requires receipt: yes");
+        }
+        if (profile.requiredParams.length > 0) {
+          console.log(`    Required params: ${profile.requiredParams.join(", ")}`);
+        }
+        console.log();
+      }
+      console.log('Use "peac policy show-profile <id>" for full details');
+      console.log('Use "peac policy init --profile <id>" to create a policy from a profile');
+    }
+    process.exit(0);
+  } catch (err) {
+    outputError(err instanceof Error ? err.message : String(err), {}, globalOpts);
+    process.exit(1);
+  }
+});
+policy.command("show-profile").description("Show details of a specific policy profile").argument("<id>", "Profile ID").action((id, options, cmd) => {
+  const globalOpts = getGlobalOptions(cmd);
+  try {
+    const profile = loadProfile(id);
+    const summary = getProfileSummary(id);
+    if (globalOpts.json) {
+      output(
+        {
+          success: true,
+          profile: {
+            id: profile.id,
+            name: profile.name,
+            description: profile.description,
+            policy: profile.policy,
+            parameters: profile.parameters,
+            defaults: profile.defaults
+          }
+        },
+        globalOpts
+      );
+    } else {
+      console.log(`Profile: ${profile.name}`);
+      console.log(`ID: ${profile.id}`);
+      console.log();
+      console.log("Description:");
+      console.log(
+        profile.description.split("\n").map((l) => `  ${l}`).join("\n")
+      );
+      console.log();
+      console.log("Policy:");
+      console.log(`  Version: ${profile.policy.version}`);
+      console.log(`  Default decision: ${profile.policy.defaults.decision}`);
+      console.log(`  Rules: ${profile.policy.rules?.length || 0}`);
+      if (profile.policy.rules && profile.policy.rules.length > 0) {
+        console.log();
+        console.log("Rules:");
+        for (const rule of profile.policy.rules) {
+          console.log(`  - ${rule.name}: ${rule.decision}`);
+          if (rule.purpose) {
+            const purposes = Array.isArray(rule.purpose) ? rule.purpose.join(", ") : rule.purpose;
+            console.log(`      purpose: ${purposes}`);
+          }
+          if (rule.reason) {
+            console.log(`      reason: ${rule.reason}`);
+          }
+        }
+      }
+      if (Object.keys(profile.parameters || {}).length > 0) {
+        console.log();
+        console.log("Parameters:");
+        for (const [key, param] of Object.entries(profile.parameters || {})) {
+          const required = param.required ? " (required)" : "";
+          console.log(`  ${key}${required}`);
+          console.log(`    ${param.description}`);
+          if (param.default) {
+            console.log(`    Default: ${param.default}`);
+          }
+          if (param.example) {
+            console.log(`    Example: ${param.example}`);
+          }
+        }
+      }
+      if (profile.defaults) {
+        console.log();
+        console.log("Defaults:");
+        if (profile.defaults.requirements?.receipt) {
+          console.log("  Receipt required: yes");
+        }
+        if (profile.defaults.rate_limit) {
+          console.log(
+            `  Rate limit: ${profile.defaults.rate_limit.limit}/${profile.defaults.rate_limit.window_seconds}s`
+          );
+        }
+      }
+    }
+    process.exit(0);
+  } catch (err) {
+    if (err instanceof ProfileError) {
+      outputError(err.message, { code: err.code, profile: id }, globalOpts);
+      process.exit(1);
+    }
+    outputError(err instanceof Error ? err.message : String(err), {}, globalOpts);
+    process.exit(1);
+  }
+});
+function sha256(content) {
+  return createHash("sha256").update(content, "utf8").digest("hex");
+}
+function zodPathToJsonPointer(path8) {
+  if (path8.length === 0) return "";
+  return "/" + path8.map((segment) => {
+    const str = String(segment);
+    return str.replace(/~/g, "~0").replace(/\//g, "~1");
+  }).join("/");
+}
+function computeCanonicalDigest(input) {
+  try {
+    const canonical = canonicalize(input);
+    return { alg: "sha-256+jcs", value: sha256(canonical) };
+  } catch {
+    return { alg: "sha-256+json", value: sha256(JSON.stringify(input)) };
+  }
+}
+var VECTORS_FILE_EXTENSIONS = /* @__PURE__ */ new Set([".json", ".txt", ".jwks", ".pem", ".zip"]);
+var VECTORS_EXCLUDE_FILES = /* @__PURE__ */ new Set([".DS_Store", ".gitkeep", "Thumbs.db"]);
+function collectFilesRecursive(dir, basePath = "") {
+  const files = [];
+  if (!fs6.existsSync(dir)) return files;
+  const entries = fs6.readdirSync(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (VECTORS_EXCLUDE_FILES.has(entry.name)) continue;
+    const relativePath = basePath ? `${basePath}/${entry.name}` : entry.name;
+    const fullPath = path6.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...collectFilesRecursive(fullPath, relativePath));
+    } else {
+      const ext = path6.extname(entry.name).toLowerCase();
+      if (VECTORS_FILE_EXTENSIONS.has(ext)) {
+        files.push({
+          relativePath,
+          content: fs6.readFileSync(fullPath, "utf8")
+        });
+      }
+    }
+  }
+  return files;
+}
+function computeVectorsDigest(fixturesDir, categories) {
+  const hash = createHash("sha256");
+  const allFiles = [];
+  const manifestPath = path6.join(fixturesDir, "manifest.json");
+  if (fs6.existsSync(manifestPath)) {
+    allFiles.push({
+      relativePath: "manifest.json",
+      content: fs6.readFileSync(manifestPath, "utf8")
+    });
+  }
+  const sortedCategories = [...categories].sort();
+  for (const cat of sortedCategories) {
+    const categoryPath = path6.join(fixturesDir, cat);
+    const categoryFiles = collectFilesRecursive(categoryPath, cat);
+    allFiles.push(...categoryFiles);
+  }
+  allFiles.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
+  for (const file of allFiles) {
+    const fileHash = sha256(file.content);
+    hash.update(file.relativePath);
+    hash.update("\0");
+    hash.update(fileHash);
+  }
+  return hash.digest("hex");
+}
+function loadManifest(fixturesDir) {
+  const manifestPath = path6.join(fixturesDir, "manifest.json");
+  if (!fs6.existsSync(manifestPath)) {
+    return {};
+  }
+  try {
+    return JSON.parse(fs6.readFileSync(manifestPath, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function getManifestEntry(manifest, category, filename) {
+  return manifest[category]?.[filename];
+}
+
+// src/lib/conformance/profiles.ts
+var PROFILE_CAPABILITIES = {
+  valid: {
+    profile: "receipt.verify.claims",
+    level: "semantic",
+    validator: "@peac/schema:ReceiptClaimsSchema"
+  },
+  invalid: {
+    profile: "receipt.verify.claims",
+    level: "semantic",
+    validator: "@peac/schema:ReceiptClaimsSchema"
+  },
+  edge: {
+    profile: "receipt.verify.claims",
+    level: "semantic",
+    validator: "@peac/schema:ReceiptClaimsSchema"
+  },
+  "agent-identity": {
+    profile: "receipt.verify.agent-identity",
+    level: "semantic",
+    validator: "@peac/schema:validateAgentIdentityAttestation"
+  },
+  attribution: {
+    profile: "receipt.verify.attribution",
+    level: "semantic",
+    validator: "@peac/schema:validateAttributionAttestation"
+  },
+  bundle: {
+    profile: "bundle.shape",
+    level: "shape",
+    validator: "structural-check",
+    notes: "Structure-only; no cryptographic integrity verification"
+  },
+  discovery: {
+    profile: "discovery.config",
+    level: "semantic",
+    validator: "@peac/disc:parse"
+  },
+  dispute: {
+    profile: "receipt.verify.dispute",
+    level: "semantic",
+    validator: "@peac/schema:validateDisputeAttestation"
+  },
+  interaction: {
+    profile: "receipt.verify.interaction",
+    level: "semantic",
+    validator: "@peac/schema:validateInteractionOrdered"
+  },
+  issue: {
+    profile: "receipt.issue",
+    level: "semantic",
+    validator: "@peac/schema:ReceiptClaimsSchema"
+  },
+  obligations: {
+    profile: "receipt.verify.obligations",
+    level: "semantic",
+    validator: "@peac/schema:validateObligationsExtension"
+  },
+  policy: {
+    profile: "policy.evaluate",
+    level: "shape",
+    validator: "structural-check",
+    notes: "Structure-only; no policy evaluation logic"
+  },
+  purpose: {
+    profile: "receipt.verify.purpose",
+    level: "semantic",
+    validator: "@peac/schema:isValidPurposeToken"
+  },
+  verifier: {
+    profile: "receipt.verify",
+    level: "semantic",
+    validator: "@peac/schema:ReceiptClaimsSchema"
+  },
+  workflow: {
+    profile: "workflow.validate",
+    level: "semantic",
+    validator: "@peac/schema:validateWorkflowContextOrdered"
+  },
+  x402: {
+    profile: "transport.x402.shape",
+    level: "shape",
+    validator: "structural-check",
+    notes: "Structure-only; no offer/receipt verification or term matching"
+  }
+};
+function getCategoryCapability(category) {
+  return PROFILE_CAPABILITIES[category] ?? {
+    profile: `receipt.verify.${category}`,
+    level: "semantic",
+    validator: "@peac/schema:ReceiptClaimsSchema (heuristic)",
+    notes: "Unknown category - uses semantic receipt validation when input looks like claims"
+  };
+}
+function getCategoryProfile(category) {
+  return getCategoryCapability(category).profile;
+}
+function shouldRunAtLevel(fixtureVersion, level) {
+  if (!fixtureVersion) return true;
+  const [major, minor] = fixtureVersion.split(".").map(Number);
+  const fixtureLevel = major > 0 || minor >= 10 ? "full" : minor >= 9 ? "standard" : "basic";
+  const levelOrder = ["basic", "standard", "full"];
+  return levelOrder.indexOf(fixtureLevel) <= levelOrder.indexOf(level);
+}
+function zodCodeToKeyword(code) {
+  const mapping = {
+    invalid_type: "type",
+    invalid_literal: "const",
+    unrecognized_keys: "additionalProperties",
+    invalid_union: "anyOf",
+    invalid_enum_value: "enum",
+    invalid_string: "format",
+    too_small: "minLength",
+    too_big: "maxLength",
+    custom: "custom"
+  };
+  return mapping[code] ?? code;
+}
+function validateReceiptPayload(payload) {
+  const result = ReceiptClaimsSchema.safeParse(payload);
+  if (result.success) {
+    return { valid: true };
+  }
+  const firstIssue = result.error.issues[0];
+  const zodPath = firstIssue?.path ?? [];
+  const errorPath = zodPathToJsonPointer(zodPath);
+  const errorKeyword = zodCodeToKeyword(firstIssue?.code ?? "unknown");
+  let errorCode = "E_INVALID_FORMAT";
+  const pathStr = zodPath.join(".");
+  if (pathStr === "iss" || pathStr.startsWith("iss.")) errorCode = "E_INVALID_ISSUER";
+  else if (pathStr === "aud" || pathStr.startsWith("aud.")) errorCode = "E_INVALID_AUDIENCE";
+  else if (pathStr === "iat") errorCode = "E_INVALID_IAT";
+  else if (pathStr === "exp") errorCode = "E_INVALID_EXP";
+  else if (pathStr === "rid") errorCode = "E_INVALID_RID";
+  else if (firstIssue?.code === "invalid_type" && zodPath.length > 0) {
+    errorCode = "E_REQUIRED";
+  }
+  return {
+    valid: false,
+    error_code: errorCode,
+    error_message: firstIssue?.message ?? "Unknown validation error",
+    error_path: errorPath,
+    error_keyword: errorKeyword
+  };
+}
+function validateParseReceiptClaims(payload) {
+  const pr = parseReceiptClaims(payload);
+  if (pr.ok) {
+    return { valid: true };
+  }
+  return {
+    valid: false,
+    error_code: pr.error.code,
+    error_message: pr.error.message
+  };
+}
+function validateDiscoveryInput(input) {
+  if (typeof input === "string") {
+    const result = parse(input);
+    if (result.valid) {
+      return { valid: true };
+    }
+    return {
+      valid: false,
+      error_code: "E_DISCOVERY_PARSE_ERROR",
+      error_message: result.errors?.join("; ") ?? "Discovery parse error"
+    };
+  }
+  if (typeof input === "object" && input !== null) {
+    const obj = input;
+    if (!obj.issuer || typeof obj.issuer !== "string") {
+      return {
+        valid: false,
+        error_code: "E_MISSING_ISSUER",
+        error_message: "Discovery document missing required issuer field"
+      };
+    }
+    if (!obj.jwks_uri || typeof obj.jwks_uri !== "string") {
+      return {
+        valid: false,
+        error_code: "E_MISSING_JWKS_URI",
+        error_message: "Discovery document missing required jwks_uri field"
+      };
+    }
+    return { valid: true };
+  }
+  return {
+    valid: false,
+    error_code: "E_INVALID_DISCOVERY",
+    error_message: "Discovery input must be string or object"
+  };
+}
+function validateAgentIdentityInput(input) {
+  const result = validateAgentIdentityAttestation(input);
+  if (result.ok) {
+    return { valid: true };
+  }
+  return {
+    valid: false,
+    error_code: "E_INVALID_AGENT_IDENTITY",
+    error_message: result.error
+  };
+}
+function validateAttributionInput(input) {
+  const result = validateAttributionAttestation(input);
+  if (result.ok) {
+    return { valid: true };
+  }
+  return {
+    valid: false,
+    error_code: "E_INVALID_ATTRIBUTION",
+    error_message: result.error
+  };
+}
+function validateDisputeInput(input) {
+  const result = validateDisputeAttestation(input);
+  if (result.ok) {
+    return { valid: true };
+  }
+  return {
+    valid: false,
+    error_code: "E_INVALID_DISPUTE",
+    error_message: result.error
+  };
+}
+function validateInteractionInput(input) {
+  const result = validateInteractionOrdered(input);
+  if (result.valid) {
+    return {
+      valid: true,
+      warnings: result.warnings.map((w) => w.message)
+    };
+  }
+  const firstError = result.errors[0];
+  return {
+    valid: false,
+    error_code: firstError?.code ?? "E_INVALID_INTERACTION",
+    error_message: firstError?.message ?? "Interaction validation failed"
+  };
+}
+function validateWorkflowInput(input) {
+  const result = validateWorkflowContextOrdered(input);
+  if (result.valid) {
+    return { valid: true };
+  }
+  return {
+    valid: false,
+    error_code: result.error_code,
+    error_message: result.error
+  };
+}
+function validateObligationsInput(input) {
+  const result = validateObligationsExtension(input);
+  if (result.ok) {
+    return { valid: true };
+  }
+  return {
+    valid: false,
+    error_code: "E_INVALID_OBLIGATIONS",
+    error_message: result.error
+  };
+}
+function validatePurposeInput(input) {
+  if (typeof input === "object" && input !== null) {
+    const obj = input;
+    if (obj.purpose_declared && Array.isArray(obj.purpose_declared)) {
+      for (const p of obj.purpose_declared) {
+        if (typeof p === "string" && !isValidPurposeToken(p) && !isCanonicalPurpose(p)) {
+          return {
+            valid: false,
+            error_code: "E_INVALID_PURPOSE_TOKEN",
+            error_message: `Invalid purpose token: ${p}`
+          };
+        }
+      }
+    }
+    if (obj.purpose_enforced && typeof obj.purpose_enforced === "string") {
+      if (!isValidPurposeToken(obj.purpose_enforced) && !isCanonicalPurpose(obj.purpose_enforced)) {
+        return {
+          valid: false,
+          error_code: "E_INVALID_PURPOSE_ENFORCED",
+          error_message: `Invalid enforced purpose: ${obj.purpose_enforced}`
+        };
+      }
+    }
+    return { valid: true };
+  }
+  return {
+    valid: false,
+    error_code: "E_INVALID_PURPOSE",
+    error_message: "Purpose input must be object with purpose_declared/purpose_enforced"
+  };
+}
+function validateBundleInput(input) {
+  if (typeof input !== "object" || input === null) {
+    return {
+      valid: false,
+      error_code: "E_INVALID_BUNDLE",
+      error_message: "Bundle must be an object"
+    };
+  }
+  const obj = input;
+  if (!obj.version || typeof obj.version !== "string") {
+    return {
+      valid: false,
+      error_code: "E_MISSING_VERSION",
+      error_message: "Bundle missing required version field"
+    };
+  }
+  if (!Array.isArray(obj.entries) && !Array.isArray(obj.receipts)) {
+    return {
+      valid: false,
+      error_code: "E_MISSING_ENTRIES",
+      error_message: "Bundle missing entries or receipts array"
+    };
+  }
+  return { valid: true };
+}
+function validateX402Input(input) {
+  if (typeof input !== "object" || input === null) {
+    return {
+      valid: false,
+      error_code: "E_INVALID_X402",
+      error_message: "x402 input must be an object"
+    };
+  }
+  const obj = input;
+  if (obj.accepts && Array.isArray(obj.accepts)) {
+    for (const accept of obj.accepts) {
+      if (typeof accept !== "object" || accept === null) {
+        return {
+          valid: false,
+          error_code: "E_INVALID_ACCEPTS",
+          error_message: "x402 accepts must contain payment option objects"
+        };
+      }
+    }
+    return { valid: true };
+  }
+  if (obj.rail && obj.reference) {
+    return { valid: true };
+  }
+  return {
+    valid: false,
+    error_code: "E_INVALID_X402_STRUCTURE",
+    error_message: "x402 input missing required fields (accepts or rail+reference)"
+  };
+}
+function validatePolicyInput(input) {
+  if (typeof input !== "object" || input === null) {
+    return {
+      valid: false,
+      error_code: "E_INVALID_POLICY",
+      error_message: "Policy input must be an object"
+    };
+  }
+  return { valid: true };
+}
+function validateIssueInput(input) {
+  if (typeof input === "object" && input !== null) {
+    const obj = input;
+    if (obj.claims) {
+      return validateReceiptPayload(obj.claims);
+    }
+    if (obj.payload) {
+      return validateReceiptPayload(obj.payload);
+    }
+  }
+  return { valid: true };
+}
+var CATEGORY_VALIDATORS = {
+  // Receipt claim validation
+  valid: (input) => {
+    const obj = input;
+    return validateReceiptPayload(obj.payload ?? obj.claims ?? input);
+  },
+  invalid: (input) => {
+    const obj = input;
+    return validateReceiptPayload(obj.payload ?? obj.claims ?? input);
+  },
+  edge: (input) => {
+    const obj = input;
+    return validateReceiptPayload(obj.payload ?? obj.claims ?? input);
+  },
+  // Parse-level validation (unified parser, parse-level error codes).
+  // The claims/payload ambiguity guard lives in the runner (test-harness concern).
+  parse: (input) => {
+    const obj = input;
+    return validateParseReceiptClaims(obj.claims ?? obj.payload ?? input);
+  },
+  // Category-specific validators
+  "agent-identity": validateAgentIdentityInput,
+  attribution: validateAttributionInput,
+  bundle: validateBundleInput,
+  discovery: validateDiscoveryInput,
+  dispute: validateDisputeInput,
+  interaction: validateInteractionInput,
+  issue: validateIssueInput,
+  obligations: validateObligationsInput,
+  policy: validatePolicyInput,
+  purpose: validatePurposeInput,
+  verifier: (input) => {
+    const obj = input;
+    return validateReceiptPayload(obj.payload ?? obj.claims ?? input);
+  },
+  workflow: validateWorkflowInput,
+  x402: validateX402Input
+};
+function getValidator(category) {
+  return CATEGORY_VALIDATORS[category] ?? ((input) => {
+    if (typeof input === "object" && input !== null) {
+      const obj = input;
+      if (obj.payload || obj.claims) {
+        return validateReceiptPayload(obj.payload ?? obj.claims);
+      }
+      if ("iss" in obj || "aud" in obj || "iat" in obj || "rid" in obj) {
+        return validateReceiptPayload(input);
+      }
+    }
+    return { valid: true };
+  });
+}
+
+// src/lib/conformance-runner.ts
+function getGitSha() {
+  try {
+    return execSync("git rev-parse --short HEAD", { encoding: "utf-8" }).trim();
+  } catch {
+    return void 0;
+  }
+}
+function runConformance(options, callbacks) {
+  const startTime = Date.now();
+  const { fixturesDir, level, category, implementationName, implementationVersion } = options;
+  const manifest = loadManifest(fixturesDir);
+  const entries = fs6.readdirSync(fixturesDir, { withFileTypes: true });
+  let categories = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name).sort();
+  if (category) {
+    if (!categories.includes(category)) {
+      throw new Error(`Category not found: ${category}`);
+    }
+    categories = [category];
+  }
+  const vectorsDigest = computeVectorsDigest(fixturesDir, categories);
+  const profiles = /* @__PURE__ */ new Set();
+  const results = [];
+  let passed = 0;
+  let failed = 0;
+  let skipped = 0;
+  for (const cat of categories) {
+    const categoryPath = path6.join(fixturesDir, cat);
+    const profile = getCategoryProfile(cat);
+    profiles.add(profile);
+    const validator = getValidator(cat);
+    const files = fs6.readdirSync(categoryPath).filter((f) => f.endsWith(".json")).sort();
+    for (const file of files) {
+      const filePath = path6.join(categoryPath, file);
+      const content = fs6.readFileSync(filePath, "utf8");
+      let fixture;
+      const baseTestId = `${cat}.${file.replace(".json", "")}`;
+      callbacks?.onTestStart?.(baseTestId);
+      try {
+        fixture = JSON.parse(content);
+      } catch (err) {
+        failed++;
+        const result = {
+          id: `${baseTestId}.parse`,
+          category: profile,
+          status: "fail",
+          observed: {
+            valid: false,
+            error_code: "E_INVALID_JSON",
+            error_message: err.message
+          },
+          diagnostics: {
+            error_code: "E_INVALID_JSON",
+            error_message: err.message
+          }
+        };
+        results.push(result);
+        callbacks?.onTestComplete?.(result);
+        continue;
+      }
+      const fixtureObj = fixture;
+      const isFixturePack = Array.isArray(fixtureObj.fixtures);
+      if (isFixturePack) {
+        const pack = fixture;
+        if (!shouldRunAtLevel(pack.version, level)) {
+          skipped++;
+          const result = {
+            id: baseTestId,
+            category: profile,
+            status: "skip",
+            diagnostics: {
+              skip_reason: `Fixture version ${pack.version} exceeds level ${level}`
+            }
+          };
+          results.push(result);
+          callbacks?.onTestComplete?.(result);
+          continue;
+        }
+        for (let i = 0; i < pack.fixtures.length; i++) {
+          const f = pack.fixtures[i];
+          const fixtureName = f.name ?? `fixture_${i}`;
+          const testId = `${baseTestId}.${fixtureName.replace(/\s+/g, "_")}`;
+          const inputDigest = computeCanonicalDigest(f.input);
+          callbacks?.onTestStart?.(testId);
+          if (typeof f.input === "object" && f.input !== null) {
+            const inputObj = f.input;
+            if (inputObj.claims !== void 0 && inputObj.payload !== void 0) {
+              failed++;
+              const result2 = {
+                id: testId,
+                category: profile,
+                status: "fail",
+                diagnostics: {
+                  error_message: 'Fixture has both "claims" and "payload" -- ambiguous; use one'
+                }
+              };
+              results.push(result2);
+              callbacks?.onTestComplete?.(result2);
+              continue;
+            }
+          }
+          const observed = validator(f.input);
+          const expectedValid = f.expected.valid;
+          const actualValid = observed.valid;
+          const expectedError = f.expected.error_code ?? f.expected.error;
+          const actualError = observed.error_code;
+          let status;
+          if (expectedValid && actualValid) {
+            status = "pass";
+            passed++;
+          } else if (!expectedValid && !actualValid) {
+            if (expectedError && actualError && expectedError !== actualError) {
+              status = "fail";
+              failed++;
+            } else {
+              status = "pass";
+              passed++;
+            }
+          } else {
+            status = "fail";
+            failed++;
+          }
+          const result = {
+            id: testId,
+            category: profile,
+            status,
+            expected: {
+              valid: expectedValid,
+              error_code: expectedError
+            },
+            observed: {
+              valid: actualValid,
+              error_code: actualError,
+              error_message: observed.error_message
+            },
+            diagnostics: {
+              input_digest: inputDigest,
+              warnings: observed.warnings
+            }
+          };
+          results.push(result);
+          callbacks?.onTestComplete?.(result);
+        }
+      } else {
+        const singleFixture = fixture;
+        const testId = baseTestId;
+        const manifestEntry = getManifestEntry(manifest, cat, file);
+        const inputToValidate = singleFixture.payload ?? fixture;
+        const inputDigest = singleFixture.payload ? computeCanonicalDigest(inputToValidate) : { alg: "sha-256", value: sha256(content) };
+        const expectedValid = singleFixture.expected_valid ?? manifestEntry?.expected_valid ?? (cat === "valid" || cat === "edge");
+        const expectedError = singleFixture.expected_error ?? manifestEntry?.expected_error_code;
+        const expectedPath = manifestEntry?.expected_path;
+        const expectedKeyword = manifestEntry?.expected_keyword;
+        const observed = validator(inputToValidate);
+        let status;
+        if (expectedValid && observed.valid) {
+          status = "pass";
+          passed++;
+        } else if (!expectedValid && !observed.valid) {
+          let mismatch = false;
+          if (expectedError && observed.error_code && expectedError !== observed.error_code) {
+            mismatch = true;
+          }
+          if (expectedPath && observed.error_path && expectedPath !== observed.error_path) {
+            mismatch = true;
+          }
+          if (expectedKeyword && observed.error_keyword && expectedKeyword !== observed.error_keyword) {
+            mismatch = true;
+          }
+          if (mismatch) {
+            status = "fail";
+            failed++;
+          } else {
+            status = "pass";
+            passed++;
+          }
+        } else {
+          status = "fail";
+          failed++;
+        }
+        const result = {
+          id: testId,
+          category: profile,
+          status,
+          expected: {
+            valid: expectedValid,
+            error_code: expectedError,
+            error_path: expectedPath,
+            error_keyword: expectedKeyword
+          },
+          observed: {
+            valid: observed.valid,
+            error_code: observed.error_code,
+            error_path: observed.error_path,
+            error_keyword: observed.error_keyword,
+            error_message: observed.error_message
+          },
+          diagnostics: {
+            input_digest: inputDigest,
+            warnings: observed.warnings
+          }
+        };
+        results.push(result);
+        callbacks?.onTestComplete?.(result);
+      }
+    }
+  }
+  const capabilities = [];
+  for (const cat of categories) {
+    const capability = getCategoryCapability(cat);
+    if (!capabilities.some((c) => c.profile === capability.profile)) {
+      capabilities.push(capability);
+    }
+  }
+  capabilities.sort((a, b) => a.profile.localeCompare(b.profile));
+  const endTime = Date.now();
+  const report = {
+    report_version: "peac-conformance-report/0.1",
+    suite: {
+      name: "peac-core-conformance",
+      version: "0.1.0",
+      vectors_digest: {
+        alg: "sha-256",
+        value: vectorsDigest
+      },
+      profiles: Array.from(profiles).sort(),
+      capabilities
+    },
+    implementation: {
+      name: implementationName ?? "@peac/cli",
+      version: implementationVersion ?? "0.0.0"
+    },
+    summary: {
+      passed,
+      failed,
+      skipped,
+      total: passed + failed + skipped,
+      status: failed === 0 ? "pass" : "fail"
+    },
+    results,
+    meta: {
+      generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+      duration_ms: endTime - startTime,
+      runner: {
+        name: "@peac/cli",
+        version: implementationVersion ?? "0.0.0",
+        git_sha: getGitSha()
+      }
+    }
+  };
+  return report;
+}
+function formatReportText(report) {
+  const lines = [];
+  lines.push("PEAC Conformance Test Results");
+  lines.push("=============================");
+  lines.push("");
+  lines.push(`Status: ${report.summary.status.toUpperCase()}`);
+  lines.push(`Profiles: ${report.suite.profiles.join(", ")}`);
+  lines.push("");
+  lines.push("Summary:");
+  lines.push(`  Passed:  ${report.summary.passed}`);
+  lines.push(`  Failed:  ${report.summary.failed}`);
+  lines.push(`  Skipped: ${report.summary.skipped}`);
+  lines.push(`  Total:   ${report.summary.total}`);
+  const failures = report.results.filter((r) => r.status === "fail");
+  if (failures.length > 0) {
+    lines.push("");
+    lines.push("Failures:");
+    for (const f of failures) {
+      lines.push(`  - ${f.id}`);
+      if (f.expected) {
+        lines.push(
+          `    Expected: valid=${f.expected.valid}${f.expected.error_code ? `, error=${f.expected.error_code}` : ""}`
+        );
+      }
+      if (f.observed) {
+        lines.push(
+          `    Observed: valid=${f.observed.valid}${f.observed.error_code ? `, error=${f.observed.error_code}` : ""}`
+        );
+      }
+    }
+  }
+  return lines.join("\n");
+}
+function formatReportMarkdown(report) {
+  const lines = [];
+  lines.push("# PEAC Conformance Report");
+  lines.push("");
+  lines.push(`**Status:** ${report.summary.status.toUpperCase()}`);
+  lines.push(`**Profiles:** ${report.suite.profiles.join(", ")}`);
+  lines.push("");
+  lines.push("## Summary");
+  lines.push("");
+  lines.push("| Metric | Count |");
+  lines.push("|--------|-------|");
+  lines.push(`| Passed | ${report.summary.passed} |`);
+  lines.push(`| Failed | ${report.summary.failed} |`);
+  lines.push(`| Skipped | ${report.summary.skipped} |`);
+  lines.push(`| Total | ${report.summary.total} |`);
+  const failures = report.results.filter((r) => r.status === "fail");
+  if (failures.length > 0) {
+    lines.push("");
+    lines.push("## Failures");
+    lines.push("");
+    for (const f of failures) {
+      lines.push(`### ${f.id}`);
+      lines.push("");
+      if (f.expected) {
+        lines.push(
+          `- **Expected:** valid=${f.expected.valid}${f.expected.error_code ? `, error=${f.expected.error_code}` : ""}`
+        );
+      }
+      if (f.observed) {
+        lines.push(
+          `- **Observed:** valid=${f.observed.valid}${f.observed.error_code ? `, error=${f.observed.error_code}` : ""}`
+        );
+      }
+      lines.push("");
+    }
+  }
+  return lines.join("\n");
+}
+function getVersion() {
+  try {
+    const pkgPath = join(__dirname, "..", "..", "package.json");
+    if (existsSync(pkgPath)) {
+      const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+      if (pkg.version) return pkg.version;
+    }
+  } catch {
+  }
+  try {
+    const pkgPath = join(process.cwd(), "packages", "cli", "package.json");
+    if (existsSync(pkgPath)) {
+      const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+      if (pkg.version) return pkg.version;
+    }
+  } catch {
+  }
+  return "0.0.0-unknown";
+}
+function getRuntime() {
+  return `node-${process.version.slice(1)}`;
+}
+function getCommit() {
+  return process.env.GIT_COMMIT ?? process.env.GITHUB_SHA;
+}
+
+// src/commands/conformance.ts
+function getGlobalOptions2(cmd) {
+  const parent = cmd.parent;
+  if (!parent) return {};
+  return parent.opts();
+}
+function outputError2(error, details, opts) {
+  if (opts.json) {
+    console.log(JSON.stringify({ success: false, error, ...details }, null, 2));
+  } else {
+    console.error(`Error: ${error}`);
+    if (details.code) {
+      console.error(`Code: ${details.code}`);
+    }
+    if (details.hint) {
+      console.error(`Hint: ${details.hint}`);
+    }
+  }
+}
+function findFixturesDir(customPath) {
+  if (customPath) {
+    if (fs6.existsSync(customPath)) {
+      return customPath;
+    }
+    return null;
+  }
+  const cliPath = path6.resolve(__dirname, "../../../../specs/conformance/fixtures");
+  if (fs6.existsSync(cliPath)) {
+    return cliPath;
+  }
+  const repoPath = path6.resolve(process.cwd(), "specs/conformance/fixtures");
+  if (fs6.existsSync(repoPath)) {
+    return repoPath;
+  }
+  const upPath = path6.resolve(process.cwd(), "../../specs/conformance/fixtures");
+  if (fs6.existsSync(upPath)) {
+    return upPath;
+  }
+  return null;
+}
+function listCategories(fixturesDir) {
+  const entries = fs6.readdirSync(fixturesDir, { withFileTypes: true });
+  return entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name);
+}
+function countFixtures(categoryPath) {
+  if (!fs6.existsSync(categoryPath)) return 0;
+  const files = fs6.readdirSync(categoryPath);
+  return files.filter((f) => f.endsWith(".json")).length;
+}
+var conformance = new Command("conformance").description("PEAC conformance testing (v0.10.8+)").option("--json", "Output in JSON format");
+conformance.command("run").description("Run conformance tests").option("-l, --level <level>", "Conformance level: basic, standard, full", "standard").option("-c, --category <category>", "Test specific category only").option("-o, --output <format>", "Output format: json, text, markdown", "text").option("-v, --verbose", "Show detailed test output").option("--fixtures <path>", "Path to fixtures directory").option("--implementation <name>", "Implementation name for report", "@peac/cli").action(async (options, cmd) => {
+  const globalOpts = getGlobalOptions2(cmd);
+  const startTime = Date.now();
+  try {
+    const fixturesDir = findFixturesDir(options.fixtures);
+    if (!fixturesDir) {
+      outputError2(
+        "Fixtures directory not found",
+        {
+          hint: options.fixtures ? `Specified path does not exist: ${options.fixtures}` : "Run from repo root, specify --fixtures <path>, or ensure specs/conformance/fixtures is available"
+        },
+        globalOpts
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const validLevels = ["basic", "standard", "full"];
+    if (!validLevels.includes(options.level)) {
+      outputError2(
+        "Invalid conformance level",
+        {
+          level: options.level,
+          valid: validLevels
+        },
+        globalOpts
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const callbacks = options.verbose ? {
+      onTestStart: (testId) => {
+        console.log(`Running: ${testId}`);
+      },
+      onTestComplete: (result) => {
+        const status = result.status === "pass" ? "PASS" : result.status === "fail" ? "FAIL" : "SKIP";
+        console.log(`  ${status}: ${result.id}`);
+      }
+    } : void 0;
+    const report = runConformance(
+      {
+        fixturesDir,
+        level: options.level,
+        category: options.category,
+        implementationName: options.implementation,
+        implementationVersion: getVersion()
+      },
+      callbacks
+    );
+    report.implementation.runtime = getRuntime();
+    const commit = getCommit();
+    if (commit) {
+      report.implementation.commit = commit;
+    }
+    report.meta = {
+      generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+      runner: {
+        name: "peac-cli",
+        version: getVersion()
+      },
+      duration_ms: Date.now() - startTime
+    };
+    if (options.output === "json" || globalOpts.json) {
+      console.log(JSON.stringify(report, null, 2));
+    } else if (options.output === "markdown") {
+      console.log(formatReportMarkdown(report));
+    } else {
+      console.log(formatReportText(report));
+    }
+    process.exitCode = report.summary.failed === 0 ? 0 : 1;
+  } catch (err) {
+    outputError2(err.message, {}, globalOpts);
+    process.exitCode = 1;
+  }
+});
+conformance.command("list").description("List available conformance test fixtures").option("-c, --category <category>", "List fixtures in specific category").option("--fixtures <path>", "Path to fixtures directory").action((options, cmd) => {
+  const globalOpts = getGlobalOptions2(cmd);
+  try {
+    const fixturesDir = findFixturesDir(options.fixtures);
+    if (!fixturesDir) {
+      outputError2(
+        "Fixtures directory not found",
+        {
+          hint: options.fixtures ? `Specified path does not exist: ${options.fixtures}` : "Run from repo root, specify --fixtures <path>, or ensure specs/conformance/fixtures is available"
+        },
+        globalOpts
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const manifestPath = path6.join(fixturesDir, "manifest.json");
+    const manifest = fs6.existsSync(manifestPath) ? JSON.parse(fs6.readFileSync(manifestPath, "utf8")) : {};
+    const categories = listCategories(fixturesDir);
+    if (options.category) {
+      if (!categories.includes(options.category)) {
+        outputError2(
+          "Category not found",
+          {
+            category: options.category,
+            available: categories
+          },
+          globalOpts
+        );
+        process.exitCode = 1;
+        return;
+      }
+      const categoryPath = path6.join(fixturesDir, options.category);
+      const files = fs6.readdirSync(categoryPath).filter((f) => f.endsWith(".json"));
+      const categoryManifest = manifest[options.category];
+      if (globalOpts.json) {
+        const fixtures = files.map((f) => ({
+          file: f,
+          description: categoryManifest?.[f]?.description || "No description"
+        }));
+        console.log(JSON.stringify({ category: options.category, fixtures }, null, 2));
+      } else {
+        console.log(`Fixtures in ${options.category}:
+`);
+        for (const file of files) {
+          const info = categoryManifest?.[file] || {};
+          const desc = info.description || "No description";
+          console.log(`  ${file}`);
+          console.log(`    ${desc}
+`);
+        }
+      }
+    } else {
+      if (globalOpts.json) {
+        const categorySummary = categories.map((cat) => ({
+          name: cat,
+          fixture_count: countFixtures(path6.join(fixturesDir, cat))
+        }));
+        console.log(JSON.stringify({ categories: categorySummary }, null, 2));
+      } else {
+        console.log(`Available conformance test categories:
+`);
+        for (const cat of categories) {
+          const count = countFixtures(path6.join(fixturesDir, cat));
+          console.log(`  ${cat} (${count} fixtures)`);
+        }
+        console.log(`
+Use 'peac conformance list -c <category>' to see fixtures in a category.`);
+      }
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    outputError2(err.message, {}, globalOpts);
+    process.exitCode = 1;
+  }
+});
+var EMBEDDED_SAMPLES = [
+  {
+    id: "basic-receipt",
+    name: "Basic Receipt",
+    description: "Minimal valid PEAC receipt with only required fields",
+    category: "valid",
+    claims: {
+      iss: "https://sandbox.peacprotocol.org",
+      aud: "https://example.com",
+      iat: 0,
+      // Placeholder - will be set at generation time
+      exp: 0,
+      // Placeholder - will be set at generation time
+      rid: "sample-basic-001"
+    }
+  },
+  {
+    id: "full-receipt",
+    name: "Full Receipt",
+    description: "PEAC receipt with all optional claims populated",
+    category: "valid",
+    claims: {
+      iss: "https://sandbox.peacprotocol.org",
+      aud: "https://api.example.com",
+      sub: "user:demo-user",
+      iat: 0,
+      exp: 0,
+      rid: "sample-full-001",
+      purpose_declared: ["search", "index"],
+      purpose_enforced: "search",
+      purpose_reason: "allowed"
+    }
+  },
+  {
+    id: "interaction-evidence",
+    name: "Interaction Evidence",
+    description: "Receipt with InteractionEvidence extension for AI agent calls",
+    category: "valid",
+    claims: {
+      iss: "https://sandbox.peacprotocol.org",
+      aud: "https://agent.example.com",
+      sub: "agent:demo-agent-v1",
+      iat: 0,
+      exp: 0,
+      rid: "sample-ie-001",
+      ext: {
+        "org.peacprotocol/interaction@0.1": {
+          version: "0.1",
+          interaction_id: "int_sample_001",
+          started_at: "2026-01-01T00:00:00.000Z",
+          completed_at: "2026-01-01T00:00:01.000Z",
+          outcome: { kind: "success" },
+          input: { hash: "sha256:abc123...", byte_length: 1024 },
+          output: { hash: "sha256:def456...", byte_length: 2048 }
+        }
+      }
+    }
+  },
+  {
+    id: "payment-evidence",
+    name: "Payment Evidence",
+    description: "Receipt with payment evidence (402 flow)",
+    category: "valid",
+    claims: {
+      iss: "https://sandbox.peacprotocol.org",
+      aud: "https://api.example.com",
+      iat: 0,
+      exp: 0,
+      rid: "sample-payment-001",
+      amt: "100",
+      cur: "USD",
+      payment: {
+        rail: "x402",
+        reference: "pay_sample_001",
+        amount: "100",
+        currency: "USD"
+      }
+    }
+  },
+  {
+    id: "long-expiry",
+    name: "Long Expiry",
+    description: "Receipt with 24-hour expiration",
+    category: "valid",
+    claims: {
+      iss: "https://sandbox.peacprotocol.org",
+      aud: "https://example.com",
+      iat: 0,
+      exp: 0,
+      // Will be set to iat + 86400 at generation time
+      rid: "sample-long-expiry-001"
+    }
+  },
+  {
+    id: "expired",
+    name: "Expired Receipt",
+    description: "Receipt that has already expired (for testing rejection)",
+    category: "invalid",
+    claims: {
+      iss: "https://sandbox.peacprotocol.org",
+      aud: "https://example.com",
+      iat: 0,
+      // Will be set to now - 7200 at generation time
+      exp: 0,
+      // Will be set to now - 3600 at generation time
+      rid: "sample-expired-001"
+    },
+    expectedError: "E_EXPIRED_RECEIPT"
+  },
+  {
+    id: "future-iat",
+    name: "Future IAT",
+    description: "Receipt with iat in the future (should be rejected)",
+    category: "invalid",
+    claims: {
+      iss: "https://sandbox.peacprotocol.org",
+      aud: "https://example.com",
+      iat: 0,
+      // Will be set to now + 3600 at generation time
+      exp: 0,
+      // Will be set to now + 7200 at generation time
+      rid: "sample-future-iat-001"
+    },
+    expectedError: "E_FUTURE_IAT"
+  },
+  {
+    id: "missing-iss",
+    name: "Missing Issuer",
+    description: "Receipt missing required iss claim (for testing validation)",
+    category: "invalid",
+    claims: {
+      aud: "https://example.com",
+      iat: 0,
+      exp: 0,
+      rid: "sample-no-iss-001"
+    },
+    expectedError: "E_MISSING_CLAIM"
+  }
+];
+function findSamplesDir(customPath) {
+  if (customPath) {
+    if (fs6.existsSync(customPath)) {
+      return customPath;
+    }
+    return null;
+  }
+  const cliPath = path6.resolve(__dirname, "../../../../specs/conformance/samples");
+  if (fs6.existsSync(cliPath)) {
+    return cliPath;
+  }
+  const repoPath = path6.resolve(process.cwd(), "specs/conformance/samples");
+  if (fs6.existsSync(repoPath)) {
+    return repoPath;
+  }
+  const upPath = path6.resolve(process.cwd(), "../../specs/conformance/samples");
+  if (fs6.existsSync(upPath)) {
+    return upPath;
+  }
+  return null;
+}
+function loadSampleFromFile(filePath, id, category) {
+  try {
+    const content = JSON.parse(fs6.readFileSync(filePath, "utf8"));
+    const claims = content.payload ?? content.claims ?? content;
+    const description = content.$comment ?? content.description ?? `Sample ${id}`;
+    return {
+      id,
+      name: id.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" "),
+      description,
+      category,
+      claims,
+      header: content.header,
+      expectedError: content.expected_error
+    };
+  } catch {
+    return null;
+  }
+}
+function loadSamplesFromDir(samplesDir) {
+  const samples2 = [];
+  const validDir = path6.join(samplesDir, "valid");
+  if (fs6.existsSync(validDir)) {
+    const files = fs6.readdirSync(validDir).filter((f) => f.endsWith(".json"));
+    for (const file of files) {
+      const id = file.replace(".json", "");
+      const sample = loadSampleFromFile(path6.join(validDir, file), id, "valid");
+      if (sample) samples2.push(sample);
+    }
+  }
+  const invalidDir = path6.join(samplesDir, "invalid");
+  if (fs6.existsSync(invalidDir)) {
+    const files = fs6.readdirSync(invalidDir).filter((f) => f.endsWith(".json"));
+    for (const file of files) {
+      const id = file.replace(".json", "");
+      const sample = loadSampleFromFile(path6.join(invalidDir, file), id, "invalid");
+      if (sample) samples2.push(sample);
+    }
+  }
+  const edgeDir = path6.join(samplesDir, "edge");
+  if (fs6.existsSync(edgeDir)) {
+    const files = fs6.readdirSync(edgeDir).filter((f) => f.endsWith(".json"));
+    for (const file of files) {
+      const id = file.replace(".json", "");
+      const sample = loadSampleFromFile(path6.join(edgeDir, file), id, "edge");
+      if (sample) samples2.push(sample);
+    }
+  }
+  return samples2;
+}
+function getSamples(customSamplesPath) {
+  const samplesDir = findSamplesDir(customSamplesPath);
+  if (samplesDir) {
+    const dirSamples = loadSamplesFromDir(samplesDir);
+    if (dirSamples.length > 0) {
+      return dirSamples;
+    }
+  }
+  return EMBEDDED_SAMPLES;
+}
+function getSampleById(id, customSamplesPath) {
+  const samples2 = getSamples(customSamplesPath);
+  return samples2.find((s) => s.id === id) ?? null;
+}
+
+// src/commands/samples.ts
+function getGlobalOptions3(cmd) {
+  const parent = cmd.parent;
+  if (!parent) return {};
+  return parent.opts();
+}
+function outputError3(error, details, opts) {
+  if (opts.json) {
+    console.log(JSON.stringify({ success: false, error, ...details }, null, 2));
+  } else {
+    console.error(`Error: ${error}`);
+    if (details.hint) {
+      console.error(`Hint: ${details.hint}`);
+    }
+  }
+}
+function applyTimeAdjustments(claims, sampleId, now) {
+  const adjusted = { ...claims };
+  const standardExpiry = 3600;
+  const longExpiry = 86400;
+  switch (sampleId) {
+    case "expired":
+      adjusted.iat = now - 7200;
+      adjusted.exp = now - 3600;
+      break;
+    case "future-iat":
+      adjusted.iat = now + 3600;
+      adjusted.exp = now + 7200;
+      break;
+    case "long-expiry":
+      adjusted.iat = now;
+      adjusted.exp = now + longExpiry;
+      break;
+    default:
+      if (adjusted.iat === 0 || !adjusted.iat) {
+        adjusted.iat = now;
+      }
+      if (adjusted.exp === 0 || !adjusted.exp) {
+        adjusted.exp = now + standardExpiry;
+      }
+  }
+  return adjusted;
+}
+var samples = new Command("samples").description("Work with PEAC sample receipts (v0.10.8+)").option("--json", "Output in JSON format");
+samples.command("list").description("List available sample receipts").option("-c, --category <category>", "Filter by category: valid, invalid, edge").option("--samples <path>", "Path to samples directory").action((options, cmd) => {
+  const globalOpts = getGlobalOptions3(cmd);
+  try {
+    const allSamples = getSamples(options.samples);
+    let filteredSamples = allSamples;
+    if (options.category) {
+      filteredSamples = allSamples.filter((s) => s.category === options.category);
+      if (filteredSamples.length === 0) {
+        outputError3("No samples in category", { category: options.category }, globalOpts);
+        process.exitCode = 1;
+        return;
+      }
+    }
+    if (globalOpts.json) {
+      const data = filteredSamples.map((s) => ({
+        id: s.id,
+        name: s.name,
+        description: s.description,
+        category: s.category
+      }));
+      console.log(JSON.stringify({ samples: data }, null, 2));
+    } else {
+      console.log("Available PEAC Sample Receipts\n");
+      console.log("VALID SAMPLES:");
+      for (const s of filteredSamples.filter((x) => x.category === "valid")) {
+        console.log(`  ${s.id}`);
+        console.log(`    ${s.description}
+`);
+      }
+      const invalid = filteredSamples.filter((x) => x.category === "invalid");
+      if (invalid.length > 0) {
+        console.log("\nINVALID SAMPLES (for testing rejection):");
+        for (const s of invalid) {
+          console.log(`  ${s.id}`);
+          console.log(`    ${s.description}
+`);
+        }
+      }
+      const edge = filteredSamples.filter((x) => x.category === "edge");
+      if (edge.length > 0) {
+        console.log("\nEDGE CASE SAMPLES:");
+        for (const s of edge) {
+          console.log(`  ${s.id}`);
+          console.log(`    ${s.description}
+`);
+        }
+      }
+      console.log('\nUse "peac samples show <id>" to see sample details.');
+      console.log('Use "peac samples generate -o <dir>" to generate sample files.');
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    outputError3(err.message, {}, globalOpts);
+    process.exitCode = 1;
+  }
+});
+samples.command("show").description("Show details of a specific sample").argument("<id>", "Sample ID").option("--samples <path>", "Path to samples directory").action((id, options, cmd) => {
+  const globalOpts = getGlobalOptions3(cmd);
+  try {
+    const sample = getSampleById(id, options.samples);
+    if (!sample) {
+      const allSamples = getSamples(options.samples);
+      const available = allSamples.map((s) => s.id);
+      outputError3("Sample not found", { id, available }, globalOpts);
+      process.exitCode = 1;
+      return;
+    }
+    if (globalOpts.json) {
+      console.log(JSON.stringify(sample, null, 2));
+    } else {
+      console.log(`Sample: ${sample.name}
+`);
+      console.log(`ID: ${sample.id}`);
+      console.log(`Category: ${sample.category}`);
+      console.log(`Description: ${sample.description}
+`);
+      console.log("Claims:");
+      console.log(JSON.stringify(sample.claims, null, 2));
+      if (sample.expectedError) {
+        console.log(`
+Expected Error: ${sample.expectedError}`);
+      }
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    outputError3(err.message, {}, globalOpts);
+    process.exitCode = 1;
+  }
+});
+samples.command("generate").description("Generate sample receipt files").requiredOption("-o, --output <dir>", "Output directory").option("-f, --format <format>", "Output format: jws, json, bundle", "jws").option("--category <category>", "Generate only specific category").option("--samples <path>", "Path to samples directory").option("--now <timestamp>", "Unix timestamp for iat/exp (for deterministic generation)").option("--kid <kid>", "Key ID to use").action(async (options, cmd) => {
+  const globalOpts = getGlobalOptions3(cmd);
+  try {
+    const outputDir = options.output;
+    const validDir = path6.join(outputDir, "valid");
+    const invalidDir = path6.join(outputDir, "invalid");
+    const edgeDir = path6.join(outputDir, "edge");
+    const bundlesDir = path6.join(outputDir, "bundles");
+    fs6.mkdirSync(validDir, { recursive: true });
+    fs6.mkdirSync(invalidDir, { recursive: true });
+    fs6.mkdirSync(edgeDir, { recursive: true });
+    fs6.mkdirSync(bundlesDir, { recursive: true });
+    const now = options.now ? parseInt(options.now, 10) : Math.floor(Date.now() / 1e3);
+    const keyPair = await generateKeypair();
+    const publicKeyBytes = keyPair.publicKey;
+    const privateKeyBytes = keyPair.privateKey;
+    const kid = options.kid || `sandbox-${new Date(now * 1e3).toISOString().slice(0, 7)}`;
+    const publicJwk = {
+      kty: "OKP",
+      crv: "Ed25519",
+      x: base64urlEncode(publicKeyBytes),
+      kid,
+      use: "sig",
+      alg: "EdDSA"
+    };
+    const generatedFiles = [];
+    let samplesToGenerate = getSamples(options.samples);
+    if (options.category) {
+      samplesToGenerate = samplesToGenerate.filter((s) => s.category === options.category);
+    }
+    for (const sample of samplesToGenerate) {
+      const targetDir = sample.category === "valid" ? validDir : sample.category === "edge" ? edgeDir : invalidDir;
+      const filename = `${sample.id}.${options.format === "json" ? "json" : "jws"}`;
+      const filepath = path6.join(targetDir, filename);
+      const adjustedClaims = applyTimeAdjustments(sample.claims, sample.id, now);
+      if (options.format === "json") {
+        const output2 = {
+          $comment: sample.description,
+          header: {
+            alg: "EdDSA",
+            typ: "peac-receipt/0.1",
+            kid
+          },
+          payload: adjustedClaims,
+          ...sample.expectedError ? { expected_error: sample.expectedError } : {}
+        };
+        fs6.writeFileSync(filepath, JSON.stringify(output2, null, 2));
+      } else {
+        const jws = await sign(adjustedClaims, privateKeyBytes, kid);
+        fs6.writeFileSync(filepath, jws);
+      }
+      generatedFiles.push(filepath);
+    }
+    const jwksPath = path6.join(bundlesDir, "sandbox-jwks.json");
+    const jwks = {
+      keys: [publicJwk]
+    };
+    fs6.writeFileSync(jwksPath, JSON.stringify(jwks, null, 2));
+    generatedFiles.push(jwksPath);
+    const bundlePath = path6.join(bundlesDir, "offline-verification.json");
+    const bundle = {
+      $comment: "Offline verification bundle with sample receipts and JWKS",
+      description: "Bundle for offline verification testing. Contains test JWKS and sample metadata.",
+      generated_at: new Date(now * 1e3).toISOString(),
+      generator: {
+        name: "peac-cli",
+        version: getVersion()
+      },
+      jwks,
+      samples: samplesToGenerate.map((s) => ({
+        id: s.id,
+        description: s.description,
+        category: s.category
+      })),
+      notes: [
+        "Sample timestamps are based on --now parameter or generation time.",
+        "Do NOT use sandbox samples in production."
+      ]
+    };
+    fs6.writeFileSync(bundlePath, JSON.stringify(bundle, null, 2));
+    generatedFiles.push(bundlePath);
+    if (globalOpts.json) {
+      console.log(
+        JSON.stringify(
+          {
+            success: true,
+            output_dir: outputDir,
+            files_generated: generatedFiles.length,
+            files: generatedFiles,
+            timestamp: now,
+            kid
+          },
+          null,
+          2
+        )
+      );
+    } else {
+      console.log(`Sample receipts generated successfully!
+`);
+      console.log(`Output directory: ${outputDir}`);
+      console.log(`Files generated: ${generatedFiles.length}`);
+      console.log(`Timestamp: ${now} (${new Date(now * 1e3).toISOString()})`);
+      console.log(`Key ID: ${kid}
+`);
+      console.log("Generated files:");
+      for (const f of generatedFiles) {
+        console.log(`  ${path6.relative(outputDir, f)}`);
+      }
+      console.log(`
+JWKS for verification: ${path6.relative(outputDir, jwksPath)}`);
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    outputError3(err.message, {}, globalOpts);
+    process.exitCode = 1;
+  }
+});
+
+// src/index.ts
+var program = new Command();
+program.name("peac").description("PEAC protocol command-line tools").version(getVersion()).exitOverride();
+program.command("verify").description("Verify a PEAC receipt JWS").argument("<jws>", "JWS compact serialization or path to file containing JWS").option("-v, --verbose", "Show detailed output").action(async (jwsInput, options) => {
+  try {
+    let jws = jwsInput;
+    if (fs6.existsSync(jwsInput)) {
+      jws = fs6.readFileSync(jwsInput, "utf-8").trim();
+    }
+    console.log("Verifying PEAC receipt...\n");
+    const { header, payload } = decode(jws);
+    console.log("Receipt Information:");
+    console.log(`   Receipt ID: ${payload.rid}`);
+    console.log(`   Issuer:     ${payload.iss}`);
+    console.log(`   Audience:   ${payload.aud}`);
+    console.log(`   Amount:     ${payload.amt} ${payload.cur}`);
+    console.log(`   Payment:    ${payload.payment.rail} (${payload.payment.reference})`);
+    console.log(`   Issued:     ${new Date(payload.iat * 1e3).toISOString()}`);
+    if (payload.exp) {
+      console.log(`   Expires:    ${new Date(payload.exp * 1e3).toISOString()}`);
+    }
+    console.log();
+    console.log("Verifying signature...");
+    const result = await verifyReceipt(jws);
+    if (result.ok) {
+      console.log("Signature valid!");
+      if (result.perf) {
+        console.log(`   Verification time: ${result.perf.verify_ms.toFixed(2)}ms`);
+        if (result.perf.jwks_fetch_ms) {
+          console.log(`   JWKS fetch time: ${result.perf.jwks_fetch_ms.toFixed(2)}ms`);
+        }
+      }
+      process.exitCode = 0;
+    } else {
+      console.log(`Verification failed: ${result.reason}`);
+      if (result.details) {
+        console.log(`   Details: ${result.details}`);
+      }
+      process.exitCode = 1;
+    }
+  } catch (err) {
+    console.error("Error:", err instanceof Error ? err.message : String(err));
+    process.exitCode = 1;
+  }
+});
+program.command("validate-issuer").description("Validate a PEAC issuer configuration").argument("<input>", "Path to peac-issuer.json file or issuer URL").action(async (input) => {
+  try {
+    console.log("Validating issuer configuration...\n");
+    let config;
+    if (input.startsWith("http://") || input.startsWith("https://")) {
+      console.log(`Fetching from ${input}...`);
+      config = await fetchIssuerConfig(input);
+    } else {
+      const text = fs6.readFileSync(input, "utf-8");
+      config = parseIssuerConfig(text);
+    }
+    console.log("Issuer configuration is valid!\n");
+    console.log("Issuer Configuration:");
+    console.log(`   Version:   ${config.version}`);
+    console.log(`   Issuer:    ${config.issuer}`);
+    console.log(`   JWKS URI:  ${config.jwks_uri}`);
+    if (config.verify_endpoint) {
+      console.log(`   Verify:    ${config.verify_endpoint}`);
+    }
+    if (config.receipt_versions && config.receipt_versions.length > 0) {
+      console.log(`   Receipts:  ${config.receipt_versions.join(", ")}`);
+    }
+    if (config.algorithms && config.algorithms.length > 0) {
+      console.log(`   Algorithms: ${config.algorithms.join(", ")}`);
+    }
+    if (config.payment_rails && config.payment_rails.length > 0) {
+      console.log(`   Rails:     ${config.payment_rails.join(", ")}`);
+    }
+    if (config.security_contact) {
+      console.log(`   Security:  ${config.security_contact}`);
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    console.error("Error:", err instanceof Error ? err.message : String(err));
+    process.exitCode = 1;
+  }
+});
+program.command("decode").description("Decode a PEAC receipt JWS (without verification)").argument("<jws>", "JWS compact serialization or path to file containing JWS").option("--json", "Output as JSON").action((jwsInput, options) => {
+  try {
+    let jws = jwsInput;
+    if (fs6.existsSync(jwsInput)) {
+      jws = fs6.readFileSync(jwsInput, "utf-8").trim();
+    }
+    const { header, payload } = decode(jws);
+    if (options.json) {
+      console.log(JSON.stringify({ header, payload }, null, 2));
+    } else {
+      console.log("PEAC Receipt (Decoded, Not Verified)\n");
+      console.log("Header:");
+      console.log(`   typ: ${header.typ}`);
+      console.log(`   alg: ${header.alg}`);
+      console.log(`   kid: ${header.kid}`);
+      console.log();
+      console.log("Claims:");
+      console.log(`   iss: ${payload.iss}`);
+      console.log(`   aud: ${payload.aud}`);
+      console.log(`   iat: ${payload.iat} (${new Date(payload.iat * 1e3).toISOString()})`);
+      if (payload.exp) {
+        console.log(`   exp: ${payload.exp} (${new Date(payload.exp * 1e3).toISOString()})`);
+      }
+      console.log(`   rid: ${payload.rid}`);
+      console.log(`   amt: ${payload.amt}`);
+      console.log(`   cur: ${payload.cur}`);
+      console.log();
+      console.log("Payment:");
+      console.log(`   rail:      ${payload.payment.rail}`);
+      console.log(`   reference: ${payload.payment.reference}`);
+      console.log(`   amount:    ${payload.payment.amount}`);
+      console.log(`   currency:  ${payload.payment.currency}`);
+      if (payload.subject) {
+        console.log();
+        console.log("Subject:");
+        console.log(`   uri: ${payload.subject.uri}`);
+      }
+      if (payload.ext) {
+        console.log();
+        console.log("Extensions:");
+        console.log(JSON.stringify(payload.ext, null, 2));
+      }
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    console.error("Error:", err instanceof Error ? err.message : String(err));
+    process.exitCode = 1;
+  }
+});
+program.addCommand(policy);
+program.addCommand(conformance);
+program.addCommand(samples);
+try {
+  program.parse();
+} catch (err) {
+  if (err instanceof CommanderError) {
+    process.exitCode = err.exitCode;
+  } else {
+    throw err;
+  }
+}
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map