@certen.io/cli 0.7.1 → 0.7.2

package/README.md

@@ -1,232 +1,232 @@
-# `@certen.io/cli`
-
-The `certen` command line for the [CERTEN Gateway](https://gateway.kompendium.co/reference) —
-proof-gated cross-chain execution on Accumulate.
-
-**Docs: <https://docs.kompendium.co>** · **Portal: <https://gateway.kompendium.co/portal>**
-
-```bash
-npm install -g @certen.io/cli
-```
-
-## From nothing to a proof
-
-```bash
-certen login          # approve this machine once in the portal; the key arrives here
-certen init           # signing key, identity, funding — created and checked
-
-certen call --identity <id> --chain base-sepolia --to 0xYourContract \
-    --fn 'confirm(bytes32)' --arg 0x… --sign-with dev --wait
-
-certen proof get <intent-id>   # the evidence, to hand to a counterparty
-```
-
-**You never copy an API key.** `certen login` uses the device authorization grant: it prints a
-short code, you approve that code in a portal session you already trust, and the CLI collects the
-key over its own channel. The secret is never displayed here and never passes through your
-clipboard or your shell history.
-
-`certen init` is idempotent. It creates only what is missing, records the identity id so a later
-run reuses it, waits until the identity can actually sign, and tells you if an abstract account
-needs gas before it can execute anything.
-
-Stuck at any point:
-
-```bash
-certen doctor         # names the one thing blocking you, and the command that fixes it
-```
-
-### If your gateway predates device authorization
-
-`certen login` will say so and point at the portal. Mint a key there and hand it over without
-putting it in your shell history:
-
-```bash
-certen auth login --api-key -   # reads the key from stdin
-```
-
-## Your key never leaves this machine
-
-`certen keys generate` creates an Ed25519 key, encrypts it with a passphrase (scrypt + AES-256-GCM),
-and writes it to `~/.certen/keys/<name>.json` with `0600` permissions. The CLI sends **signatures**
-to the gateway. It never sends a private key, and there is no code path that could.
-
-```bash
-certen keys generate --name dev          # prompts for a passphrase (confirmed)
-certen keys generate --name ci --no-passphrase   # unencrypted; file permissions only
-certen keys list                         # metadata only — never decrypts
-certen keys show dev
-certen keys verify dev                   # proves the key decrypts and signs correctly
-certen keys sign --name dev --hash <hex> # print a signature, send nothing
-certen keys delete dev --yes
-certen keys path
-```
-
-Set `CERTEN_KEY_PASSPHRASE` to skip the prompt in CI. When it is set and there is no TTY, the CLI
-uses it; when neither is available it fails with an explanation rather than hanging on a prompt
-nobody can see.
-
-**`certen keys sign` sends nothing anywhere.** It is the air-gapped path: generate on one machine,
-carry the hash to it, carry the signature back.
-
-## Proof-gated contract calls
-
-```bash
-certen call --identity <uuid> --chain base-sepolia --to 0xTarget \
-    --fn 'confirm(bytes32)' --arg 0x… --sign-with dev --wait
-```
-
-`--fn` takes a Solidity signature and `--arg` repeats positionally. Arguments are checked against
-the signature **before** anything is sent — on a proof-gated call, a valid proof of the *wrong*
-call is still a valid proof, so a mis-encoded argument is worse than an error.
-
-The ADI URL, the abstract account (`msg.sender` on chain) and the numeric chain id are all derived
-from the identity. You do not supply them, and you should not need to know that omitting them
-produces a bodyless 502.
-
-`--dry-run` prints the intent that would be sent without sending it — also the starting point if
-you need a multi-leg intent, which you then pass to `tx create --intent @file.json`.
-
-## Transfers
-
-```bash
-certen tx create --identity <uuid> --to-chain ethereum-sepolia \
-  --from 0xYourAbstractAccount --to 0xRecipient --amount 0.001 --sign-with dev --wait
-```
-
-**`--amount` is in WHOLE UNITS.** `1` means one ETH, `0.5` means half. This is the field most
-worth reading twice: the gateway documented it as wei until 2026-08-11, and someone sending `1`
-meaning one wei moves a whole ETH — which on a funded account succeeds silently.
-
-`--from` is the identity's abstract account on the source chain; `certen portfolio` shows it.
-
-If that account has no gas, the CLI refuses before submitting. That refusal is worth having: an
-intent from an empty abstract account is accepted, signed and submitted — every step reports
-success — and then parks at `anchoring` forever, because the execution leg cannot run on chain.
-`--force` overrides it.
-
-Or drive the steps yourself — useful when the signer is an HSM, another machine, or your own
-policy engine:
-
-```bash
-certen tx create --identity <uuid> ...          # returns signing_data.hash_to_sign
-certen keys sign --name dev --hash <hash>       # or your HSM
-certen tx sign <intent-id> --signature <sig> --public-key <pub>
-```
-
-`--signature`/`--public-key` remain first-class. `--sign-with` is a convenience, not a replacement.
-
-## Proofs
-
-```bash
-certen proof get <intent-id>        # also accepts a proof id or a transaction hash
-certen proof bundle <proof-id>      # the artifact to hand over
-certen proof share <proof-id>       # a link a counterparty opens without a key of yours
-certen proof verify <intent-id>     # what was, and was NOT, verified
-```
-
-`proof verify` reports three separate judgements — inclusion, authorization, outcome — and it can
-establish only the first, and only as something the gateway asserted. It says so. Asking the
-gateway is not independent verification; to verify without trusting CERTEN, query an Accumulate
-node for the receipt and read the execution on the destination chain.
-
-`proof get` falls back to the Accumulate merkle receipt when the proof-service is unavailable or
-when an intent has no `proof_id` — the normal case for governance and authorization transactions.
-A 5xx from the proof-service means that service is down, **not** that your proof is missing.
-
-## Multi-party approvals
-
-```bash
-certen pending list
-certen pending sign <id> --identity <adi> --vote approve
-certen pending submit <request-id> --sign-with dev --hash <hash>
-```
-
-`--vote` takes `approve`, `reject`, or `abstain` — lowercase strings. Not `accept`, and not a
-number.
-
-## Everything else
-
-```bash
-certen chains                                    # what CERTEN is deployed on (no API key needed)
-certen whoami                                    # which key, which gateway, what standing
-certen identity get <id> | list | link-chain <id> --chain <chain> | retire <id> --yes
-certen portfolio                                 # balances across every identity and chain
-certen tx status <id> --wait | tx list
-certen pricing                                   # everything CERTEN charges for, in one call
-certen balance | quote --chain <chain> [--sku <sku>] | fund <amount> --chain <chain>
-certen governance add-delegate | set-threshold
-certen admin api-keys list | create | rotate | revoke
-certen admin audit-log | usage
-```
-
-Run `certen <group> --help` for the flags on any of them, or `certen --help` for the whole tree
-grouped by where you are in the journey.
-
-## Chains
-
-This CLI targets `ethereum-sepolia`, `base-sepolia` and `arbitrum-sepolia`. A chain outside that
-set is refused with the reason — and if the gateway genuinely serves it, the refusal says so
-rather than claiming it does not exist. `CERTEN_ALLOW_ANY_CHAIN=1` lifts the restriction.
-
-## Scripting and AI agents: `--json`
-
-`--json` turns the CLI into a machine interface. It is a contract, documented in full in
-[docs/CLI-CONTRACT.md](../../docs/CLI-CONTRACT.md) and enforced by a conformance suite.
-
-```bash
-certen --json tx status <id>
-# {"ok":true,"data":{"intent_id":"…","status":"completed"}}
-
-certen --json portfolio
-# {"ok":false,"error":{"code":"NETWORK_ERROR","message":"connect ECONNREFUSED","retryable":true,"status":0}}
-```
-
-- **Exactly one JSON object on stdout**, nothing else. Every human-facing line goes to stderr.
-- **Exit codes:** `0` ok · `1` operation failed · `2` usage error · `3` gateway unreachable. Branch on
-  these instead of parsing text. `3` guarantees nothing was submitted, so a retry cannot
-  double-execute.
-- **`error.retryable`** comes from the SDK's own `CertenError.isRetryable`, so the CLI and the SDK
-  give an identical retry decision.
-- **`certen --help --json`** returns the entire command tree — every command, flag and exit code — in
-  one call.
-
-Without `--json`, output is the human table format as before. Do not parse it.
-
-## Configuration
-
-| | |
-|---|---|
-| `CERTEN_API_KEY` | API key. Always wins, so CI never touches the keyring or config file. |
-| `CERTEN_API_URL` | Gateway base URL. Defaults to `https://gateway.kompendium.co`. |
-| `CERTEN_KEY_PASSPHRASE` | Passphrase for local signing keys. |
-
-`certen auth login` stores the API key in your OS keyring by default, or in
-`~/.certen/config.json` at `0600` with `--no-keyring`.
-
-## Things that will bite you
-
-**Identity creation is asynchronous.** `identity create` returns `202` and provisioning continues.
-Poll until the status is terminal, and check `can_sign` — it derives from the on-chain key page, so
-it can read `true` while the status is still `creating`.
-
-**A proof cycle takes 60–110 seconds.** Real validator work, not a tunable delay. Do not wrap it in
-a 30-second timeout.
-
-**Sign the bytes, not the text.** If you are producing signatures outside this CLI: sign the raw
-bytes of the hash, do not hash it again, and do not sign the ASCII of the hex string. All three
-mistakes produce a well-formed 128-hex signature the gateway rejects. `certen keys sign` handles
-this for you.
-
-## Documentation
-
-**<https://docs.kompendium.co>** — getting started, authentication, errors, idempotency, and
-task-shaped guides: onboarding an identity, external signing, proof-gating a contract call, M-of-N
-panels, and verifying a proof.
-
-The [live API reference](https://gateway.kompendium.co/reference) is generated from the running
-gateway and is authoritative — when a guide and the spec disagree, the spec is right.
-
-## License
-
-MIT
+# `@certen.io/cli`
+
+The `certen` command line for the [CERTEN Gateway](https://gateway.kompendium.co/reference) —
+proof-gated cross-chain execution on Accumulate.
+
+**Docs: <https://docs.kompendium.co>** · **Portal: <https://gateway.kompendium.co/portal>**
+
+```bash
+npm install -g @certen.io/cli
+```
+
+## From nothing to a proof
+
+```bash
+certen login          # approve this machine once in the portal; the key arrives here
+certen init           # signing key, identity, funding — created and checked
+
+certen call --identity <id> --chain base-sepolia --to 0xYourContract \
+    --fn 'confirm(bytes32)' --arg 0x… --sign-with dev --wait
+
+certen proof get <intent-id>   # the evidence, to hand to a counterparty
+```
+
+**You never copy an API key.** `certen login` uses the device authorization grant: it prints a
+short code, you approve that code in a portal session you already trust, and the CLI collects the
+key over its own channel. The secret is never displayed here and never passes through your
+clipboard or your shell history.
+
+`certen init` is idempotent. It creates only what is missing, records the identity id so a later
+run reuses it, waits until the identity can actually sign, and tells you if an abstract account
+needs gas before it can execute anything.
+
+Stuck at any point:
+
+```bash
+certen doctor         # names the one thing blocking you, and the command that fixes it
+```
+
+### If your gateway predates device authorization
+
+`certen login` will say so and point at the portal. Mint a key there and hand it over without
+putting it in your shell history:
+
+```bash
+certen auth login --api-key -   # reads the key from stdin
+```
+
+## Your key never leaves this machine
+
+`certen keys generate` creates an Ed25519 key, encrypts it with a passphrase (scrypt + AES-256-GCM),
+and writes it to `~/.certen/keys/<name>.json` with `0600` permissions. The CLI sends **signatures**
+to the gateway. It never sends a private key, and there is no code path that could.
+
+```bash
+certen keys generate --name dev          # prompts for a passphrase (confirmed)
+certen keys generate --name ci --no-passphrase   # unencrypted; file permissions only
+certen keys list                         # metadata only — never decrypts
+certen keys show dev
+certen keys verify dev                   # proves the key decrypts and signs correctly
+certen keys sign --name dev --hash <hex> # print a signature, send nothing
+certen keys delete dev --yes
+certen keys path
+```
+
+Set `CERTEN_KEY_PASSPHRASE` to skip the prompt in CI. When it is set and there is no TTY, the CLI
+uses it; when neither is available it fails with an explanation rather than hanging on a prompt
+nobody can see.
+
+**`certen keys sign` sends nothing anywhere.** It is the air-gapped path: generate on one machine,
+carry the hash to it, carry the signature back.
+
+## Proof-gated contract calls
+
+```bash
+certen call --identity <uuid> --chain base-sepolia --to 0xTarget \
+    --fn 'confirm(bytes32)' --arg 0x… --sign-with dev --wait
+```
+
+`--fn` takes a Solidity signature and `--arg` repeats positionally. Arguments are checked against
+the signature **before** anything is sent — on a proof-gated call, a valid proof of the *wrong*
+call is still a valid proof, so a mis-encoded argument is worse than an error.
+
+The ADI URL, the abstract account (`msg.sender` on chain) and the numeric chain id are all derived
+from the identity. You do not supply them, and you should not need to know that omitting them
+produces a bodyless 502.
+
+`--dry-run` prints the intent that would be sent without sending it — also the starting point if
+you need a multi-leg intent, which you then pass to `tx create --intent @file.json`.
+
+## Transfers
+
+```bash
+certen tx create --identity <uuid> --to-chain ethereum-sepolia \
+  --from 0xYourAbstractAccount --to 0xRecipient --amount 0.001 --sign-with dev --wait
+```
+
+**`--amount` is in WHOLE UNITS.** `1` means one ETH, `0.5` means half. This is the field most
+worth reading twice: the gateway documented it as wei until 2026-08-11, and someone sending `1`
+meaning one wei moves a whole ETH — which on a funded account succeeds silently.
+
+`--from` is the identity's abstract account on the source chain; `certen portfolio` shows it.
+
+If that account has no gas, the CLI refuses before submitting. That refusal is worth having: an
+intent from an empty abstract account is accepted, signed and submitted — every step reports
+success — and then parks at `anchoring` forever, because the execution leg cannot run on chain.
+`--force` overrides it.
+
+Or drive the steps yourself — useful when the signer is an HSM, another machine, or your own
+policy engine:
+
+```bash
+certen tx create --identity <uuid> ...          # returns signing_data.hash_to_sign
+certen keys sign --name dev --hash <hash>       # or your HSM
+certen tx sign <intent-id> --signature <sig> --public-key <pub>
+```
+
+`--signature`/`--public-key` remain first-class. `--sign-with` is a convenience, not a replacement.
+
+## Proofs
+
+```bash
+certen proof get <intent-id>        # also accepts a proof id or a transaction hash
+certen proof bundle <proof-id>      # the artifact to hand over
+certen proof share <proof-id>       # a link a counterparty opens without a key of yours
+certen proof verify <intent-id>     # what was, and was NOT, verified
+```
+
+`proof verify` reports three separate judgements — inclusion, authorization, outcome — and it can
+establish only the first, and only as something the gateway asserted. It says so. Asking the
+gateway is not independent verification; to verify without trusting CERTEN, query an Accumulate
+node for the receipt and read the execution on the destination chain.
+
+`proof get` falls back to the Accumulate merkle receipt when the proof-service is unavailable or
+when an intent has no `proof_id` — the normal case for governance and authorization transactions.
+A 5xx from the proof-service means that service is down, **not** that your proof is missing.
+
+## Multi-party approvals
+
+```bash
+certen pending list
+certen pending sign <id> --identity <adi> --vote approve
+certen pending submit <request-id> --sign-with dev --hash <hash>
+```
+
+`--vote` takes `approve`, `reject`, or `abstain` — lowercase strings. Not `accept`, and not a
+number.
+
+## Everything else
+
+```bash
+certen chains                                    # what CERTEN is deployed on (no API key needed)
+certen whoami                                    # which key, which gateway, what standing
+certen identity get <id> | list | link-chain <id> --chain <chain> | retire <id> --yes
+certen portfolio                                 # balances across every identity and chain
+certen tx status <id> --wait | tx list
+certen pricing                                   # everything CERTEN charges for, in one call
+certen balance | quote --chain <chain> [--sku <sku>] | fund <amount> --chain <chain>
+certen governance add-delegate | set-threshold
+certen admin api-keys list | create | rotate | revoke
+certen admin audit-log | usage
+```
+
+Run `certen <group> --help` for the flags on any of them, or `certen --help` for the whole tree
+grouped by where you are in the journey.
+
+## Chains
+
+This CLI targets `ethereum-sepolia`, `base-sepolia` and `arbitrum-sepolia`. A chain outside that
+set is refused with the reason — and if the gateway genuinely serves it, the refusal says so
+rather than claiming it does not exist. `CERTEN_ALLOW_ANY_CHAIN=1` lifts the restriction.
+
+## Scripting and AI agents: `--json`
+
+`--json` turns the CLI into a machine interface. It is a contract, documented in full in
+[docs/CLI-CONTRACT.md](../../docs/CLI-CONTRACT.md) and enforced by a conformance suite.
+
+```bash
+certen --json tx status <id>
+# {"ok":true,"data":{"intent_id":"…","status":"completed"}}
+
+certen --json portfolio
+# {"ok":false,"error":{"code":"NETWORK_ERROR","message":"connect ECONNREFUSED","retryable":true,"status":0}}
+```
+
+- **Exactly one JSON object on stdout**, nothing else. Every human-facing line goes to stderr.
+- **Exit codes:** `0` ok · `1` operation failed · `2` usage error · `3` gateway unreachable. Branch on
+  these instead of parsing text. `3` guarantees nothing was submitted, so a retry cannot
+  double-execute.
+- **`error.retryable`** comes from the SDK's own `CertenError.isRetryable`, so the CLI and the SDK
+  give an identical retry decision.
+- **`certen --help --json`** returns the entire command tree — every command, flag and exit code — in
+  one call.
+
+Without `--json`, output is the human table format as before. Do not parse it.
+
+## Configuration
+
+| | |
+|---|---|
+| `CERTEN_API_KEY` | API key. Always wins, so CI never touches the keyring or config file. |
+| `CERTEN_API_URL` | Gateway base URL. Defaults to `https://gateway.kompendium.co`. |
+| `CERTEN_KEY_PASSPHRASE` | Passphrase for local signing keys. |
+
+`certen auth login` stores the API key in your OS keyring by default, or in
+`~/.certen/config.json` at `0600` with `--no-keyring`.
+
+## Things that will bite you
+
+**Identity creation is asynchronous.** `identity create` returns `202` and provisioning continues.
+Poll until the status is terminal, and check `can_sign` — it derives from the on-chain key page, so
+it can read `true` while the status is still `creating`.
+
+**A proof cycle takes 60–110 seconds.** Real validator work, not a tunable delay. Do not wrap it in
+a 30-second timeout.
+
+**Sign the bytes, not the text.** If you are producing signatures outside this CLI: sign the raw
+bytes of the hash, do not hash it again, and do not sign the ASCII of the hex string. All three
+mistakes produce a well-formed 128-hex signature the gateway rejects. `certen keys sign` handles
+this for you.
+
+## Documentation
+
+**<https://docs.kompendium.co>** — getting started, authentication, errors, idempotency, and
+task-shaped guides: onboarding an identity, external signing, proof-gating a contract call, M-of-N
+panels, and verifying a proof.
+
+The [live API reference](https://gateway.kompendium.co/reference) is generated from the running
+gateway and is authoritative — when a guide and the spec disagree, the spec is right.
+
+## License
+
+MIT

package/dist/commands/chains.js

@@ -116,8 +116,8 @@ export function registerChainsCommands(program) {
         hint('');
         hint('Detail for one: certen chains base-sepolia');
     });
-    chains.addHelpText('after', `
-Registry version and Accumulate network are included in --json output.
+    chains.addHelpText('after', `
+Registry version and Accumulate network are included in --json output.
 This command needs no API key, so it also answers "is the gateway up".`);
 }
 //# sourceMappingURL=chains.js.map

package/dist/help-root.js

@@ -36,16 +36,16 @@ const GROUPS = [
         commands: ['portfolio', 'webhooks', 'oauth-clients', 'orgs', 'admin', 'scopes', 'errors'],
     },
 ];
-const QUICKSTART = `
-  From nothing to a proof:
-
-    certen login                               # approve this machine in the portal
-    certen init                                # key, identity, funding — all checked
-    certen call --identity <id> --chain base-sepolia --to 0xContract \\
-        --fn 'confirm(bytes32)' --arg 0x... --sign-with dev --wait
-    certen proof get <intent-id>               # the evidence, to hand over
-
-  Stuck? Run: certen doctor
+const QUICKSTART = `
+  From nothing to a proof:
+
+    certen login                               # approve this machine in the portal
+    certen init                                # key, identity, funding — all checked
+    certen call --identity <id> --chain base-sepolia --to 0xContract \\
+        --fn 'confirm(bytes32)' --arg 0x... --sign-with dev --wait
+    certen proof get <intent-id>               # the evidence, to hand over
+
+  Stuck? Run: certen doctor
 `;
 export function formatRootHelp(cmd, helper) {
     // Subcommands inherit this configuration, so anything that is not the root is handed straight

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { readFileSync } from 'node:fs';
+import { readFileSync, realpathSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { Command, CommanderError } from 'commander';
@@ -143,11 +143,41 @@ export async function run(argv) {
     }
 }
 /* c8 ignore start — entrypoint wiring, exercised by the conformance suite as a subprocess */
-// Run only when executed as the binary, not when imported by a test. `pathToFileURL` is what makes
-// this correct on Windows, where a naive `file://` + path concatenation produces a URL that never
-// matches `import.meta.url`.
-const invokedDirectly = Boolean(process.argv[1]) && import.meta.url === pathToFileURL(process.argv[1]).href;
-if (invokedDirectly) {
+/**
+ * Was this file run as the program, rather than imported by a test?
+ *
+ * `import.meta.url` is always the REAL path of this module — node resolves symlinks before it
+ * records one. `process.argv[1]` is not: it is the path as typed. Every POSIX install of this
+ * package puts a SYMLINK at `node_modules/.bin/certen` pointing into `dist/`, and `npx` is no
+ * exception, so on Linux and macOS the two strings never matched and this comparison was false
+ * for every real user. The CLI then did nothing at all: no parse, no request, no output, exit 0.
+ * "It seems to run and prints nothing" is exactly what a silent `if` at the bottom of a binary
+ * looks like from outside.
+ *
+ * Windows hid it, which is why it shipped. npm writes a `.cmd` shim there instead of a symlink,
+ * and the shim invokes node on the real path — so argv[1] arrived already resolved and the guard
+ * passed. Every test hid it too: they all spawn `node dist/index.js` directly, never through the
+ * installed bin, which is the only path with a symlink in it.
+ *
+ * Resolving argv[1] the way node already resolved `import.meta.url` is what makes the two
+ * comparable. `realpathSync` throws on a path that does not exist, and a path that does not
+ * exist is not this module either way, so the fallback is the unresolved string rather than a
+ * crash in the first statement the binary runs.
+ */
+function isMainModule() {
+    const argv1 = process.argv[1];
+    if (!argv1)
+        return false;
+    let resolved = argv1;
+    try {
+        resolved = realpathSync(argv1);
+    }
+    catch {
+        // Ignored: see above — the comparison below reaches the same answer without throwing.
+    }
+    return import.meta.url === pathToFileURL(resolved).href;
+}
+if (isMainModule()) {
     run(process.argv).then((code) => {
         process.exitCode = code;
     });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAiB,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,oFAAoF;AACpF,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,OAAiB,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC;AACD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;AAE9B,MAAM,UAAU,YAAY;IAC1B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,QAAQ,CAAC;SACd,WAAW,CAAC,oBAAoB,CAAC;QAClC,yFAAyF;QACzF,wFAAwF;SACvF,OAAO,CAAC,OAAO,CAAC;QACjB,iGAAiG;QACjG,sFAAsF;SACrF,MAAM,CAAC,QAAQ,EAAE,+DAA+D,CAAC,CAAC;IAErF,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACrC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACpC,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACnC,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACrC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAEhC,iGAAiG;IACjG,kGAAkG;IAClG,kGAAkG;IAClG,mEAAmE;IACnE,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAE3B,sFAAsF;IACtF,uFAAuF;IACvF,gCAAgC;IAChC,OAAO,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAY;IACrC,GAAG,CAAC,YAAY,EAAE,CAAC;IACnB,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ;QAAE,iBAAiB,CAAC,GAAc,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;QAClC,uFAAuF;QACvF,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,yBAAyB,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACrG,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,CAAC;QACD,OAAO,WAAW,CAAC;YACjB,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;YAC5C,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,IAAI,CAAC,KAAK;SACrB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;QAC/B,4CAA4C;QAC5C,EAAE;QACF,+EAA+E;QAC/E,+EAA+E;QAC/E,4EAA4E;QAC5E,sEAAsE;QACtE,EAAE;QACF,+EAA+E;QAC/E,gFAAgF;QAChF,2CAA2C;QAC3C,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc;IACtC,gGAAgG;IAChG,qFAAqF;IACrF,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,WAAW,CAAC,IAAI,CAAC,CAAC;IAClB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;IAErD,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAE/B,8FAA8F;IAC9F,4BAA4B;IAC5B,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACpC,YAAY,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,mGAAmG;AACnG,kGAAkG;AAClG,6BAA6B;AAC7B,MAAM,eAAe,GACnB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAEtF,IAAI,eAAe,EAAE,CAAC;IACpB,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AACD,oBAAoB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAiB,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,oFAAoF;AACpF,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,OAAiB,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC;AACD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;AAE9B,MAAM,UAAU,YAAY;IAC1B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,QAAQ,CAAC;SACd,WAAW,CAAC,oBAAoB,CAAC;QAClC,yFAAyF;QACzF,wFAAwF;SACvF,OAAO,CAAC,OAAO,CAAC;QACjB,iGAAiG;QACjG,sFAAsF;SACrF,MAAM,CAAC,QAAQ,EAAE,+DAA+D,CAAC,CAAC;IAErF,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACrC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACpC,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACnC,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACrC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAEhC,iGAAiG;IACjG,kGAAkG;IAClG,kGAAkG;IAClG,mEAAmE;IACnE,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAE3B,sFAAsF;IACtF,uFAAuF;IACvF,gCAAgC;IAChC,OAAO,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAY;IACrC,GAAG,CAAC,YAAY,EAAE,CAAC;IACnB,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ;QAAE,iBAAiB,CAAC,GAAc,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;QAClC,uFAAuF;QACvF,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,yBAAyB,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACrG,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,CAAC;QACD,OAAO,WAAW,CAAC;YACjB,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;YAC5C,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,IAAI,CAAC,KAAK;SACrB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;QAC/B,4CAA4C;QAC5C,EAAE;QACF,+EAA+E;QAC/E,+EAA+E;QAC/E,4EAA4E;QAC5E,sEAAsE;QACtE,EAAE;QACF,+EAA+E;QAC/E,gFAAgF;QAChF,2CAA2C;QAC3C,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc;IACtC,gGAAgG;IAChG,qFAAqF;IACrF,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,WAAW,CAAC,IAAI,CAAC,CAAC;IAClB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;IAErD,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAE/B,8FAA8F;IAC9F,4BAA4B;IAC5B,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACpC,YAAY,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,sFAAsF;IACxF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AACD,oBAAoB"}