attenu-guard 0.11.0 → 0.13.0

package/dist/esm/cli.js

@@ -2,7 +2,7 @@
  * attenu-guard — command-line tool.
  *
  *   attenu-guard verify <log.jsonl | bundle.json> [--hs256-key HEX | --pubkey HEX] [--kid KID]
- *                                                 [--witness-keys FILE]
+ *                                                 [--witness-keys FILE] [--entries]
  *
  * A `.jsonl` audit log is checked for hash-chain integrity. A bundle (the
  * output of `exportBundle`, or of the Python library's `export_bundle`) is
@@ -10,53 +10,252 @@
  * bundle alone; the signed anchor is verified when a key is given and reported
  * as "not checked" otherwise. `--witness-keys FILE` supplies the trusted witness
  * keys for a bundle carrying observer envelopes; without it every envelope fails
- * `envelope_unknown_witness`, and the output says which flag to pass.
+ * `envelope_unknown_witness`, and the output says which flag to pass. A trust-set row may carry
+ * `not_after`; a row expired at the time of the run is not trusted. A trust file that is not one
+ * (not JSON, not an array of rows, or a row the verifier refuses) is one line naming the file and,
+ * for a bad row, the kid.
  *
- * Exit codes: 0 = ok, 2 = a check failed, 1 = usage. The output lines match the
- * Python CLI's, so either implementation can stand in for the other in a script.
+ * `--entries` prints, after everything else, `entries:` and one line per ledger entry: its seq,
+ * event, node and scope; on a bundle, its envelope state, with the observed result and the
+ * witness's kid when that state is witness-signed; and the checks that failed on that entry.
+ * Without the flag the output is unchanged.
+ *
+ * A ledger with zero events is reported EMPTY, not OK.
+ *
+ * Exit codes: 0 = ok, 2 = a check failed, there was nothing to check, or the trust file is
+ * malformed, 1 = usage (a missing argument, or a file that cannot be read).
+ * The output lines match the Python CLI's, so either implementation can stand in
+ * for the other in a script.
  */
 import { readFileSync } from "node:fs";
 import { AuditLog } from "./audit.js";
-import { parseBundle, verifyBundle } from "./evidence.js";
+import { intOr, parseJson } from "./canonical.js";
+import { BARE, escaped, integerText, oneLine } from "./display.js";
+import { PROCESS_ASSERTED, WITNESS_SIGNED, integrityBreak, parseBundle, stateKey, validateWitnessKeys, verifyBundle, } from "./evidence.js";
 import { Ed25519Verifier, HS256TestSigner } from "./wire.js";
+/** The Python CLI prints the same line for the same file. */
+const EMPTY = "EMPTY — no events to verify";
 const USAGE = `attenu-guard — command-line tool.
 
   attenu-guard verify <log.jsonl | bundle.json> [--hs256-key HEX | --pubkey HEX] [--kid KID]
-                                                [--witness-keys FILE]
+                                                [--witness-keys FILE] [--entries]
                                      verify a hash-chained audit log, or an evidence bundle
                                      (integrity · child ⊆ parent · containment;
                                       --hs256-key/--pubkey checks the anchor;
-                                      --witness-keys FILE supplies the trusted observer-envelope keys)
+                                      --witness-keys FILE supplies the trusted observer-envelope keys;
+                                      --entries adds one line per entry: its envelope state and the checks that failed on it;
+                                      a line is key=value tokens split by single spaces, the key before the first "=",
+                                      and a value never contains a space; one that starts with " is a JSON string)
 `;
+/** A `--witness-keys` file that was read and is not a trust set. The message says why. */
+class NotATrustSet extends Error {
+}
 /**
  * The trust set for a bundle's observer envelopes, read from `--witness-keys FILE`.
  *
  * The file is the `witness_keys` array the interop vectors carry — `[{kid, alg,
- * public_key_hex}]` — or one whole vector case, in which case its `witness_keys` member is used.
- * Without a trust set every envelope in a bundle fails `envelope_unknown_witness`, which is
- * correct (an unknown key is not a trusted one) and useless as a default, so this is how a bundle
- * carrying envelopes is verified from the command line.
+ * public_key_hex}]`, each row optionally with `not_after` — or one whole vector case, in which case
+ * its `witness_keys` member is used. Without a trust set every envelope in a bundle fails
+ * `envelope_unknown_witness`, which is correct (an unknown key is not a trusted one) and useless as
+ * a default, so this is how a bundle carrying envelopes is verified from the command line.
+ *
+ * Every row is validated here, by the same checks the verifier runs, so a bad row is reported
+ * against this file before any bundle is read. Throws the file system's error when the file cannot
+ * be read, and `NotATrustSet` when it is not a trust set: not JSON (JSON is UTF-8 text, so bytes
+ * that are not UTF-8 are not JSON either), not an array of rows, or a row the verifier refuses,
+ * whose message names the kid. The messages are the Python CLI's, word for word.
  */
 function readWitnessKeys(path) {
-    let parsed = JSON.parse(readFileSync(path, "utf8"));
+    const bytes = readFileSync(path);
+    let parsed;
+    try {
+        // `ignoreBOM` keeps a byte-order mark in the text, where JSON.parse refuses it as Python does.
+        parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes));
+    }
+    catch {
+        throw new NotATrustSet("the file is not valid JSON");
+    }
     if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) && "witness_keys" in parsed) {
         parsed = parsed["witness_keys"];
     }
     if (!Array.isArray(parsed)) {
-        throw new Error(`${path}: expected a list of {kid, alg, public_key_hex}, got ${typeof parsed}`);
+        throw new NotATrustSet("expected a JSON array of {kid, alg, public_key_hex} rows, or a vector case carrying one as witness_keys");
+    }
+    try {
+        validateWitnessKeys(parsed);
+    }
+    catch (err) {
+        throw new NotATrustSet(err.message);
     }
     return parsed;
 }
+/**
+ * The C library's text for the file-system errors a path argument meets — what Python prints as
+ * `strerror` — so `cannot read FILE: REASON` reads the same from both CLIs. `null` for an error
+ * that is not a file-system one. A code outside this table prints Node's own message, which is
+ * worded differently.
+ */
+function readFailure(err) {
+    const code = err?.code;
+    if (typeof code !== "string")
+        return null;
+    return STRERROR[code] ?? err.message;
+}
+const STRERROR = {
+    ENOENT: "No such file or directory",
+    EACCES: "Permission denied",
+    EISDIR: "Is a directory",
+    ENOTDIR: "Not a directory",
+    ELOOP: "Too many levels of symbolic links",
+    ENAMETOOLONG: "File name too long",
+    EPERM: "Operation not permitted",
+    EMFILE: "Too many open files",
+    EINVAL: "Invalid argument",
+    EIO: "Input/output error",
+};
 /** Render a boolean the way Python does, so the two CLIs print the same line. */
 function py(value) {
     return value ? "True" : "False";
 }
+/**
+ * Entry index -> the checks that failed on that entry: the `reason` of every failure about it,
+ * each once, in the order the verifier reported them.
+ *
+ * `failureEntries` is the verifier's own record of the entry each failure is about, by index
+ * (`VerifyReport.failure_entries`), so a failure lands on its entry even when that entry's seq is
+ * missing, null, a boolean, a string or another entry's. A failure about no single entry (a
+ * version, root, anchor or chain-id failure, or an envelope whose subject names no entry) is in
+ * the bundle-level output already and lands on no line.
+ */
+function failedByEntry(failureEntries, details) {
+    const failed = new Map();
+    failureEntries.forEach((index, k) => {
+        if (index === null)
+            return;
+        const reason = details[k].reason;
+        const reasons = failed.get(index) ?? [];
+        if (!reasons.includes(reason))
+            reasons.push(reason);
+        failed.set(index, reasons);
+    });
+    return failed;
+}
+/**
+ * One value on an `--entries` line, byte for byte what the Python CLI prints.
+ *
+ * The values come from the bundle, which is attacker-supplied, and a line is only worth reading if
+ * no value can end it early or start a forged one: a `scope` carrying a newline and a clean-looking
+ * second line would otherwise print a fake entry with the real entry's `failed=` attached to it. So
+ * a value is printed as it is only when it is printable ASCII with no space, `"` or `\`, and an
+ * integer in decimal. Anything else is printed in the `escaped` JSON form (display.ts), which holds
+ * no whitespace and which a JSON parser reads back.
+ */
+function entryValue(value) {
+    if (typeof value === "string" && BARE.test(value))
+        return value;
+    return integerText(value) ?? escaped(value);
+}
+/**
+ * One `--entries` line: two spaces, then `key=value` tokens separated by single spaces, in a fixed
+ * order. `seq` is always printed, as the integer when it is integral (`1.0` prints 1, as the
+ * verifier reads it), and as `seq=null` for an entry that has none: an entry without a seq is
+ * exactly the entry a reader must see. Any other key with no value is left out.
+ *
+ * How a line parses: no token contains whitespace; the key is the text before the token's first
+ * `=`, and keys never contain one, though a value may (`scope=failed=containment` is the scope
+ * "failed=containment"); a value that starts with `"` is a JSON string, and any other value is
+ * printed as it is.
+ */
+function entryLine(e, rest) {
+    const tokens = [`seq=${entryValue((intOr(e["seq"]) ?? null))}`];
+    const pairs = [
+        ["event", e["event"]],
+        ["node", e["node"]],
+        ["scope", e["scope"]],
+        ...rest,
+    ];
+    for (const [key, value] of pairs) {
+        if (value !== null && value !== undefined)
+            tokens.push(`${key}=${entryValue(value)}`);
+    }
+    return `  ${tokens.join(" ")}`;
+}
+/**
+ * A bundle's entries with the state the verifier computed for each, read by index: an entry is
+ * witness-signed exactly when `envelopes.witnesses` holds its index, which is the entry the
+ * verifier resolved an envelope to, so of two entries sharing a seq only the one the witness signed
+ * reads witness-signed. `observed` and `witness` are printed only on such an entry: they are what
+ * its envelope says, and an entry that is process-asserted carries no observation the reader may
+ * rely on.
+ */
+function bundleEntryLines(entries, rep) {
+    const failed = failedByEntry(rep.failure_entries, rep.failure_details);
+    const { results, witnesses } = rep.envelopes;
+    return entries.map((e, i) => {
+        const kid = Object.hasOwn(witnesses, String(i)) ? witnesses[String(i)] : null;
+        // `results` is keyed the way `states` is (`stateKey`), and for a covered entry the result filed
+        // there is its own envelope's.
+        const key = stateKey(e, i);
+        return entryLine(e, [
+            ["state", kid === null ? PROCESS_ASSERTED : WITNESS_SIGNED],
+            ["observed", kid !== null && Object.hasOwn(results, key) ? results[key] : null],
+            ["witness", kid],
+            ["failed", failed.get(i)?.join(",") ?? null],
+        ]);
+    });
+}
+/** A plain ledger's entries. A plain ledger carries no envelopes, so there is no state to print. */
+function ledgerEntryLines(entries, failureEntries, details) {
+    const failed = failedByEntry(failureEntries, details);
+    return entries.map((e, i) => entryLine(e, [["failed", failed.get(i)?.join(",") ?? null]]));
+}
+/** One JSON object with an `entries` member: what `exportBundle` writes. */
+function isBundleShaped(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value) && "entries" in value;
+}
+/**
+ * Why a file that is neither a bundle nor a ledger could not be read, in one line.
+ *
+ * A file that is ONE JSON object with `entries`, read by JavaScript's lenient parser, is a bundle
+ * the strict one refused — a duplicate member, a number past the double range, a lone surrogate —
+ * and that refusal is the reason. Anything else was read as JSON Lines, and the reason is the first
+ * line that does not parse. A parser's message can quote the input, so it goes through `oneLine`.
+ */
+function unparsable(text, bundleError, ledgerError) {
+    if (bundleError !== null) {
+        let lenient = null;
+        try {
+            lenient = JSON.parse(text);
+        }
+        catch {
+            lenient = null;
+        }
+        if (isBundleShaped(lenient))
+            return oneLine(bundleError.message);
+    }
+    const lines = text.split(/\r?\n/);
+    for (let n = 0; n < lines.length; n++) {
+        if (lines[n].trim() === "")
+            continue;
+        try {
+            parseJson(lines[n]);
+        }
+        catch (err) {
+            return `line ${n + 1}: ${oneLine(err.message)}`;
+        }
+    }
+    return oneLine(ledgerError.message);
+}
+function writeEntries(lines) {
+    process.stdout.write(`entries:\n${lines.map((line) => `${line}\n`).join("")}`);
+}
 function verify(args) {
     let path = null;
     let keyHex = null;
     let pubHex = null;
     let kid = null;
     let witnessPath = null;
+    let listEntries = false;
     for (let i = 0; i < args.length; i++) {
         const a = args[i];
         if (a === "--hs256-key")
@@ -67,6 +266,8 @@ function verify(args) {
             kid = args[++i] ?? null;
         else if (a === "--witness-keys")
             witnessPath = args[++i] ?? null;
+        else if (a === "--entries")
+            listEntries = true;
         else if (path === null)
             path = a;
     }
@@ -74,18 +275,28 @@ function verify(args) {
         process.stdout.write(USAGE);
         return 1;
     }
-    const text = readFileSync(path, "utf8");
+    let text;
+    try {
+        text = readFileSync(path, "utf8");
+    }
+    catch (err) {
+        // A wrong path is a usage error, not a stack trace.
+        const reason = readFailure(err);
+        if (reason === null)
+            throw err;
+        process.stdout.write(`cannot read ${path}: ${reason}\n`);
+        return 1;
+    }
     let bundle = null;
+    let bundleError = null;
     try {
         // A bundle is ONE JSON object; a ledger is JSON Lines.
         const parsed = parseBundle(text);
-        bundle =
-            parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) && "entries" in parsed
-                ? parsed
-                : null;
+        bundle = isBundleShaped(parsed) ? parsed : null;
     }
-    catch {
+    catch (err) {
         bundle = null;
+        bundleError = err;
     }
     if (bundle !== null) {
         const anchorKid = bundle.anchor?.["kid"] ?? undefined;
@@ -95,12 +306,34 @@ function verify(args) {
         else if (pubHex) {
             signer = new Ed25519Verifier(Buffer.from(pubHex, "hex"), kid ?? anchorKid ?? "k1");
         }
-        const witnessKeys = witnessPath === null ? null : readWitnessKeys(witnessPath);
+        let witnessKeys = null;
+        if (witnessPath) {
+            try {
+                witnessKeys = readWitnessKeys(witnessPath);
+            }
+            catch (err) {
+                // Read, and not a trust set: one line, naming the file and, for a bad row, the kid.
+                if (err instanceof NotATrustSet) {
+                    process.stdout.write(`cannot use --witness-keys ${witnessPath}: ${err.message}\n`);
+                    return 2;
+                }
+                // Unreadable, as for the bundle path above.
+                const reason = readFailure(err);
+                if (reason === null)
+                    throw err;
+                process.stdout.write(`cannot read ${witnessPath}: ${reason}\n`);
+                return 1;
+            }
+        }
         const rep = verifyBundle(bundle, signer, { witnessKeys });
         const c = rep.checks;
+        // An allow marked `policy: "unlisted"` passed through un-gated and is excused from containment,
+        // so `actions_checked` does not count it. Say how many there were, only when there were any:
+        // every other bundle prints this line exactly as it always has.
+        const ungated = rep.ungated > 0 ? ` ungated=${rep.ungated}` : "";
         process.stdout.write(`integrity=${py(c.integrity)} monotonicity=${py(c.monotonicity)} ` +
             `containment=${py(c.containment)} anchor=${c.anchor} ` +
-            `nodes=${rep.nodes} actions_checked=${rep.actions_checked}\n`);
+            `nodes=${rep.nodes} actions_checked=${rep.actions_checked}${ungated}\n`);
         for (const f of rep.failures)
             process.stdout.write(`  - ${f}\n`);
         // A bundle carrying envelopes and no trust set fails every one of them, correctly and
@@ -110,11 +343,41 @@ function verify(args) {
             process.stdout.write("hint: pass --witness-keys FILE to supply the trusted witness keys\n");
         }
         process.stdout.write(rep.ok ? "OK\n" : "FAILED\n");
+        if (listEntries)
+            writeEntries(bundleEntryLines(bundle.entries ?? [], rep));
         return rep.ok ? 0 : 2;
     }
-    const entries = AuditLog.parseLines(text);
+    let entries;
+    try {
+        entries = AuditLog.parseLines(text);
+    }
+    catch (err) {
+        // Neither a bundle nor a ledger this build reads: one line, not a stack trace. Exit 1, as the
+        // Python CLI exits on a file it cannot parse.
+        process.stdout.write(`cannot parse ${path}: ${unparsable(text, bundleError, err)}\n`);
+        return 1;
+    }
+    if (entries.length === 0) {
+        // A ledger with no entries has nothing to verify. Reporting it OK would be a fail-open: a
+        // truncated or never-written file would pass the same check as a clean chain.
+        process.stdout.write(`${EMPTY}\n`);
+        if (listEntries)
+            writeEntries([]);
+        return 2;
+    }
     const [ok, reason] = AuditLog.verify(entries);
     process.stdout.write(ok ? "OK\n" : `TAMPERED — ${reason}\n`);
+    if (listEntries) {
+        // A plain ledger has one check, the hash chain, and its failure is about the entry a bundle's
+        // integrity failure is about: the first one the chain does not reproduce at.
+        const at = [];
+        const details = [];
+        if (!ok) {
+            at.push(integrityBreak(entries));
+            details.push({ reason: "integrity", seq: null, node: null, call_id: null, detail: `integrity: ${reason}` });
+        }
+        writeEntries(ledgerEntryLines(entries, at, details));
+    }
     return ok ? 0 : 2;
 }
 export function main(argv = process.argv.slice(2)) {

package/dist/esm/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAgC,MAAM,eAAe,CAAC;AACxF,OAAO,EAAE,eAAe,EAAE,eAAe,EAAe,MAAM,WAAW,CAAC;AAE1E,MAAM,KAAK,GAAG;;;;;;;;CAQb,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,cAAc,IAAI,MAAM,EAAE,CAAC;QACxG,MAAM,GAAI,MAAkC,CAAC,cAAc,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wDAAwD,OAAO,MAAM,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,MAA+B,CAAC;AACzC,CAAC;AAED,iFAAiF;AACjF,SAAS,EAAE,CAAC,KAAc;IACxB,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAClC,CAAC;AAED,SAAS,MAAM,CAAC,IAAc;IAC5B,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,IAAI,WAAW,GAAkB,IAAI,CAAC;IAEtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,aAAa;YAAE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;aAC/C,IAAI,CAAC,KAAK,UAAU;YAAE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;aACjD,IAAI,CAAC,KAAK,OAAO;YAAE,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;aAC3C,IAAI,CAAC,KAAK,gBAAgB;YAAE,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;aAC5D,IAAI,IAAI,KAAK,IAAI;YAAE,IAAI,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,uDAAuD;QACvD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAY,CAAC;QAC5C,MAAM;YACJ,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,SAAS,IAAI,MAAM;gBAC5F,CAAC,CAAE,MAAiB;gBACpB,CAAC,CAAC,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,SAAS,GAAI,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAwB,IAAI,SAAS,CAAC;QAC9E,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,MAAM;YAAE,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC;aAC1F,IAAI,MAAM,EAAE,CAAC;YAChB,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,WAAW,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG;YAChE,eAAe,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG;YACtD,SAAS,GAAG,CAAC,KAAK,oBAAoB,GAAG,CAAC,eAAe,IAAI,CAChE,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjE,sFAAsF;QACtF,0FAA0F;QAC1F,8EAA8E;QAC9E,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACnD,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,MAAM,IAAI,CAAC,CAAC;IAC7D,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACvF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,QAAQ,EAAoB,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAc,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,WAAW,EACX,QAAQ,EACR,mBAAmB,EACnB,YAAY,GAKb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAe,MAAM,WAAW,CAAC;AAE1E,6DAA6D;AAC7D,MAAM,KAAK,GAAG,6BAA6B,CAAC;AAE5C,MAAM,KAAK,GAAG;;;;;;;;;;;CAWb,CAAC;AAEF,0FAA0F;AAC1F,MAAM,YAAa,SAAQ,KAAK;CAAG;AAEnC;;;;;;;;;;;;;;GAcG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,+FAA+F;QAC/F,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,4BAA4B,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,cAAc,IAAI,MAAM,EAAE,CAAC;QACxG,MAAM,GAAI,MAAkC,CAAC,cAAc,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,YAAY,CACpB,yGAAyG,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,mBAAmB,CAAC,MAA+B,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,MAA+B,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAC;IACtD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAK,GAAa,CAAC,OAAO,CAAC;AAClD,CAAC;AAED,MAAM,QAAQ,GAAqC;IACjD,MAAM,EAAE,2BAA2B;IACnC,MAAM,EAAE,mBAAmB;IAC3B,MAAM,EAAE,gBAAgB;IACxB,OAAO,EAAE,iBAAiB;IAC1B,KAAK,EAAE,mCAAmC;IAC1C,YAAY,EAAE,oBAAoB;IAClC,KAAK,EAAE,yBAAyB;IAChC,MAAM,EAAE,qBAAqB;IAC7B,MAAM,EAAE,kBAAkB;IAC1B,GAAG,EAAE,oBAAoB;CAC1B,CAAC;AAEF,iFAAiF;AACjF,SAAS,EAAE,CAAC,KAAc;IACxB,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAClC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CACpB,cAA0C,EAC1C,OAAiC;IAEjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,cAAc,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,UAAU,CAAC,KAAY;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,SAAS,CAAC,CAAc,EAAE,IAAuD;IACxF,MAAM,MAAM,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAU,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,KAAK,GAA6C;QACtD,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACrB,GAAG,IAAI;KACR,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QACjC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,OAA+B,EAAE,GAAiB;IAC1E,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;IACvE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC;IAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/E,gGAAgG;QAChG,+BAA+B;QAC/B,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3B,OAAO,SAAS,CAAC,CAAC,EAAE;YAClB,CAAC,OAAO,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC;YAC3D,CAAC,UAAU,EAAE,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAChF,CAAC,SAAS,EAAE,GAAG,CAAC;YAChB,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,oGAAoG;AACpG,SAAS,gBAAgB,CACvB,OAA+B,EAC/B,cAA0C,EAC1C,OAAiC;IAEjC,MAAM,MAAM,GAAG,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACtD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,4EAA4E;AAC5E,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,SAAS,IAAI,KAAK,CAAC;AACpG,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,IAAY,EAAE,WAAoB,EAAE,WAAoB;IAC1E,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,OAAO,GAAY,IAAI,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,cAAc,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAE,WAAqB,CAAC,OAAO,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,SAAS;QACtC,IAAI,CAAC;YACH,SAAS,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,OAAO,CAAE,GAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAE,WAAqB,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,YAAY,CAAC,KAAwB;IAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,MAAM,CAAC,IAAc;IAC5B,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,aAAa;YAAE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;aAC/C,IAAI,CAAC,KAAK,UAAU;YAAE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;aACjD,IAAI,CAAC,KAAK,OAAO;YAAE,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;aAC3C,IAAI,CAAC,KAAK,gBAAgB;YAAE,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;aAC5D,IAAI,CAAC,KAAK,WAAW;YAAE,WAAW,GAAG,IAAI,CAAC;aAC1C,IAAI,IAAI,KAAK,IAAI;YAAE,IAAI,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oDAAoD;QACpD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,GAAG,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,WAAW,GAAY,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,uDAAuD;QACvD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAY,CAAC;QAC5C,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAiB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,IAAI,CAAC;QACd,WAAW,GAAG,GAAG,CAAC;IACpB,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,SAAS,GAAI,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAwB,IAAI,SAAS,CAAC;QAC9E,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,MAAM;YAAE,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC;aAC1F,IAAI,MAAM,EAAE,CAAC;YAChB,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,WAAW,GAAiC,IAAI,CAAC;QACrD,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,WAAW,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,oFAAoF;gBACpF,IAAI,GAAG,YAAY,YAAY,EAAE,CAAC;oBAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,WAAW,KAAK,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;oBACnF,OAAO,CAAC,CAAC;gBACX,CAAC;gBACD,4CAA4C;gBAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;gBAChC,IAAI,MAAM,KAAK,IAAI;oBAAE,MAAM,GAAG,CAAC;gBAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC;gBAChE,OAAO,CAAC,CAAC;YACX,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;QACrB,gGAAgG;QAChG,6FAA6F;QAC7F,gEAAgE;QAChE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG;YAChE,eAAe,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG;YACtD,SAAS,GAAG,CAAC,KAAK,oBAAoB,GAAG,CAAC,eAAe,GAAG,OAAO,IAAI,CAC1E,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjE,sFAAsF;QACtF,0FAA0F;QAC1F,8EAA8E;QAC9E,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,WAAW;YAAE,YAAY,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3E,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,OAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,8FAA8F;QAC9F,8CAA8C;QAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACtF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,0FAA0F;QAC1F,8EAA8E;QAC9E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW;YAAE,YAAY,CAAC,EAAE,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,MAAM,IAAI,CAAC,CAAC;IAC7D,IAAI,WAAW,EAAE,CAAC;QAChB,8FAA8F;QAC9F,6EAA6E;QAC7E,MAAM,EAAE,GAAsB,EAAE,CAAC;QACjC,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,YAAY,CAAC,gBAAgB,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACvF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/esm/display.d.ts

@@ -0,0 +1,76 @@
+/**
+ * display.ts — how a value from a ledger, a bundle or a trust file is printed into a line of text.
+ *
+ * A ledger, a bundle and the envelopes beside it are untrusted input, and their values reach a
+ * terminal through the verifier's finding messages, `attenu-guard verify`, and `--entries`. A value
+ * that carries a line break can end the line it is printed on and start a forged one: a node named
+ * "n1\nOK" would print a line reading `OK` under a failed verification. Two rules cover every place
+ * such a value is printed, and both are the Python implementation's, byte for byte:
+ *
+ *   - a value printed bare goes through `shown`: as its text when that text is printable ASCII
+ *     0x21-0x7E other than `"` and `\`, so clean input prints exactly as it always has, and as its
+ *     `escaped` JSON form otherwise, which holds no whitespace and no line break;
+ *   - a value printed the way Python's `repr` prints it goes through `pyRepr`, which quotes and
+ *     escapes a string exactly as `repr` does. Python's `{x!r}` needs no other rule, so neither
+ *     does this.
+ */
+import { type CJson } from "./canonical.js";
+/** The bare form: printable ASCII 0x21-0x7E without `"` (0x22) or `\` (0x5C). */
+export declare const BARE: RegExp;
+/**
+ * Python's `repr` of a `str`: single quotes unless the text holds a `'` and no `"`, the quote and
+ * the backslash escaped, `\t` `\n` `\r` by name, any other control character or DEL as `\xHH`, and
+ * a non-ASCII character as it is when Python counts it printable, as `\xHH`, `\uHHHH` or
+ * `\UHHHHHHHH` when it does not. Lower-case hex throughout, as CPython writes it.
+ */
+export declare function pyStrRepr(s: string): string;
+/**
+ * `text` with every character Python's `repr` would escape written as that escape, and nothing
+ * else changed: no quotes added, no backslash doubled. For a parser's message, which can quote a
+ * fragment of the input it refused: one line, always.
+ */
+export declare function oneLine(text: string): string;
+/**
+ * Python-style `repr` for the value types a finding message carries. A number that kept its
+ * literal prints as Python prints what `json` reads from it (`1` an int, `1.0` a float); a number
+ * that has lost its literal prints as JavaScript prints it, as this module always has.
+ */
+export declare function pyRepr(value: CJson): string;
+/**
+ * Python's `str()` where a message interpolates a value bare (`{x}`) rather than through `repr`
+ * (`{x!r}`): the same rendering for every type except a string, which `str` leaves unquoted.
+ */
+export declare function pyStr(value: CJson): string;
+/**
+ * `value` as a finding message prints it bare: its text (Python's `str`) when that text is bare,
+ * its `escaped` JSON form otherwise. Clean values print exactly as they always have. An absent
+ * value is Python's `None`.
+ */
+export declare function shown(value: CJson | undefined): string;
+/**
+ * `shown`, for a caller that already holds the text Python's `str` gives for `value` (a ceiling
+ * renders its numbers the way Python renders a float): the text when it is bare, `value`'s
+ * `escaped` form otherwise.
+ */
+export declare function shownText(text: string, value: CJson): string;
+/**
+ * `value` as whitespace-free, ASCII-only JSON: Python's
+ * `json.dumps(value, ensure_ascii=True, separators=(",", ":"))`, with every space then written as
+ * `\u0020`. Inside a string that is `\"` and `\\`, the short escapes `\n` `\t` `\r` `\b` `\f`, and
+ * a lower-case `\uXXXX` for every other UTF-16 unit outside printable ASCII. That form holds no
+ * whitespace and no line break, and a JSON parser gives the value back.
+ */
+export declare function escaped(value: CJson): string;
+/**
+ * A number Python's `json` reads as an `int`, in decimal, or `null` for anything else. A parsed
+ * bundle keeps every number's literal, so `1` and `1.0` stay as distinct as they are in Python. A
+ * number that has lost its literal is read as an integer when it is integral.
+ */
+export declare function integerText(value: CJson): string | null;
+/**
+ * Python's `repr` of a float, which `json` writes: the shortest digits that read back as the same
+ * number, in positional form from 1e-4 up to below 1e16 with `.0` on an integral value, and in
+ * exponent form, with a two-digit exponent at least, outside that range.
+ */
+export declare function pyFloat(n: number): string;
+//# sourceMappingURL=display.d.ts.map

package/dist/esm/display.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"display.d.ts","sourceRoot":"","sources":["../../src/display.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAa,KAAK,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAEvD,iFAAiF;AACjF,eAAO,MAAM,IAAI,QAAmB,CAAC;AAErC;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAM3C;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI5C;AA0BD;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAe3C;AAED;;;GAGG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAE1C;AAED;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,GAAG,MAAM,CAGtD;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,MAAM,CAE5D;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAE5C;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,IAAI,CAMvD;AAuCD;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAiBzC"}