nucleus-substrate-cli 0.1.0

Command-line client for the Nucleus substrate. Single binary `nucleus-substrate` driving offline receipt verification (signature + all-projections), live hub fetches, and counter inspection.
# nucleus-substrate-cli

[![Crates.io](https://img.shields.io/crates/v/nucleus-substrate-cli.svg)](https://crates.io/crates/nucleus-substrate-cli)
[![Docs.rs](https://docs.rs/nucleus-substrate-cli/badge.svg)](https://docs.rs/nucleus-substrate-cli)

Command-line client for the Nucleus substrate. Single binary
`nucleus-substrate` driving offline receipt verification + live hub
fetches.

## Install

```bash
cargo install nucleus-substrate-cli
```

## Subcommands

```text
nucleus-substrate verify <receipt.json> [--hub <url>] [--jwks <file>]
nucleus-substrate fetch <auction_id> --hub <url>
nucleus-substrate counters --hub <url>
nucleus-substrate agent-card --hub <url>
```

### `verify` — offline receipt verification

Reads a receipt JSON file (or stdin via `-`), loads JWKS either
from a file (`--jwks`) or by fetching the hub's
`/.well-known/jwks.json` endpoint (`--hub`), then runs
[`verify_receipt_fully`][sdk-verify] from the SDK.

Output on success:

```text
VERIFY PASS
  session:     spiffe://.../agent
  issuer_kid:  ...
  root_hash:   ...
  projections:
    - identity
    - flow
    - economic
```

Exit code 2 on failure. When the flow projection reports
`has_adversarial_bid=true`, a stderr WARNING reminds the operator
that mechanism truthfulness cannot be assumed for that clearing.

### `fetch` / `counters` / `agent-card`

Thin wrappers over the corresponding SDK methods — pretty-printed
JSON to stdout.

## Live smoke

```bash
$ nucleus-substrate agent-card --hub https://nucleus-auction-hub.fly.dev
{
  "name": "nucleus-auction-hub",
  ...
}
```

## License

Dual-licensed under MIT OR Apache-2.0.

[sdk-verify]: https://docs.rs/nucleus-substrate-sdk/latest/nucleus_substrate_sdk/fn.verify_receipt_fully.html