@peac/cli 0.12.10 → 0.12.12

package/dist/index.mjs

@@ -12,6 +12,7 @@ import { createHash } from 'crypto';
 import { computeReceiptRef, validateWorkflowContextOrdered, isValidPurposeToken, isCanonicalPurpose, validateObligationsExtension, validateInteractionOrdered, validateDisputeAttestation, validateAttributionAttestation, validateAgentIdentityAttestation, ReceiptClaimsSchema, parseReceiptClaims } from '@peac/schema';
 import { parse } from '@peac/disc';
 import { readDisputeBundle } from '@peac/audit';
+import { createRequire } from 'module';
 
 function getGlobalOptions(cmd) {
   const parent = cmd.parent;
@@ -565,9 +566,9 @@ policy.command("show-profile").description("Show details of a specific policy pr
 function sha256(content) {
   return createHash("sha256").update(content, "utf8").digest("hex");
 }
-function zodPathToJsonPointer(path8) {
-  if (path8.length === 0) return "";
-  return "/" + path8.map((segment) => {
+function zodPathToJsonPointer(path9) {
+  if (path9.length === 0) return "";
+  return "/" + path9.map((segment) => {
     const str = String(segment);
     return str.replace(/~/g, "~0").replace(/\//g, "~1");
   }).join("/");
@@ -2368,6 +2369,209 @@ function reconcileCommand() {
   );
   return reconcile;
 }
+var requireFrom = createRequire(path6.join(process.cwd(), "package.json"));
+function paint(status, msg) {
+  const labels = {
+    green: "PASS",
+    yellow: "WARN",
+    red: "FAIL"
+  };
+  return `[${labels[status]}] ${msg}`;
+}
+function parseMajor(nodeVersion) {
+  const m = /^v(\d+)\./.exec(nodeVersion);
+  return m ? parseInt(m[1], 10) : 0;
+}
+function checkNodeVersion() {
+  const major = parseMajor(process.version);
+  if (major >= 22) {
+    return {
+      name: "Node version",
+      status: "green",
+      detail: `${process.version} (>= 22 required)`
+    };
+  }
+  return {
+    name: "Node version",
+    status: "red",
+    detail: `${process.version} is below the required Node >= 22`
+  };
+}
+function checkPackageResolution() {
+  const required = ["@peac/protocol", "@peac/crypto", "@peac/schema", "@peac/kernel"];
+  const missing = [];
+  for (const pkg of required) {
+    try {
+      requireFrom.resolve(pkg);
+    } catch {
+      missing.push(pkg);
+    }
+  }
+  if (missing.length === 0) {
+    return {
+      name: "Package resolution",
+      status: "green",
+      detail: `${required.length} required packages resolvable`
+    };
+  }
+  return {
+    name: "Package resolution",
+    status: "red",
+    detail: `${missing.length} missing: ${missing.join(", ")}`
+  };
+}
+function checkKeyMaterial(cwd) {
+  const env = process.env.PEAC_ISSUER_KEY || "";
+  if (env) {
+    if (env.startsWith("env:") || env.startsWith("file:")) {
+      return {
+        name: "Issuer key material",
+        status: "green",
+        detail: `PEAC_ISSUER_KEY set via ${env.split(":")[0]}:... scheme`
+      };
+    }
+    return {
+      name: "Issuer key material",
+      status: "yellow",
+      detail: "PEAC_ISSUER_KEY set but not using env: or file: scheme"
+    };
+  }
+  const candidatePaths = [
+    path6.join(cwd, "issuer.jwk.json"),
+    path6.join(cwd, ".peac/issuer.jwk.json")
+  ];
+  for (const p of candidatePaths) {
+    if (fs6.existsSync(p)) {
+      return {
+        name: "Issuer key material",
+        status: "yellow",
+        detail: `found ${path6.relative(cwd, p)}; prefer PEAC_ISSUER_KEY env var`
+      };
+    }
+  }
+  return {
+    name: "Issuer key material",
+    status: "yellow",
+    detail: "not found (issuance disabled; read-only tools still work)"
+  };
+}
+function checkPeacTxt(cwd) {
+  const p = path6.join(cwd, ".well-known/peac.txt");
+  if (fs6.existsSync(p)) {
+    return {
+      name: "peac.txt presence",
+      status: "green",
+      detail: `.well-known/peac.txt present at ${p}`
+    };
+  }
+  return {
+    name: "peac.txt presence",
+    status: "yellow",
+    detail: "no .well-known/peac.txt (discovery-layer check; optional for tool callers)"
+  };
+}
+async function checkOnlineJwks(issuerUrl, timeoutMs) {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+  try {
+    const cfgUrl = new URL("/.well-known/peac-issuer.json", issuerUrl).toString();
+    const res = await fetch(cfgUrl, { signal: ctrl.signal });
+    if (res.status !== 200) {
+      return {
+        name: "Issuer configuration",
+        status: "red",
+        detail: `${cfgUrl} returned ${res.status}`
+      };
+    }
+    const cfg = await res.json();
+    const jwksUri = cfg.jwks_uri;
+    if (!jwksUri) {
+      return {
+        name: "Issuer configuration",
+        status: "red",
+        detail: `${cfgUrl} missing jwks_uri`
+      };
+    }
+    const jwksRes = await fetch(jwksUri, { signal: ctrl.signal });
+    if (jwksRes.status !== 200) {
+      return {
+        name: "Issuer configuration",
+        status: "red",
+        detail: `jwks_uri ${jwksUri} returned ${jwksRes.status}`
+      };
+    }
+    const jwks = await jwksRes.json();
+    const keyCount = Array.isArray(jwks.keys) ? jwks.keys.length : 0;
+    if (keyCount === 0) {
+      return {
+        name: "Issuer configuration",
+        status: "red",
+        detail: `jwks_uri ${jwksUri} returned empty keys array`
+      };
+    }
+    return {
+      name: "Issuer configuration",
+      status: "green",
+      detail: `${cfgUrl} + jwks_uri resolvable with ${keyCount} key(s)`
+    };
+  } catch (err) {
+    return {
+      name: "Issuer configuration",
+      status: "red",
+      detail: `fetch failed: ${err instanceof Error ? err.message : String(err)}`
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function runDoctor(options) {
+  const results = [];
+  results.push(checkNodeVersion());
+  results.push(checkPackageResolution());
+  results.push(checkKeyMaterial(options.cwd));
+  results.push(checkPeacTxt(options.cwd));
+  if (options.online) {
+    if (!options.issuer) {
+      results.push({
+        name: "Issuer configuration",
+        status: "yellow",
+        detail: "--online set but --issuer <url> not provided; skipping remote check"
+      });
+    } else {
+      results.push(await checkOnlineJwks(options.issuer, options.timeout));
+    }
+  } else {
+    results.push({
+      name: "Issuer configuration",
+      status: "yellow",
+      detail: "offline mode (default); pass --online --issuer <url> to enable remote check"
+    });
+  }
+  console.log("\npeac doctor");
+  console.log("-----------");
+  for (const r of results) {
+    console.log(paint(r.status, `${r.name}: ${r.detail}`));
+  }
+  const hasRed = results.some((r) => r.status === "red");
+  console.log(hasRed ? "\nFAIL: one or more checks are red." : "\nOK: no red checks.");
+  return hasRed ? 1 : 0;
+}
+function doctor(program2) {
+  program2.command("doctor").description("Run PEAC installability diagnostics (offline by default)").option("--online", "enable remote checks (issuer configuration, JWKS)", false).option("--issuer <url>", "issuer URL for --online checks (https://...)").option(
+    "--timeout <ms>",
+    "timeout for remote checks in milliseconds",
+    (v) => parseInt(v, 10),
+    5e3
+  ).action(async (opts) => {
+    const exitCode = await runDoctor({
+      online: !!opts.online,
+      issuer: opts.issuer,
+      timeout: opts.timeout,
+      cwd: process.cwd()
+    });
+    process.exit(exitCode);
+  });
+}
 
 // src/index.ts
 var program = new Command();
@@ -2504,6 +2708,7 @@ program.addCommand(policy);
 program.addCommand(conformance);
 program.addCommand(samples);
 program.addCommand(reconcileCommand());
+doctor(program);
 try {
   program.parse();
 } catch (err) {