@nexart/cli 0.15.0 → 0.16.0

package/CHANGELOG.md

@@ -1,5 +1,69 @@
 # @nexart/cli — Changelog
 
+## v0.16.0 (2026-06-17) — `verify-record`: fully automatic, audit-grade, self-contained
+
+Feature release. `verify-bundle` is **byte-for-byte unchanged** — the redesigned
+output and automatic key/timestamp resolution apply to `verify-record` only.
+
+- **Automatic verification.** `nexart verify-record <file>` now verifies integrity,
+  the receipt signature, **and** the RFC 3161 timestamp with no extra flags. The
+  `--verify-timestamp` gate is gone — timestamp verification always runs when a token
+  is present (the ASN.1 stack still loads lazily, only when a token exists).
+- **Self-contained signing key resolution.** By priority: `--public-key` (explicit
+  override) → auto-fetched from the node's published key set at
+  `https://node.nexart.io/.well-known/nexart-node.json` (the key whose `kid` matches
+  the receipt's `attestorKeyId`) → a bundle-embedded key. The fetch is the **only**
+  network call, lives entirely in the CLI layer (the auditable `standaloneVerify.ts`
+  core stays `node:crypto`-only / no network), and fails gracefully. New **`--offline`**
+  flag disables it; the URL is overridable via `NEXART_NODE_WELLKNOWN_URL`.
+- **Embedded DigiCert trust store.** Timestamps verify against a built-in trust store
+  (DigiCert Trusted Root G4 + DigiCert Assured ID Root CA) by default; **`--tsa-roots`**
+  overrides it with custom PEM roots.
+- **Flexible input.** The bundle is read from `record.bundle` or, failing that, the
+  record root is treated as the bundle. The old "missing bundle" error is removed — a
+  malformed record now reports a clean **Integrity: FAIL** (exit `1`).
+- **Timestamp precedence:** `verification.timestamp.token` → `timestamp.token` →
+  bundle-embedded (`trustedTimestamps[]` / singular `timestamp`).
+- **Redesigned audit-grade report** (and `--json`): **Integrity**, **Signature**,
+  **Timestamp** (`VERIFIED` / `INVALID (<reason>)` / `PRESENT BUT NOT VERIFIED` /
+  `NOT INCLUDED IN RECORD` + generation time and authority), **Node** (node id, key id,
+  key source, operator), **Identity**, and **Execution** (protocol, provider, model,
+  input/output hashes, parameters, created-at). The report now ends with a single
+  headline line — **`FINAL STATUS: VERIFIED EVIDENCE RECORD`** or **`FINAL STATUS:
+  FAILED`**.
+- **New `nexart verify-url <url>`.** One-command verification: fetches a CER record (or
+  a bare bundle) as JSON from a URL and verifies it through the **same** automatic
+  key/timestamp resolution and audit-grade renderer as `verify-record`. The payload is
+  auto-detected as a full record (`verification.receipt`) or a raw bundle — both route
+  through the rich verifier. The URL fetch is the record *source* and always runs;
+  `--offline` here only disables the separate signing-key auto-fetch. Bad HTTP status,
+  network errors, and non-JSON bodies fail cleanly with exit `1`.
+- **New `nexart verify-hash <certificate_hash>`.** Resolves a record straight from its
+  certificate hash: constructs the public node lookup URL
+  (`https://node.nexart.io/v1/cer/public?certificate_hash=<hash>`) and verifies it via
+  `verify-url`, so the output is **identical** to `verify-url`. The hash must carry the
+  canonical `sha256:` prefix (a missing prefix fails cleanly with exit `1` before any
+  network call). Supports `--short`, `--offline`, `--json` (and the rest of the
+  `verify-url` options). Distinct from the existing `verify <snapshot>` command, which
+  is left untouched.
+- **New `verify-record -` (stdin).** A `-` path reads the record from standard input,
+  enabling pipelines such as `curl -s … | nexart verify-record -`.
+- **New `--short` flag** (`verify-record` and `verify-url`): prints only a single
+  verdict line — `✔ VERIFIED` or `✖ FAILED`.
+- **Unchanged invariants:** the timestamp layer never modifies `certificateHash`, is
+  never canonicalised, and **never affects the Integrity/Signature result or the exit
+  code** (`0` only when integrity passes and the signature is not invalid, `1`
+  otherwise). Operational TSA errors (untrusted root, imprint mismatch, unreadable
+  `--tsa-roots`) are reported as a timestamp *status*, never a crash. `verify-bundle`
+  remains **byte-for-byte unchanged**.
+
+## v0.15.1 (2026-06-17) — docs: correct README version header
+
+Docs-only patch. No code or behaviour changes.
+
+- **Fixed:** the README title still read `v0.12.0` despite several releases since;
+  it now reflects the current package version.
+
 ## v0.15.0 (2026-06-17) — `verify-record` (full CER record + timestamp verification)
 
 Additive feature. No breaking changes. `verify-bundle` is byte-for-byte unchanged.

package/README.md

@@ -1,4 +1,4 @@
-# @nexart/cli v0.12.0
+# @nexart/cli v0.16.0
 
 Command-line interface for NexArt — run, replay, and verify deterministic generative art, plus AI execution certification commands.
 
@@ -798,35 +798,140 @@ optional externally anchored timestamp:
 }
 ```
 
-**How it differs from `verify-bundle`.** `verify-bundle` takes a bundle whose
-receipt and signature are already embedded inside it. `verify-record` accepts the
-record envelope above, lifts `verification.receipt` / `verification.receiptSignature`
-onto the bundle, and then runs the **exact same** integrity + signature checks as
-`verify-bundle` (it reuses the identical internal verifier — no duplicated crypto).
-The record-level `timestamp.token` takes precedence over any token embedded in the
-bundle; if the record omits it, an embedded `trustedTimestamps[]` / `timestamp` is
-used instead. Everything else — flags, output, exit-code semantics — is identical
-to `verify-bundle`.
+**Fully automatic since v0.16.0.** Give it a record file and nothing else — the
+command verifies integrity, the receipt signature, **and** the RFC 3161 timestamp
+automatically, and prints an audit-grade report. It is self-contained: a third party
+needs only the record and this CLI.
 
 ```bash
-# Integrity + signature of a full record (offline)
-nexart verify-record record.json --public-key node-keys.json
+# Full automatic verification: integrity + signature + timestamp
+nexart verify-record record.json
 
-# Machine-readable output
-nexart verify-record record.json --public-key node-keys.json --json
+# Machine-readable report
+nexart verify-record record.json --json
+
+# Read the record from stdin (use "-" as the path)
+curl -s https://node.example/records/abc.json | nexart verify-record -
+
+# One-line verdict only (✔ VERIFIED / ✖ FAILED)
+nexart verify-record record.json --short
+
+# Fully offline, with an explicit signing key
+nexart verify-record record.json --offline --public-key node-keys.json
+```
+
+**Flexible input.** The bundle is taken from `record.bundle` when present, or the
+record root is treated as the bundle itself (a certified bundle with its receipt and
+signature embedded works directly). There is no "missing bundle" error — a
+structurally invalid record simply reports a clean **Integrity: FAIL**.
+
+**Signing key resolution (by priority).**
+
+1. **`--public-key <file>`** — an explicit override (PEM, JWK, NodeKeysDocument, or
+   raw base64url).
+2. **Auto-fetch** — otherwise the node's published key set is fetched from
+   `https://node.nexart.io/.well-known/nexart-node.json` and the key whose `kid`
+   matches the receipt's `attestorKeyId` is used. This is the **only** network call
+   in the verify path; it lives entirely in the CLI layer (the auditable core never
+   touches the network) and fails gracefully — a network error just falls through to
+   the next source. Override the URL with `NEXART_NODE_WELLKNOWN_URL`, or disable the
+   fetch entirely with **`--offline`**.
+3. **Embedded key** — a key embedded in the bundle, if any.
+
+**Automatic timestamp verification.** An RFC 3161 token at
+`verification.timestamp.token`, `timestamp.token`, or embedded in the bundle is
+verified automatically and offline against an **embedded DigiCert trust store**
+(DigiCert Trusted Root G4 + DigiCert Assured ID Root CA). Override the trusted roots
+with **`--tsa-roots <file>`** (PEM). The ASN.1 stack (`pkijs` / `asn1js`) loads
+**only** when a token is actually present. The timestamp layer is **strictly
+additive**: it never modifies `certificateHash`, is never canonicalised, and **never
+affects the Integrity / Signature result or the exit code** (which is `0` only when
+integrity passes and the signature is not invalid, `1` otherwise) — an
+untrusted-root, imprint-mismatch, or unreadable-`--tsa-roots` outcome is reported as
+a timestamp *status*, never a crash.
+
+**Input from a file or stdin.** Pass a file path, or **`-`** to read the record from
+standard input — handy for pipelines such as `curl -s … | nexart verify-record -`.
+
+**Report.** The default output is an audit-grade summary — **Integrity**,
+**Signature**, **Timestamp** (`VERIFIED` / `INVALID (<reason>)` / `PRESENT BUT NOT
+VERIFIED` / `NOT INCLUDED IN RECORD`, plus generation time and authority), **Node**
+(node id, key id, key source, operator), **Identity** (asserted identity, or none),
+and **Execution** (protocol, provider, model, input/output hashes, parameters,
+created-at). It ends with a single headline line — **`FINAL STATUS: VERIFIED EVIDENCE
+RECORD`** or **`FINAL STATUS: FAILED`**. `--json` emits the same information as a
+structured object; `--short` prints only `✔ VERIFIED` or `✖ FAILED`.
+
+| Option | Description |
+| --- | --- |
+| `--public-key <file>` | Override the signing key. Default: auto-fetched from the node `.well-known` key set. |
+| `--offline` | Do not contact the network; use `--public-key` or a bundle-embedded key only. |
+| `--kid <id>` | Key id to select from the key set (default: the receipt's `attestorKeyId`). |
+| `--tsa-roots <file>` | Override the default DigiCert TSA trust roots with custom root certificate(s) (PEM). |
+| `--json` | Emit a machine-readable report. |
+| `--short` | Print only a single verdict line (`✔ VERIFIED` / `✖ FAILED`). |
+| `--verbose` | Show intermediate verification steps. |
+
+> **`verify-bundle` is unchanged.** The redesigned output and automatic key/timestamp
+> resolution apply to `verify-record` only;
+> [`verify-bundle`](#independent-verification-nexart-verify-bundle) keeps its existing
+> behaviour, flags, and byte-for-byte output.
+
+---
+
+## Verifying from a URL (`nexart verify-url`)
+
+`nexart verify-url <url>` is the one-command verification experience: it **fetches** a
+CER record (or a bare bundle) as JSON from a URL and verifies it with the exact same
+automatic key/timestamp resolution and audit-grade renderer as `verify-record`.
+
+```bash
+# Fetch and fully verify a published record
+nexart verify-url https://node.example/records/abc.json
 
-# Additionally verify the record's RFC 3161 timestamp against trusted TSA roots
-nexart verify-record record.json --public-key node-keys.json \
-  --verify-timestamp --tsa-roots tsa-roots.pem
+# One-line PASS/FAIL verdict
+nexart verify-url https://node.example/records/abc.json --short
+
+# Machine-readable report
+nexart verify-url https://node.example/records/abc.json --json
+```
+
+The response is auto-detected as a **full record** (has `verification.receipt`) or a
+**raw bundle**; both route through the same rich verifier (a bare bundle is accepted
+directly). The URL fetch is the record *source* and always happens; **`--offline`**
+here only disables the separate signing-key auto-fetch (so pair it with `--public-key`
+or rely on a bundle-embedded key). A non-2xx response, a network error, or a
+non-JSON body fails cleanly with exit `1`. All other options match `verify-record`
+(`--public-key`, `--kid`, `--tsa-roots`, `--json`, `--short`, `--verbose`).
+
+---
+
+## Verifying by certificate hash (`nexart verify-hash`)
+
+`nexart verify-hash <certificate_hash>` resolves a CER record straight from its
+certificate hash. It constructs the public node lookup URL
+(`https://node.nexart.io/v1/cer/public?certificate_hash=<hash>`) and then verifies it
+through `verify-url`, so the **output is identical** to `verify-url`.
+
+```bash
+# Resolve and fully verify a record by certificate hash
+nexart verify-hash sha256:abc123…
+
+# One-line PASS/FAIL verdict
+nexart verify-hash sha256:abc123… --short
+
+# Machine-readable report
+nexart verify-hash sha256:abc123… --json
 ```
 
-The **Integrity**, **Signature**, **Timestamp** semantics, the human-readable and
-`--json` shapes, and the option table are all exactly as documented for
-[`verify-bundle`](#independent-verification-nexart-verify-bundle) above. The
-timestamp layer is, identically, **strictly additive**: `pkijs` is loaded **only**
-under `--verify-timestamp`, and the timestamp result **never** affects the
-Integrity/Signature outcome or the process exit code (which is `0` only when
-integrity passes and the signature is not invalid, `1` otherwise).
+The hash **must** include the canonical `sha256:` prefix; a missing prefix fails
+cleanly with exit `1` (before any network call). Network failures behave exactly like
+`verify-url`. Options match `verify-url` (`--public-key`, `--kid`, `--tsa-roots`,
+`--json`, `--short`, `--offline`, `--verbose`); as with `verify-url`, `--offline` only
+disables the signing-key auto-fetch — the record itself is always fetched.
+
+> Note: this is distinct from `nexart verify <snapshot>`, which verifies that a
+> snapshot reproduces its expected output.
 
 ---
 

package/dist/index.d.ts

@@ -220,27 +220,62 @@ export declare function verifyBundleStandaloneCommand(file: string, opts: {
 /**
  * nexart verify-record — Verify a full NexArt CER RECORD offline and independently.
  *
- * A "record" is the full verification envelope: { bundle, verification: { receipt,
- * receiptSignature }, timestamp? }. This command is STRICTLY ADDITIVE alongside
- * `verify-bundle` and reuses the exact same engine:
+ * A "record" is the full verification envelope. v0.16.0 makes this command fully
+ * automatic, audit-grade, and self-contained — a third party needs only the record
+ * file and this CLI:
+ *   - FLEXIBLE PARSING: the bundle is taken from `record.bundle` when present, or the
+ *     record root is treated as the bundle itself. There is no "missing bundle" error;
+ *     a structurally invalid record simply reports a clean Integrity FAIL.
  *   - INTEGRITY + SIGNATURE: the record's `verification.receipt` /
- *     `verification.receiptSignature` are merged into a SHALLOW copy of `bundle`
- *     (which never affects the recomputed certificateHash — receipt/signature are
- *     not part of the certificate payload) and handed to verifyBundleStandalone().
- *     Behaviour, including --public-key / --kid, is identical to verify-bundle.
- *   - TIMESTAMP (optional, additive): the record-level `timestamp.token` (or a
- *     bundle-embedded timestamp) is verified via the same resolveTimestampResult()
- *     path used by verify-bundle. It NEVER affects integrity, signature, or the
- *     exit code, and the ASN.1 stack loads only behind --verify-timestamp.
+ *     `verification.receiptSignature` are merged into a SHALLOW copy of the bundle
+ *     (which never affects the recomputed certificateHash) and handed to
+ *     verifyBundleStandalone(). The signing public key is, by priority:
+ *       1. `--public-key <file>` (explicit override), else
+ *       2. auto-fetched from the node's published key set at
+ *          https://node.nexart.io/.well-known/nexart-node.json, selecting the key
+ *          whose kid matches the receipt's attestorKeyId (skipped under --offline),
+ *          else
+ *       3. key material embedded in the bundle, if any.
+ *   - TIMESTAMP (automatic): an RFC 3161 token at `verification.timestamp.token`,
+ *     `timestamp.token`, or embedded in the bundle is verified automatically and
+ *     offline against the embedded DigiCert trust store (override with --tsa-roots).
+ *     The ASN.1 stack loads only when a token is actually present. The timestamp
+ *     NEVER affects Integrity, Signature, or the exit code.
+ *
+ * Exit code: 0 when integrity passes and signature is not a failure, 1 otherwise.
  */
-export declare function verifyRecordStandaloneCommand(file: string, opts: {
+export interface RecordVerifyOpts {
     publicKey?: string;
     kid?: string;
     json?: boolean;
     verbose?: boolean;
-    verifyTimestamp?: boolean;
     tsaRoots?: string;
-}): Promise<StandaloneVerifyResult>;
+    offline?: boolean;
+    wellKnownUrl?: string;
+    short?: boolean;
+}
+export declare function verifyRecordStandaloneCommand(file: string, opts: RecordVerifyOpts): Promise<StandaloneVerifyResult>;
+/**
+ * Verify an already-parsed CER record (or bare bundle) object and render the
+ * audit-grade report. This is the shared core behind `verify-record` (file / stdin)
+ * and `verify-url` (network), so key resolution, timestamp verification, and the rich
+ * renderer behave identically across all input sources.
+ */
+export declare function verifyRecordFromObject(record: unknown, opts: RecordVerifyOpts): Promise<StandaloneVerifyResult>;
+/**
+ * nexart verify-url — Fetch a CER record (or bare bundle) from a URL and verify it
+ * automatically, using the SAME rich renderer and key/timestamp resolution as
+ * `verify-record`. The single network fetch here is the record SOURCE; `--offline`
+ * still disables the (separate) signing-key auto-fetch, exactly as for verify-record.
+ */
+export declare function verifyUrlCommand(url: string, opts: RecordVerifyOpts): Promise<StandaloneVerifyResult>;
+/**
+ * nexart verify-hash — Resolve a certificate hash to its public CER record URL and verify it.
+ * This is a thin convenience wrapper over `verify-url`: it constructs
+ * `${PUBLIC_CER_ENDPOINT}?certificate_hash=<hash>` and delegates, so the output is
+ * identical to `verify-url`. The hash must carry the canonical `sha256:` prefix.
+ */
+export declare function verifyHashCommand(certificateHash: string, opts: RecordVerifyOpts): Promise<StandaloneVerifyResult>;
 /**
  * Render the human-readable timestamp STATUS line WITHOUT importing the ASN.1 stack.
  * This deliberately mirrors formatTsaLine() in tsaVerify.ts but lives here so the

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAcH,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAGL,cAAc,IAAI,iBAAiB,EAqBpC,MAAM,sBAAsB,CAAC;AAi0B9B;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAerD;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,OAAO,CAAC,CA0BlB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,OAAO,EACb,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,GAAE,OAAO,KAAwB,GACvC,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAoB5C;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,0BAAoB,CAAC;AAEhD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,EAAE,CAwB9D;AAoED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,EACD,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CAuCf;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,OAAO,GAAE,OAAO,KAAwB,EACxC,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CA8Cf;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,OAAO,GAAE,OAAO,KAAwB,EACxC,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CA8Df;AAqCD,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,EAChE,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CA+Hf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACrB,OAAO,CAAC,IAAI,CAAC,CAoCf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAC7D,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CAqCf;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1H,OAAO,CAAC,sBAAsB,CAAC,CAqCjC;AA2GD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1H,OAAO,CAAC,sBAAsB,CAAC,CAkEjC;AAoCD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,gBAAgB,EAAE,SAAS,GAAG,MAAM,CAyBtF;AAmDD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,EACvB,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CAwBf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAcH,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAGL,cAAc,IAAI,iBAAiB,EAqBpC,MAAM,sBAAsB,CAAC;AAi0B9B;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAerD;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,OAAO,CAAC,CA0BlB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,OAAO,EACb,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,GAAE,OAAO,KAAwB,GACvC,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAoB5C;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,0BAAoB,CAAC;AAEhD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,EAAE,CAwB9D;AAoED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,EACD,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CAuCf;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,OAAO,GAAE,OAAO,KAAwB,EACxC,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CA8Cf;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,OAAO,GAAE,OAAO,KAAwB,EACxC,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CA8Df;AAqCD,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,EAChE,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CA+Hf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACrB,OAAO,CAAC,IAAI,CAAC,CAoCf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAC7D,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CAqCf;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1H,OAAO,CAAC,sBAAsB,CAAC,CAqCjC;AAiHD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,sBAAsB,CAAC,CAKjC;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,sBAAsB,CAAC,CAmHjC;AAyBD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,sBAAsB,CAAC,CA6BjC;AAeD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,sBAAsB,CAAC,CASjC;AA8RD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,gBAAgB,EAAE,SAAS,GAAG,MAAM,CAyBtF;AAmDD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,EACvB,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CAwBf"}