#!/usr/bin/env node
/**
 * `nucleus-verify` — offline verifier for capability-boundary in-bounds
 * attestation receipts. Exit code is the gate:
 *   0  → receipt verified AND the agent stayed in bounds
 *   1  → receipt failed verification, or the agent went out of bounds
 *   2  → usage / I/O error
 *
 * Usage:
 *   nucleus-verify <receipt.json> [--expect-principal <spiffe-id>]
 *                                 [--expect-key <base64url>] [--json] [--quiet]
 *   nucleus-verify --help
 *
 * Reads from stdin if `<receipt.json>` is "-" or omitted with piped input.
 * Designed as a drop-in CI / GitHub Action step.
 */
export {};