@zanii/cli 0.1.0 → 0.2.0

package/README.md

@@ -1,6 +1,6 @@
 # @zanii/cli
 
-The Zanii command line — generate identities, sign delegations, record and verify
+The Zanii command line: generate identities, sign delegations, record and verify
 proofs, and export audit bundles from the terminal, no code required.
 
 ```sh
@@ -19,19 +19,64 @@ zanii delegate --owner owner.json --to <agent-did> \
 zanii verify <hash>                              # fetch + verify a proof, offline (exit 1 if it fails)
 zanii bundle bundle.json                         # verify an exported audit bundle, offline
 zanii export <did> --out bundle.json             # download an agent's full history
+zanii audit <tag> --out evidence.json            # audit a data subject's slice; writes the evidence bundle
+zanii audit <tag> --bundle evidence.json         # offline audit of a bundle: zero network calls
 zanii stats                                      # ledger counters
 zanii agent <did>                                # an agent's trust summary
 ```
 
 Global flags: `--server <url>` (or `ZANII_SERVER`; default `https://ledger.zanii.agency`)
-and `--json` for machine-readable output on any command. `verify` / `bundle` exit
-non-zero on failure, so they drop straight into CI.
+and `--json` for machine-readable output on any command. `verify` / `bundle` / `audit`
+exit non-zero on failure, so they drop straight into CI.
+
+## Auditing a data subject (the offline third party)
+
+`zanii audit <tag>` fetches the subject's receipt slice (`GET /v1/subjects/{tag}`),
+verifies every receipt **offline** (signature, delegation, scope, via
+`@zanii/subject`), and prints the five custody verdict rows computed by
+`computeVerdicts` from `@zanii/custody-verdicts`, the exact function the subject
+page calls, never a second implementation. The four states print unmistakably
+(`✓ PROVEN` / `○ NOT COVERED` / `✘ FAILED` / `? CANNOT DETERMINE`) with each row's
+detail string verbatim; a `not covered` row never claims "never". Exit code is `1`
+when any row is `failed`, else `0`; auditors script this.
+
+With `--out <file>` the run also writes the **evidence bundle**:
+
+```json
+{
+  "v": 1,
+  "tag": "<subject tag>",
+  "server": "https://ledger.zanii.agency",
+  "fetched_at": "<ISO8601>",
+  "receipts": [{ "receipt": { "…": "as served, custody payload embedded" }, "hash": "…", "index": 0 }],
+  "sth": { "…": "signed tree head as served" }
+}
+```
+
+### The offline recipe: verify with networking disabled
+
+```sh
+# 1. on a networked machine: download the bundle (or export it from the subject page)
+zanii audit <tag> --out evidence.json
+
+# 2. disable networking (airplane mode, firewall, air-gapped machine), then:
+zanii audit <tag> --bundle evidence.json
+```
+
+Offline mode serves the bundle to the same `fetchSubjectHistory` verifier through
+an inert `fetchImpl`: the identical receipt-verification code runs in both modes,
+and any attempted network call fails the run. The output prints
+`offline: 0 network calls` as the assertion. Compare the rows with the subject
+page: they must be identical. `--out` is live-mode-only (the bundle is the input)
+and `--bundle` always requires a file. Both mistakes are usage errors, never
+silent fallbacks.
 
 Also exported as a library: `import { run } from '@zanii/cli'`.
 
 ## Changelog
 
-- **0.1.0** — initial release: `keygen`, `did`, `delegate`, `revoke`, `verify`, `bundle`, `export`, `stats`, `agent`.
+- **0.2.0**: `audit`: live + offline (zero-network) data-subject audits over evidence bundles, via `@zanii/subject` + `@zanii/custody-verdicts`.
+- **0.1.0**: initial release: `keygen`, `did`, `delegate`, `revoke`, `verify`, `bundle`, `export`, `stats`, `agent`.
 
 ## License
 

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AA4CjF,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAkF1H"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AA2IjF,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAwJ1H"}

package/dist/index.js

@@ -1,14 +1,77 @@
 /**
- * @zanii/cli — the Zanii command line. Generate identities, sign delegations,
+ * @zanii/cli: the Zanii command line. Generate identities, sign delegations,
  * record + verify proofs, and export audit bundles from the terminal, no code.
  *
  * `run()` is exported and testable; the `zanii` bin just calls it with process.argv.
  */
 import { readFileSync, writeFileSync } from 'node:fs';
 import { createCert, createRevocation, generateKeypair, verifyAuditBundle } from '@zanii/core';
+import { computeVerdicts } from '@zanii/custody-verdicts';
 import { fetchAndVerifyProof } from '@zanii/sdk';
+import { fetchSubjectHistory } from '@zanii/subject';
+import { proveAbsence } from '@zanii/train';
 const hex = (b) => Buffer.from(b).toString('hex');
 const unhex = (s) => new Uint8Array(Buffer.from(s, 'hex'));
+function asPayload(p) {
+    return p !== null && typeof p === 'object' && !Array.isArray(p)
+        ? p
+        : undefined;
+}
+function buildExtraEvidence(manifestHistory, tag, reader) {
+    const extra = {};
+    if (reader.jurisdiction)
+        extra.jurisdiction = reader.jurisdiction;
+    if (reader.declaredSubprocessors)
+        extra.declaredSubprocessors = reader.declaredSubprocessors;
+    if (reader.trustedSigners) {
+        // Reader-side trust root for coverage attestations. A partial CoverageEvidence
+        // object is honest: without a signed attestation the row stays not-covered.
+        extra.coverage = { trustedSigners: reader.trustedSigners };
+    }
+    const declarations = manifestHistory.receipts
+        .map((sr) => ({ sr, payload: asPayload(sr.receipt.payload) }))
+        .filter((x) => x.payload?.type === 'training.manifest.declaration');
+    if (declarations.length === 0)
+        return extra;
+    const latest = declarations
+        .slice()
+        .sort((a, b) => Date.parse(b.sr.receipt.ts) - Date.parse(a.sr.receipt.ts))[0];
+    if (!latest)
+        return extra;
+    const payload = latest.payload;
+    const manifest = asPayload(payload.manifest);
+    if (!manifest || manifest.v !== 1 || manifest.type !== 'training.manifest')
+        return extra;
+    const refs = Array.isArray(payload.refs)
+        ? payload.refs
+        : manifest.size === 0
+            ? []
+            : undefined;
+    if (refs === undefined)
+        return extra;
+    try {
+        const absenceProof = proveAbsence(manifest, refs, tag);
+        const anchoredAt = latest.sr.receipt.ts;
+        const training = {
+            manifest,
+            anchoredAt,
+            runAttestedAt: anchoredAt,
+            absenceProof,
+        };
+        extra.training = training;
+    }
+    catch {
+        // If training evidence cannot be built, honestly omit it.
+    }
+    return extra;
+}
+/** The four verdict states, unmistakable in a terminal. Detail strings print verbatim. */
+const STATE_MARK = {
+    proven: '✓ PROVEN',
+    'not covered': '○ NOT COVERED',
+    failed: '✘ FAILED',
+    'cannot determine': '? CANNOT DETERMINE',
+};
 function parse(args) {
     const positional = [];
     const flags = {};
@@ -28,7 +91,13 @@ function parse(args) {
     }
     return { positional, flags };
 }
-const HELP = `zanii — verifiable identity & proof-of-action for AI agents
+function parseList(flag) {
+    if (typeof flag !== 'string' || !flag)
+        return undefined;
+    const parts = flag.split(',').map((s) => s.trim()).filter(Boolean);
+    return parts.length > 0 ? parts : undefined;
+}
+const HELP = `zanii: verifiable identity & proof-of-action for AI agents
 
   zanii keygen [--out identity.json]           generate an agent identity (did:key)
   zanii did <identity.json>                    print an identity's DID
@@ -38,6 +107,9 @@ const HELP = `zanii — verifiable identity & proof-of-action for AI agents
   zanii verify <hash> [--server <url>]         fetch + verify a proof, offline
   zanii bundle <bundle.json>                   verify an audit bundle, offline
   zanii export <did> [--server <url>] [--out bundle.json]
+  zanii audit <tag> [--out bundle.json]        audit a data subject's slice; writes the evidence bundle
+                                               (8 custody verdict rows; pass --jurisdiction, --declared-subprocessors, --trusted-signers)
+  zanii audit <tag> --bundle <file>            offline audit of a bundle: zero network calls
   zanii stats [--server <url>]                 ledger counters
   zanii agent <did> [--server <url>]           an agent's trust summary
 
@@ -63,10 +135,10 @@ export async function run(argv, opts = {}) {
                 const id = { did: kp.did, privateKey: hex(kp.privateKey), publicKey: hex(kp.publicKey) };
                 if (out) {
                     writeFileSync(out, JSON.stringify(id, null, 2));
-                    ctx.log(`identity written to ${out} — keep the private key secret`);
+                    ctx.log(`identity written to ${out}. Keep the private key secret`);
                 }
                 else
-                    emit(id, `did: ${id.did}\nprivateKey: ${id.privateKey}  (secret — store securely)`);
+                    emit(id, `did: ${id.did}\nprivateKey: ${id.privateKey}  (secret, store securely)`);
                 return 0;
             }
             case 'did': {
@@ -119,6 +191,90 @@ export async function run(argv, opts = {}) {
                     ctx.log(JSON.stringify(bundle));
                 return 0;
             }
+            case 'audit': {
+                const tag = positional[0];
+                if (!tag)
+                    throw new Error('usage: zanii audit <tag> [--out bundle.json]  or  zanii audit <tag> --bundle <file>');
+                // A valueless or empty --bundle must NEVER fall through to the live, networked
+                // path. parse() is equals-blind (`--bundle=<file>` lands in flags literally
+                // named "bundle=<file>"), so scan the raw argv for the equals form, here only.
+                const eqForm = rest.find((a) => a.startsWith('--bundle='));
+                const eqFile = eqForm === undefined ? undefined : eqForm.slice('--bundle='.length);
+                if (eqForm !== undefined && !eqFile)
+                    throw new Error('usage: zanii audit <tag> --bundle <file>: --bundle requires a bundle file');
+                if (flags.bundle === true || flags.bundle === '')
+                    throw new Error('usage: zanii audit <tag> --bundle <file>: --bundle requires a bundle file');
+                const bundleFile = (typeof flags.bundle === 'string' ? flags.bundle : undefined) ?? eqFile;
+                const jurisdiction = parseList(flags.jurisdiction);
+                const declaredSubprocessors = parseList(flags['declared-subprocessors']);
+                const trustedSigners = parseList(flags['trusted-signers']);
+                let rows;
+                let note;
+                let payload;
+                if (bundleFile) {
+                    // Offline mode: the bundle is served to fetchSubjectHistory through an inert
+                    // fetchImpl, so the SAME receipt-verification code runs as in the live path.
+                    // Zero network is enforced, not trusted: the fetchImpl only answers the
+                    // sentinel bundle origin; any other URL throws, failing the run.
+                    if (out)
+                        throw new Error('--out cannot be combined with --bundle');
+                    let b;
+                    try {
+                        b = JSON.parse(readFileSync(bundleFile, 'utf8'));
+                    }
+                    catch (e) {
+                        throw new Error(`cannot read evidence bundle ${bundleFile}: ${e instanceof Error ? e.message : String(e)}`);
+                    }
+                    if (b?.v !== 1 || typeof b?.tag !== 'string' || !Array.isArray(b?.receipts))
+                        throw new Error(`${bundleFile} is not a v1 evidence bundle`);
+                    if (b.tag !== tag)
+                        throw new Error(`bundle is for tag ${b.tag}, not ${tag}`);
+                    const ORIGIN = 'offline://bundle';
+                    let networkCalls = 0;
+                    const offlineFetch = async (input) => {
+                        const url = String(input);
+                        if (!url.startsWith(`${ORIGIN}/`)) {
+                            networkCalls++;
+                            throw new Error(`offline audit attempted a network call: ${url}`);
+                        }
+                        return new Response(JSON.stringify({ receipts: b.receipts, sth: b.sth ?? undefined }), { status: 200 });
+                    };
+                    const history = await fetchSubjectHistory(tag, { server: ORIGIN, fetchImpl: offlineFetch })
+                        ?? { tag, receipts: [], verified: true, failures: [] };
+                    if (networkCalls !== 0)
+                        throw new Error(`offline audit made ${networkCalls} network call(s)`);
+                    const extra = b.extra ?? {};
+                    rows = await computeVerdicts(history, extra);
+                    note = `offline: 0 network calls, verified against ${bundleFile} alone (fetched at ${b.fetched_at} from ${b.server}); the rows must match the subject page exactly`;
+                    payload = { mode: 'offline', tag, bundle: bundleFile, networkCalls, rows, extra };
+                }
+                else {
+                    const history = await fetchSubjectHistory(tag, { server, fetchImpl: ctx.fetchImpl })
+                        ?? { tag, receipts: [], verified: true, failures: [] };
+                    const manifestHistory = await fetchSubjectHistory('zanii:training-manifests', { server, fetchImpl: ctx.fetchImpl })
+                        ?? { tag: 'zanii:training-manifests', receipts: [], verified: true, failures: [] };
+                    const extra = buildExtraEvidence(manifestHistory, tag, { jurisdiction, declaredSubprocessors, trustedSigners });
+                    if (history.receipts.length === 0)
+                        ctx.log(`no receipts on ${server} for tag ${tag}`);
+                    const bundle = {
+                        v: 1, tag, server, fetched_at: new Date().toISOString(),
+                        receipts: history.receipts.map(({ receipt, hash, index }) => ({ receipt, hash, index })),
+                        sth: history.sth ?? null,
+                        extra,
+                    };
+                    rows = await computeVerdicts(history, extra);
+                    if (out) {
+                        writeFileSync(out, JSON.stringify(bundle, null, 2));
+                        note = `evidence bundle written to ${out}. Audit it offline later with: zanii audit ${tag} --bundle ${out}`;
+                    }
+                    else
+                        note = JSON.stringify(bundle);
+                    payload = { mode: 'live', tag, rows, bundle };
+                }
+                const human = rows.map((r) => `${STATE_MARK[r.state]} · ${r.label}\n  ${r.detail}`).join('\n') + `\n${note}`;
+                emit(payload, human);
+                return rows.some((r) => r.state === 'failed') ? 1 : 0;
+            }
             case 'stats': {
                 const s = await get('/v1/stats');
                 emit(s, `${s.receipts} proofs · ${s.agents} agents · ${s.anchors} anchors`);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AASjD,MAAM,GAAG,GAAG,CAAC,CAAa,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACtE,MAAM,KAAK,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAQ/E,SAAS,KAAK,CAAC,IAAc;IAC3B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,KAAK,GAAqC,EAAE,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;gBAAC,CAAC,EAAE,CAAC;YAAC,CAAC;;gBAAM,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;QACrH,CAAC;;YAAM,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,IAAI,GAAG;;;;;;;;;;;;;kGAaqF,CAAC;AAEnG,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,OAA6D,EAAE;IACvG,MAAM,GAAG,GAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpH,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,6BAA6B,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpH,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;IACjC,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,MAAM,IAAI,GAAG,CAAC,GAAY,EAAE,KAAa,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnG,MAAM,GAAG,GAAG,KAAK,EAAE,IAAY,EAAgB,EAAE;QAC/C,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,EAAE,GAAG,eAAe,EAAE,CAAC;gBAC7B,MAAM,EAAE,GAAiB,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvG,IAAI,GAAG,EAAE,CAAC;oBAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBAAC,GAAG,CAAC,GAAG,CAAC,uBAAuB,GAAG,gCAAgC,CAAC,CAAC;gBAAC,CAAC;;oBAC7H,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,iBAAiB,EAAE,CAAC,UAAU,6BAA6B,CAAC,CAAC;gBACzF,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAiB,CAAC;gBAC5E,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;gBAChB,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAiB,CAAC;gBACpF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACpF,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;gBACnI,IAAI,GAAG,EAAE,CAAC;oBAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBAAC,GAAG,CAAC,GAAG,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;gBAAC,CAAC;;oBACnG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;gBACtC,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAiB,CAAC;gBACpF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;gBAClE,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;gBACtF,IAAI,GAAG,EAAE,CAAC;oBAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBAAC,GAAG,CAAC,GAAG,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;gBAAC,CAAC;;oBAClG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;gBACpC,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;gBAChF,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACjI,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAC,CAAC;gBAChE,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBACzC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,KAAK,CAAC,QAAQ,YAAY,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACnL,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC;gBAC7E,IAAI,GAAG,EAAE,CAAC;oBAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBAAC,GAAG,CAAC,GAAG,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;gBAAC,CAAC;;oBACvG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBACrC,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,CAAC;gBACjC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,aAAa,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC;gBAC5E,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,kBAAkB,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC;gBAC5E,IAAI,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,QAAQ,eAAe,CAAC,CAAC,OAAO,gBAAgB,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;gBAC/G,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,MAAM,CAAC;YAAC,KAAK,QAAQ,CAAC;YAAC,KAAK,IAAI,CAAC;YAAC,KAAK,SAAS;gBACnD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO,CAAC,CAAC;YACX;gBACE,GAAG,CAAC,GAAG,CAAC,oBAAoB,GAAG,QAAQ,IAAI,EAAE,CAAC,CAAC;gBAC/C,OAAO,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAgB,MAAM,aAAa,CAAC;AAC7G,OAAO,EAAE,eAAe,EAAwG,MAAM,yBAAyB,CAAC;AAChK,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAuB,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAyB,MAAM,cAAc,CAAC;AASnE,MAAM,GAAG,GAAG,CAAC,CAAa,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACtE,MAAM,KAAK,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AA2B/E,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,CAAC,CAAE,CAA6B;QAChC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CACzB,eAA+B,EAC/B,GAAW,EACX,MAAgG;IAEhG,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,IAAI,MAAM,CAAC,YAAY;QAAE,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IAClE,IAAI,MAAM,CAAC,qBAAqB;QAAE,KAAK,CAAC,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,CAAC;IAC7F,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,+EAA+E;QAC/E,4EAA4E;QAC5E,KAAK,CAAC,QAAQ,GAAG,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAsB,CAAC;IACjF,CAAC;IAED,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ;SAC1C,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,CAAE,EAAE,CAAC,OAA8B,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;SACrF,MAAM,CAAC,CAAC,CAAC,EAAqF,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,KAAK,+BAA+B,CAAC,CAAC;IAEzJ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5C,MAAM,MAAM,GAAG,YAAY;SACxB,KAAK,EAAE;SACP,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAiC,CAAC;IAC7E,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,KAAK,mBAAmB;QAAE,OAAO,KAAK,CAAC;IAEzF,MAAM,IAAI,GAAyB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QAC5D,CAAC,CAAE,OAAO,CAAC,IAAiB;QAC5B,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;YACnB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAqB;YACjC,QAAQ;YACR,UAAU;YACV,aAAa,EAAE,UAAU;YACzB,YAAY;SACb,CAAC;QACF,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,GAAiC;IAC/C,MAAM,EAAE,UAAU;IAClB,aAAa,EAAE,eAAe;IAC9B,MAAM,EAAE,UAAU;IAClB,kBAAkB,EAAE,oBAAoB;CACzC,CAAC;AAEF,SAAS,KAAK,CAAC,IAAc;IAC3B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,KAAK,GAAqC,EAAE,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;gBAAC,CAAC,EAAE,CAAC;YAAC,CAAC;;gBAAM,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;QACrH,CAAC;;YAAM,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;kGAgBqF,CAAC;AAEnG,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,OAA6D,EAAE;IACvG,MAAM,GAAG,GAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpH,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,6BAA6B,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpH,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;IACjC,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,MAAM,IAAI,GAAG,CAAC,GAAY,EAAE,KAAa,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnG,MAAM,GAAG,GAAG,KAAK,EAAE,IAAY,EAAgB,EAAE;QAC/C,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,EAAE,GAAG,eAAe,EAAE,CAAC;gBAC7B,MAAM,EAAE,GAAiB,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvG,IAAI,GAAG,EAAE,CAAC;oBAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBAAC,GAAG,CAAC,GAAG,CAAC,uBAAuB,GAAG,+BAA+B,CAAC,CAAC;gBAAC,CAAC;;oBAC5H,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,iBAAiB,EAAE,CAAC,UAAU,4BAA4B,CAAC,CAAC;gBACxF,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAiB,CAAC;gBAC5E,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;gBAChB,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAiB,CAAC;gBACpF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACpF,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;gBACnI,IAAI,GAAG,EAAE,CAAC;oBAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBAAC,GAAG,CAAC,GAAG,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;gBAAC,CAAC;;oBACnG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;gBACtC,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAiB,CAAC;gBACpF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;gBAClE,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;gBACtF,IAAI,GAAG,EAAE,CAAC;oBAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBAAC,GAAG,CAAC,GAAG,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;gBAAC,CAAC;;oBAClG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;gBACpC,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;gBAChF,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACjI,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAC,CAAC;gBAChE,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBACzC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,KAAK,CAAC,QAAQ,YAAY,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACnL,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC;gBAC7E,IAAI,GAAG,EAAE,CAAC;oBAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBAAC,GAAG,CAAC,GAAG,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;gBAAC,CAAC;;oBACvG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBACrC,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;gBAC1B,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;gBACjH,+EAA+E;gBAC/E,4EAA4E;gBAC5E,+EAA+E;gBAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC3D,MAAM,MAAM,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBACnF,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;gBAClI,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;gBAC/I,MAAM,UAAU,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC;gBAC3F,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBACnD,MAAM,qBAAqB,GAAG,SAAS,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBACzE,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBAC3D,IAAI,IAAkB,CAAC;gBACvB,IAAI,IAAY,CAAC;gBACjB,IAAI,OAAgC,CAAC;gBACrC,IAAI,UAAU,EAAE,CAAC;oBACf,6EAA6E;oBAC7E,6EAA6E;oBAC7E,wEAAwE;oBACxE,iEAAiE;oBACjE,IAAI,GAAG;wBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;oBACnE,IAAI,CAAiB,CAAC;oBACtB,IAAI,CAAC;wBACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAmB,CAAC;oBACrE,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CAAC,+BAA+B,UAAU,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBAC9G,CAAC;oBACD,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,8BAA8B,CAAC,CAAC;oBAC1I,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG;wBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,GAAG,SAAS,GAAG,EAAE,CAAC,CAAC;oBAC7E,MAAM,MAAM,GAAG,kBAAkB,CAAC;oBAClC,IAAI,YAAY,GAAG,CAAC,CAAC;oBACrB,MAAM,YAAY,GAAc,KAAK,EAAE,KAAK,EAAE,EAAE;wBAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;wBAC1B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC;4BAClC,YAAY,EAAE,CAAC;4BACf,MAAM,IAAI,KAAK,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;wBACpE,CAAC;wBACD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC1G,CAAC,CAAC;oBACF,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;2BACtF,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;oBACzD,IAAI,YAAY,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,YAAY,kBAAkB,CAAC,CAAC;oBAC9F,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC5B,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBAC7C,IAAI,GAAG,8CAA8C,UAAU,sBAAsB,CAAC,CAAC,UAAU,SAAS,CAAC,CAAC,MAAM,iDAAiD,CAAC;oBACpK,OAAO,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;gBACpF,CAAC;qBAAM,CAAC;oBACN,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;2BAC/E,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;oBACzD,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;2BAC9G,EAAE,GAAG,EAAE,0BAA0B,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;oBACrF,MAAM,KAAK,GAAG,kBAAkB,CAAC,eAAe,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,qBAAqB,EAAE,cAAc,EAAE,CAAC,CAAC;oBAChH,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;wBAAE,GAAG,CAAC,GAAG,CAAC,kBAAkB,MAAM,YAAY,GAAG,EAAE,CAAC,CAAC;oBACtF,MAAM,MAAM,GAAmB;wBAC7B,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACvD,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;wBACxF,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI;wBACxB,KAAK;qBACN,CAAC;oBACF,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBAC7C,IAAI,GAAG,EAAE,CAAC;wBAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;wBAAC,IAAI,GAAG,8BAA8B,GAAG,8CAA8C,GAAG,aAAa,GAAG,EAAE,CAAC;oBAAC,CAAC;;wBACzK,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;oBACnC,OAAO,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;gBAChD,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;gBAC7G,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACrB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,CAAC;gBACjC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,aAAa,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC;gBAC5E,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,kBAAkB,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC;gBAC5E,IAAI,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,QAAQ,eAAe,CAAC,CAAC,OAAO,gBAAgB,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;gBAC/G,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,MAAM,CAAC;YAAC,KAAK,QAAQ,CAAC;YAAC,KAAK,IAAI,CAAC;YAAC,KAAK,SAAS;gBACnD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO,CAAC,CAAC;YACX;gBACE,GAAG,CAAC,GAAG,CAAC,oBAAoB,GAAG,QAAQ,IAAI,EAAE,CAAC,CAAC;gBAC/C,OAAO,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zanii/cli",
-  "version": "0.1.0",
-  "description": "The Zanii command line: generate identities, sign delegations, record + verify proofs, and export audit bundles — no code required.",
+  "version": "0.2.0",
+  "description": "The Zanii command line: generate identities, sign delegations, record + verify proofs, and export audit bundles, no code required.",
   "license": "Apache-2.0",
   "homepage": "https://ledger.zanii.agency",
   "type": "module",
@@ -29,14 +29,23 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@zanii/core": "0.2.0",
-    "@zanii/sdk": "0.2.1"
+    "@zanii/core": "0.4.0",
+    "@zanii/minimization": "0.1.1",
+    "@zanii/custody-verdicts": "0.1.0",
+    "@zanii/sdk": "0.4.0",
+    "@zanii/residency": "0.2.0",
+    "@zanii/subprocessor": "0.2.0",
+    "@zanii/train": "0.2.0",
+    "@zanii/subject": "0.1.1"
   },
   "devDependencies": {
+    "@noble/curves": "^1.8.1",
+    "@noble/hashes": "^1.7.1",
     "@types/node": "^26.1.0",
+    "@zanii/data-custody": "^0.1.0",
     "typescript": "^5.8.2",
     "vitest": "^3.0.9",
-    "@zanii/testing": "0.1.0"
+    "@zanii/testing": "0.1.1"
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",

package/src/index.ts

@@ -1,12 +1,15 @@
 /**
- * @zanii/cli — the Zanii command line. Generate identities, sign delegations,
+ * @zanii/cli: the Zanii command line. Generate identities, sign delegations,
  * record + verify proofs, and export audit bundles from the terminal, no code.
  *
  * `run()` is exported and testable; the `zanii` bin just calls it with process.argv.
  */
 import { readFileSync, writeFileSync } from 'node:fs';
-import { createCert, createRevocation, generateKeypair, verifyAuditBundle } from '@zanii/core';
+import { createCert, createRevocation, generateKeypair, verifyAuditBundle, type Receipt } from '@zanii/core';
+import { computeVerdicts, type ExtraEvidence, type TrainingEvidence, type CoverageEvidence, type VerdictRow, type VerdictState } from '@zanii/custody-verdicts';
 import { fetchAndVerifyProof } from '@zanii/sdk';
+import { fetchSubjectHistory, type SubjectHistory } from '@zanii/subject';
+import { proveAbsence, type TrainingManifest } from '@zanii/train';
 
 export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
 
@@ -24,6 +27,92 @@ interface IdentityFile {
   publicKey?: string;
 }
 
+/**
+ * The custody evidence bundle: exactly what the subject page emits and what
+ * `audit --bundle` consumes. `receipts`/`sth` are the `GET /v1/subjects/{tag}`
+ * body as served (receipts carry their custody payloads embedded); the rest is
+ * provenance. Never strip or recompute fields: the offline audit re-verifies
+ * the bundle through the same code path as the live fetch.
+ */
+interface EvidenceBundle {
+  v: 1;
+  tag: string;
+  server: string;
+  fetched_at: string; // ISO8601
+  receipts: Array<{ receipt: Receipt; hash: string; index: number }>;
+  sth?: Record<string, unknown> | null;
+  extra?: ExtraEvidence;
+}
+
+type ReceiptWithPayload = Receipt & { payload?: unknown };
+
+function asPayload(p: unknown): Record<string, unknown> | undefined {
+  return p !== null && typeof p === 'object' && !Array.isArray(p)
+    ? (p as Record<string, unknown>)
+    : undefined;
+}
+
+function buildExtraEvidence(
+  manifestHistory: SubjectHistory,
+  tag: string,
+  reader: { jurisdiction?: string[]; declaredSubprocessors?: string[]; trustedSigners?: string[] },
+): ExtraEvidence {
+  const extra: ExtraEvidence = {};
+  if (reader.jurisdiction) extra.jurisdiction = reader.jurisdiction;
+  if (reader.declaredSubprocessors) extra.declaredSubprocessors = reader.declaredSubprocessors;
+  if (reader.trustedSigners) {
+    // Reader-side trust root for coverage attestations. A partial CoverageEvidence
+    // object is honest: without a signed attestation the row stays not-covered.
+    extra.coverage = { trustedSigners: reader.trustedSigners } as CoverageEvidence;
+  }
+
+  const declarations = manifestHistory.receipts
+    .map((sr) => ({ sr, payload: asPayload((sr.receipt as ReceiptWithPayload).payload) }))
+    .filter((x): x is { sr: typeof manifestHistory.receipts[0]; payload: Record<string, unknown> } => x.payload?.type === 'training.manifest.declaration');
+
+  if (declarations.length === 0) return extra;
+
+  const latest = declarations
+    .slice()
+    .sort((a, b) => Date.parse(b.sr.receipt.ts) - Date.parse(a.sr.receipt.ts))[0];
+  if (!latest) return extra;
+
+  const payload = latest.payload;
+  const manifest = asPayload(payload.manifest) as TrainingManifest | undefined;
+  if (!manifest || manifest.v !== 1 || manifest.type !== 'training.manifest') return extra;
+
+  const refs: string[] | undefined = Array.isArray(payload.refs)
+    ? (payload.refs as string[])
+    : manifest.size === 0
+      ? []
+      : undefined;
+  if (refs === undefined) return extra;
+
+  try {
+    const absenceProof = proveAbsence(manifest, refs, tag);
+    const anchoredAt = latest.sr.receipt.ts;
+    const training: TrainingEvidence = {
+      manifest,
+      anchoredAt,
+      runAttestedAt: anchoredAt,
+      absenceProof,
+    };
+    extra.training = training;
+  } catch {
+    // If training evidence cannot be built, honestly omit it.
+  }
+
+  return extra;
+}
+
+/** The four verdict states, unmistakable in a terminal. Detail strings print verbatim. */
+const STATE_MARK: Record<VerdictState, string> = {
+  proven: '✓ PROVEN',
+  'not covered': '○ NOT COVERED',
+  failed: '✘ FAILED',
+  'cannot determine': '? CANNOT DETERMINE',
+};
+
 function parse(args: string[]): { positional: string[]; flags: Record<string, string | boolean> } {
   const positional: string[] = [];
   const flags: Record<string, string | boolean> = {};
@@ -37,7 +126,13 @@ function parse(args: string[]): { positional: string[]; flags: Record<string, st
   return { positional, flags };
 }
 
-const HELP = `zanii — verifiable identity & proof-of-action for AI agents
+function parseList(flag: unknown): string[] | undefined {
+  if (typeof flag !== 'string' || !flag) return undefined;
+  const parts = flag.split(',').map((s) => s.trim()).filter(Boolean);
+  return parts.length > 0 ? parts : undefined;
+}
+
+const HELP = `zanii: verifiable identity & proof-of-action for AI agents
 
   zanii keygen [--out identity.json]           generate an agent identity (did:key)
   zanii did <identity.json>                    print an identity's DID
@@ -47,6 +142,9 @@ const HELP = `zanii — verifiable identity & proof-of-action for AI agents
   zanii verify <hash> [--server <url>]         fetch + verify a proof, offline
   zanii bundle <bundle.json>                   verify an audit bundle, offline
   zanii export <did> [--server <url>] [--out bundle.json]
+  zanii audit <tag> [--out bundle.json]        audit a data subject's slice; writes the evidence bundle
+                                               (8 custody verdict rows; pass --jurisdiction, --declared-subprocessors, --trusted-signers)
+  zanii audit <tag> --bundle <file>            offline audit of a bundle: zero network calls
   zanii stats [--server <url>]                 ledger counters
   zanii agent <did> [--server <url>]           an agent's trust summary
 
@@ -71,8 +169,8 @@ export async function run(argv: string[], opts: { log?: (s: string) => void; fet
       case 'keygen': {
         const kp = generateKeypair();
         const id: IdentityFile = { did: kp.did, privateKey: hex(kp.privateKey), publicKey: hex(kp.publicKey) };
-        if (out) { writeFileSync(out, JSON.stringify(id, null, 2)); ctx.log(`identity written to ${out} — keep the private key secret`); }
-        else emit(id, `did: ${id.did}\nprivateKey: ${id.privateKey}  (secret — store securely)`);
+        if (out) { writeFileSync(out, JSON.stringify(id, null, 2)); ctx.log(`identity written to ${out}. Keep the private key secret`); }
+        else emit(id, `did: ${id.did}\nprivateKey: ${id.privateKey}  (secret, store securely)`);
         return 0;
       }
       case 'did': {
@@ -113,6 +211,76 @@ export async function run(argv: string[], opts: { log?: (s: string) => void; fet
         else ctx.log(JSON.stringify(bundle));
         return 0;
       }
+      case 'audit': {
+        const tag = positional[0];
+        if (!tag) throw new Error('usage: zanii audit <tag> [--out bundle.json]  or  zanii audit <tag> --bundle <file>');
+        // A valueless or empty --bundle must NEVER fall through to the live, networked
+        // path. parse() is equals-blind (`--bundle=<file>` lands in flags literally
+        // named "bundle=<file>"), so scan the raw argv for the equals form, here only.
+        const eqForm = rest.find((a) => a.startsWith('--bundle='));
+        const eqFile = eqForm === undefined ? undefined : eqForm.slice('--bundle='.length);
+        if (eqForm !== undefined && !eqFile) throw new Error('usage: zanii audit <tag> --bundle <file>: --bundle requires a bundle file');
+        if (flags.bundle === true || flags.bundle === '') throw new Error('usage: zanii audit <tag> --bundle <file>: --bundle requires a bundle file');
+        const bundleFile = (typeof flags.bundle === 'string' ? flags.bundle : undefined) ?? eqFile;
+        const jurisdiction = parseList(flags.jurisdiction);
+        const declaredSubprocessors = parseList(flags['declared-subprocessors']);
+        const trustedSigners = parseList(flags['trusted-signers']);
+        let rows: VerdictRow[];
+        let note: string;
+        let payload: Record<string, unknown>;
+        if (bundleFile) {
+          // Offline mode: the bundle is served to fetchSubjectHistory through an inert
+          // fetchImpl, so the SAME receipt-verification code runs as in the live path.
+          // Zero network is enforced, not trusted: the fetchImpl only answers the
+          // sentinel bundle origin; any other URL throws, failing the run.
+          if (out) throw new Error('--out cannot be combined with --bundle');
+          let b: EvidenceBundle;
+          try {
+            b = JSON.parse(readFileSync(bundleFile, 'utf8')) as EvidenceBundle;
+          } catch (e) {
+            throw new Error(`cannot read evidence bundle ${bundleFile}: ${e instanceof Error ? e.message : String(e)}`);
+          }
+          if (b?.v !== 1 || typeof b?.tag !== 'string' || !Array.isArray(b?.receipts)) throw new Error(`${bundleFile} is not a v1 evidence bundle`);
+          if (b.tag !== tag) throw new Error(`bundle is for tag ${b.tag}, not ${tag}`);
+          const ORIGIN = 'offline://bundle';
+          let networkCalls = 0;
+          const offlineFetch: FetchLike = async (input) => {
+            const url = String(input);
+            if (!url.startsWith(`${ORIGIN}/`)) {
+              networkCalls++;
+              throw new Error(`offline audit attempted a network call: ${url}`);
+            }
+            return new Response(JSON.stringify({ receipts: b.receipts, sth: b.sth ?? undefined }), { status: 200 });
+          };
+          const history = await fetchSubjectHistory(tag, { server: ORIGIN, fetchImpl: offlineFetch })
+            ?? { tag, receipts: [], verified: true, failures: [] };
+          if (networkCalls !== 0) throw new Error(`offline audit made ${networkCalls} network call(s)`);
+          const extra = b.extra ?? {};
+          rows = await computeVerdicts(history, extra);
+          note = `offline: 0 network calls, verified against ${bundleFile} alone (fetched at ${b.fetched_at} from ${b.server}); the rows must match the subject page exactly`;
+          payload = { mode: 'offline', tag, bundle: bundleFile, networkCalls, rows, extra };
+        } else {
+          const history = await fetchSubjectHistory(tag, { server, fetchImpl: ctx.fetchImpl })
+            ?? { tag, receipts: [], verified: true, failures: [] };
+          const manifestHistory = await fetchSubjectHistory('zanii:training-manifests', { server, fetchImpl: ctx.fetchImpl })
+            ?? { tag: 'zanii:training-manifests', receipts: [], verified: true, failures: [] };
+          const extra = buildExtraEvidence(manifestHistory, tag, { jurisdiction, declaredSubprocessors, trustedSigners });
+          if (history.receipts.length === 0) ctx.log(`no receipts on ${server} for tag ${tag}`);
+          const bundle: EvidenceBundle = {
+            v: 1, tag, server, fetched_at: new Date().toISOString(),
+            receipts: history.receipts.map(({ receipt, hash, index }) => ({ receipt, hash, index })),
+            sth: history.sth ?? null,
+            extra,
+          };
+          rows = await computeVerdicts(history, extra);
+          if (out) { writeFileSync(out, JSON.stringify(bundle, null, 2)); note = `evidence bundle written to ${out}. Audit it offline later with: zanii audit ${tag} --bundle ${out}`; }
+          else note = JSON.stringify(bundle);
+          payload = { mode: 'live', tag, rows, bundle };
+        }
+        const human = rows.map((r) => `${STATE_MARK[r.state]} · ${r.label}\n  ${r.detail}`).join('\n') + `\n${note}`;
+        emit(payload, human);
+        return rows.some((r) => r.state === 'failed') ? 1 : 0;
+      }
       case 'stats': {
         const s = await get('/v1/stats');
         emit(s, `${s.receipts} proofs · ${s.agents} agents · ${s.anchors} anchors`);