@nexart/cli 0.12.0 → 0.12.2

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # @nexart/cli — Changelog
 
+## v0.12.2 (2026-06-15) — bump core to `@nexart/ai-execution@^0.23.0`
+
+Dependency alignment. No command behavior changes, no breaking changes.
+
+- **Bumps** `@nexart/ai-execution` to `^0.23.0`, which adds optional identity
+  binding (`snapshot.identity`). The change is additive and PII-safe.
+- **`nexart verify-bundle`** already verifies identity-bound bundles with no code
+  change: `snapshot.identity` is sealed snapshot data bound by `certificateHash`,
+  and the standalone verifier recomputes over the snapshot exactly as stored — so
+  a tampered `snapshot.identity` FAILS integrity, while identity-free bundles
+  verify byte-for-byte unchanged.
+- Keeps the SDK-backed `nexart ai` commands on the latest core.
+
+## v0.12.1 (2026-06-14) — packaging fix for `verify-bundle`
+
+Packaging-only fix. No functional changes, no breaking changes, no command
+behavior changes.
+
+- **Fix:** the published npm package was missing `dist/standaloneVerify.js` (and
+  its type declarations), which broke the `nexart verify-bundle` command at
+  runtime with `Cannot find module dist/standaloneVerify.js`. The `files` field
+  in `package.json` listed individual `dist/index.*` files only; it now ships the
+  entire `dist/` directory, so all compiled modules are included.
+- **Restores** full functionality of the `nexart verify-bundle` command.
+
 ## v0.12.0 (2026-06-14) — `verify-bundle` (standalone, SDK-free CER verification)
 
 Additive and fully backward-compatible. No existing command, flag, or output

package/README.md

@@ -667,7 +667,10 @@ nexart verify-bundle cer.json --public-key node-keys.json --verbose
 1. **Integrity** — recomputes `certificateHash` from the bundle's evidentiary
    payload (`bundleType`, `createdAt`, `snapshot`, `version`, and, when present,
    `context` / `contextSummary` / `policyEvaluation`) and compares it to the
-   stored value. Canonicalisation is bound to `snapshot.protocolVersion`:
+   stored value. The whole `snapshot` is hashed, so an optional
+   `snapshot.identity` assertion (v0.23.0+) is bound by `certificateHash` and
+   tampering with it FAILS — no special-casing in the verifier. Canonicalisation
+   is bound to `snapshot.protocolVersion`:
    - `1.2.0` → **nexart-v1** (NexArt's original canonical JSON)
    - `1.3.0` → **jcs-v1** (RFC 8785 JSON Canonicalization Scheme)
 

package/dist/standaloneVerify.d.ts

@@ -0,0 +1,65 @@
+import { type KeyObject } from 'node:crypto';
+/** Canonicalisation mode bound to a protocolVersion. Fail-closed on unknown. */
+export declare function canonicalModeForProtocol(protocolVersion: string): 'nexart-v1' | 'jcs-v1';
+/** Canonicalise `value` using the mode bound to `protocolVersion`. */
+export declare function canonicalForProtocol(value: unknown, protocolVersion: string): string;
+interface Bundle {
+    bundleType?: unknown;
+    certificateHash?: unknown;
+    createdAt?: unknown;
+    version?: unknown;
+    snapshot?: {
+        protocolVersion?: unknown;
+    } & Record<string, unknown>;
+    context?: unknown;
+    contextSummary?: unknown;
+    policyEvaluation?: unknown;
+    receipt?: unknown;
+    signature?: unknown;
+    attestorKeyId?: unknown;
+    publicKey?: unknown;
+    meta?: {
+        attestation?: Record<string, unknown>;
+    } & Record<string, unknown>;
+}
+/** Recompute "sha256:<hex>" over the bundle's evidentiary payload. */
+export declare function recomputeCertificateHash(bundle: Bundle): {
+    hash: string;
+    protocolVersion: string;
+    canonical: string;
+};
+/**
+ * Resolve an Ed25519 public KeyObject from arbitrary supplied material:
+ *   • PEM (-----BEGIN PUBLIC KEY-----)
+ *   • JWK JSON ({ kty:'OKP', crv:'Ed25519', x })
+ *   • NodeKeysDocument JSON ({ keys:[{ kid, publicKey | publicKeyJwk | publicKeySpkiB64 }] })
+ *   • raw base64url / base64 string (32-byte point)
+ */
+export declare function resolvePublicKey(material: string, kid?: string): KeyObject;
+export type Pass = 'pass' | 'fail' | 'skipped';
+export interface StandaloneVerifyResult {
+    status: 'verified' | 'failed';
+    integrity: Pass;
+    signature: Pass;
+    protocolVersion: string;
+    expectedCertificateHash: string | null;
+    actualCertificateHash: string | null;
+    reasons: string[];
+    steps: string[];
+}
+export interface StandaloneVerifyOptions {
+    /** Raw public-key material (PEM/JWK/NodeKeysDocument/raw). Highest priority. */
+    publicKeyMaterial?: string;
+    /** kid to select from a NodeKeysDocument. */
+    kid?: string;
+    /** Collect human-readable intermediate steps. */
+    verbose?: boolean;
+}
+/**
+ * Verify a CER bundle with no NexArt dependency. Returns a structured result;
+ * never throws for an ordinary verification failure (only for programmer error
+ * such as a non-object bundle).
+ */
+export declare function verifyBundleStandalone(bundleInput: unknown, options?: StandaloneVerifyOptions): StandaloneVerifyResult;
+export {};
+//# sourceMappingURL=standaloneVerify.d.ts.map

package/dist/standaloneVerify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"standaloneVerify.d.ts","sourceRoot":"","sources":["../src/standaloneVerify.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAmD,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAkE9F,gFAAgF;AAChF,wBAAgB,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,CAOxF;AAED,sEAAsE;AACtE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAIpF;AAYD,UAAU,MAAM;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5E;AAeD,sEAAsE;AACtE,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAMrH;AAgED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAsC1E;AAkBD,MAAM,MAAM,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAE/C,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC9B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6CAA6C;IAC7C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,OAAO,EACpB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAmIxB"}

package/dist/standaloneVerify.js

@@ -0,0 +1,387 @@
+// ─────────────────────────────────────────────────────────────────────────────
+// Standalone CER verifier — ZERO NexArt dependencies.
+//
+// This module re-implements, from first principles, everything needed to verify
+// a NexArt CER bundle (`cer.ai.execution.v1`) independently of the NexArt node
+// and of every `@nexart/*` package. A third-party auditor can read this single
+// file end-to-end and reproduce the result with nothing but the JSON bundle, the
+// signer's public key, and the Node.js standard library.
+//
+// It imports ONLY `node:crypto`. There is no hidden NexArt logic, no network,
+// and no SDK import — by design and by audit.
+//
+// What it proves:
+//   1. INTEGRITY — recompute the certificateHash from the bundle's evidentiary
+//      payload and compare it to `bundle.certificateHash`.
+//   2. SIGNATURE — when a signed node attestation receipt is present, verify its
+//      Ed25519 signature over the canonical JSON of the receipt.
+//
+// Canonicalisation is bound to the protocol version, exactly as the producer did:
+//   • 1.2.0 → "nexart-v1"  (NexArt's original canonical JSON; copied verbatim)
+//   • 1.3.0 → "jcs-v1"     (RFC 8785 JSON Canonicalization Scheme)
+// Both schemes are byte-for-byte identical for every JSON-safe value; they are
+// kept as two explicit functions so the binding to protocolVersion is auditable.
+// ─────────────────────────────────────────────────────────────────────────────
+import { createHash, createPublicKey, verify as edVerify } from 'node:crypto';
+// ── Canonicalisation: nexart-v1 (protocolVersion 1.2.0) ──────────────────────
+// Copied verbatim from NexArt's frozen canonicaliser. These bytes never change.
+function canonicalizeNexartV1(value) {
+    if (value === null)
+        return 'null';
+    if (typeof value === 'boolean')
+        return value ? 'true' : 'false';
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value)) {
+            throw new Error(`Non-finite number not allowed in canonical JSON: ${value}`);
+        }
+        return JSON.stringify(value);
+    }
+    if (typeof value === 'string')
+        return JSON.stringify(value);
+    if (Array.isArray(value)) {
+        return '[' + value.map((item) => canonicalizeNexartV1(item)).join(',') + ']';
+    }
+    if (typeof value === 'object') {
+        const obj = value;
+        const keys = Object.keys(obj).sort();
+        const entries = keys
+            .map((key) => {
+            const val = obj[key];
+            if (val === undefined)
+                return null;
+            return JSON.stringify(key) + ':' + canonicalizeNexartV1(val);
+        })
+            .filter((e) => e !== null);
+        return '{' + entries.join(',') + '}';
+    }
+    throw new Error(`Unsupported type for canonical JSON: ${typeof value}`);
+}
+// ── Canonicalisation: jcs-v1 (protocolVersion 1.3.0) — RFC 8785 ──────────────
+// RFC 8785 JSON Canonicalization Scheme (§3.2):
+//   • literals null/true/false; numbers via ECMAScript Number::toString (finite);
+//   • strings via minimal JSON escaping; object members sorted by UTF-16 code
+//     unit; no insignificant whitespace. JSON.stringify(scalar) already emits the
+//     RFC 8785 string/number forms, and Array.prototype.sort() orders by UTF-16
+//     code unit — so this is a faithful, dependency-free RFC 8785 serialiser.
+function canonicalizeJcs(value) {
+    if (value === null)
+        return 'null';
+    if (typeof value === 'boolean')
+        return value ? 'true' : 'false';
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value)) {
+            throw new Error(`RFC 8785: non-finite number is not valid JSON: ${value}`);
+        }
+        return JSON.stringify(value);
+    }
+    if (typeof value === 'string')
+        return JSON.stringify(value);
+    if (Array.isArray(value)) {
+        return '[' + value.map((item) => canonicalizeJcs(item)).join(',') + ']';
+    }
+    if (typeof value === 'object') {
+        const obj = value;
+        const keys = Object.keys(obj).sort();
+        const entries = [];
+        for (const key of keys) {
+            const val = obj[key];
+            if (val === undefined)
+                continue;
+            entries.push(JSON.stringify(key) + ':' + canonicalizeJcs(val));
+        }
+        return '{' + entries.join(',') + '}';
+    }
+    throw new Error(`RFC 8785: unsupported type for canonical JSON: ${typeof value}`);
+}
+/** Canonicalisation mode bound to a protocolVersion. Fail-closed on unknown. */
+export function canonicalModeForProtocol(protocolVersion) {
+    if (protocolVersion === '1.3.0')
+        return 'jcs-v1';
+    if (protocolVersion === '1.2.0')
+        return 'nexart-v1';
+    throw new Error(`Unsupported protocolVersion "${protocolVersion}": no canonicalisation mode is bound to it ` +
+        `(supported: 1.2.0 → nexart-v1, 1.3.0 → jcs-v1).`);
+}
+/** Canonicalise `value` using the mode bound to `protocolVersion`. */
+export function canonicalForProtocol(value, protocolVersion) {
+    return canonicalModeForProtocol(protocolVersion) === 'jcs-v1'
+        ? canonicalizeJcs(value)
+        : canonicalizeNexartV1(value);
+}
+function sha256Hex(text) {
+    return createHash('sha256').update(text, 'utf8').digest('hex');
+}
+function buildCertificatePayload(bundle) {
+    const payload = {
+        bundleType: 'cer.ai.execution.v1',
+        createdAt: bundle.createdAt,
+        snapshot: bundle.snapshot,
+        version: bundle.version,
+    };
+    if (bundle.context !== undefined)
+        payload.context = bundle.context;
+    if (bundle.contextSummary !== undefined)
+        payload.contextSummary = bundle.contextSummary;
+    if (bundle.policyEvaluation !== undefined)
+        payload.policyEvaluation = bundle.policyEvaluation;
+    return payload;
+}
+/** Recompute "sha256:<hex>" over the bundle's evidentiary payload. */
+export function recomputeCertificateHash(bundle) {
+    const pv = bundle.snapshot?.protocolVersion;
+    const protocolVersion = typeof pv === 'string' ? pv : '1.2.0';
+    const payload = buildCertificatePayload(bundle);
+    const canonical = canonicalForProtocol(payload, protocolVersion);
+    return { hash: `sha256:${sha256Hex(canonical)}`, protocolVersion, canonical };
+}
+function extractReceipt(bundle) {
+    const pickKey = (src) => {
+        const jwk = src.publicKeyJwk;
+        const raw = typeof src.publicKey === 'string' ? src.publicKey : undefined;
+        const spki = typeof src.publicKeySpkiB64 === 'string' ? src.publicKeySpkiB64 : undefined;
+        if (jwk || raw || spki)
+            return { jwk, raw, spki };
+        return undefined;
+    };
+    if (bundle.receipt && typeof bundle.receipt === 'object' && typeof bundle.signature === 'string') {
+        return {
+            receipt: bundle.receipt,
+            signature: bundle.signature,
+            attestorKeyId: typeof bundle.attestorKeyId === 'string' ? bundle.attestorKeyId : undefined,
+            embeddedKey: pickKey(bundle),
+        };
+    }
+    const att = bundle.meta?.attestation;
+    if (att && typeof att === 'object') {
+        const a = att;
+        if (a.receipt && typeof a.receipt === 'object' && typeof a.signature === 'string') {
+            return {
+                receipt: a.receipt,
+                signature: a.signature,
+                attestorKeyId: typeof a.attestorKeyId === 'string' ? a.attestorKeyId : undefined,
+                embeddedKey: pickKey(a),
+            };
+        }
+    }
+    return null;
+}
+// ── Public key resolution ────────────────────────────────────────────────────
+function rawToBase64Url(s) {
+    return s.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function base64urlToBuffer(s) {
+    return Buffer.from(s.replace(/-/g, '+').replace(/_/g, '/'), 'base64');
+}
+function keyFromJwkX(x) {
+    return createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: rawToBase64Url(x) }, format: 'jwk' });
+}
+function keyFromSpkiBase64(spkiB64) {
+    const der = base64urlToBuffer(spkiB64);
+    // Use the trailing 32 bytes (the raw Ed25519 point) so any SPKI variant works.
+    const raw = der.subarray(der.length - 32);
+    return keyFromJwkX(rawToBase64Url(raw.toString('base64')));
+}
+/**
+ * Resolve an Ed25519 public KeyObject from arbitrary supplied material:
+ *   • PEM (-----BEGIN PUBLIC KEY-----)
+ *   • JWK JSON ({ kty:'OKP', crv:'Ed25519', x })
+ *   • NodeKeysDocument JSON ({ keys:[{ kid, publicKey | publicKeyJwk | publicKeySpkiB64 }] })
+ *   • raw base64url / base64 string (32-byte point)
+ */
+export function resolvePublicKey(material, kid) {
+    const text = material.trim();
+    if (text.startsWith('-----BEGIN'))
+        return createPublicKey(text);
+    try {
+        const parsed = JSON.parse(text);
+        if (Array.isArray(parsed.keys)) {
+            const keys = parsed.keys;
+            const activeKid = typeof parsed.activeKid === 'string' ? parsed.activeKid : undefined;
+            let entry;
+            if (kid) {
+                // Strict (parity with SDK selectNodeKey): a requested kid that is absent
+                // is an error, never a silent fallback to another key.
+                entry = keys.find((k) => k.kid === kid);
+                if (!entry)
+                    throw new Error(`Key with kid="${kid}" not found in node keys document`);
+            }
+            else if (activeKid) {
+                entry = keys.find((k) => k.kid === activeKid);
+                if (!entry)
+                    throw new Error(`activeKid="${activeKid}" not found in node keys document`);
+            }
+            else {
+                entry = keys[0];
+            }
+            if (!entry)
+                throw new Error('No key entry found in node keys document');
+            return keyFromEntry(entry);
+        }
+        if (parsed.kty === 'OKP' || typeof parsed.x === 'string') {
+            return keyFromJwkX(String(parsed.x));
+        }
+        return keyFromEntry(parsed);
+    }
+    catch (err) {
+        if (err instanceof SyntaxError) {
+            // Not JSON → treat as a raw base64url/base64 32-byte public key.
+            return keyFromJwkX(rawToBase64Url(text));
+        }
+        throw err;
+    }
+}
+function keyFromEntry(entry) {
+    const jwk = entry.publicKeyJwk;
+    if (jwk && typeof jwk.x === 'string')
+        return keyFromJwkX(jwk.x);
+    if (typeof entry.publicKey === 'string')
+        return keyFromJwkX(rawToBase64Url(entry.publicKey));
+    if (typeof entry.publicKeySpkiB64 === 'string')
+        return keyFromSpkiBase64(entry.publicKeySpkiB64);
+    throw new Error('Key entry has no usable public key (publicKeyJwk.x, publicKey, or publicKeySpkiB64)');
+}
+function keyFromEmbedded(embedded) {
+    if (embedded.jwk && typeof embedded.jwk.x === 'string')
+        return keyFromJwkX(embedded.jwk.x);
+    if (embedded.raw)
+        return keyFromJwkX(rawToBase64Url(embedded.raw));
+    if (embedded.spki)
+        return keyFromSpkiBase64(embedded.spki);
+    throw new Error('Embedded key has no usable public key material');
+}
+/**
+ * Verify a CER bundle with no NexArt dependency. Returns a structured result;
+ * never throws for an ordinary verification failure (only for programmer error
+ * such as a non-object bundle).
+ */
+export function verifyBundleStandalone(bundleInput, options = {}) {
+    const reasons = [];
+    const steps = [];
+    const step = (s) => { if (options.verbose)
+        steps.push(s); };
+    if (typeof bundleInput !== 'object' || bundleInput === null) {
+        return {
+            status: 'failed',
+            integrity: 'fail',
+            signature: 'skipped',
+            protocolVersion: 'unknown',
+            expectedCertificateHash: null,
+            actualCertificateHash: null,
+            reasons: ['Bundle is not a JSON object'],
+            steps,
+        };
+    }
+    const bundle = bundleInput;
+    const expectedHash = typeof bundle.certificateHash === 'string' ? bundle.certificateHash : null;
+    // ── Structural checks ──
+    if (bundle.bundleType !== 'cer.ai.execution.v1') {
+        reasons.push(`Expected bundleType "cer.ai.execution.v1", got ${JSON.stringify(bundle.bundleType)}`);
+    }
+    if (!bundle.snapshot || typeof bundle.snapshot !== 'object') {
+        reasons.push('snapshot is required');
+    }
+    if (!expectedHash || !expectedHash.startsWith('sha256:')) {
+        reasons.push(`certificateHash must start with "sha256:", got ${JSON.stringify(bundle.certificateHash)}`);
+    }
+    // ── 1. Integrity ──
+    let integrity = 'fail';
+    let actualHash = null;
+    let protocolVersion = 'unknown';
+    if (bundle.snapshot && typeof bundle.snapshot === 'object') {
+        try {
+            const recomputed = recomputeCertificateHash(bundle);
+            actualHash = recomputed.hash;
+            protocolVersion = recomputed.protocolVersion;
+            step(`Canonicalisation mode: ${canonicalModeForProtocol(protocolVersion)} (protocolVersion ${protocolVersion})`);
+            step(`Canonical payload bytes: ${recomputed.canonical.length}`);
+            step(`Recomputed certificateHash: ${actualHash}`);
+            step(`Bundle certificateHash:     ${expectedHash ?? '(none)'}`);
+            if (expectedHash && actualHash === expectedHash) {
+                integrity = 'pass';
+            }
+            else {
+                reasons.push(`certificateHash mismatch: recomputed ${actualHash}, bundle has ${expectedHash ?? '(none)'}`);
+            }
+        }
+        catch (err) {
+            reasons.push(`Cannot recompute certificateHash: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    // ── 2. Signature ──
+    let signature = 'skipped';
+    const extracted = extractReceipt(bundle);
+    if (!extracted) {
+        step('No signed node attestation receipt present → signature: skipped');
+    }
+    else {
+        step('Signed node attestation receipt found');
+        const receiptCertHash = extracted.receipt.certificateHash;
+        if (typeof receiptCertHash === 'string' && expectedHash && receiptCertHash !== expectedHash) {
+            signature = 'fail';
+            reasons.push(`Receipt certificateHash (${receiptCertHash}) does not match bundle certificateHash (${expectedHash})`);
+        }
+        else {
+            let key = null;
+            try {
+                if (options.publicKeyMaterial) {
+                    key = resolvePublicKey(options.publicKeyMaterial, options.kid ?? extracted.attestorKeyId);
+                    step('Public key resolved from supplied material');
+                }
+                else if (extracted.embeddedKey) {
+                    key = keyFromEmbedded(extracted.embeddedKey);
+                    step('Public key resolved from key material embedded in the bundle');
+                }
+            }
+            catch (err) {
+                signature = 'fail';
+                reasons.push(`Cannot load public key: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            if (!key && signature !== 'fail') {
+                signature = 'skipped';
+                reasons.push('Signature present but no public key supplied (pass --public-key <path> to verify it)');
+                step('No public key available → signature: skipped');
+            }
+            else if (key) {
+                try {
+                    // Receipt signature mode is bound to the receipt's OWN protocolVersion.
+                    // Fail-closed (parity with the SDK): a missing/unsupported version is an
+                    // invalid signature, never silently coerced to a default.
+                    const rpv = extracted.receipt.protocolVersion;
+                    if (typeof rpv !== 'string') {
+                        throw new Error('Receipt protocolVersion is missing or not a string (fail-closed)');
+                    }
+                    const message = Buffer.from(canonicalForProtocol(extracted.receipt, rpv), 'utf8');
+                    const sigBytes = base64urlToBuffer(extracted.signature);
+                    step(`Signed message (canonical receipt) bytes: ${message.length}`);
+                    step(`Signature bytes: ${sigBytes.length}`);
+                    if (sigBytes.length !== 64) {
+                        signature = 'fail';
+                        reasons.push(`Ed25519 signature must be 64 bytes, got ${sigBytes.length}`);
+                    }
+                    else {
+                        const ok = edVerify(null, message, key, sigBytes);
+                        signature = ok ? 'pass' : 'fail';
+                        if (!ok)
+                            reasons.push('Ed25519 signature verification failed');
+                    }
+                }
+                catch (err) {
+                    signature = 'fail';
+                    reasons.push(`Signature verification error: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+        }
+    }
+    const status = integrity === 'pass' && signature !== 'fail' ? 'verified' : 'failed';
+    return {
+        status,
+        integrity,
+        signature,
+        protocolVersion,
+        expectedCertificateHash: expectedHash,
+        actualCertificateHash: actualHash,
+        reasons,
+        steps,
+    };
+}
+//# sourceMappingURL=standaloneVerify.js.map

package/dist/standaloneVerify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"standaloneVerify.js","sourceRoot":"","sources":["../src/standaloneVerify.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,sDAAsD;AACtD,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,iFAAiF;AACjF,yDAAyD;AACzD,EAAE;AACF,8EAA8E;AAC9E,8CAA8C;AAC9C,EAAE;AACF,kBAAkB;AAClB,+EAA+E;AAC/E,2DAA2D;AAC3D,iFAAiF;AACjF,iEAAiE;AACjE,EAAE;AACF,kFAAkF;AAClF,+EAA+E;AAC/E,mEAAmE;AACnE,+EAA+E;AAC/E,iFAAiF;AACjF,gFAAgF;AAEhF,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,IAAI,QAAQ,EAAkB,MAAM,aAAa,CAAC;AAE9F,gFAAgF;AAChF,gFAAgF;AAChF,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,oDAAoD,KAAK,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAC/E,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI;aACjB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACnC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC/D,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAC7B,OAAO,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,KAAK,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,gFAAgF;AAChF,gDAAgD;AAChD,kFAAkF;AAClF,8EAA8E;AAC9E,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,kDAAkD,KAAK,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,GAAG,KAAK,SAAS;gBAAE,SAAS;YAChC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,OAAO,KAAK,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,wBAAwB,CAAC,eAAuB;IAC9D,IAAI,eAAe,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IACjD,IAAI,eAAe,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC;IACpD,MAAM,IAAI,KAAK,CACb,gCAAgC,eAAe,6CAA6C;QAC1F,iDAAiD,CACpD,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,oBAAoB,CAAC,KAAc,EAAE,eAAuB;IAC1E,OAAO,wBAAwB,CAAC,eAAe,CAAC,KAAK,QAAQ;QAC3D,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC;QACxB,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAwBD,SAAS,uBAAuB,CAAC,MAAc;IAC7C,MAAM,OAAO,GAA4B;QACvC,UAAU,EAAE,qBAAqB;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IACnE,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IACxF,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS;QAAE,OAAO,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;IAC9F,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC;IAC5C,MAAM,eAAe,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9D,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,oBAAoB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACjE,OAAO,EAAE,IAAI,EAAE,UAAU,SAAS,CAAC,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;AAChF,CAAC;AAUD,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,OAAO,GAAG,CAAC,GAA4B,EAAmC,EAAE;QAChF,MAAM,GAAG,GAAG,GAAG,CAAC,YAA2C,CAAC;QAC5D,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,IAAI,GAAG,IAAI,GAAG,IAAI,IAAI;YAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QAClD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACjG,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAsC;YACtD,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,aAAa,EAAE,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YAC1F,WAAW,EAAE,OAAO,CAAC,MAA4C,CAAC;SACnE,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC;IACrC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,GAA8B,CAAC;QACzC,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClF,OAAO;gBACL,OAAO,EAAE,CAAC,CAAC,OAAsC;gBACjD,SAAS,EAAE,CAAC,CAAC,SAAmB;gBAChC,aAAa,EAAE,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,aAAwB,CAAC,CAAC,CAAC,SAAS;gBAC5F,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;aACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,SAAS,cAAc,CAAC,CAAS;IAC/B,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACvC,+EAA+E;IAC/E,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC1C,OAAO,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,GAAY;IAC7D,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IAEhE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QAE3D,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAsC,CAAC;YAC3D,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,SAAoB,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,IAAI,KAA0C,CAAC;YAC/C,IAAI,GAAG,EAAE,CAAC;gBACR,yEAAyE;gBACzE,uDAAuD;gBACvD,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;gBACxC,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,mCAAmC,CAAC,CAAC;YACvF,CAAC;iBAAM,IAAI,SAAS,EAAE,CAAC;gBACrB,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;gBAC9C,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,SAAS,mCAAmC,CAAC,CAAC;YAC1F,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YACxE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAED,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,IAAI,OAAO,MAAM,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACzD,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;YAC/B,iEAAiE;YACjE,OAAO,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B;IAClD,MAAM,GAAG,GAAG,KAAK,CAAC,YAA2C,CAAC;IAC9D,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7F,IAAI,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ;QAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACjG,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;AACzG,CAAC;AAED,SAAS,eAAe,CAAC,QAAsD;IAC7E,IAAI,QAAQ,CAAC,GAAG,IAAI,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,QAAQ,CAAC,GAAG;QAAE,OAAO,WAAW,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,IAAI;QAAE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;AACpE,CAAC;AAyBD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAoB,EACpB,UAAmC,EAAE;IAErC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,GAAG,IAAI,OAAO,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpE,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QAC5D,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,MAAM;YACjB,SAAS,EAAE,SAAS;YACpB,eAAe,EAAE,SAAS;YAC1B,uBAAuB,EAAE,IAAI;YAC7B,qBAAqB,EAAE,IAAI;YAC3B,OAAO,EAAE,CAAC,6BAA6B,CAAC;YACxC,KAAK;SACN,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,WAAqB,CAAC;IACrC,MAAM,YAAY,GAAG,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;IAEhG,0BAA0B;IAC1B,IAAI,MAAM,CAAC,UAAU,KAAK,qBAAqB,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,kDAAkD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,kDAAkD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,qBAAqB;IACrB,IAAI,SAAS,GAAS,MAAM,CAAC;IAC7B,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,eAAe,GAAG,SAAS,CAAC;IAEhC,IAAI,MAAM,CAAC,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;YACpD,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC;YAC7B,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;YAC7C,IAAI,CAAC,0BAA0B,wBAAwB,CAAC,eAAe,CAAC,qBAAqB,eAAe,GAAG,CAAC,CAAC;YACjH,IAAI,CAAC,4BAA4B,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,+BAA+B,UAAU,EAAE,CAAC,CAAC;YAClD,IAAI,CAAC,+BAA+B,YAAY,IAAI,QAAQ,EAAE,CAAC,CAAC;YAChE,IAAI,YAAY,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBAChD,SAAS,GAAG,MAAM,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,wCAAwC,UAAU,gBAAgB,YAAY,IAAI,QAAQ,EAAE,CAAC,CAAC;YAC7G,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,qCAAqC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,IAAI,SAAS,GAAS,SAAS,CAAC;IAChC,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAEzC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,iEAAiE,CAAC,CAAC;IAC1E,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,uCAAuC,CAAC,CAAC;QAC9C,MAAM,eAAe,GAAG,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC;QAC1D,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,YAAY,IAAI,eAAe,KAAK,YAAY,EAAE,CAAC;YAC5F,SAAS,GAAG,MAAM,CAAC;YACnB,OAAO,CAAC,IAAI,CACV,4BAA4B,eAAe,4CAA4C,YAAY,GAAG,CACvG,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,GAAqB,IAAI,CAAC;YACjC,IAAI,CAAC;gBACH,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;oBAC9B,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG,IAAI,SAAS,CAAC,aAAa,CAAC,CAAC;oBAC1F,IAAI,CAAC,4CAA4C,CAAC,CAAC;gBACrD,CAAC;qBAAM,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;oBACjC,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;oBAC7C,IAAI,CAAC,8DAA8D,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,MAAM,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,2BAA2B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9F,CAAC;YAED,IAAI,CAAC,GAAG,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;gBACjC,SAAS,GAAG,SAAS,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;gBACrG,IAAI,CAAC,8CAA8C,CAAC,CAAC;YACvD,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,wEAAwE;oBACxE,yEAAyE;oBACzE,0DAA0D;oBAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC;oBAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;wBAC5B,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;oBACtF,CAAC;oBACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;oBAClF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;oBACxD,IAAI,CAAC,6CAA6C,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;oBACpE,IAAI,CAAC,oBAAoB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC5C,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;wBAC3B,SAAS,GAAG,MAAM,CAAC;wBACnB,OAAO,CAAC,IAAI,CAAC,2CAA2C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC7E,CAAC;yBAAM,CAAC;wBACN,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;wBAClD,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;wBACjC,IAAI,CAAC,EAAE;4BAAE,OAAO,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;oBACjE,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,SAAS,GAAG,MAAM,CAAC;oBACnB,OAAO,CAAC,IAAI,CAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACpG,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GACV,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEvE,OAAO;QACL,MAAM;QACN,SAAS;QACT,SAAS;QACT,eAAe;QACf,uBAAuB,EAAE,YAAY;QACrC,qBAAqB,EAAE,UAAU;QACjC,OAAO;QACP,KAAK;KACN,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nexart/cli",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "description": "NexArt CLI — Code Mode and AI execution certification",
   "type": "module",
   "main": "./dist/index.js",
@@ -29,7 +29,7 @@
   "author": "NexArt",
   "license": "MIT",
   "dependencies": {
-    "@nexart/ai-execution": "^0.22.0",
+    "@nexart/ai-execution": "^0.23.0",
     "@nexart/codemode-sdk": "^1.12.0",
     "yargs": "^17.7.2"
   },
@@ -46,10 +46,8 @@
     "node": ">=18.0.0"
   },
   "files": [
-    "dist/index.js",
-    "dist/index.js.map",
-    "dist/index.d.ts",
-    "dist/index.d.ts.map",
+    "dist",
+    "!dist/__tests__",
     "README.md",
     "CHANGELOG.md"
   ]