npm - @motebit/verify - Versions diffs - 1.2.1 → 1.3.0 - Mend

@motebit/verify 1.2.1 → 1.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (12) hide show

package/README.md CHANGED Viewed

@@ -1,6 +1,6 @@
 # @motebit/verify
-The canonical `motebit-verify` command-line tool. A single binary that verifies any signed motebit artifact — identity files, execution receipts, credentials, presentations — including credentials carrying hardware-attestation claims under any of the four canonical sovereign-verifiable platforms (Apple App Attest, Android Hardware-Backed Keystore Attestation, TPM 2.0, WebAuthn) plus the deprecated Play Integrity adapter bundled for one minor cycle for backward compat with already-minted credentials.
+The canonical `motebit-verify` command-line tool. A single binary that verifies any signed motebit artifact — identity files, execution receipts, credentials, presentations — including credentials carrying hardware-attestation claims under any of the four canonical sovereign-verifiable platforms (Apple App Attest, Android Hardware-Backed Keystore Attestation, TPM 2.0, WebAuthn).
 Network-free. No relay contact, no external service, no cloud dependency. Every trust anchor is pinned in the installed package.
@@ -28,14 +28,14 @@ VALID (credential)
 Hardware-attestation channel covers every currently-shipped platform:
-| Platform                        | Adapter                            | Trust anchor                                                                                                                                         |
-| ------------------------------- | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `secure_enclave`                | `@motebit/crypto` (built-in)       | ECDSA-P256 signature; self-asserted SE public key                                                                                                    |
-| `device_check`                  | `@motebit/crypto-appattest`        | Pinned Apple App Attestation Root CA                                                                                                                 |
-| `tpm`                           | `@motebit/crypto-tpm`              | Pinned Infineon / Nuvoton / STMicro / Intel PTT vendor roots                                                                                         |
-| `android_keystore`              | `@motebit/crypto-android-keystore` | Pinned Google Hardware Attestation roots (RSA + ECDSA P-384)                                                                                         |
-| `webauthn`                      | `@motebit/crypto-webauthn`         | Pinned Apple / Yubico / Microsoft FIDO roots                                                                                                         |
-| `play_integrity` _(deprecated)_ | `@motebit/crypto-play-integrity`   | Operator-supplied JWKS (no global Google JWKS exists; bundled for one minor cycle for backward compat — see `docs/doctrine/hardware-attestation.md`) |
+| Platform                     | Adapter                            | Trust anchor                                                                                                                                                      |
+| ---------------------------- | ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `secure_enclave`             | `@motebit/crypto` (built-in)       | ECDSA-P256 signature; self-asserted SE public key                                                                                                                 |
+| `device_check`               | `@motebit/crypto-appattest`        | Pinned Apple App Attestation Root CA                                                                                                                              |
+| `tpm`                        | `@motebit/crypto-tpm`              | Pinned Infineon / Nuvoton / STMicro / Intel PTT vendor roots                                                                                                      |
+| `android_keystore`           | `@motebit/crypto-android-keystore` | Pinned Google Hardware Attestation roots (RSA + ECDSA P-384)                                                                                                      |
+| `webauthn`                   | `@motebit/crypto-webauthn`         | Pinned Apple / Yubico / Microsoft FIDO roots                                                                                                                      |
+| `play_integrity` _(removed)_ | _(no adapter wired)_               | Removed 2026-05-03. Credentials carrying this platform fail-closed. Use `@motebit/crypto-android-keystore` instead — see `docs/doctrine/hardware-attestation.md`. |
 Unknown platform → named error, fail-closed. Missing adapter context → named error, fail-closed. Never silent acceptance.
@@ -51,11 +51,10 @@ motebit-verify <file> --clock-skew 30     # allow N seconds of clock drift
 motebit-verify <file> \
   --bundle-id com.example.app \
   --android-attestation-application-id ./app-id.bin \
-  --android-package com.example.app \
   --rp-id example.com
 ```
-**Verifying `android_keystore` credentials requires `--android-attestation-application-id`.** The flag's value is a path to a binary file containing the raw bytes of the leaf cert's `attestationApplicationId` extension — operators capture this once at build time (deterministic from the registered Android package name + signing-cert SHA-256) and commit the file alongside other pinned config. Without the flag, the Android Keystore arm is intentionally unwired (passing a placeholder would false-reject every real claim); the dispatcher reports `"verifier not wired"`. The legacy `--android-package` flag still configures the deprecated Play Integrity adapter for backward-compat with already-minted credentials.
+**Verifying `android_keystore` credentials requires `--android-attestation-application-id`.** The flag's value is a path to a binary file containing the raw bytes of the leaf cert's `attestationApplicationId` extension — operators capture this once at build time (deterministic from the registered Android package name + signing-cert SHA-256) and commit the file alongside other pinned config. Without the flag, the Android Keystore arm is intentionally unwired (passing a placeholder would false-reject every real claim); the dispatcher reports `"verifier not wired"`.
 Exit codes:
@@ -76,6 +75,33 @@ const result = await verifyFile("cred.json", {
 });
 ```
+`buildHardwareVerifiers()` with no arguments uses motebit's canonical defaults (`com.motebit.mobile` bundle, `motebit.com` RP ID, pinned Apple/Google/FIDO/TPM roots). To verify credentials minted by a fork, a federation peer, or a custom build, pass a `HardwareVerifierBundleConfig`:
+```ts
+import { readFileSync } from "node:fs";
+import { buildHardwareVerifiers } from "@motebit/verify";
+import { verifyFile } from "@motebit/verifier";
+const result = await verifyFile("cred.json", {
+  hardwareAttestation: buildHardwareVerifiers({
+    // Apple App Attest — non-motebit iOS build
+    appAttestBundleId: "com.example.app",
+    // Android Keystore — raw attestationApplicationId bytes from the
+    // leaf cert, computed once at build time from (packageName, signing-cert SHA-256)
+    androidKeystoreExpectedAttestationApplicationId: readFileSync("./app-id.bin"),
+    // WebAuthn — relying-party domain
+    webauthnRpId: "example.com",
+    // Optional — override any pinned root set (test fabrications, federation peer roots, etc.)
+    appAttestRootPem: customAppleRootPem,
+    androidKeystoreRootPems: [customGoogleRoot1, customGoogleRoot2],
+    webauthnRootPems: [customYubicoRoot],
+    tpmRootPems: [customInfineonRoot],
+  }),
+});
+```
+Every field is optional and falls back to the motebit-canonical default. The Android Keystore arm is wired only when `androidKeystoreExpectedAttestationApplicationId` is supplied — there is no canonical default for the leaf-cert package binding, by design.
 ## The three-package lineage
 This package sits at the top of a deliberate three-layer split — the same shape long-lived tool lineages use (git / libgit2, cargo / tokio, npm / @npm/arborist):
@@ -113,7 +139,7 @@ If you were on `@motebit/verify@^0.7.0`, migration depends on what you were usin
 - [`@motebit/verifier`](https://www.npmjs.com/package/@motebit/verifier) — Apache-2.0 library underneath this CLI (`verifyFile`, `verifyArtifact`, `formatHuman`)
 - [`@motebit/crypto`](https://www.npmjs.com/package/@motebit/crypto) — Apache-2.0 primitives (`verify`, `sign`, suite dispatch; zero monorepo deps)
 - [`@motebit/crypto-appattest`](https://www.npmjs.com/package/@motebit/crypto-appattest) — Apple App Attest adapter bundled into this CLI
-- [`@motebit/crypto-play-integrity`](https://www.npmjs.com/package/@motebit/crypto-play-integrity) — Google Play Integrity adapter bundled into this CLI
+- [`@motebit/crypto-android-keystore`](https://www.npmjs.com/package/@motebit/crypto-android-keystore) — Android Hardware-Backed Keystore Attestation adapter bundled into this CLI
 - [`@motebit/crypto-tpm`](https://www.npmjs.com/package/@motebit/crypto-tpm) — TPM 2.0 EK chain adapter bundled into this CLI
 - [`@motebit/crypto-webauthn`](https://www.npmjs.com/package/@motebit/crypto-webauthn) — WebAuthn packed-attestation adapter bundled into this CLI
 - [`motebit`](https://www.npmjs.com/package/motebit) — reference runtime and operator console

package/dist/adapters.d.ts CHANGED Viewed

@@ -4,11 +4,9 @@
  * `@motebit/verifier` (Apache-2.0) accepts an optional
  * `HardwareAttestationVerifiers` record but wires none of the leaves
  * itself; that keeps it dep-thin. This Apache-2.0 aggregator imports
- * every leaf (`@motebit/crypto-appattest`,
+ * every canonical leaf (`@motebit/crypto-appattest`,
  * `@motebit/crypto-android-keystore`, `@motebit/crypto-tpm`,
- * `@motebit/crypto-webauthn`, plus the deprecated
- * `@motebit/crypto-play-integrity` for backward compatibility during
- * its 1.x deprecation cycle) and produces a single
+ * `@motebit/crypto-webauthn`) and produces a single
  * `HardwareAttestationVerifiers` object the CLI hands to `verifyFile`.
  * Any credential whose subject carries a hardware-attestation claim
  * for any of the canonical platforms now verifies end-to-end — chain
@@ -28,15 +26,15 @@
  * Operators verifying credentials from a different motebit deployment
  * can override any of these via the config parameter.
  *
- * Play Integrity (deprecated): wired for one minor cycle so
- * already-minted credentials carrying `platform: "play_integrity"`
- * continue to verify cleanly through the same CLI invocation. New
- * mobile builds emit `platform: "android_keystore"` instead — see
+ * Note: `@motebit/crypto-play-integrity` was deprecated 2026-04-26 and
+ * fully removed 2026-05-03. The structural reason — Google publishes no
+ * global Play Integrity JWKS, so the package can't satisfy motebit's
+ * third-party-verifiability invariant — is captured in
  * `docs/doctrine/hardware-attestation.md` § "Three architectural
- * categories".
+ * categories". Android attestation lives entirely on
+ * `@motebit/crypto-android-keystore` now.
  */
 import type { HardwareAttestationVerifiers } from "@motebit/crypto";
-import { type GoogleJwks } from "@motebit/crypto-play-integrity";
 export interface HardwareVerifierBundleConfig {
     /**
      * Apple App Attest — bundle ID the attested iOS app was built with.
@@ -69,27 +67,6 @@ export interface HardwareVerifierBundleConfig {
      * covering both pre- and post-rotation device fleets).
      */
     readonly androidKeystoreRootPems?: ReadonlyArray<string>;
-    /**
-     * Google Play Integrity (DEPRECATED) — Android package name the
-     * attested app was built with. Defaults to `com.motebit.mobile`.
-     * Wired during the `@motebit/crypto-play-integrity@1.x`
-     * deprecation cycle so already-minted credentials continue to
-     * verify; new mobile builds emit `platform: "android_keystore"`.
-     */
-    readonly playIntegrityPackageName?: string;
-    /**
-     * Google Play Integrity (DEPRECATED) — override the pinned JWKS.
-     * Fail-closed by default — see the structural-mismatch note in
-     * `@motebit/crypto-play-integrity`'s CLAUDE.md (no global Google
-     * JWKS exists; this verifier is operator-key-mediated rather than
-     * sovereign-verifiable, which is why it's been deprecated).
-     */
-    readonly playIntegrityPinnedJwks?: GoogleJwks;
-    /**
-     * Google Play Integrity (DEPRECATED) — relax the device-integrity
-     * floor. Defaults to the strict `"MEETS_DEVICE_INTEGRITY"`.
-     */
-    readonly playIntegrityRequiredDeviceIntegrity?: string;
     /**
      * WebAuthn — Relying Party ID the credential was minted for.
      * Defaults to `motebit.com`.

package/dist/adapters.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"adapters.d.ts","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AAAA~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG~~;AACH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;~~AAIpE~~,~~OAAO,EAAyB,KAAK,UAAU,EAAE,~~MAAM,~~gCAAgC,CAAC;AAIxF,MAAM,~~WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;;;;;OASG;IACH,QAAQ,CAAC,+CAA+C,CAAC,EAAE,UAAU,CAAC;IACtE;;;;;OAKG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACzD~~;;;;;;OAMG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,UAAU,CAAC;IAC9C~~;;;OAGG;IACH,QAAQ,CAAC,~~oCAAoC,CAAC,EAAE,MAAM,CAAC;IACvD;;;OAGG;IACH,QAAQ,CAAC,~~YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAClD;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AAOD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,CAAC,EAAE,4BAA4B,GACpC,4BAA4B,~~CA4C9B~~"}
1	+ {"version":3,"file":"adapters.d.ts","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAMpE,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;;;;;OASG;IACH,QAAQ,CAAC,+CAA+C,CAAC,EAAE,UAAU,CAAC;IACtE;;;;;OAKG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACzD;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAClD;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AAOD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,CAAC,EAAE,4BAA4B,GACpC,4BAA4B,CAiC9B"}

package/dist/adapters.js CHANGED Viewed

@@ -1,7 +1,5 @@
 import { androidKeystoreVerifier } from "@motebit/crypto-android-keystore";
 import { deviceCheckVerifier, APPLE_APPATTEST_ROOT_PEM } from "@motebit/crypto-appattest";
-// eslint-disable-next-line @typescript-eslint/no-deprecated -- consumed for one minor deprecation cycle so already-minted Play Integrity claims continue to verify; removed at @motebit/crypto-play-integrity@2.0.0.
-import { playIntegrityVerifier } from "@motebit/crypto-play-integrity";
 import { tpmVerifier } from "@motebit/crypto-tpm";
 import { webauthnVerifier, DEFAULT_FIDO_ROOTS } from "@motebit/crypto-webauthn";
 /** Motebit's canonical iOS / Android app identifier. */
@@ -31,7 +29,6 @@ const DEFAULT_WEBAUTHN_RP_ID = "motebit.com";
  */
 export function buildHardwareVerifiers(config) {
     const appAttestBundleId = config?.appAttestBundleId ?? DEFAULT_BUNDLE_ID;
-    const playIntegrityPackageName = config?.playIntegrityPackageName ?? DEFAULT_BUNDLE_ID;
     const webauthnRpId = config?.webauthnRpId ?? DEFAULT_WEBAUTHN_RP_ID;
     const verifiers = {
         deviceCheck: deviceCheckVerifier({
@@ -41,16 +38,6 @@ export function buildHardwareVerifiers(config) {
         tpm: tpmVerifier({
             ...(config?.tpmRootPems !== undefined ? { rootPems: config.tpmRootPems } : {}),
         }),
-        // eslint-disable-next-line @typescript-eslint/no-deprecated -- one-minor-cycle backward compat for already-minted Play Integrity credentials; removed at @motebit/crypto-play-integrity@2.0.0.
-        playIntegrity: playIntegrityVerifier({
-            expectedPackageName: playIntegrityPackageName,
-            ...(config?.playIntegrityPinnedJwks !== undefined
-                ? { pinnedJwks: config.playIntegrityPinnedJwks }
-                : {}),
-            ...(config?.playIntegrityRequiredDeviceIntegrity !== undefined
-                ? { requiredDeviceIntegrity: config.playIntegrityRequiredDeviceIntegrity }
-                : {}),
-        }),
         webauthn: webauthnVerifier({
             expectedRpId: webauthnRpId,
             rootPems: config?.webauthnRootPems ?? DEFAULT_FIDO_ROOTS,

package/dist/adapters.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"adapters.js","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"~~AAsCA~~,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,~~qNAAqN;AACrN,~~OAAO,EAAE,~~qBAAqB,EAAmB,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,~~WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;~~AAyEhF~~,wDAAwD;AACxD,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAC/C,qEAAqE;AACrE,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAqC;IAErC,MAAM,iBAAiB,GAAG,MAAM,EAAE,iBAAiB,IAAI,iBAAiB,CAAC;IACzE,MAAM,~~wBAAwB,GAAG,MAAM,EAAE,wBAAwB,IAAI,iBAAiB,CAAC;IACvF,MAAM,~~YAAY,GAAG,MAAM,EAAE,YAAY,IAAI,sBAAsB,CAAC;IAEpE,MAAM,SAAS,GAA0C;QACvD,WAAW,EAAE,mBAAmB,CAAC;YAC/B,gBAAgB,EAAE,iBAAiB;YACnC,OAAO,EAAE,MAAM,EAAE,gBAAgB,IAAI,wBAAwB;SAC9D,CAAC;QACF,GAAG,EAAE,WAAW,CAAC;YACf,GAAG,CAAC,MAAM,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/E,CAAC;QACF~~,+LAA+L;QAC/L~~,aAAa,EAAE,qBAAqB,CAAC;YACnC,mBAAmB,EAAE,wBAAwB;YAC7C,GAAG,CAAC,MAAM,EAAE,uBAAuB,KAAK,SAAS;gBAC/C,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,uBAAuB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,EAAE,oCAAoC,KAAK,SAAS;gBAC5D,CAAC,CAAC,EAAE,uBAAuB,EAAE,MAAM,CAAC,oCAAoC,EAAE;gBAC1E,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,QAAQ,EAAE,gBAAgB,CAAC;YACzB,YAAY,EAAE,YAAY;YAC1B,QAAQ,EAAE,MAAM,EAAE,gBAAgB,IAAI,kBAAkB;SACzD,CAAC;KACH,CAAC;IAEF,oEAAoE;IACpE,oEAAoE;IACpE,gEAAgE;IAChE,2DAA2D;IAC3D,iCAAiC;IACjC,IAAI,MAAM,EAAE,+CAA+C,KAAK,SAAS,EAAE,CAAC;QAC1E,SAAS,CAAC,eAAe,GAAG,uBAAuB,CAAC;YAClD,gCAAgC,EAAE,MAAM,CAAC,+CAA+C;YACxF,GAAG,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS;gBAC9C,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,uBAAuB,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}
1	+ {"version":3,"file":"adapters.js","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAoDhF,wDAAwD;AACxD,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAC/C,qEAAqE;AACrE,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAqC;IAErC,MAAM,iBAAiB,GAAG,MAAM,EAAE,iBAAiB,IAAI,iBAAiB,CAAC;IACzE,MAAM,YAAY,GAAG,MAAM,EAAE,YAAY,IAAI,sBAAsB,CAAC;IAEpE,MAAM,SAAS,GAA0C;QACvD,WAAW,EAAE,mBAAmB,CAAC;YAC/B,gBAAgB,EAAE,iBAAiB;YACnC,OAAO,EAAE,MAAM,EAAE,gBAAgB,IAAI,wBAAwB;SAC9D,CAAC;QACF,GAAG,EAAE,WAAW,CAAC;YACf,GAAG,CAAC,MAAM,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/E,CAAC;QACF,QAAQ,EAAE,gBAAgB,CAAC;YACzB,YAAY,EAAE,YAAY;YAC1B,QAAQ,EAAE,MAAM,EAAE,gBAAgB,IAAI,kBAAkB;SACzD,CAAC;KACH,CAAC;IAEF,oEAAoE;IACpE,oEAAoE;IACpE,gEAAgE;IAChE,2DAA2D;IAC3D,iCAAiC;IACjC,IAAI,MAAM,EAAE,+CAA+C,KAAK,SAAS,EAAE,CAAC;QAC1E,SAAS,CAAC,eAAe,GAAG,uBAAuB,CAAC;YAClD,gCAAgC,EAAE,MAAM,CAAC,+CAA+C;YACxF,GAAG,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS;gBAC9C,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,uBAAuB,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/cli.d.ts CHANGED Viewed

@@ -5,10 +5,9 @@
  * Verifies identity files, execution receipts, credentials, and
  * presentations against their embedded signatures. When a credential
  * carries a `hardware_attestation` claim for `device_check` / `tpm` /
- * `android_keystore` / `webauthn` (plus the deprecated `play_integrity`
- * for backward compat with already-minted credentials), the bundled
- * platform adapters verify the chain, extension, package binding, and
- * identity binding end-to-end.
+ * `android_keystore` / `webauthn`, the bundled platform adapters
+ * verify the chain, extension, package binding, and identity binding
+ * end-to-end.
  *
  * ```
  *   motebit-verify <file>                 # auto-detect, print human
@@ -30,9 +29,8 @@
  *   2  usage / I/O error
  *
  * Network-free by design. Every adapter pins its own trust anchor
- * (Apple App Attest Root CA, FIDO roots, TPM vendor roots); Play
- * Integrity's JWKS is fail-closed by default until an operator lands
- * real bytes (see `@motebit/crypto-play-integrity`'s CLAUDE.md).
+ * (Apple App Attest Root CA, FIDO roots, TPM vendor roots, Google
+ * Hardware Attestation roots).
  *
  * Three-package lineage — mirrors how tools like `git` / `libgit2` or
  * `cargo` / `tokio` separate the verb-tool from the library layer:
@@ -41,5 +39,49 @@
  *   @motebit/verifier — Apache-2.0 library (file I/O, human formatting)
  *   @motebit/crypto   — Apache-2.0 primitives (verify, sign, suite dispatch)
  */
+import type { ArtifactType, ContentArtifactManifest } from "@motebit/crypto";
+import type { ContentArtifactType } from "@motebit/protocol";
+interface ParsedArgs {
+    readonly mode: "verify" | "verify-content-artifact" | "help" | "version";
+    readonly file?: string;
+    readonly json: boolean;
+    readonly expectedType?: ArtifactType;
+    readonly clockSkewSeconds?: number;
+    readonly bundleId?: string;
+    readonly androidAttestationApplicationIdPath?: string;
+    readonly rpId?: string;
+    /** Content-artifact mode: manifest input — either base64url header value or path to JSON file. */
+    readonly manifest?: string;
+    /** Content-artifact mode: optional pinned producer key (hex, 64 chars). */
+    readonly expectedProducerKey?: string;
+    /** Content-artifact mode: optional expected artifact-type from the closed registry. */
+    readonly expectedArtifactType?: ContentArtifactType;
+    readonly usageError?: string;
+}
+export declare function parseArgs(argv: readonly string[]): ParsedArgs;
+/**
+ * Decode the `--manifest` argument. Tries the value as a filesystem
+ * path first; if the file exists and parses as JSON, returns that.
+ * Otherwise, treats it as a base64url-encoded canonical-JSON
+ * representation (the form `services/relay/src/state-export.ts` emits
+ * in the `X-Motebit-Content-Manifest` HTTP header). Returns the
+ * parsed manifest object or a usage error.
+ *
+ * Auto-detect order matters: a base64url string could in principle be
+ * a legal path on disk, but the path-first try is bounded (readFileSync
+ * + JSON.parse) and falls through silently to header-decode. The
+ * inverse — treating every input as header bytes — would accidentally
+ * succeed on JSON files whose contents happen to base64-decode as
+ * arbitrary bytes, returning malformed garbage.
+ */
+export declare function decodeManifestInput(value: string): {
+    ok: true;
+    manifest: ContentArtifactManifest;
+} | {
+    ok: false;
+    error: string;
+};
+/** Failure-reason → human-readable phrase for the human-mode CLI output. */
+export declare function describeContentArtifactReason(reason: string): string;
 export {};
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG~~"}
1	+ {"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AA6B7D,UAAU,UAAU;IAClB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,yBAAyB,GAAG,MAAM,GAAG,SAAS,CAAC;IACzE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,mCAAmC,CAAC,EAAE,MAAM,CAAC;IACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,uFAAuF;IACvF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,mBAAmB,CAAC;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAsH7D;AAgND;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,GACZ;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,uBAAuB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA0BhF;AAED,4EAA4E;AAC5E,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAmBpE"}

package/dist/cli.js CHANGED Viewed

@@ -5,10 +5,9 @@
  * Verifies identity files, execution receipts, credentials, and
  * presentations against their embedded signatures. When a credential
  * carries a `hardware_attestation` claim for `device_check` / `tpm` /
- * `android_keystore` / `webauthn` (plus the deprecated `play_integrity`
- * for backward compat with already-minted credentials), the bundled
- * platform adapters verify the chain, extension, package binding, and
- * identity binding end-to-end.
+ * `android_keystore` / `webauthn`, the bundled platform adapters
+ * verify the chain, extension, package binding, and identity binding
+ * end-to-end.
  *
  * ```
  *   motebit-verify <file>                 # auto-detect, print human
@@ -30,9 +29,8 @@
  *   2  usage / I/O error
  *
  * Network-free by design. Every adapter pins its own trust anchor
- * (Apple App Attest Root CA, FIDO roots, TPM vendor roots); Play
- * Integrity's JWKS is fail-closed by default until an operator lands
- * real bytes (see `@motebit/crypto-play-integrity`'s CLAUDE.md).
+ * (Apple App Attest Root CA, FIDO roots, TPM vendor roots, Google
+ * Hardware Attestation roots).
  *
  * Three-package lineage — mirrors how tools like `git` / `libgit2` or
  * `cargo` / `tokio` separate the verb-tool from the library layer:
@@ -44,6 +42,9 @@
 import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { verifyContentArtifact } from "@motebit/crypto";
+import { ALL_CONTENT_ARTIFACT_TYPES, isContentArtifactType } from "@motebit/protocol";
+import { verifyInnerSignedReceipts, } from "@motebit/state-export-client";
 import { formatHuman, verifyFile } from "@motebit/verifier";
 import { buildHardwareVerifiers } from "./adapters.js";
 const EXPECT_VALUES = [
@@ -53,13 +54,29 @@ const EXPECT_VALUES = [
     "presentation",
     "skill",
 ];
-function parseArgs(argv) {
+/**
+ * First positional argument that switches the CLI into content-artifact
+ * mode. Verifies a relay-asserted (or motebit-asserted) C2PA-shape
+ * manifest against the bytes it covers — the consumer-side primitive
+ * for the state-export-signing surface (`docs/doctrine/nist-alignment.md`
+ * §8). Stays a subcommand rather than auto-detection because
+ * content-artifact mode takes TWO inputs (body + manifest); auto-
+ * detection on a single positional cannot distinguish them.
+ */
+const CONTENT_ARTIFACT_SUBCOMMAND = "content-artifact";
+export function parseArgs(argv) {
+    // Detect content-artifact subcommand at the head of the arg list.
+    // The remaining args are parsed in content-artifact mode — a strict
+    // subset of the credential-verification flags (no platform-specific
+    // overrides) plus content-artifact-specific flags.
+    if (argv[0] === CONTENT_ARTIFACT_SUBCOMMAND) {
+        return parseContentArtifactArgs(argv.slice(1));
+    }
     let file;
     let json = false;
     let expectedType;
     let clockSkewSeconds;
     let bundleId;
-    let androidPackage;
     let androidAttestationApplicationIdPath;
     let rpId;
     let help = false;
@@ -114,14 +131,6 @@ function parseArgs(argv) {
                 i += 2;
                 break;
             }
-            case "--android-package": {
-                const value = argv[i + 1];
-                if (value === undefined)
-                    return usage("--android-package requires a value");
-                androidPackage = value;
-                i += 2;
-                break;
-            }
             case "--android-attestation-application-id": {
                 // Path to a binary file containing the raw bytes of the leaf
                 // cert's `attestationApplicationId` extension value. Operators
@@ -170,7 +179,6 @@ function parseArgs(argv) {
         ...(expectedType !== undefined && { expectedType }),
         ...(clockSkewSeconds !== undefined && { clockSkewSeconds }),
         ...(bundleId !== undefined && { bundleId }),
-        ...(androidPackage !== undefined && { androidPackage }),
         ...(androidAttestationApplicationIdPath !== undefined && {
             androidAttestationApplicationIdPath,
         }),
@@ -180,12 +188,115 @@ function parseArgs(argv) {
 function usage(message) {
     return { mode: "help", json: false, usageError: message };
 }
+/**
+ * Parse args for the `content-artifact` subcommand. Accepts:
+ *
+ *   motebit-verify content-artifact <body-file> --manifest <header-or-path>
+ *                                    [--expect <artifact-type>]
+ *                                    [--producer-key <hex>]
+ *                                    [--json]
+ *
+ * `--manifest` accepts EITHER a base64url-encoded canonical-JSON value
+ * (as emitted in the `X-Motebit-Content-Manifest` HTTP header) OR a
+ * filesystem path to a JSON file. Auto-detected by checking if the
+ * value parses as JSON when treated as a path; on filesystem read
+ * failure, falls back to base64url-header interpretation.
+ *
+ * `--producer-key` (optional) pins the expected producer's hex public
+ * key (32 bytes / 64 hex chars). When set, the CLI rejects with
+ * `producer_key_mismatch` if the manifest's declared key differs —
+ * the offline trust-anchor primitive (a verifier who has pinned the
+ * relay's pubkey from `/.well-known/motebit-transparency.json` can
+ * confirm the producer matches).
+ *
+ * `--expect` (optional) narrows to a member of the `ContentArtifactType`
+ * registry; mirrors the closed-registry pattern of the credential-
+ * mode `--expect`.
+ */
+function parseContentArtifactArgs(argv) {
+    let file;
+    let manifest;
+    let expectedArtifactType;
+    let expectedProducerKey;
+    let json = false;
+    let help = false;
+    let i = 0;
+    while (i < argv.length) {
+        const arg = argv[i];
+        switch (arg) {
+            case "-h":
+            case "--help":
+                help = true;
+                i++;
+                break;
+            case "--json":
+                json = true;
+                i++;
+                break;
+            case "--manifest": {
+                const value = argv[i + 1];
+                if (value === undefined)
+                    return usage("--manifest requires a value (header or file path)");
+                manifest = value;
+                i += 2;
+                break;
+            }
+            case "--expect":
+            case "--expected-type": {
+                const value = argv[i + 1];
+                if (value === undefined)
+                    return usage(`${arg} requires a value`);
+                if (!isContentArtifactType(value)) {
+                    return usage(`unknown --expect value "${value}" (valid: ${ALL_CONTENT_ARTIFACT_TYPES.join(", ")})`);
+                }
+                expectedArtifactType = value;
+                i += 2;
+                break;
+            }
+            case "--producer-key": {
+                const value = argv[i + 1];
+                if (value === undefined)
+                    return usage("--producer-key requires a hex value");
+                if (!/^[0-9a-fA-F]{64}$/.test(value)) {
+                    return usage("--producer-key must be 64 hex characters (32-byte Ed25519 public key)");
+                }
+                expectedProducerKey = value.toLowerCase();
+                i += 2;
+                break;
+            }
+            default:
+                if (arg.startsWith("-"))
+                    return usage(`unknown flag: ${arg}`);
+                if (file !== undefined) {
+                    return usage(`expected exactly one body-file argument, got a second: "${arg}" (after "${file}")`);
+                }
+                file = arg;
+                i++;
+                break;
+        }
+    }
+    if (help)
+        return { mode: "help", json };
+    if (file === undefined)
+        return usage("content-artifact: missing body-file argument");
+    if (manifest === undefined)
+        return usage("content-artifact: --manifest is required");
+    return {
+        mode: "verify-content-artifact",
+        file,
+        manifest,
+        json,
+        ...(expectedArtifactType !== undefined && { expectedArtifactType }),
+        ...(expectedProducerKey !== undefined && { expectedProducerKey }),
+    };
+}
 function renderHelp() {
     return [
         "motebit-verify — verify any signed Motebit artifact offline.",
         "",
         "USAGE",
         "  motebit-verify <path> [options]",
+        "  motebit-verify content-artifact <body-file> --manifest <header-or-path> [options]",
         "",
         "  <path> may be a single file (identity, receipt, credential, presentation,",
         "  or a skill envelope JSON) OR a skill directory containing SKILL.md +",
@@ -194,15 +305,20 @@ function renderHelp() {
         "  body-hash + per-file-hash cross-check; single-file inputs run the",
         "  artifact's own signature check.",
         "",
+        "  `content-artifact` mode verifies a C2PA-shape relay-asserted",
+        "  manifest (e.g. the `X-Motebit-Content-Manifest` HTTP header emitted",
+        "  on every state-export endpoint) against the response-body bytes",
+        "  it covers. Two-step check: SHA-256 content-hash recomputation +",
+        "  Ed25519 signature verification against the manifest's declared",
+        "  producer key. Offline by design; pin the producer key with",
+        `  --producer-key from /.well-known/motebit-transparency.json.`,
+        "",
         "OPTIONS",
         "  --json                    Print structured JSON instead of human-readable.",
         "  --expect <type>           Require the artifact to be of the named type.",
         "  --clock-skew <seconds>    Allow N seconds of clock skew.",
         "  --bundle-id <id>          Override the expected iOS bundle ID for App Attest",
         "                            (default: com.motebit.mobile).",
-        "  --android-package <name>  Override the expected Android package name for",
-        "                            the deprecated Play Integrity adapter",
-        "                            (default: com.motebit.mobile).",
         "  --android-attestation-application-id <path>",
         "                            Path to a binary file containing the raw bytes",
         "                            of the leaf cert's `attestationApplicationId`",
@@ -215,6 +331,24 @@ function renderHelp() {
         "                            alongside other pinned config.",
         "  --rp-id <id>              Override the expected WebAuthn Relying Party ID",
         "                            (default: motebit.com).",
+        "",
+        "  CONTENT-ARTIFACT MODE — `motebit-verify content-artifact <body> ...`",
+        "  --manifest <header-or-path>",
+        "                            Either a base64url-encoded canonical-JSON",
+        "                            manifest value (the form emitted in the",
+        "                            X-Motebit-Content-Manifest HTTP header) OR a",
+        "                            filesystem path to a JSON manifest file.",
+        "                            Auto-detected.",
+        "  --producer-key <hex>      Pin the expected producer's Ed25519 public",
+        "                            key (64 hex chars). When set, rejects with",
+        "                            producer_key_mismatch if the manifest's",
+        "                            declared key differs. Pair with a key fetched",
+        "                            from /.well-known/motebit-transparency.json",
+        "                            for offline trust-anchor enforcement.",
+        "  --expect <artifact-type>  In content-artifact mode, narrows to a member",
+        "                            of the ContentArtifactType registry",
+        `                            (${ALL_CONTENT_ARTIFACT_TYPES.length} types today; see @motebit/protocol).`,
+        "",
         "  -h, --help                Show this help.",
         "  -V, --version             Print version.",
         "",
@@ -231,11 +365,13 @@ function renderHelp() {
         "                     --android-attestation-application-id)",
         "  webauthn           WebAuthn packed attestation (pinned Apple / Yubico / Microsoft)",
         "",
-        "PLATFORMS WIRED (deprecated, removed at @motebit/crypto-play-integrity@2.0.0)",
-        "  play_integrity     Google Play Integrity (operator-supplied JWKS;",
-        "                     no global Google JWKS exists by Google's design.",
-        "                     See docs/doctrine/hardware-attestation.md § 'Three",
-        "                     architectural categories' for the structural reason.)",
+        "PLATFORMS REMOVED",
+        "  play_integrity     Google Play Integrity adapter was removed 2026-05-03.",
+        "                     Credentials carrying this platform now hit the canonical",
+        "                     dispatcher's fail-closed 'verifier not wired' branch.",
+        "                     Use @motebit/crypto-android-keystore instead — see",
+        "                     docs/doctrine/hardware-attestation.md § 'Three",
+        "                     architectural categories' for the structural reason.",
     ].join("\n");
 }
 let cachedVersion;
@@ -253,6 +389,210 @@ function getPackageVersion() {
     }
     return cachedVersion;
 }
+/**
+ * Decode the `--manifest` argument. Tries the value as a filesystem
+ * path first; if the file exists and parses as JSON, returns that.
+ * Otherwise, treats it as a base64url-encoded canonical-JSON
+ * representation (the form `services/relay/src/state-export.ts` emits
+ * in the `X-Motebit-Content-Manifest` HTTP header). Returns the
+ * parsed manifest object or a usage error.
+ *
+ * Auto-detect order matters: a base64url string could in principle be
+ * a legal path on disk, but the path-first try is bounded (readFileSync
+ * + JSON.parse) and falls through silently to header-decode. The
+ * inverse — treating every input as header bytes — would accidentally
+ * succeed on JSON files whose contents happen to base64-decode as
+ * arbitrary bytes, returning malformed garbage.
+ */
+export function decodeManifestInput(value) {
+    // Path-first: if the value looks like a path and readable as JSON, use that.
+    try {
+        const fileContents = readFileSync(value, "utf-8");
+        const parsed = JSON.parse(fileContents);
+        return { ok: true, manifest: parsed };
+    }
+    catch {
+        // Fall through to header-decode.
+    }
+    // Header-form: base64url → UTF-8 → JSON. Buffer is available because
+    // the CLI runs in Node ≥20 (per repo engines).
+    try {
+        const decoded = Buffer.from(value, "base64url").toString("utf-8");
+        if (decoded === "") {
+            return { ok: false, error: "--manifest is empty or undecodable as base64url" };
+        }
+        const parsed = JSON.parse(decoded);
+        return { ok: true, manifest: parsed };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+            ok: false,
+            error: `--manifest is neither a readable JSON file nor a valid base64url-encoded manifest: ${msg}`,
+        };
+    }
+}
+/** Failure-reason → human-readable phrase for the human-mode CLI output. */
+export function describeContentArtifactReason(reason) {
+    switch (reason) {
+        case "content_hash_mismatch":
+            return "body bytes do not match the manifest's content_hash (the artifact was tampered, OR the manifest was issued for different bytes)";
+        case "signature_invalid":
+            return "signature does not verify against the declared producer key (manifest tampered, OR signed by a different key than the one declared)";
+        case "malformed_public_key":
+            return "manifest's producer_public_key is not 64 hex characters (32-byte Ed25519)";
+        case "malformed_signature":
+            return "manifest's signature is not valid base64url";
+        case "unsupported_suite":
+            return "manifest's cryptosuite is not yet implemented by this verifier (post-quantum migration pending)";
+        case "producer_key_mismatch":
+            return "manifest's declared producer key does not match the value pinned via --producer-key";
+        case "artifact_type_mismatch":
+            return "manifest's artifact_type does not match the value required via --expect";
+        default:
+            return reason;
+    }
+}
+async function verifyContentArtifactCli(args, json) {
+    if (args.file === undefined) {
+        process.stderr.write(`motebit-verify: content-artifact missing body-file argument\n`);
+        return 2;
+    }
+    if (args.manifest === undefined) {
+        process.stderr.write(`motebit-verify: content-artifact requires --manifest\n`);
+        return 2;
+    }
+    let bodyBytes;
+    try {
+        const buf = readFileSync(args.file);
+        bodyBytes = new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`motebit-verify: cannot read body-file ${args.file}: ${msg}\n`);
+        return 2;
+    }
+    const decoded = decodeManifestInput(args.manifest);
+    if (!decoded.ok) {
+        process.stderr.write(`motebit-verify: ${decoded.error}\n`);
+        return 2;
+    }
+    const manifest = decoded.manifest;
+    // Pre-crypto policy checks: producer-key pin and artifact-type narrow.
+    // Both bounded to bytes-level comparison — no new crypto in this
+    // package per CLAUDE.md Rule 1. The primitive's failure modes stay
+    // pristine; these CLI-layer rejections carry their own typed reasons.
+    if (args.expectedProducerKey !== undefined &&
+        manifest.producer_public_key.toLowerCase() !== args.expectedProducerKey) {
+        const result = {
+            valid: false,
+            reason: "producer_key_mismatch",
+            expected_producer_public_key: args.expectedProducerKey,
+            actual_producer_public_key: manifest.producer_public_key.toLowerCase(),
+        };
+        if (json) {
+            process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+        }
+        else {
+            process.stdout.write(`✗ content-artifact INVALID — ${describeContentArtifactReason(result.reason)}\n`);
+        }
+        return 1;
+    }
+    if (args.expectedArtifactType !== undefined &&
+        manifest.artifact_type !== args.expectedArtifactType) {
+        const result = {
+            valid: false,
+            reason: "artifact_type_mismatch",
+            expected_artifact_type: args.expectedArtifactType,
+            actual_artifact_type: manifest.artifact_type,
+        };
+        if (json) {
+            process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+        }
+        else {
+            process.stdout.write(`✗ content-artifact INVALID — ${describeContentArtifactReason(result.reason)}\n`);
+        }
+        return 1;
+    }
+    const result = await verifyContentArtifact(manifest, bodyBytes);
+    // v1.1 inner-receipt recursive verification — only when the outer
+    // manifest already verified (no point auditing the inside of bytes
+    // we don't trust were assembled by the relay we expected). Auto-on
+    // when applicable; no flag to remember. Calm-software register:
+    // surfaces a per-inner-receipt summary only when v1.1 bodies are
+    // detected. Per `spec/execution-ledger-v1.md` §4.3 + closure of the
+    // operator-trust gap (`docs/doctrine/nist-alignment.md` §8).
+    let innerVerification;
+    if (result.valid && manifest.artifact_type === "execution-ledger") {
+        try {
+            const parsed = JSON.parse(new TextDecoder().decode(bodyBytes));
+            const inner = await verifyInnerSignedReceipts(parsed);
+            if (inner.applicable)
+                innerVerification = inner;
+        }
+        catch {
+            // Body parsed earlier for the outer manifest, but if v1.1 inner
+            // recursion can't parse it (somehow), silently skip — the outer
+            // check has already verified the bytes. v1.0 bodies and bodies
+            // without `signed_receipts` set `applicable: false` and don't
+            // surface a section.
+        }
+    }
+    const innerFailed = innerVerification !== undefined && !innerVerification.allValid;
+    if (json) {
+        process.stdout.write(`${JSON.stringify({
+            valid: result.valid && !innerFailed,
+            ...(result.reason !== undefined && { reason: result.reason }),
+            manifest: {
+                suite: manifest.suite,
+                artifact_type: manifest.artifact_type,
+                producer: manifest.producer,
+                producer_public_key: manifest.producer_public_key,
+                claim_generator: manifest.claim_generator,
+                produced_at: manifest.produced_at,
+                content_hash: manifest.content_hash,
+                ...(manifest.invocation !== undefined && { invocation: manifest.invocation }),
+            },
+            ...(innerVerification !== undefined && { inner_receipts: innerVerification }),
+        }, null, 2)}\n`);
+    }
+    else {
+        if (result.valid) {
+            process.stdout.write([
+                `✓ content-artifact VERIFIED`,
+                `  artifact_type    ${manifest.artifact_type}`,
+                `  producer         ${manifest.producer}`,
+                `  producer_key     ${manifest.producer_public_key}`,
+                `  claim_generator  ${manifest.claim_generator}`,
+                `  produced_at      ${manifest.produced_at}`,
+                `  suite            ${manifest.suite}`,
+                `  content_hash     ${manifest.content_hash}`,
+                ``,
+            ].join("\n"));
+            if (innerVerification !== undefined) {
+                const allOk = innerVerification.allValid;
+                process.stdout.write([
+                    `${allOk ? "✓" : "✗"} inner receipts ${innerVerification.verifiedCount}/${innerVerification.totalCount} VERIFIED (spec: motebit/execution-ledger@1.1)`,
+                    ...innerVerification.results.map((r) => {
+                        if (r.valid) {
+                            return `  ✓ ${r.taskId}  motebit=${r.motebitId}${r.signerDid !== undefined ? `  signer=${r.signerDid}` : ""}`;
+                        }
+                        return `  ✗ ${r.taskId}  motebit=${r.motebitId}  reason=${r.reason ?? "unknown"}${r.detail !== undefined ? `  detail=${r.detail}` : ""}`;
+                    }),
+                    ``,
+                ].join("\n"));
+            }
+        }
+        else {
+            process.stdout.write(`✗ content-artifact INVALID — ${describeContentArtifactReason(result.reason ?? "unknown")}\n`);
+        }
+    }
+    // Overall validity gates on outer AND inner — a v1.1 bundle where any
+    // inner receipt fails is not a clean verification, even if the relay's
+    // outer signature checks out (the relay is correctly attesting bytes
+    // it assembled, but those bytes contain falsified inner claims).
+    return result.valid && !innerFailed ? 0 : 1;
+}
 async function main() {
     const args = parseArgs(process.argv.slice(2));
     if (args.mode === "version") {
@@ -268,6 +608,9 @@ async function main() {
         process.stdout.write(`${help}\n`);
         return 0;
     }
+    if (args.mode === "verify-content-artifact") {
+        return verifyContentArtifactCli(args, args.json);
+    }
     if (args.file === undefined) {
         process.stderr.write(`motebit-verify: missing file argument\n\n${renderHelp()}\n`);
         return 2;
@@ -286,7 +629,6 @@ async function main() {
     }
     const hardwareAttestation = buildHardwareVerifiers({
         ...(args.bundleId !== undefined && { appAttestBundleId: args.bundleId }),
-        ...(args.androidPackage !== undefined && { playIntegrityPackageName: args.androidPackage }),
         ...(androidKeystoreExpectedAttestationApplicationId !== undefined && {
             androidKeystoreExpectedAttestationApplicationId,
         }),
@@ -313,13 +655,31 @@ async function main() {
     }
     return result.valid ? 0 : 1;
 }
-main()
-    .then((code) => {
-    process.exit(code);
-})
-    .catch((err) => {
-    const msg = err instanceof Error ? err.message : String(err);
-    process.stderr.write(`motebit-verify: ${msg}\n`);
-    process.exit(2);
-});
+// Entry-point guard: only run when invoked as the binary, not when
+// imported by tests or programmatic consumers. Mirrors the standard
+// Node ESM pattern `if (import.meta.url === pathToFileURL(argv[1]))`.
+// Without this, importing cli.ts to test the pure-function helpers
+// triggers main() with vitest's argv and exits the test process.
+const invokedAsBinary = (() => {
+    if (process.argv[1] === undefined)
+        return false;
+    try {
+        const argvFileUrl = new URL(`file://${process.argv[1]}`).href;
+        return import.meta.url === argvFileUrl;
+    }
+    catch {
+        return false;
+    }
+})();
+if (invokedAsBinary) {
+    main()
+        .then((code) => {
+        process.exit(code);
+    })
+        .catch((err) => {
+        const msg = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`motebit-verify: ${msg}\n`);
+        process.exit(2);
+    });
+}
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEvD,MAAM,aAAa,GAA4B;IAC7C,UAAU;IACV,SAAS;IACT,YAAY;IACZ,cAAc;IACd,OAAO;CACR,CAAC;AAeF,SAAS,SAAS,CAAC,IAAuB;IACxC,IAAI,IAAwB,CAAC;IAC7B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,YAAsC,CAAC;IAC3C,IAAI,gBAAoC,CAAC;IACzC,IAAI,QAA4B,CAAC;IACjC,IAAI,cAAkC,CAAC;IACvC,IAAI,mCAAuD,CAAC;IAC5D,IAAI,IAAwB,CAAC;IAC7B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC;YACV,KAAK,QAAQ;gBACX,IAAI,GAAG,IAAI,CAAC;gBACZ,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,KAAK,IAAI,CAAC;YACV,KAAK,WAAW;gBACd,OAAO,GAAG,IAAI,CAAC;gBACf,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,GAAG,IAAI,CAAC;gBACZ,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,KAAK,UAAU,CAAC;YAChB,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,GAAG,GAAG,mBAAmB,CAAC,CAAC;gBACjE,IAAI,CAAE,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1D,OAAO,KAAK,CAAC,2BAA2B,KAAK,aAAa,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACzF,CAAC;gBACD,YAAY,GAAG,KAAqB,CAAC;gBACrC,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;YACR,CAAC;YACD,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBACxF,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjC,OAAO,KAAK,CAAC,qDAAqD,KAAK,IAAI,CAAC,CAAC;gBAC/E,CAAC;gBACD,gBAAgB,GAAG,CAAC,CAAC;gBACrB,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;YACR,CAAC;YACD,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBACtE,QAAQ,GAAG,KAAK,CAAC;gBACjB,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;YACR,CAAC;YACD,KAAK,mBAAmB,CAAC,CAAC,CAAC;gBACzB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBAC5E,cAAc,GAAG,KAAK,CAAC;gBACvB,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;YACR,CAAC;YACD,KAAK,sCAAsC,CAAC,CAAC,CAAC;gBAC5C,6DAA6D;gBAC7D,+DAA+D;gBAC/D,0DAA0D;gBAC1D,2DAA2D;gBAC3D,+DAA+D;gBAC/D,8DAA8D;gBAC9D,8CAA8C;gBAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,OAAO,KAAK,CAAC,uEAAuE,CAAC,CAAC;gBACxF,CAAC;gBACD,mCAAmC,GAAG,KAAK,CAAC;gBAC5C,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;YACR,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBAClE,IAAI,GAAG,KAAK,CAAC;gBACb,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;YACR,CAAC;YACD;gBACE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,OAAO,KAAK,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAC;gBAC9D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,OAAO,KAAK,CACV,sDAAsD,GAAG,aAAa,IAAI,IAAI,CAC/E,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,GAAG,CAAC;gBACX,CAAC,EAAE,CAAC;gBACJ,MAAM;QACV,CAAC;IACH,CAAC;IAED,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAE9D,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,IAAI;QACJ,IAAI;QACJ,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;QACnD,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAC3D,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC3C,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,CAAC;QACvD,GAAG,CAAC,mCAAmC,KAAK,SAAS,IAAI;YACvD,mCAAmC;SACpC,CAAC;QACF,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;QACL,8DAA8D;QAC9D,EAAE;QACF,OAAO;QACP,mCAAmC;QACnC,EAAE;QACF,6EAA6E;QAC7E,wEAAwE;QACxE,6DAA6D;QAC7D,oEAAoE;QACpE,qEAAqE;QACrE,mCAAmC;QACnC,EAAE;QACF,SAAS;QACT,8EAA8E;QAC9E,2EAA2E;QAC3E,4DAA4D;QAC5D,gFAAgF;QAChF,4DAA4D;QAC5D,4EAA4E;QAC5E,mEAAmE;QACnE,4DAA4D;QAC5D,+CAA+C;QAC/C,4EAA4E;QAC5E,2EAA2E;QAC3E,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,0EAA0E;QAC1E,4EAA4E;QAC5E,yEAAyE;QACzE,4DAA4D;QAC5D,6EAA6E;QAC7E,qDAAqD;QACrD,6CAA6C;QAC7C,4CAA4C;QAC5C,EAAE;QACF,YAAY;QACZ,kEAAkE;QAClE,qFAAqF;QACrF,0BAA0B;QAC1B,EAAE;QACF,6BAA6B;QAC7B,2DAA2D;QAC3D,sFAAsF;QACtF,mEAAmE;QACnE,iEAAiE;QACjE,4DAA4D;QAC5D,sFAAsF;QACtF,EAAE;QACF,+EAA+E;QAC/E,qEAAqE;QACrE,uEAAuE;QACvE,yEAAyE;QACzE,4EAA4E;KAC7E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,IAAI,aAAiC,CAAC;AACtC,SAAS,iBAAiB;IACxB,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAyB,CAAC;QAC/E,aAAa,GAAG,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,GAAG,OAAO,CAAC;IAC1B,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,iBAAiB,EAAE,IAAI,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,IAAI,CAAC,UAAU,OAAO,IAAI,IAAI,CAAC,CAAC;YACxE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,UAAU,EAAE,IAAI,CAAC,CAAC;QACnF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,+CAAuE,CAAC;IAC5E,IAAI,IAAI,CAAC,mCAAmC,KAAK,SAAS,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YACrE,+CAA+C,GAAG,IAAI,UAAU,CAC9D,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,CACjB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uEAAuE,IAAI,CAAC,mCAAmC,KAAK,GAAG,IAAI,CAC5H,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;QACjD,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxE,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,wBAAwB,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3F,GAAG,CAAC,+CAA+C,KAAK,SAAS,IAAI;YACnE,+CAA+C;SAChD,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;KAC5D,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE;YACnC,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3E,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACvF,mBAAmB;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,IAAI,EAAE;KACH,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;IACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC,CAAC;KACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
1	+ {"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD,OAAO,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EACL,yBAAyB,GAE1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEvD,MAAM,aAAa,GAA4B;IAC7C,UAAU;IACV,SAAS;IACT,YAAY;IACZ,cAAc;IACd,OAAO;CACR,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,2BAA2B,GAAG,kBAAkB,CAAC;AAoBvD,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,kEAAkE;IAClE,oEAAoE;IACpE,oEAAoE;IACpE,mDAAmD;IACnD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,2BAA2B,EAAE,CAAC;QAC5C,OAAO,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,IAAwB,CAAC;IAC7B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,YAAsC,CAAC;IAC3C,IAAI,gBAAoC,CAAC;IACzC,IAAI,QAA4B,CAAC;IACjC,IAAI,mCAAuD,CAAC;IAC5D,IAAI,IAAwB,CAAC;IAC7B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC;YACV,KAAK,QAAQ;gBACX,IAAI,GAAG,IAAI,CAAC;gBACZ,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,KAAK,IAAI,CAAC;YACV,KAAK,WAAW;gBACd,OAAO,GAAG,IAAI,CAAC;gBACf,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,GAAG,IAAI,CAAC;gBACZ,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,KAAK,UAAU,CAAC;YAChB,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,GAAG,GAAG,mBAAmB,CAAC,CAAC;gBACjE,IAAI,CAAE,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1D,OAAO,KAAK,CAAC,2BAA2B,KAAK,aAAa,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACzF,CAAC;gBACD,YAAY,GAAG,KAAqB,CAAC;gBACrC,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;YACR,CAAC;YACD,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBACxF,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjC,OAAO,KAAK,CAAC,qDAAqD,KAAK,IAAI,CAAC,CAAC;gBAC/E,CAAC;gBACD,gBAAgB,GAAG,CAAC,CAAC;gBACrB,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;YACR,CAAC;YACD,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBACtE,QAAQ,GAAG,KAAK,CAAC;gBACjB,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;YACR,CAAC;YACD,KAAK,sCAAsC,CAAC,CAAC,CAAC;gBAC5C,6DAA6D;gBAC7D,+DAA+D;gBAC/D,0DAA0D;gBAC1D,2DAA2D;gBAC3D,+DAA+D;gBAC/D,8DAA8D;gBAC9D,8CAA8C;gBAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,OAAO,KAAK,CAAC,uEAAuE,CAAC,CAAC;gBACxF,CAAC;gBACD,mCAAmC,GAAG,KAAK,CAAC;gBAC5C,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;YACR,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBAClE,IAAI,GAAG,KAAK,CAAC;gBACb,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;YACR,CAAC;YACD;gBACE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,OAAO,KAAK,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAC;gBAC9D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,OAAO,KAAK,CACV,sDAAsD,GAAG,aAAa,IAAI,IAAI,CAC/E,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,GAAG,CAAC;gBACX,CAAC,EAAE,CAAC;gBACJ,MAAM;QACV,CAAC;IACH,CAAC;IAED,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAE9D,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,IAAI;QACJ,IAAI;QACJ,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;QACnD,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,CAAC;QAC3D,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC3C,GAAG,CAAC,mCAAmC,KAAK,SAAS,IAAI;YACvD,mCAAmC;SACpC,CAAC;QACF,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,wBAAwB,CAAC,IAAuB;IACvD,IAAI,IAAwB,CAAC;IAC7B,IAAI,QAA4B,CAAC;IACjC,IAAI,oBAAqD,CAAC;IAC1D,IAAI,mBAAuC,CAAC;IAC5C,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,IAAI,GAAG,KAAK,CAAC;IAEjB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC;YACV,KAAK,QAAQ;gBACX,IAAI,GAAG,IAAI,CAAC;gBACZ,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,GAAG,IAAI,CAAC;gBACZ,CAAC,EAAE,CAAC;gBACJ,MAAM;YACR,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBAC3F,QAAQ,GAAG,KAAK,CAAC;gBACjB,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;YACR,CAAC;YACD,KAAK,UAAU,CAAC;YAChB,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,GAAG,GAAG,mBAAmB,CAAC,CAAC;gBACjE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClC,OAAO,KAAK,CACV,2BAA2B,KAAK,aAAa,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACtF,CAAC;gBACJ,CAAC;gBACD,oBAAoB,GAAG,KAAK,CAAC;gBAC7B,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;YACR,CAAC;YACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC,qCAAqC,CAAC,CAAC;gBAC7E,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrC,OAAO,KAAK,CAAC,uEAAuE,CAAC,CAAC;gBACxF,CAAC;gBACD,mBAAmB,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC1C,CAAC,IAAI,CAAC,CAAC;gBACP,MAAM;YACR,CAAC;YACD;gBACE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,OAAO,KAAK,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAC;gBAC9D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,OAAO,KAAK,CACV,2DAA2D,GAAG,aAAa,IAAI,IAAI,CACpF,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,GAAG,CAAC;gBACX,CAAC,EAAE,CAAC;gBACJ,MAAM;QACV,CAAC;IACH,CAAC;IAED,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACrF,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAErF,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,IAAI;QACJ,QAAQ;QACR,IAAI;QACJ,GAAG,CAAC,oBAAoB,KAAK,SAAS,IAAI,EAAE,oBAAoB,EAAE,CAAC;QACnE,GAAG,CAAC,mBAAmB,KAAK,SAAS,IAAI,EAAE,mBAAmB,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;QACL,8DAA8D;QAC9D,EAAE;QACF,OAAO;QACP,mCAAmC;QACnC,qFAAqF;QACrF,EAAE;QACF,6EAA6E;QAC7E,wEAAwE;QACxE,6DAA6D;QAC7D,oEAAoE;QACpE,qEAAqE;QACrE,mCAAmC;QACnC,EAAE;QACF,gEAAgE;QAChE,uEAAuE;QACvE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,8DAA8D;QAC9D,+DAA+D;QAC/D,EAAE;QACF,SAAS;QACT,8EAA8E;QAC9E,2EAA2E;QAC3E,4DAA4D;QAC5D,gFAAgF;QAChF,4DAA4D;QAC5D,+CAA+C;QAC/C,4EAA4E;QAC5E,2EAA2E;QAC3E,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,0EAA0E;QAC1E,4EAA4E;QAC5E,yEAAyE;QACzE,4DAA4D;QAC5D,6EAA6E;QAC7E,qDAAqD;QACrD,EAAE;QACF,wEAAwE;QACxE,+BAA+B;QAC/B,uEAAuE;QACvE,qEAAqE;QACrE,0EAA0E;QAC1E,sEAAsE;QACtE,4CAA4C;QAC5C,wEAAwE;QACxE,wEAAwE;QACxE,qEAAqE;QACrE,2EAA2E;QAC3E,yEAAyE;QACzE,mEAAmE;QACnE,2EAA2E;QAC3E,iEAAiE;QACjE,gCAAgC,0BAA0B,CAAC,MAAM,uCAAuC;QACxG,EAAE;QACF,6CAA6C;QAC7C,4CAA4C;QAC5C,EAAE;QACF,YAAY;QACZ,kEAAkE;QAClE,qFAAqF;QACrF,0BAA0B;QAC1B,EAAE;QACF,6BAA6B;QAC7B,2DAA2D;QAC3D,sFAAsF;QACtF,mEAAmE;QACnE,iEAAiE;QACjE,4DAA4D;QAC5D,sFAAsF;QACtF,EAAE;QACF,mBAAmB;QACnB,4EAA4E;QAC5E,+EAA+E;QAC/E,4EAA4E;QAC5E,yEAAyE;QACzE,qEAAqE;QACrE,2EAA2E;KAC5E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,IAAI,aAAiC,CAAC;AACtC,SAAS,iBAAiB;IACxB,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAyB,CAAC;QAC/E,aAAa,GAAG,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,GAAG,OAAO,CAAC;IAC1B,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAa;IAEb,6EAA6E;IAC7E,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAA4B,CAAC;QACnE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;IAED,qEAAqE;IACrE,+CAA+C;IAC/C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClE,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;QACjF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,sFAAsF,GAAG,EAAE;SACnG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,uBAAuB;YAC1B,OAAO,iIAAiI,CAAC;QAC3I,KAAK,mBAAmB;YACtB,OAAO,qIAAqI,CAAC;QAC/I,KAAK,sBAAsB;YACzB,OAAO,2EAA2E,CAAC;QACrF,KAAK,qBAAqB;YACxB,OAAO,6CAA6C,CAAC;QACvD,KAAK,mBAAmB;YACtB,OAAO,iGAAiG,CAAC;QAC3G,KAAK,uBAAuB;YAC1B,OAAO,qFAAqF,CAAC;QAC/F,KAAK,wBAAwB;YAC3B,OAAO,yEAAyE,CAAC;QACnF;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,IAAgB,EAAE,IAAa;IACrE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACtF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC/E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,SAAS,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC;QACrF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC,uEAAuE;IACvE,iEAAiE;IACjE,mEAAmE;IACnE,sEAAsE;IACtE,IACE,IAAI,CAAC,mBAAmB,KAAK,SAAS;QACtC,QAAQ,CAAC,mBAAmB,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,mBAAmB,EACvE,CAAC;QACD,MAAM,MAAM,GAAG;YACb,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,uBAAuB;YAC/B,4BAA4B,EAAE,IAAI,CAAC,mBAAmB;YACtD,0BAA0B,EAAE,QAAQ,CAAC,mBAAmB,CAAC,WAAW,EAAE;SACvE,CAAC;QACF,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gCAAgC,6BAA6B,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CACjF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IACE,IAAI,CAAC,oBAAoB,KAAK,SAAS;QACvC,QAAQ,CAAC,aAAa,KAAK,IAAI,CAAC,oBAAoB,EACpD,CAAC;QACD,MAAM,MAAM,GAAG;YACb,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,wBAAwB;YAChC,sBAAsB,EAAE,IAAI,CAAC,oBAAoB;YACjD,oBAAoB,EAAE,QAAQ,CAAC,aAAa;SAC7C,CAAC;QACF,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gCAAgC,6BAA6B,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CACjF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEhE,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,gEAAgE;IAChE,iEAAiE;IACjE,oEAAoE;IACpE,6DAA6D;IAC7D,IAAI,iBAAwD,CAAC;IAC7D,IAAI,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,aAAa,KAAK,kBAAkB,EAAE,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAY,CAAC;YAC1E,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,MAAM,CAAC,CAAC;YACtD,IAAI,KAAK,CAAC,UAAU;gBAAE,iBAAiB,GAAG,KAAK,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;YAChE,gEAAgE;YAChE,+DAA+D;YAC/D,8DAA8D;YAC9D,qBAAqB;QACvB,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,iBAAiB,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;IAEnF,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CACf;YACE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,WAAW;YACnC,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YAC7D,QAAQ,EAAE;gBACR,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;gBACjD,eAAe,EAAE,QAAQ,CAAC,eAAe;gBACzC,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,GAAG,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;aAC9E;YACD,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;SAC9E,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CACN,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;gBACE,6BAA6B;gBAC7B,sBAAsB,QAAQ,CAAC,aAAa,EAAE;gBAC9C,sBAAsB,QAAQ,CAAC,QAAQ,EAAE;gBACzC,sBAAsB,QAAQ,CAAC,mBAAmB,EAAE;gBACpD,sBAAsB,QAAQ,CAAC,eAAe,EAAE;gBAChD,sBAAsB,QAAQ,CAAC,WAAW,EAAE;gBAC5C,sBAAsB,QAAQ,CAAC,KAAK,EAAE;gBACtC,sBAAsB,QAAQ,CAAC,YAAY,EAAE;gBAC7C,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC;gBACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;oBACE,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,mBAAmB,iBAAiB,CAAC,aAAa,IAAI,iBAAiB,CAAC,UAAU,gDAAgD;oBACtJ,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;wBACrC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;4BACZ,OAAO,OAAO,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;wBAChH,CAAC;wBACD,OAAO,OAAO,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,SAAS,YAAY,CAAC,CAAC,MAAM,IAAI,SAAS,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBAC3I,CAAC,CAAC;oBACF,EAAE;iBACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gCAAgC,6BAA6B,CAAC,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAC9F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,sEAAsE;IACtE,uEAAuE;IACvE,qEAAqE;IACrE,iEAAiE;IACjE,OAAO,MAAM,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,iBAAiB,EAAE,IAAI,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,IAAI,CAAC,UAAU,OAAO,IAAI,IAAI,CAAC,CAAC;YACxE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;QAC5C,OAAO,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,UAAU,EAAE,IAAI,CAAC,CAAC;QACnF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,+CAAuE,CAAC;IAC5E,IAAI,IAAI,CAAC,mCAAmC,KAAK,SAAS,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YACrE,+CAA+C,GAAG,IAAI,UAAU,CAC9D,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,CACjB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uEAAuE,IAAI,CAAC,mCAAmC,KAAK,GAAG,IAAI,CAC5H,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;QACjD,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxE,GAAG,CAAC,+CAA+C,KAAK,SAAS,IAAI;YACnE,+CAA+C;SAChD,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;KAC5D,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE;YACnC,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3E,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACvF,mBAAmB;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,mEAAmE;AACnE,oEAAoE;AACpE,sEAAsE;AACtE,mEAAmE;AACnE,iEAAiE;AACjE,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE;IAC5B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;QAC9D,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,WAAW,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,IAAI,eAAe,EAAE,CAAC;IACpB,IAAI,EAAE;SACH,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/index.d.ts CHANGED Viewed

@@ -9,9 +9,9 @@
  * "tpm" | "android_keystore" | "webauthn", ... }` verifies end-to-end
  * through this package instead of returning the permissive-floor
  * verifier's `adapter not yet shipped` sentinel. The deprecated
- * `play_integrity` arm is also wired during the
- * `@motebit/crypto-play-integrity@1.x` deprecation cycle for backward
- * compatibility with already-minted credentials.
+ * `play_integrity` adapter was removed 2026-05-03 — credentials
+ * carrying that platform hit the canonical dispatcher's fail-closed
+ * "verifier not wired" branch.
  *
  * Programmatic use:
  *

package/dist/index.js CHANGED Viewed

@@ -9,9 +9,9 @@
  * "tpm" | "android_keystore" | "webauthn", ... }` verifies end-to-end
  * through this package instead of returning the permissive-floor
  * verifier's `adapter not yet shipped` sentinel. The deprecated
- * `play_integrity` arm is also wired during the
- * `@motebit/crypto-play-integrity@1.x` deprecation cycle for backward
- * compatibility with already-minted credentials.
+ * `play_integrity` adapter was removed 2026-05-03 — credentials
+ * carrying that platform hit the canonical dispatcher's fail-closed
+ * "verifier not wired" branch.
  *
  * Programmatic use:
  *

package/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "name": "@motebit/verify",
-  "version": "1.2.1",
-  "description": "The canonical `motebit-verify` command-line tool — verifies any signed motebit artifact offline, with every hardware-attestation platform bundled (Apple App Attest, Android Hardware-Backed Keystore Attestation, TPM 2.0, WebAuthn — plus the deprecated Google Play Integrity for one minor cycle). One install, no network, self-attesting. Replaces the deprecated @motebit/verify@0.x zero-dep library: library primitives now live in @motebit/crypto; file-reading + formatting helpers in @motebit/verifier; this package is the binary.",
+  "version": "1.3.0",
+  "description": "The canonical `motebit-verify` command-line tool — verifies any signed motebit artifact offline, with every hardware-attestation platform bundled (Apple App Attest, Android Hardware-Backed Keystore Attestation, TPM 2.0, WebAuthn). One install, no network, self-attesting. Replaces the deprecated @motebit/verify@0.x zero-dep library: library primitives now live in @motebit/crypto; file-reading + formatting helpers in @motebit/verifier; this package is the binary.",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -36,7 +36,6 @@
     "tpm",
     "webauthn",
     "ed25519",
-    "play-integrity",
     "attestation"
   ],
   "homepage": "https://github.com/motebit/motebit/tree/main/packages/verify#readme",
@@ -52,13 +51,14 @@
     "access": "public"
   },
   "dependencies": {
-    "@motebit/crypto": "1.2.1",
-    "@motebit/crypto-android-keystore": "1.1.2",
-    "@motebit/crypto-appattest": "1.0.3",
-    "@motebit/crypto-play-integrity": "1.1.2",
-    "@motebit/crypto-tpm": "1.1.2",
-    "@motebit/crypto-webauthn": "1.0.3",
-    "@motebit/verifier": "1.1.1"
+    "@motebit/crypto": "1.3.0",
+    "@motebit/crypto-android-keystore": "1.1.3",
+    "@motebit/crypto-tpm": "1.1.4",
+    "@motebit/crypto-webauthn": "1.0.5",
+    "@motebit/crypto-appattest": "1.0.5",
+    "@motebit/protocol": "1.3.0",
+    "@motebit/state-export-client": "0.2.0",
+    "@motebit/verifier": "1.1.2"
   },
   "devDependencies": {
     "@noble/curves": "^1.9.0",