#!/usr/bin/env node
/**
 * `nucleus-attest` — producer-side CLI. Reads a nucleus-tool-proxy trace
 * export (from the `emit_toolproxy_trace` example, or any equivalent
 * instrumentation), signs an in-bounds attestation receipt, and writes it to
 * stdout. The cross-check + signer public key go to stderr.
 *
 * Usage:
 *   nucleus-attest [export.json] [--key <pkcs8.pem>] [--signed-at <iso>]
 *   emit_toolproxy_trace ... | nucleus-attest > receipt.json
 *
 * With no --key, an EPHEMERAL Ed25519 keypair is generated in memory (no key
 * custody) — fine for demos/CI dry-runs; the public key is printed to stderr
 * so a verifier can pin it. Exit 0 on a produced receipt, 2 on error.
 */
export {};