@nexart/cli 0.16.0 → 1.0.0

package/CHANGELOG.md

@@ -1,5 +1,75 @@
 # @nexart/cli — Changelog
 
+## v1.0.0 (2026-06-18) — First stable release (includes `verify-offline`)
+
+> **Stabilisation release.** Marks the `@nexart/cli` command surface stable under
+> semantic versioning. No cryptographic, hashing, canonicalisation, or exit-code
+> change. Builds on `@nexart/ai-execution@^1.0.0` and `@nexart/codemode-sdk@^1.12.0`,
+> both stable. The CLI continues to implement **zero** independent verification logic —
+> it delegates entirely to the SDK verification core. The `verify-offline` command
+> introduced for this release (below) is the only functional addition.
+
+### Included in this release
+The new `verify-offline` command — a UX-only entry point over the existing offline
+verification path:
+
+- **New `verify-offline <record.json>` command.** A convenience alias for
+  `verify-record --offline`: it runs the **same** verification core (integrity via
+  certificate-hash recompute, Ed25519 receipt signature, timestamp reporting) and
+  **never contacts a NexArt node**. The signing key comes from `--keys` (an alias for
+  `--public-key`) or a key embedded in the record. Reads from a file path or `-` (stdin).
+- **Offline report labelling.** A passing record prints
+  **`FINAL STATUS: AUTHENTIC (OFFLINE)`** with an explicit **`Mode: Offline Verification`**
+  line (the redaction note is still appended for privacy-redacted records). A real
+  integrity mismatch or invalid signature stays **`FINAL STATUS: FAILED`** with exit `1`.
+  `--json` gains an additive `"mode": "offline"` field; online output is unchanged.
+- **No new verification logic.** Hashing, the version-dispatched `canonicalForProtocol()`
+  canonicalisation, the 3-state core, and exit codes are byte-for-byte identical to
+  `verify-record`. As before, a missing or unverifiable timestamp is *reported* but never
+  gates the verdict or exit code. `verify-bundle` is untouched.
+
+## v0.16.1 (2026-06-17) — `verify-record`: 3-state verification (VERIFIED / AUTHENTIC (REDACTED) / FAILED)
+
+UX release. `verify-bundle` is **byte-for-byte unchanged**; the new third state applies
+to `verify-record` (and the `verify-url` / `verify-hash` commands that render through it).
+
+- **Privacy-redacted records are no longer reported as FAILED.** A public record served
+  from a node may have the snapshot's `input` / `output` *content* stripped while the
+  `inputHash` / `outputHash` anchors are kept. Because `certificateHash` is sealed over the
+  full snapshot, recompute is impossible on a redacted snapshot — but that is **not
+  tampering**. Such records now report **`FINAL STATUS: AUTHENTIC (REDACTED)`** with
+  **`⚠ Integrity: NOT RECOMPUTABLE (redacted)`** and **exit 0**, provided the receipt
+  signature still verifies.
+- **Three exit-stable states.** `VERIFIED` (exit 0) → content present, hash recomputes;
+  `AUTHENTIC (REDACTED)` (exit 0) → content stripped, hashes kept, signature passes;
+  `FAILED` (exit 1) → a real content mismatch or an invalid signature. A genuine mismatch
+  is **never** softened to redacted, and a redacted record whose hash still recomputes
+  stays **VERIFIED**.
+- **Report.** For a redacted record the Signature line is shown before the Integrity line,
+  and a short **Public Verification (Redacted)** note explains that full integrity
+  verification requires the original (un-redacted) execution data. `--short` now emits
+  `✔ VERIFIED` / `⚠ AUTHENTIC (REDACTED)` / `✖ FAILED`. `--json` gains a `redacted`
+  boolean, an `authentic-redacted` `status`, and a `redacted` `integrity` value.
+- **No cryptographic change.** `certificateHash` computation, canonicalisation, and the
+  signature / timestamp logic are untouched — this is purely a classification and
+  presentation layer. `verify-bundle` does not opt into redaction classification and is
+  byte-for-byte unchanged.
+- **UX hardening.** The redacted context block now names the redaction source
+  (`Redaction: Applied by certification node (privacy mode)`) and sits tight under the
+  headline. A present-but-unverifiable timestamp (parse failure, or verification not
+  attempted) reports `⚠ Timestamp: PRESENT BUT NOT VERIFIED` instead of
+  `INVALID (malformed token)`, and a missing one reports `Timestamp: NOT INCLUDED` — the
+  timestamp still never affects `FINAL STATUS`. Section order is fixed: Signature →
+  Integrity → Timestamp → Node → Identity → Execution.
+- **Timestamp compatibility (no longer "malformed token").** RFC 3161 timestamp
+  verification now accepts the full `TimeStampResp` returned by the certification node
+  (PKIStatusInfo + `timeStampToken`) in addition to a bare `TimeStampToken` (CMS
+  `ContentInfo`). The wrapper is detected structurally and unwrapped to the inner
+  `ContentInfo` before the unchanged signature / imprint / chain checks run. This is a
+  parsing-layer fix only — `certificateHash`, the imprint binding, the signature logic,
+  and the "timestamp never affects `FINAL STATUS`/exit code" invariant are all
+  unchanged; an unparseable token still degrades to `PRESENT BUT NOT VERIFIED`.
+
 ## v0.16.0 (2026-06-17) — `verify-record`: fully automatic, audit-grade, self-contained
 
 Feature release. `verify-bundle` is **byte-for-byte unchanged** — the redesigned

package/README.md

@@ -1,4 +1,4 @@
-# @nexart/cli v0.16.0
+# @nexart/cli v1.0.0
 
 Command-line interface for NexArt — run, replay, and verify deterministic generative art, plus AI execution certification commands.
 
@@ -34,7 +34,9 @@ authenticity without relying on NexArt systems or source code.
 ### What this verifies
 
 - **Integrity** — the record's `certificateHash` is recomputed from the record's
-  contents and compared to the stored value.
+  contents and compared to the stored value. A privacy-redacted public record
+  (input/output content stripped, hashes kept) is reported as **AUTHENTIC
+  (REDACTED)** rather than failed — see the [3-state model](#verifying-a-full-cer-record-nexart-verify-record).
 - **Authenticity** — the Ed25519 signature over the node's receipt is verified,
   when a signature is present.
 
@@ -691,13 +693,16 @@ nexart verify-bundle cer.json --verify-timestamp --tsa-roots tsa-roots.pem
    not established.
 
 3. **Timestamp (RFC 3161)** *(optional, additive — `--verify-timestamp`)* — when
-   the bundle carries an RFC 3161 TimeStampToken (in `trustedTimestamps[]` or a
+   the bundle carries an RFC 3161 timestamp (in `trustedTimestamps[]` or a
    singular `timestamp`), this **offline** check confirms the token anchors the
-   bundle to a point in time. It verifies, in order: (1) the TSA's CMS signature
-   over the embedded `TSTInfo`; (2) that the token's message imprint equals the
-   bundle's `certificateHash` digest; (3) that the TSA signing certificate chains
-   to a root supplied via `--tsa-roots`; (4) that the certificate is valid at the
-   timestamp; and (5) that the timestamp is at or after the bundle's `createdAt`.
+   bundle to a point in time. Both wire shapes are accepted: a full
+   `TimeStampResp` (the certification node's output) and a bare `TimeStampToken`
+   (e.g. OpenSSL's `-token_out`) — the response wrapper is detected and unwrapped
+   automatically. It verifies, in order: (1) the TSA's CMS signature over the
+   embedded `TSTInfo`; (2) that the token's message imprint equals the bundle's
+   `certificateHash` digest; (3) that the TSA signing certificate chains to a root
+   supplied via `--tsa-roots`; (4) that the certificate is valid at the timestamp;
+   and (5) that the timestamp is at or after the bundle's `createdAt`.
 
    This layer is **strictly additive**: it never modifies `certificateHash`, is
    never included in canonicalisation, and **never affects the Integrity or
@@ -813,7 +818,7 @@ nexart verify-record record.json --json
 # Read the record from stdin (use "-" as the path)
 curl -s https://node.example/records/abc.json | nexart verify-record -
 
-# One-line verdict only (✔ VERIFIED / ✖ FAILED)
+# One-line verdict only (✔ VERIFIED / ⚠ AUTHENTIC (REDACTED) / ✖ FAILED)
 nexart verify-record record.json --short
 
 # Fully offline, with an explicit signing key
@@ -825,6 +830,35 @@ record root is treated as the bundle itself (a certified bundle with its receipt
 signature embedded works directly). There is no "missing bundle" error — a
 structurally invalid record simply reports a clean **Integrity: FAIL**.
 
+**Three-state model (since v0.16.1).** A public record served from a node may be
+**privacy-redacted**: the snapshot's `input` / `output` *content* is stripped while the
+`inputHash` / `outputHash` anchors are kept. Because `certificateHash` is sealed over the
+full snapshot, it can no longer be recomputed from a redacted snapshot — but that is
+**not tampering**. `verify-record` (and `verify-url` / `verify-hash`) detect this case and
+report a third outcome:
+
+| Outcome | When | Integrity line | Exit |
+| --- | --- | --- | --- |
+| **VERIFIED** | content present, `certificateHash` recomputes, signature not invalid | `✔ Integrity: PASS` | `0` |
+| **AUTHENTIC (REDACTED)** | content stripped (hashes kept), recompute not possible, signature **passes** | `⚠ Integrity: NOT RECOMPUTABLE (redacted)` | `0` |
+| **FAILED** | a real integrity mismatch (content present but hash differs) or an invalid signature | `✖ Integrity: FAIL` | `1` |
+
+A redacted record is reclassified **only** when the snapshot is genuinely content-stripped
+*and* the signature still verifies — a true content mismatch is **never** softened to
+redacted, an invalid signature is always **FAILED**, and a redacted record whose hash still
+recomputes simply stays **VERIFIED**. The `certificateHash` computation, canonicalisation,
+and signature/timestamp logic are **unchanged**; this is purely a classification and
+presentation layer.
+
+> **What AUTHENTIC (REDACTED) does and does not prove.** It proves the record carries a
+> valid node signature over the sealed `certificateHash` — i.e. it is authentic. It does
+> **not** recompute the full snapshot, so it cannot prove the *content* behind the kept
+> `inputHash` / `outputHash` was not altered before redaction. Redaction detection is
+> structural (content absent, hashes present), so treat **AUTHENTIC (REDACTED)** as
+> trustworthy only when the record comes from an authenticated node source (e.g. the
+> node's public endpoint over TLS). For the strongest guarantee, obtain the full,
+> un-redacted record and re-run `verify-record` to get **VERIFIED**.
+
 **Signing key resolution (by priority).**
 
 1. **`--public-key <file>`** — an explicit override (PEM, JWK, NodeKeysDocument, or
@@ -853,14 +887,28 @@ a timestamp *status*, never a crash.
 **Input from a file or stdin.** Pass a file path, or **`-`** to read the record from
 standard input — handy for pipelines such as `curl -s … | nexart verify-record -`.
 
-**Report.** The default output is an audit-grade summary — **Integrity**,
-**Signature**, **Timestamp** (`VERIFIED` / `INVALID (<reason>)` / `PRESENT BUT NOT
-VERIFIED` / `NOT INCLUDED IN RECORD`, plus generation time and authority), **Node**
-(node id, key id, key source, operator), **Identity** (asserted identity, or none),
-and **Execution** (protocol, provider, model, input/output hashes, parameters,
-created-at). It ends with a single headline line — **`FINAL STATUS: VERIFIED EVIDENCE
-RECORD`** or **`FINAL STATUS: FAILED`**. `--json` emits the same information as a
-structured object; `--short` prints only `✔ VERIFIED` or `✖ FAILED`.
+**Report.** The default output is an audit-grade summary rendered in a fixed section
+order — **Signature**, **Integrity**, **Timestamp** (`VERIFIED` / `INVALID (<reason>)` /
+`PRESENT BUT NOT VERIFIED` / `NOT INCLUDED`, plus generation time and authority),
+**Node** (node id, key id, key source, operator), **Identity** (asserted identity, or
+none), and **Execution** (protocol, provider, model, input/output hashes, parameters,
+created-at). A present-but-unverifiable token (a parse failure, or verification not
+attempted) is shown as a caution — `⚠ Timestamp: PRESENT BUT NOT VERIFIED` — never as an
+error, and the timestamp **never** affects `FINAL STATUS`. The report ends with a single
+headline line — **`FINAL STATUS: VERIFIED EVIDENCE RECORD`**, **`FINAL STATUS: AUTHENTIC
+(REDACTED)`**, or **`FINAL STATUS: FAILED`**. For a redacted record the Signature line is
+shown before the Integrity line and a tight context block follows the headline:
+
+```
+FINAL STATUS: AUTHENTIC (REDACTED)
+Mode: Public Verification (Redacted)
+Redaction: Applied by certification node (privacy mode)
+! Full integrity verification requires access to original execution data
+```
+
+`--json` emits the same information as a structured object (with `status` of `verified` /
+`authentic-redacted` / `failed`, `integrity` including `redacted`, and a `redacted`
+boolean); `--short` prints only `✔ VERIFIED`, `⚠ AUTHENTIC (REDACTED)`, or `✖ FAILED`.
 
 | Option | Description |
 | --- | --- |
@@ -869,7 +917,7 @@ structured object; `--short` prints only `✔ VERIFIED` or `✖ FAILED`.
 | `--kid <id>` | Key id to select from the key set (default: the receipt's `attestorKeyId`). |
 | `--tsa-roots <file>` | Override the default DigiCert TSA trust roots with custom root certificate(s) (PEM). |
 | `--json` | Emit a machine-readable report. |
-| `--short` | Print only a single verdict line (`✔ VERIFIED` / `✖ FAILED`). |
+| `--short` | Print only a single verdict line (`✔ VERIFIED` / `⚠ AUTHENTIC (REDACTED)` / `✖ FAILED`). |
 | `--verbose` | Show intermediate verification steps. |
 
 > **`verify-bundle` is unchanged.** The redesigned output and automatic key/timestamp
@@ -879,6 +927,43 @@ structured object; `--short` prints only `✔ VERIFIED` or `✖ FAILED`.
 
 ---
 
+## Offline verification (`nexart verify-offline`)
+
+`nexart verify-offline <record.json>` is a convenience alias for
+`verify-record --offline` for relying parties who want a single, unambiguous
+"verify this locally, never touch the network" command. It runs the **exact same**
+verification core — integrity (certificate-hash recompute), Ed25519 receipt
+signature, and timestamp reporting — and **never contacts a NexArt node**. The
+signing key must come from `--keys` (an alias for `--public-key`) or be embedded in
+the record.
+
+```bash
+# Verify a record locally with an explicit node key file
+nexart verify-offline record.json --keys node-keys.json
+
+# Verify a record that embeds its own signing key
+nexart verify-offline record.json
+
+# Read the record from stdin
+curl -s https://node.example/records/abc.json | nexart verify-offline - --keys node-keys.json
+```
+
+It differs from `verify-record` only in presentation: a passing record reports
+**`FINAL STATUS: AUTHENTIC (OFFLINE)`** with an explicit **`Mode: Offline
+Verification`** line (the redaction note is still appended for a privacy-redacted
+record), while a real mismatch or invalid signature stays **`FINAL STATUS:
+FAILED`** with exit `1`. `--json` adds `"mode": "offline"`. **Hashing,
+canonicalisation, the 3-state core, and exit codes are identical to
+`verify-record`** — this is a UX wrapper, not new verification logic. As with
+`verify-record`, a missing or unverifiable timestamp is *reported* but never
+changes the verdict or exit code.
+
+> **This verifies authenticity and integrity, not re-execution.** A pass confirms
+> the record was signed by a NexArt node and has not been tampered with; it does
+> **not** re-run the workload.
+
+---
+
 ## Verifying from a URL (`nexart verify-url`)
 
 `nexart verify-url <url>` is the one-command verification experience: it **fetches** a
@@ -889,7 +974,7 @@ automatic key/timestamp resolution and audit-grade renderer as `verify-record`.
 # Fetch and fully verify a published record
 nexart verify-url https://node.example/records/abc.json
 
-# One-line PASS/FAIL verdict
+# One-line verdict (✔ VERIFIED / ⚠ AUTHENTIC (REDACTED) / ✖ FAILED)
 nexart verify-url https://node.example/records/abc.json --short
 
 # Machine-readable report
@@ -917,7 +1002,7 @@ through `verify-url`, so the **output is identical** to `verify-url`.
 # Resolve and fully verify a record by certificate hash
 nexart verify-hash sha256:abc123…
 
-# One-line PASS/FAIL verdict
+# One-line verdict (✔ VERIFIED / ⚠ AUTHENTIC (REDACTED) / ✖ FAILED)
 nexart verify-hash sha256:abc123… --short
 
 # Machine-readable report

package/dist/index.d.ts

@@ -253,6 +253,7 @@ export interface RecordVerifyOpts {
     offline?: boolean;
     wellKnownUrl?: string;
     short?: boolean;
+    offlineMode?: boolean;
 }
 export declare function verifyRecordStandaloneCommand(file: string, opts: RecordVerifyOpts): Promise<StandaloneVerifyResult>;
 /**

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAcH,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAGL,cAAc,IAAI,iBAAiB,EAqBpC,MAAM,sBAAsB,CAAC;AAi0B9B;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAerD;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,OAAO,CAAC,CA0BlB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,OAAO,EACb,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,GAAE,OAAO,KAAwB,GACvC,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAoB5C;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,0BAAoB,CAAC;AAEhD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,EAAE,CAwB9D;AAoED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,EACD,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CAuCf;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,OAAO,GAAE,OAAO,KAAwB,EACxC,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CA8Cf;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,OAAO,GAAE,OAAO,KAAwB,EACxC,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CA8Df;AAqCD,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,EAChE,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CA+Hf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACrB,OAAO,CAAC,IAAI,CAAC,CAoCf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAC7D,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CAqCf;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1H,OAAO,CAAC,sBAAsB,CAAC,CAqCjC;AAiHD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,sBAAsB,CAAC,CAKjC;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,sBAAsB,CAAC,CAmHjC;AAyBD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,sBAAsB,CAAC,CA6BjC;AAeD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,sBAAsB,CAAC,CASjC;AA8RD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,gBAAgB,EAAE,SAAS,GAAG,MAAM,CAyBtF;AAmDD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,EACvB,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CAwBf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAcH,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAGL,cAAc,IAAI,iBAAiB,EAqBpC,MAAM,sBAAsB,CAAC;AAi0B9B;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,CAerD;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,OAAO,CAAC,CA0BlB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,OAAO,EACb,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,GAAE,OAAO,KAAwB,GACvC,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAoB5C;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,0BAAoB,CAAC;AAEhD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,EAAE,CAwB9D;AAoED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,EACD,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CAuCf;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,OAAO,GAAE,OAAO,KAAwB,EACxC,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CA8Cf;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,OAAO,GAAE,OAAO,KAAwB,EACxC,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CA8Df;AAqCD,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,EAChE,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CA+Hf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACrB,OAAO,CAAC,IAAI,CAAC,CAoCf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAC7D,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CAqCf;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1H,OAAO,CAAC,sBAAsB,CAAC,CAqCjC;AAiHD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAKhB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,sBAAsB,CAAC,CAKjC;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,sBAAsB,CAAC,CAuHjC;AAyBD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,sBAAsB,CAAC,CA6BjC;AAeD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,sBAAsB,CAAC,CASjC;AAkUD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,gBAAgB,EAAE,SAAS,GAAG,MAAM,CAyBtF;AAmDD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,EACvB,WAAW,GAAE,MAAM,OAAO,CAAC,MAAM,CAAiB,GACjD,OAAO,CAAC,IAAI,CAAC,CAwBf"}

package/dist/index.js

@@ -1559,6 +1559,9 @@ export async function verifyRecordFromObject(record, opts) {
         publicKeyMaterial,
         kid: attestorKeyId,
         verbose: opts.verbose,
+        // Public records may be privacy-redacted (input/output content stripped). Classify
+        // those as `integrity: 'redacted'` rather than a tamper FAIL.
+        classifyRedacted: true,
     });
     // If no override / well-known key was used but the signature still verified, the
     // verifier must have used key material embedded in the bundle.
@@ -1594,7 +1597,8 @@ export async function verifyRecordFromObject(record, opts) {
         opts,
     });
     // Exit code is determined SOLELY by integrity + signature — never by the timestamp.
-    process.exitCode = result.status === 'verified' ? 0 : 1;
+    // VERIFIED and AUTHENTIC (REDACTED) both exit 0; only FAILED exits 1.
+    process.exitCode = result.status === 'failed' ? 1 : 0;
     return result;
 }
 /**
@@ -1750,7 +1754,7 @@ function keySourceLabel(source) {
 function formatRecordTimestampLine(status) {
     const CHECK = '\u2714';
     const CROSS = '\u2716';
-    const CIRCLE = '\u25CB';
+    const WARN = '\u26A0';
     switch (status) {
         case 'valid':
             return `${CHECK} Timestamp: VERIFIED`;
@@ -1764,13 +1768,15 @@ function formatRecordTimestampLine(status) {
             return `${CROSS} Timestamp: INVALID (expired)`;
         case 'invalid-time':
             return `${CROSS} Timestamp: INVALID (time)`;
+        // A present-but-unverifiable token (parse failure, or verification not attempted) is
+        // NOT a broken record — it is advisory only and never affects FINAL STATUS. Report it
+        // as a caution, not an error, so users don't read it as tampering.
         case 'malformed':
-            return `${CROSS} Timestamp: INVALID (malformed token)`;
         case 'present-unverified':
-            return `${CIRCLE} Timestamp: PRESENT BUT NOT VERIFIED`;
+            return `${WARN} Timestamp: PRESENT BUT NOT VERIFIED`;
         case 'not-present':
         default:
-            return `${CIRCLE} Timestamp: NOT INCLUDED IN RECORD`;
+            return `${CROSS} Timestamp: NOT INCLUDED`;
     }
 }
 /**
@@ -1795,7 +1801,9 @@ function renderRecordVerification(result, tsaResult, ctx) {
     if (ctx.opts.json) {
         process.stdout.write(JSON.stringify({
             status: result.status,
+            ...(ctx.opts.offlineMode ? { mode: 'offline' } : {}),
             integrity: result.integrity,
+            redacted: result.integrity === 'redacted',
             signature: result.signature,
             protocolVersion: result.protocolVersion,
             certificateHash: result.expectedCertificateHash,
@@ -1824,11 +1832,16 @@ function renderRecordVerification(result, tsaResult, ctx) {
         }, null, 2) + '\n');
         return;
     }
-    const mark = (p) => p === 'pass' ? '\u2714' : p === 'fail' ? '\u2716' : '\u25CB';
-    const label = (p) => p.toUpperCase();
-    // --short: a single machine-glanceable verdict line, nothing else.
+    const WARN = '\u26A0';
+    const mark = (p) => p === 'pass' ? '\u2714' : p === 'redacted' ? WARN : p === 'fail' ? '\u2716' : '\u25CB';
+    const label = (p) => p === 'redacted' ? 'NOT RECOMPUTABLE (redacted)' : p.toUpperCase();
+    // --short: a single machine-glanceable verdict line, nothing else. 3-state.
     if (ctx.opts.short) {
-        console.log(result.status === 'verified' ? '\u2714 VERIFIED' : '\u2716 FAILED');
+        console.log(result.status === 'verified'
+            ? '\u2714 VERIFIED'
+            : result.status === 'authentic-redacted'
+                ? `${WARN} AUTHENTIC (REDACTED)`
+                : '\u2716 FAILED');
         return;
     }
     if (ctx.opts.verbose && result.steps.length > 0) {
@@ -1837,9 +1850,10 @@ function renderRecordVerification(result, tsaResult, ctx) {
             console.log(`  - ${s}`);
         console.log('');
     }
-    // ── Verdict block ──
-    console.log(`${mark(result.integrity)} Integrity: ${label(result.integrity)}`);
+    // ── Verdict block ── Signature FIRST: authenticity establishes trust up front,
+    // then integrity (recomputable vs redacted), then the (advisory) timestamp.
     console.log(`${mark(result.signature)} Signature: ${label(result.signature)}`);
+    console.log(`${mark(result.integrity)} Integrity: ${label(result.integrity)}`);
     console.log(formatRecordTimestampLine(tsaResult.status));
     if (tsaResult.status !== 'not-present' && genTimeIso) {
         console.log(`  Time:      ${genTimeIso}`);
@@ -1885,11 +1899,34 @@ function renderRecordVerification(result, tsaResult, ctx) {
     }
     if (str(ctx.bundle.createdAt))
         console.log(`  Created:    ${str(ctx.bundle.createdAt)}`);
-    // ── Final verdict line ──
+    // ── Final verdict line (3-state) ──
+    // `verify-offline` (offlineMode) is a DISPLAY wrapper: a non-failed record is labelled
+    // "AUTHENTIC (OFFLINE)" regardless of the redacted/verified split, while a failure stays
+    // "FAILED". The 3-state core, exit code, and crypto are untouched.
+    const offline = ctx.opts.offlineMode === true;
     console.log('');
-    console.log(result.status === 'verified'
-        ? 'FINAL STATUS: VERIFIED EVIDENCE RECORD'
-        : 'FINAL STATUS: FAILED');
+    console.log(result.status === 'failed'
+        ? 'FINAL STATUS: FAILED'
+        : offline
+            ? 'FINAL STATUS: AUTHENTIC (OFFLINE)'
+            : result.status === 'verified'
+                ? 'FINAL STATUS: VERIFIED EVIDENCE RECORD'
+                : 'FINAL STATUS: AUTHENTIC (REDACTED)');
+    // Mode / context block. In offline mode an explicit "Mode: Offline Verification" line
+    // is always shown for a passing record; the redaction note is appended when the public
+    // record was privacy-redacted. Online keeps the original redacted-only context block.
+    if (offline && result.status !== 'failed') {
+        console.log('Mode: Offline Verification');
+        if (result.status === 'authentic-redacted') {
+            console.log('Redaction: Applied by certification node (privacy mode)');
+            console.log('! Full integrity verification requires access to original execution data');
+        }
+    }
+    else if (result.status === 'authentic-redacted') {
+        console.log('Mode: Public Verification (Redacted)');
+        console.log('Redaction: Applied by certification node (privacy mode)');
+        console.log('! Full integrity verification requires access to original execution data');
+    }
     // ── Failure reasons (stderr) ──
     if (result.status === 'failed' || result.reasons.length > 0) {
         for (const r of result.reasons)
@@ -2544,7 +2581,7 @@ if (_isMainModule) {
             default: false,
         })
             .option('short', {
-            describe: 'Print only a single verdict line (✔ VERIFIED / ✖ FAILED)',
+            describe: 'Print only a single verdict line (✔ VERIFIED / ⚠ AUTHENTIC (REDACTED) / ✖ FAILED)',
             type: 'boolean',
             default: false,
         })
@@ -2574,6 +2611,62 @@ if (_isMainModule) {
             offline: argv.offline,
             tsaRoots: argv['tsa-roots'],
         });
+    })
+        .command('verify-offline <file>', 'Verify a CER record locally without contacting a NexArt node (offline-only alias of verify-record --offline)', (yargs) => {
+        return yargs
+            .positional('file', {
+            describe: 'Path to the CER record JSON, or "-" to read it from stdin ({ bundle, verification?, timestamp? } or a bare bundle)',
+            type: 'string',
+            demandOption: true,
+        })
+            .option('keys', {
+            alias: 'public-key',
+            describe: 'Node public key(s) for signature verification (PEM, JWK, NodeKeysDocument, or raw base64url). Falls back to a key embedded in the record',
+            type: 'string',
+        })
+            .option('kid', {
+            describe: 'Key id to select from the key set (default: the receipt attestorKeyId)',
+            type: 'string',
+        })
+            .option('json', {
+            describe: 'Output machine-readable JSON',
+            type: 'boolean',
+            default: false,
+        })
+            .option('short', {
+            describe: 'Print only a single verdict line (✔ VERIFIED / ⚠ AUTHENTIC (REDACTED) / ✖ FAILED)',
+            type: 'boolean',
+            default: false,
+        })
+            .option('verbose', {
+            describe: 'Show intermediate verification steps',
+            type: 'boolean',
+            default: false,
+        })
+            .option('tsa-roots', {
+            describe: 'Override the default DigiCert TSA trust roots with custom root certificate(s) (PEM)',
+            type: 'string',
+        })
+            .example('$0 verify-offline record.json --keys node-keys.json', 'Fully offline verification with an explicit key file')
+            .example('$0 verify-offline record.json', 'Offline verification using a key embedded in the record')
+            .epilogue('This verifies that the record was signed by a NexArt node and has not been tampered with. ' +
+            'It does not re-execute the workload, and never contacts a node.');
+    }, async (argv) => {
+        // yargs collapses a bare "-" positional to an empty string; restore the stdin sentinel.
+        const file = argv.file === '' ? '-' : argv.file;
+        await verifyRecordStandaloneCommand(file, {
+            // `keys` is the alias for `public-key`; yargs populates both, prefer either.
+            publicKey: argv.keys ?? argv['public-key'],
+            kid: argv.kid,
+            json: argv.json,
+            short: argv.short,
+            verbose: argv.verbose,
+            tsaRoots: argv['tsa-roots'],
+            // verify-offline is offline by definition: no network for keys or anything else.
+            offline: true,
+            // Display-only: label the report as an offline verification.
+            offlineMode: true,
+        });
     })
         .command('verify-hash <certificate_hash>', 'Resolve a certificate hash to its public CER record and verify it — one-command verification', (yargs) => {
         return yargs
@@ -2601,7 +2694,7 @@ if (_isMainModule) {
             default: false,
         })
             .option('short', {
-            describe: 'Print only a single verdict line (✔ VERIFIED / ✖ FAILED)',
+            describe: 'Print only a single verdict line (✔ VERIFIED / ⚠ AUTHENTIC (REDACTED) / ✖ FAILED)',
             type: 'boolean',
             default: false,
         })
@@ -2654,7 +2747,7 @@ if (_isMainModule) {
             default: false,
         })
             .option('short', {
-            describe: 'Print only a single verdict line (✔ VERIFIED / ✖ FAILED)',
+            describe: 'Print only a single verdict line (✔ VERIFIED / ⚠ AUTHENTIC (REDACTED) / ✖ FAILED)',
             type: 'boolean',
             default: false,
         })