@obep/cli

@obep/cli

The authoring CLI for OBEP — generate a signing keypair, then lint, sign, and verify playbooks. Apache-2.0.

npm install -D @obep/cli   # or: npx @obep/cli <command>

The binary is obep-playbook:

obep-playbook keygen --out keys                          # Ed25519 keypair (tenant.key / tenant.pub)
obep-playbook register-key --api-key <key> --pub keys/tenant.pub
obep-playbook derive trace.json --out flow.json          # recorded run -> candidate playbook
obep-playbook lint flow.json                             # schema + danger flags
obep-playbook sign flow.json --key keys/tenant.key --out flow-signed.json
obep-playbook verify flow-signed.json --pub keys/tenant.pub

The private key stays on your machine — only the public half is registered, and the relay verifies signatures it can never forge. For the managed relay, most teams author errands from a goal with their AI coding tool (@openerrand/mcp) instead of running this by hand. See the docs and the repo.