@parmanasystems/verifier-cli

Command-line governance verification tool. Exposes a commandRegistry that maps domain/command pairs to async handlers. The CLI entry point (not in this package) dispatches to the registry based on parsed arguments. Commands cover offline attestation verification, bundle integrity, provenance replay, policy simulation, policy inspection, runtime inspection, and workspace management.

Public API

/**
 * Registry of all CLI commands.
 * Key structure: commandRegistry[domain][command](context)
 * Domains: "verify", "runtime", "provenance", "policy", "workspace"
 */
const commandRegistry: Record<string, Record<string, CommandHandler>>

type CommandHandler = (context: CommandContext) => Promise<void>

interface CommandContext {
  domain?: string;
  command?: string;
  /** Primary argument (file path, policy path, workspace name, etc.) */
  target?: string;
  /** Secondary argument (e.g. rebuilt manifest path for provenance verify). */
  extra?: string;
  args?: string[];
  /** Output results as JSON. */
  json?: boolean;
  /** Fail on any warning. */
  strict?: boolean;
  /** Path to trust-root.json for verification commands. */
  trustRootPath?: string;
}

Commands

| Domain | Command | target | extra | Description | |--------|---------|----------|---------|-------------| | verify | attestation | Path to attestation JSON | — | Verify an ExecutionAttestation signature offline. | | verify | bundle | Path to bundle.manifest.json | Path to bundle.sig | Verify a policy bundle manifest and signature. | | verify | artifact | Path to artifact directory | — | Verify a governance artifact. | | runtime | inspect | — | — | Inspect the current runtime manifest. | | provenance | verify | Path to manifest | Path to rebuilt manifest | Verify provenance by comparing two manifests. | | policy | simulate | Path to policy directory | Path to input JSON | Simulate policy evaluation against input signals. | | policy | inspect | Path to policy directory | — | Inspect a compiled policy structure. | | policy | graph | Path to policy directory | — | Print policy rule dependency graph. | | policy | build | Path to policy directory | — | Build/compile a policy. | | policy | compile | Path to policy directory | — | Compile a policy (alias for build). | | workspace | init | Workspace name | — | Initialize a new governance workspace. | | workspace | check | — | — | Validate workspace configuration. | | workspace | explain | — | — | Explain workspace structure. |

Environment variables

Verification commands may read PARMANA_TRUST_PUBLIC_KEY if trustRootPath is not set in the command context.

Package wiring

@parmanasystems/verifier-cli depends on @parmanasystems/verifier (for attestation and bundle verification), @parmanasystems/governance (for policy compilation and loading), and @parmanasystems/execution (for signal validation and evaluation). It does not depend on @parmanasystems/server and does not require a running runtime.