@nexart/cli 0.2.2 → 0.3.0

package/dist/index.js

@@ -1,13 +1,16 @@
 #!/usr/bin/env node
 /**
- * @nexart/cli v0.2.2 — NexArt CodeMode CLI
+ * @nexart/cli v0.3.0 — NexArt CLI
  *
- * Commands:
- * - nexart run <file> — Execute via remote renderer and create snapshot
+ * Code Mode commands:
+ * - nexart run <file>      — Execute via remote renderer and create snapshot
  * - nexart replay <snapshot> — Re-execute from snapshot
  * - nexart verify <snapshot> — Verify snapshot hash
  *
- * Remote rendering via canonical Node renderer endpoint with API key auth.
+ * AI Certification commands:
+ * - nexart ai create <file>  — Create a CER bundle via node API
+ * - nexart ai certify <file> — Certify an AI execution and attest
+ * - nexart ai verify <file>  — Verify a CER bundle locally
  */
 import yargs from 'yargs';
 import { hideBin } from 'yargs/helpers';
@@ -16,11 +19,13 @@ import * as path from 'path';
 import * as crypto from 'crypto';
 import * as http from 'http';
 import * as https from 'https';
-const CLI_VERSION = '0.2.2';
+import { fileURLToPath } from 'url';
+const CLI_VERSION = '0.3.0';
 const SDK_VERSION = '1.8.4';
 const PROTOCOL_VERSION = '1.2.0';
 const DEFAULT_ENDPOINT = process.env.NEXART_RENDERER_ENDPOINT || 'http://localhost:5000';
 const DEFAULT_API_KEY = process.env.NEXART_API_KEY || '';
+const DEFAULT_NODE_ENDPOINT = process.env.NEXART_NODE_ENDPOINT || 'https://node.nexart.art';
 function sha256(data) {
     const buffer = typeof data === 'string' ? Buffer.from(data, 'utf-8') : data;
     return crypto.createHash('sha256').update(buffer).digest('hex');
@@ -67,17 +72,49 @@ function validateApiKey(apiKey, endpoint) {
         process.exit(1);
     }
 }
-function writeFileWithAbsolutePath(filePath, data) {
-    const absolutePath = path.resolve(process.cwd(), filePath);
+function resolveOutputPath(outPath) {
+    if (path.isAbsolute(outPath)) {
+        return outPath;
+    }
+    return path.resolve(process.cwd(), outPath);
+}
+function deriveSnapshotPath(pngPath) {
+    if (pngPath.toLowerCase().endsWith('.png')) {
+        return pngPath.replace(/\.png$/i, '.snapshot.json');
+    }
+    return pngPath + '.snapshot.json';
+}
+function writeFileAndVerify(filePath, data) {
+    const absolutePath = resolveOutputPath(filePath);
+    const dir = path.dirname(absolutePath);
+    if (!fs.existsSync(dir)) {
+        try {
+            fs.mkdirSync(dir, { recursive: true });
+        }
+        catch (error) {
+            console.error(`[nexart] Error: Failed to create directory: ${dir}`);
+            console.error(`[nexart] ${error}`);
+            process.exit(1);
+        }
+    }
     try {
         fs.writeFileSync(absolutePath, data);
-        return absolutePath;
     }
     catch (error) {
         console.error(`[nexart] Error: Failed to write file: ${absolutePath}`);
         console.error(`[nexart] ${error}`);
         process.exit(1);
     }
+    if (!fs.existsSync(absolutePath)) {
+        console.error(`[nexart] Error: File was not created: ${absolutePath}`);
+        process.exit(1);
+    }
+    const stats = fs.statSync(absolutePath);
+    if (stats.size === 0) {
+        console.error(`[nexart] Error: File is empty (0 bytes): ${absolutePath}`);
+        process.exit(1);
+    }
+    return absolutePath;
 }
 /**
  * Call remote renderer endpoint with optional API key auth
@@ -186,6 +223,7 @@ function createPlaceholderPng() {
 async function runCommand(file, options) {
     console.log(`[nexart] Running: ${file}`);
     console.log(`[nexart] Renderer: ${options.renderer}`);
+    console.log(`[nexart] Output: ${options.out}`);
     if (!fs.existsSync(file)) {
         console.error(`[nexart] Error: File not found: ${file}`);
         process.exit(1);
@@ -237,11 +275,11 @@ async function runCommand(file, options) {
     if (options.includeCode) {
         snapshot.code = code;
     }
-    const outPath = options.out;
-    const snapshotPath = outPath.replace(/\.png$/i, '.snapshot.json');
-    const pngAbsPath = writeFileWithAbsolutePath(outPath, pngBytes);
-    const snapshotAbsPath = writeFileWithAbsolutePath(snapshotPath, JSON.stringify(snapshot, null, 2));
-    console.log(`[nexart] Wrote PNG: ${pngAbsPath}`);
+    const pngPath = resolveOutputPath(options.out);
+    const snapshotPath = deriveSnapshotPath(pngPath);
+    const pngAbsPath = writeFileAndVerify(pngPath, pngBytes);
+    const snapshotAbsPath = writeFileAndVerify(snapshotPath, JSON.stringify(snapshot, null, 2));
+    console.log(`[nexart] Wrote PNG: ${pngAbsPath} (${pngBytes.length} bytes)`);
     console.log(`[nexart] Wrote Snapshot: ${snapshotAbsPath}`);
     console.log(`[nexart] outputHash: ${outputHash}`);
     console.log(`[nexart] codeHash: ${codeHash}`);
@@ -297,8 +335,9 @@ async function replayCommand(snapshotFile, options) {
         pngBytes = createPlaceholderPng();
     }
     const outputHash = sha256(pngBytes);
-    const pngAbsPath = writeFileWithAbsolutePath(options.out, pngBytes);
-    console.log(`[nexart] Wrote PNG: ${pngAbsPath}`);
+    const pngPath = resolveOutputPath(options.out);
+    const pngAbsPath = writeFileAndVerify(pngPath, pngBytes);
+    console.log(`[nexart] Wrote PNG: ${pngAbsPath} (${pngBytes.length} bytes)`);
     console.log(`[nexart] outputHash: ${outputHash}`);
 }
 async function verifyCommand(snapshotFile, options) {
@@ -368,6 +407,266 @@ async function verifyCommand(snapshotFile, options) {
         process.exit(1);
     }
 }
+// ─── AI Execution Certification ────────────────────────────────────────────
+/**
+ * Read all bytes from stdin (non-TTY only).
+ */
+export async function readStdinText() {
+    return new Promise((resolve, reject) => {
+        if (process.stdin.isTTY) {
+            reject(new Error('No input file provided and stdin is a terminal.\n' +
+                'Provide a file:  nexart ai create <file>\n' +
+                'Or pipe input:   cat execution.json | nexart ai create'));
+            return;
+        }
+        const chunks = [];
+        process.stdin.on('data', chunk => chunks.push(chunk));
+        process.stdin.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8')));
+        process.stdin.on('error', reject);
+    });
+}
+/**
+ * Read and parse JSON from a file path or stdin.
+ */
+export async function readInputJson(file, stdinReader = readStdinText) {
+    if (file) {
+        if (!fs.existsSync(file)) {
+            console.error(`[nexart] Error: File not found: ${file}`);
+            process.exit(1);
+        }
+        try {
+            return JSON.parse(fs.readFileSync(file, 'utf-8'));
+        }
+        catch {
+            console.error(`[nexart] Error: Invalid JSON in file: ${file}`);
+            process.exit(1);
+        }
+    }
+    let text;
+    try {
+        text = await stdinReader();
+    }
+    catch (e) {
+        console.error(`[nexart] Error: ${e.message}`);
+        process.exit(1);
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        console.error('[nexart] Error: Invalid JSON from stdin');
+        process.exit(1);
+    }
+}
+/**
+ * POST to a NexArt node API endpoint using fetch.
+ * Accepts an optional fetchFn for dependency injection in tests.
+ */
+export async function callNodeApi(endpoint, apiPath, body, apiKey, fetchFn = globalThis.fetch) {
+    const url = new URL(apiPath, endpoint).toString();
+    const headers = {
+        'Content-Type': 'application/json',
+    };
+    if (apiKey) {
+        headers['Authorization'] = `Bearer ${apiKey}`;
+    }
+    const response = await fetchFn(url, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify(body),
+    });
+    let data = null;
+    try {
+        data = await response.json();
+    }
+    catch {
+        data = null;
+    }
+    return { status: response.status, data };
+}
+/**
+ * Deterministic canonical JSON serialization matching CER v1 spec:
+ * - Object keys sorted lexicographically
+ * - Nested objects recursively sorted
+ * - Arrays maintain insertion order
+ * - undefined values omitted
+ */
+export function canonicalJson(value) {
+    if (value === null || typeof value !== 'object') {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return '[' + value.map(canonicalJson).join(',') + ']';
+    }
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    const pairs = keys
+        .filter(k => obj[k] !== undefined)
+        .map(k => JSON.stringify(k) + ':' + canonicalJson(obj[k]));
+    return '{' + pairs.join(',') + '}';
+}
+/**
+ * Recompute the certificateHash for a CER v1 bundle.
+ * Protected set: { bundleType, version, createdAt, snapshot }
+ */
+export function computeBundleHash(bundle) {
+    const { bundleType, version, createdAt, snapshot } = bundle;
+    const protectedSet = { bundleType, version, createdAt, snapshot };
+    return 'sha256:' + sha256(canonicalJson(protectedSet));
+}
+/**
+ * Check whether a CER bundle has a valid-looking attestation.
+ */
+export function hasAttestation(bundle) {
+    return (typeof bundle['attestationId'] === 'string' &&
+        bundle['attestationId'].length > 0);
+}
+/**
+ * nexart ai create — Read execution input, call POST /v1/cer/ai/create,
+ * print CER bundle JSON to stdout, optionally save to --out file.
+ */
+export async function aiCreateCommand(file, opts, fetchFn = globalThis.fetch, stdinReader = readStdinText) {
+    const input = await readInputJson(file, stdinReader);
+    if (isRemoteEndpoint(opts.endpoint) && !opts.apiKey) {
+        console.error('[nexart] Error: Missing API key for remote node endpoint.');
+        console.error('[nexart] Set NEXART_API_KEY environment variable or pass --api-key.');
+        process.exit(1);
+    }
+    let result;
+    try {
+        result = await callNodeApi(opts.endpoint, '/v1/cer/ai/create', input, opts.apiKey, fetchFn);
+    }
+    catch (e) {
+        console.error(`[nexart] Error: Failed to connect to node at ${opts.endpoint}: ${e.message}`);
+        process.exit(1);
+    }
+    if (result.status === 401) {
+        console.error('[nexart] Error: Authentication failed. Check your API key.');
+        process.exit(1);
+    }
+    if (result.status === 403) {
+        console.error('[nexart] Error: Access denied.');
+        process.exit(1);
+    }
+    if (result.status >= 400) {
+        const errMsg = (result.data && typeof result.data === 'object' && 'error' in result.data)
+            ? result.data.error
+            : `Server error: ${result.status}`;
+        console.error(`[nexart] Error: ${errMsg}`);
+        process.exit(1);
+    }
+    const bundleJson = JSON.stringify(result.data, null, 2);
+    process.stdout.write(bundleJson + '\n');
+    if (opts.out) {
+        const outPath = writeFileAndVerify(opts.out, bundleJson);
+        console.error(`[nexart] Saved to: ${outPath}`);
+    }
+}
+/**
+ * nexart ai certify — Read execution input, call POST /v1/cer/ai/certify,
+ * print certificateHash / verificationUrl / attestationId summary.
+ * --json prints full JSON response instead.
+ */
+export async function aiCertifyCommand(file, opts, fetchFn = globalThis.fetch, stdinReader = readStdinText) {
+    const input = await readInputJson(file, stdinReader);
+    if (isRemoteEndpoint(opts.endpoint) && !opts.apiKey) {
+        console.error('[nexart] Error: Missing API key for remote node endpoint.');
+        console.error('[nexart] Set NEXART_API_KEY environment variable or pass --api-key.');
+        process.exit(1);
+    }
+    let result;
+    try {
+        result = await callNodeApi(opts.endpoint, '/v1/cer/ai/certify', input, opts.apiKey, fetchFn);
+    }
+    catch (e) {
+        console.error(`[nexart] Error: Failed to connect to node at ${opts.endpoint}: ${e.message}`);
+        process.exit(1);
+    }
+    if (result.status === 401) {
+        console.error('[nexart] Error: Authentication failed. Check your API key.');
+        process.exit(1);
+    }
+    if (result.status === 403) {
+        console.error('[nexart] Error: Access denied.');
+        process.exit(1);
+    }
+    if (result.status >= 400) {
+        const errMsg = (result.data && typeof result.data === 'object' && 'error' in result.data)
+            ? result.data.error
+            : `Server error: ${result.status}`;
+        console.error(`[nexart] Error: ${errMsg}`);
+        process.exit(1);
+    }
+    const responseData = result.data;
+    const fullJson = JSON.stringify(responseData, null, 2);
+    if (opts.json) {
+        process.stdout.write(fullJson + '\n');
+    }
+    else {
+        const certHash = typeof responseData.certificateHash === 'string'
+            ? responseData.certificateHash : '(not provided)';
+        const verifyUrl = typeof responseData.verificationUrl === 'string'
+            ? responseData.verificationUrl : '(not provided)';
+        const attestId = typeof responseData.attestationId === 'string'
+            ? responseData.attestationId : '(not provided)';
+        console.log('CER certified');
+        console.log(`certificateHash: ${certHash}`);
+        console.log(`verificationUrl: ${verifyUrl}`);
+        console.log(`attestationId:   ${attestId}`);
+    }
+    if (opts.out) {
+        const outPath = writeFileAndVerify(opts.out, fullJson);
+        console.error(`[nexart] Saved to: ${outPath}`);
+    }
+}
+/**
+ * nexart ai verify — Read a CER bundle JSON from file or stdin,
+ * verify integrity locally, report PASS/FAIL.
+ * --json prints machine-readable output.
+ */
+export async function aiVerifyCommand(file, opts, stdinReader = readStdinText) {
+    const raw = await readInputJson(file, stdinReader);
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
+        console.error('[nexart] Error: Input is not a valid CER bundle object');
+        process.exit(1);
+    }
+    const bundle = raw;
+    if (bundle['bundleType'] !== 'cer.ai.execution.v1') {
+        console.error(`[nexart] Error: Unsupported bundleType: ${bundle['bundleType']}`);
+        console.error('[nexart] Expected: cer.ai.execution.v1');
+        process.exit(1);
+    }
+    const computedHash = computeBundleHash(bundle);
+    const storedHash = bundle['certificateHash'];
+    const integrityPass = computedHash === storedHash;
+    const attestationPresent = hasAttestation(bundle);
+    const overallPass = integrityPass;
+    const result = overallPass ? 'PASS' : 'FAIL';
+    if (opts.json) {
+        const output = {
+            result,
+            bundleIntegrity: integrityPass ? 'PASS' : 'FAIL',
+            nodeAttestation: attestationPresent ? 'PRESENT' : 'ABSENT',
+            ...(integrityPass ? {} : {
+                expected: storedHash,
+                computed: computedHash,
+            }),
+        };
+        process.stdout.write(JSON.stringify(output, null, 2) + '\n');
+    }
+    else {
+        console.log(`Verification result: ${result}`);
+        console.log(`bundleIntegrity: ${integrityPass ? 'PASS' : 'FAIL'}`);
+        console.log(`nodeAttestation: ${attestationPresent ? 'PRESENT' : 'ABSENT'}`);
+        if (!integrityPass) {
+            console.error(`[nexart] Expected hash: ${storedHash}`);
+            console.error(`[nexart] Computed hash: ${computedHash}`);
+        }
+    }
+    process.exit(overallPass ? 0 : 1);
+}
+// ─── CLI Setup ─────────────────────────────────────────────────────────────
+const _isMainModule = process.argv[1] === fileURLToPath(import.meta.url);
 const apiKeyOption = {
     'api-key': {
         describe: 'API key for authenticated remote rendering',
@@ -375,169 +674,260 @@ const apiKeyOption = {
         default: DEFAULT_API_KEY,
     },
 };
-yargs(hideBin(process.argv))
-    .command('run <file>', 'Execute a Code Mode sketch and create snapshot', (yargs) => {
-    return yargs
-        .positional('file', {
-        describe: 'Path to the sketch file',
-        type: 'string',
-        demandOption: true,
-    })
-        .option('out', {
-        alias: 'o',
-        describe: 'Output PNG path',
-        type: 'string',
-        default: 'out.png',
-    })
-        .option('seed', {
-        alias: 's',
-        describe: 'PRNG seed',
-        type: 'number',
-        default: Math.floor(Math.random() * 2147483647),
-    })
-        .option('vars', {
-        alias: 'v',
-        describe: 'Comma-separated VAR values (10 values, 0-100)',
-        type: 'string',
-        default: '0,0,0,0,0,0,0,0,0,0',
-    })
-        .option('width', {
-        alias: 'w',
-        describe: 'Canvas width',
-        type: 'number',
-        default: 1950,
-    })
-        .option('height', {
-        describe: 'Canvas height',
-        type: 'number',
-        default: 2400,
-    })
-        .option('renderer', {
-        describe: 'Renderer mode: remote (default, real PNG) or local (NOT implemented, placeholder only)',
-        choices: ['local', 'remote'],
-        default: 'remote',
-    })
-        .option('endpoint', {
-        describe: 'Remote renderer endpoint URL',
-        type: 'string',
-        default: DEFAULT_ENDPOINT,
-    })
-        .options(apiKeyOption)
-        .option('runtime-hash', {
-        describe: 'Override runtime hash (advanced)',
-        type: 'string',
-    })
-        .option('include-code', {
-        describe: 'Embed code in snapshot for standalone replay/verify',
-        type: 'boolean',
-        default: false,
-    });
-}, async (argv) => {
-    await runCommand(argv.file, {
-        out: argv.out,
-        seed: argv.seed,
-        vars: argv.vars,
-        width: argv.width,
-        height: argv.height,
-        renderer: argv.renderer,
-        endpoint: argv.endpoint,
-        apiKey: argv['api-key'],
-        runtimeHash: argv['runtime-hash'],
-        includeCode: argv['include-code'],
-    });
-})
-    .command('replay <snapshot>', 'Re-execute from a snapshot file', (yargs) => {
-    return yargs
-        .positional('snapshot', {
-        describe: 'Path to snapshot JSON file',
-        type: 'string',
-        demandOption: true,
-    })
-        .option('out', {
-        alias: 'o',
-        describe: 'Output PNG path',
-        type: 'string',
-        default: 'replay.png',
-    })
-        .option('code', {
-        alias: 'c',
-        describe: 'Path to code file (if not embedded in snapshot)',
-        type: 'string',
-    })
-        .option('renderer', {
-        describe: 'Renderer mode',
-        choices: ['local', 'remote'],
-        default: 'remote',
-    })
-        .option('endpoint', {
-        describe: 'Remote renderer endpoint URL',
-        type: 'string',
-        default: DEFAULT_ENDPOINT,
-    })
-        .options(apiKeyOption);
-}, async (argv) => {
-    await replayCommand(argv.snapshot, {
-        out: argv.out,
-        code: argv.code,
-        renderer: argv.renderer,
-        endpoint: argv.endpoint,
-        apiKey: argv['api-key'],
-    });
-})
-    .command('verify <snapshot>', 'Verify a snapshot produces the expected output', (yargs) => {
-    return yargs
-        .positional('snapshot', {
-        describe: 'Path to snapshot JSON file',
+const nodeApiKeyOption = {
+    'api-key': {
+        describe: 'API key for NexArt node (env: NEXART_API_KEY)',
         type: 'string',
-        demandOption: true,
-    })
-        .option('code', {
-        alias: 'c',
-        describe: 'Path to code file (if not embedded in snapshot)',
+        default: DEFAULT_API_KEY,
+    },
+};
+const nodeEndpointOption = {
+    endpoint: {
+        describe: 'NexArt node endpoint URL (env: NEXART_NODE_ENDPOINT)',
         type: 'string',
+        default: DEFAULT_NODE_ENDPOINT,
+    },
+};
+if (_isMainModule) {
+    yargs(hideBin(process.argv))
+        .command('run <file>', 'Execute a Code Mode sketch and create snapshot', (yargs) => {
+        return yargs
+            .positional('file', {
+            describe: 'Path to the sketch file',
+            type: 'string',
+            demandOption: true,
+        })
+            .option('out', {
+            alias: 'o',
+            describe: 'Output PNG file path (writes to current directory)',
+            type: 'string',
+            default: 'out.png',
+        })
+            .option('seed', {
+            alias: 's',
+            describe: 'PRNG seed',
+            type: 'number',
+            default: Math.floor(Math.random() * 2147483647),
+        })
+            .option('vars', {
+            alias: 'v',
+            describe: 'Comma-separated VAR values (10 values, 0-100)',
+            type: 'string',
+            default: '0,0,0,0,0,0,0,0,0,0',
+        })
+            .option('width', {
+            alias: 'w',
+            describe: 'Canvas width (use default 1950 for canonical)',
+            type: 'number',
+            default: 1950,
+        })
+            .option('height', {
+            describe: 'Canvas height (use default 2400 for canonical)',
+            type: 'number',
+            default: 2400,
+        })
+            .option('renderer', {
+            describe: 'Renderer mode: remote (default) or local (placeholder)',
+            choices: ['local', 'remote'],
+            default: 'remote',
+        })
+            .option('endpoint', {
+            describe: 'Remote renderer endpoint URL',
+            type: 'string',
+            default: DEFAULT_ENDPOINT,
+        })
+            .options(apiKeyOption)
+            .option('runtime-hash', {
+            describe: 'Override runtime hash (advanced)',
+            type: 'string',
+        })
+            .option('include-code', {
+            describe: 'Embed code in snapshot for standalone replay/verify',
+            type: 'boolean',
+            default: false,
+        })
+            .example('$0 run sketch.js --seed 123 --out ./out.png', 'Run sketch and write to ./out.png')
+            .example('$0 run sketch.js --seed 123 --include-code', 'Run and embed code in snapshot');
+    }, async (argv) => {
+        await runCommand(argv.file, {
+            out: argv.out,
+            seed: argv.seed,
+            vars: argv.vars,
+            width: argv.width,
+            height: argv.height,
+            renderer: argv.renderer,
+            endpoint: argv.endpoint,
+            apiKey: argv['api-key'],
+            runtimeHash: argv['runtime-hash'],
+            includeCode: argv['include-code'],
+        });
     })
-        .option('renderer', {
-        describe: 'Renderer mode',
-        choices: ['local', 'remote'],
-        default: 'remote',
+        .command('replay <snapshot>', 'Re-execute from a snapshot file', (yargs) => {
+        return yargs
+            .positional('snapshot', {
+            describe: 'Path to snapshot JSON file',
+            type: 'string',
+            demandOption: true,
+        })
+            .option('out', {
+            alias: 'o',
+            describe: 'Output PNG file path',
+            type: 'string',
+            default: 'replay.png',
+        })
+            .option('code', {
+            alias: 'c',
+            describe: 'Path to code file (if not embedded in snapshot)',
+            type: 'string',
+        })
+            .option('renderer', {
+            describe: 'Renderer mode',
+            choices: ['local', 'remote'],
+            default: 'remote',
+        })
+            .option('endpoint', {
+            describe: 'Remote renderer endpoint URL',
+            type: 'string',
+            default: DEFAULT_ENDPOINT,
+        })
+            .options(apiKeyOption);
+    }, async (argv) => {
+        await replayCommand(argv.snapshot, {
+            out: argv.out,
+            code: argv.code,
+            renderer: argv.renderer,
+            endpoint: argv.endpoint,
+            apiKey: argv['api-key'],
+        });
     })
-        .option('endpoint', {
-        describe: 'Remote renderer endpoint URL',
-        type: 'string',
-        default: DEFAULT_ENDPOINT,
+        .command('verify <snapshot>', 'Verify a snapshot produces the expected output', (yargs) => {
+        return yargs
+            .positional('snapshot', {
+            describe: 'Path to snapshot JSON file',
+            type: 'string',
+            demandOption: true,
+        })
+            .option('code', {
+            alias: 'c',
+            describe: 'Path to code file (if not embedded in snapshot)',
+            type: 'string',
+        })
+            .option('renderer', {
+            describe: 'Renderer mode',
+            choices: ['local', 'remote'],
+            default: 'remote',
+        })
+            .option('endpoint', {
+            describe: 'Remote renderer endpoint URL',
+            type: 'string',
+            default: DEFAULT_ENDPOINT,
+        })
+            .options(apiKeyOption);
+    }, async (argv) => {
+        await verifyCommand(argv.snapshot, {
+            code: argv.code,
+            renderer: argv.renderer,
+            endpoint: argv.endpoint,
+            apiKey: argv['api-key'],
+        });
     })
-        .options(apiKeyOption);
-}, async (argv) => {
-    await verifyCommand(argv.snapshot, {
-        code: argv.code,
-        renderer: argv.renderer,
-        endpoint: argv.endpoint,
-        apiKey: argv['api-key'],
-    });
-})
-    .demandCommand(1, 'You must provide a command')
-    .help()
-    .version(CLI_VERSION)
-    .epilog(`
+        .command('ai', 'AI execution certification commands', (yargs) => {
+        return yargs
+            .command('create [file]', 'Create a Certified Execution Record from an AI execution input', (yargs) => {
+            return yargs
+                .positional('file', {
+                describe: 'Path to execution input JSON (omit to read from stdin)',
+                type: 'string',
+            })
+                .option('out', {
+                alias: 'o',
+                describe: 'Save returned CER bundle to this file',
+                type: 'string',
+            })
+                .options(nodeEndpointOption)
+                .options(nodeApiKeyOption)
+                .example('$0 ai create execution.json', 'Create CER from file')
+                .example('cat execution.json | $0 ai create', 'Create CER from stdin')
+                .example('$0 ai create execution.json --out cer.json', 'Save CER to file');
+        }, async (argv) => {
+            await aiCreateCommand(argv.file, { out: argv.out, endpoint: argv.endpoint, apiKey: argv['api-key'] });
+        })
+            .command('certify [file]', 'Certify an AI execution and receive attestation from the node', (yargs) => {
+            return yargs
+                .positional('file', {
+                describe: 'Path to execution input JSON (omit to read from stdin)',
+                type: 'string',
+            })
+                .option('out', {
+                alias: 'o',
+                describe: 'Save full response JSON to this file',
+                type: 'string',
+            })
+                .option('json', {
+                alias: 'j',
+                describe: 'Print full JSON response instead of summary',
+                type: 'boolean',
+                default: false,
+            })
+                .options(nodeEndpointOption)
+                .options(nodeApiKeyOption)
+                .example('$0 ai certify execution.json', 'Certify and print summary')
+                .example('$0 ai certify execution.json --json', 'Print full JSON response')
+                .example('$0 ai certify execution.json --out response.json', 'Save response');
+        }, async (argv) => {
+            await aiCertifyCommand(argv.file, { out: argv.out, json: argv.json, endpoint: argv.endpoint, apiKey: argv['api-key'] });
+        })
+            .command('verify [file]', 'Verify a CER bundle locally (no network required)', (yargs) => {
+            return yargs
+                .positional('file', {
+                describe: 'Path to CER bundle JSON (omit to read from stdin)',
+                type: 'string',
+            })
+                .option('json', {
+                alias: 'j',
+                describe: 'Print machine-readable JSON result',
+                type: 'boolean',
+                default: false,
+            })
+                .example('$0 ai verify cer.json', 'Verify a CER bundle')
+                .example('cat cer.json | $0 ai verify', 'Verify from stdin')
+                .example('$0 ai verify cer.json --json', 'Machine-readable output');
+        }, async (argv) => {
+            await aiVerifyCommand(argv.file, { json: argv.json });
+        })
+            .demandCommand(1, 'You must provide a subcommand: create, certify, or verify')
+            .help();
+    }, () => { })
+        .demandCommand(1, 'You must provide a command')
+        .help()
+        .version(CLI_VERSION)
+        .epilog(`
 Environment Variables:
   NEXART_RENDERER_ENDPOINT  Remote renderer URL (default: http://localhost:5000)
-  NEXART_API_KEY            API key for authenticated rendering
+  NEXART_NODE_ENDPOINT      NexArt node API URL (default: https://node.nexart.art)
+  NEXART_API_KEY            API key for authenticated requests
+
+Output Files:
+  --out ./out.png creates:
+    ./out.png           - The rendered PNG image
+    ./out.snapshot.json - Snapshot for replay/verify
 
 Examples:
-  # Run with API key (remote)
-  export NEXART_RENDERER_ENDPOINT=https://nexart-canonical-renderer-production.up.railway.app
-  export NEXART_API_KEY=nx_live_...
-  nexart run sketch.js --seed 12345 --include-code
+  # Run with remote renderer
+  npx @nexart/cli run ./sketch.js --seed 123 --include-code --out ./out.png
 
-  # Or pass API key directly
-  nexart run sketch.js --seed 12345 --api-key nx_live_...
+  # Verify Code Mode output is deterministic
+  npx @nexart/cli verify ./out.snapshot.json
 
-  # Local mode (placeholder only, no auth needed)
-  nexart run sketch.js --renderer local
+  # AI: Create a CER bundle
+  npx @nexart/cli ai create execution.json
 
-  # Verify and replay
-  nexart verify out.snapshot.json
-  nexart replay out.snapshot.json --out replay.png
+  # AI: Certify an execution
+  npx @nexart/cli ai certify execution.json
+
+  # AI: Verify a CER bundle locally
+  npx @nexart/cli ai verify cer.json
   `)
-    .parse();
+        .parse();
+}
 //# sourceMappingURL=index.js.map