@peac/cli 0.12.9 → 0.12.11

package/dist/commands/doctor.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `peac doctor`: installability diagnostics.
+ *
+ * Runs a fixed set of offline-first checks that flag common PEAC
+ * installation problems (Node version, required package resolution,
+ * tracked config presence). Remote checks (JWKS reachability, reference
+ * verifier reachability) are opt-in via the --online flag; by default
+ * the command performs zero network calls.
+ *
+ * Each check reports green / yellow / red. Exit code is 0 when all
+ * required checks are green or yellow; 1 when any required check is
+ * red.
+ */
+import { Command } from 'commander';
+export declare function runDoctor(options: {
+    online: boolean;
+    issuer?: string;
+    timeout: number;
+    cwd: string;
+}): Promise<number>;
+export declare function doctor(program: Command): void;
+//# sourceMappingURL=doctor.d.ts.map

package/dist/commands/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAkLpC,wBAAsB,SAAS,CAAC,OAAO,EAAE;IACvC,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,MAAM,CAAC,CAkClB;AAED,wBAAgB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqB7C"}

package/dist/index.cjs

@@ -12,6 +12,7 @@ var crypto$1 = require('crypto');
 var schema = require('@peac/schema');
 var disc = require('@peac/disc');
 var audit = require('@peac/audit');
+var module$1 = require('module');
 
 function _interopNamespace(e) {
   if (e && e.__esModule) return e;
@@ -586,9 +587,9 @@ policy.command("show-profile").description("Show details of a specific policy pr
 function sha256(content) {
   return crypto$1.createHash("sha256").update(content, "utf8").digest("hex");
 }
-function zodPathToJsonPointer(path8) {
-  if (path8.length === 0) return "";
-  return "/" + path8.map((segment) => {
+function zodPathToJsonPointer(path9) {
+  if (path9.length === 0) return "";
+  return "/" + path9.map((segment) => {
     const str = String(segment);
     return str.replace(/~/g, "~0").replace(/\//g, "~1");
   }).join("/");
@@ -2389,6 +2390,209 @@ function reconcileCommand() {
   );
   return reconcile;
 }
+var requireFrom = module$1.createRequire(path6__namespace.join(process.cwd(), "package.json"));
+function paint(status, msg) {
+  const labels = {
+    green: "PASS",
+    yellow: "WARN",
+    red: "FAIL"
+  };
+  return `[${labels[status]}] ${msg}`;
+}
+function parseMajor(nodeVersion) {
+  const m = /^v(\d+)\./.exec(nodeVersion);
+  return m ? parseInt(m[1], 10) : 0;
+}
+function checkNodeVersion() {
+  const major = parseMajor(process.version);
+  if (major >= 22) {
+    return {
+      name: "Node version",
+      status: "green",
+      detail: `${process.version} (>= 22 required)`
+    };
+  }
+  return {
+    name: "Node version",
+    status: "red",
+    detail: `${process.version} is below the required Node >= 22`
+  };
+}
+function checkPackageResolution() {
+  const required = ["@peac/protocol", "@peac/crypto", "@peac/schema", "@peac/kernel"];
+  const missing = [];
+  for (const pkg of required) {
+    try {
+      requireFrom.resolve(pkg);
+    } catch {
+      missing.push(pkg);
+    }
+  }
+  if (missing.length === 0) {
+    return {
+      name: "Package resolution",
+      status: "green",
+      detail: `${required.length} required packages resolvable`
+    };
+  }
+  return {
+    name: "Package resolution",
+    status: "red",
+    detail: `${missing.length} missing: ${missing.join(", ")}`
+  };
+}
+function checkKeyMaterial(cwd) {
+  const env = process.env.PEAC_ISSUER_KEY || "";
+  if (env) {
+    if (env.startsWith("env:") || env.startsWith("file:")) {
+      return {
+        name: "Issuer key material",
+        status: "green",
+        detail: `PEAC_ISSUER_KEY set via ${env.split(":")[0]}:... scheme`
+      };
+    }
+    return {
+      name: "Issuer key material",
+      status: "yellow",
+      detail: "PEAC_ISSUER_KEY set but not using env: or file: scheme"
+    };
+  }
+  const candidatePaths = [
+    path6__namespace.join(cwd, "issuer.jwk.json"),
+    path6__namespace.join(cwd, ".peac/issuer.jwk.json")
+  ];
+  for (const p of candidatePaths) {
+    if (fs6__namespace.existsSync(p)) {
+      return {
+        name: "Issuer key material",
+        status: "yellow",
+        detail: `found ${path6__namespace.relative(cwd, p)}; prefer PEAC_ISSUER_KEY env var`
+      };
+    }
+  }
+  return {
+    name: "Issuer key material",
+    status: "yellow",
+    detail: "not found (issuance disabled; read-only tools still work)"
+  };
+}
+function checkPeacTxt(cwd) {
+  const p = path6__namespace.join(cwd, ".well-known/peac.txt");
+  if (fs6__namespace.existsSync(p)) {
+    return {
+      name: "peac.txt presence",
+      status: "green",
+      detail: `.well-known/peac.txt present at ${p}`
+    };
+  }
+  return {
+    name: "peac.txt presence",
+    status: "yellow",
+    detail: "no .well-known/peac.txt (discovery-layer check; optional for tool callers)"
+  };
+}
+async function checkOnlineJwks(issuerUrl, timeoutMs) {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+  try {
+    const cfgUrl = new URL("/.well-known/peac-issuer.json", issuerUrl).toString();
+    const res = await fetch(cfgUrl, { signal: ctrl.signal });
+    if (res.status !== 200) {
+      return {
+        name: "Issuer configuration",
+        status: "red",
+        detail: `${cfgUrl} returned ${res.status}`
+      };
+    }
+    const cfg = await res.json();
+    const jwksUri = cfg.jwks_uri;
+    if (!jwksUri) {
+      return {
+        name: "Issuer configuration",
+        status: "red",
+        detail: `${cfgUrl} missing jwks_uri`
+      };
+    }
+    const jwksRes = await fetch(jwksUri, { signal: ctrl.signal });
+    if (jwksRes.status !== 200) {
+      return {
+        name: "Issuer configuration",
+        status: "red",
+        detail: `jwks_uri ${jwksUri} returned ${jwksRes.status}`
+      };
+    }
+    const jwks = await jwksRes.json();
+    const keyCount = Array.isArray(jwks.keys) ? jwks.keys.length : 0;
+    if (keyCount === 0) {
+      return {
+        name: "Issuer configuration",
+        status: "red",
+        detail: `jwks_uri ${jwksUri} returned empty keys array`
+      };
+    }
+    return {
+      name: "Issuer configuration",
+      status: "green",
+      detail: `${cfgUrl} + jwks_uri resolvable with ${keyCount} key(s)`
+    };
+  } catch (err) {
+    return {
+      name: "Issuer configuration",
+      status: "red",
+      detail: `fetch failed: ${err instanceof Error ? err.message : String(err)}`
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function runDoctor(options) {
+  const results = [];
+  results.push(checkNodeVersion());
+  results.push(checkPackageResolution());
+  results.push(checkKeyMaterial(options.cwd));
+  results.push(checkPeacTxt(options.cwd));
+  if (options.online) {
+    if (!options.issuer) {
+      results.push({
+        name: "Issuer configuration",
+        status: "yellow",
+        detail: "--online set but --issuer <url> not provided; skipping remote check"
+      });
+    } else {
+      results.push(await checkOnlineJwks(options.issuer, options.timeout));
+    }
+  } else {
+    results.push({
+      name: "Issuer configuration",
+      status: "yellow",
+      detail: "offline mode (default); pass --online --issuer <url> to enable remote check"
+    });
+  }
+  console.log("\npeac doctor");
+  console.log("-----------");
+  for (const r of results) {
+    console.log(paint(r.status, `${r.name}: ${r.detail}`));
+  }
+  const hasRed = results.some((r) => r.status === "red");
+  console.log(hasRed ? "\nFAIL: one or more checks are red." : "\nOK: no red checks.");
+  return hasRed ? 1 : 0;
+}
+function doctor(program2) {
+  program2.command("doctor").description("Run PEAC installability diagnostics (offline by default)").option("--online", "enable remote checks (issuer configuration, JWKS)", false).option("--issuer <url>", "issuer URL for --online checks (https://...)").option(
+    "--timeout <ms>",
+    "timeout for remote checks in milliseconds",
+    (v) => parseInt(v, 10),
+    5e3
+  ).action(async (opts) => {
+    const exitCode = await runDoctor({
+      online: !!opts.online,
+      issuer: opts.issuer,
+      timeout: opts.timeout,
+      cwd: process.cwd()
+    });
+    process.exit(exitCode);
+  });
+}
 
 // src/index.ts
 var program = new commander.Command();
@@ -2525,6 +2729,7 @@ program.addCommand(policy);
 program.addCommand(conformance);
 program.addCommand(samples);
 program.addCommand(reconcileCommand());
+doctor(program);
 try {
   program.parse();
 } catch (err) {