burnledger 0.4.0 → 0.6.0

package/dist/esm/cli.js

@@ -5,15 +5,17 @@ import { readFile } from "node:fs/promises";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { nodeCrypto } from "./crypto-node.js";
-import { verifyCertificate, verifyTransparency, publicKeyFromHex } from "./verify.js";
-import { parseKeyEntries } from "./keys.js";
-const USAGE = "Usage: burnledger check --cert <file> --keys <file> [--online --api-url <url> --api-key <key>]\n";
+import { CERTIFICATE_REVOKED, VerificationError } from "./errors.js";
+import { formatTimestamp, publicKeyFromHex, verifyCertificateWithStatus, verifyTransparency, VALID_REVOCATION_UNKNOWN, } from "./verify.js";
+import { KEY_LIST_STALE, KEY_LIST_VALID, parseKeyListDocument, verifyKeyList, } from "./keys.js";
+import { ANCHOR_INCONSISTENT, checkStatementAnchor } from "./anchor.js";
+const USAGE = "Usage: burnledger check --cert <file> --keys <file> [--online --api-url <url>]\n";
 function die(msg) { process.stderr.write(msg); process.exit(2); }
 function parseArgs(argv) {
     const args = argv.slice(2);
     if (args[0] !== "check")
         die(USAGE);
-    let certPath = "", keysPath = "", online = false, apiUrl = "", apiKey = "";
+    let certPath = "", keysPath = "", online = false, apiUrl = "";
     for (let i = 1; i < args.length; i++) {
         const a = args[i];
         if (a === "--cert") {
@@ -28,8 +30,11 @@ function parseArgs(argv) {
         else if (a === "--api-url") {
             apiUrl = args[++i] ?? die("--api-url requires a value\n");
         }
+        // Accepted and ignored. The status endpoint is unauthenticated, so the key
+        // buys nothing — but it is a published flag that scripts already pass, and
+        // failing on an unknown flag would break them for no gain.
         else if (a === "--api-key") {
-            apiKey = args[++i] ?? die("--api-key requires a value\n");
+            void (args[++i] ?? die("--api-key requires a value\n"));
         }
         else
             die(`Unknown argument: ${a}\n`);
@@ -38,29 +43,46 @@ function parseArgs(argv) {
         die("Both --cert and --keys are required.\n");
     if (online) {
         try {
-            ({ apiUrl, apiKey } = resolveApiConfig(apiUrl, apiKey, process.env));
+            apiUrl = resolveApiBaseUrl(apiUrl, process.env);
         }
         catch (e) {
             die(e.message + "\n");
         }
     }
-    return { certPath, keysPath, online, apiUrl, apiKey };
+    return { certPath, keysPath, online, apiUrl };
 }
 /** Flag first, then environment — the precedence docs/cli.md promises and the
- * Go CLI (cmd/cli/online.go resolveAPIConfig) implements. Exported for testing. */
-export function resolveApiConfig(apiUrl, apiKey, env) {
+ * Go CLI (cmd/cli/online.go resolveAPIBaseURL) implements. Exported for testing.
+ *
+ * It no longer resolves a key, and that is the change. GET
+ * /v1/certificates/{id}/status is unauthenticated by design: the audience for
+ * revocation is a relying party holding a certificate — a regulator, an
+ * auditor, the customer's customer — who has no account here and never will.
+ * Demanding an API key was what stopped that reader asking the one question the
+ * artifact exists to answer. */
+export function resolveApiBaseUrl(apiUrl, env) {
     apiUrl ||= env.BURNLEDGER_API_URL ?? "";
     if (!apiUrl)
         throw new Error("--api-url or BURNLEDGER_API_URL environment variable is required for online mode");
-    apiKey ||= env.BURNLEDGER_API_KEY ?? "";
-    if (!apiKey)
-        throw new Error("--api-key or BURNLEDGER_API_KEY environment variable is required for online mode");
-    return { apiUrl, apiKey };
+    return apiUrl;
 }
+/** Load the key set and, separately, what the file establishes about the key
+ * STATUSES (ADR-017 §5a). The keys load the same way whether or not the file
+ * carries a signed statement — key_id == sha256(public_key) makes every
+ * identity self-checking — so an unsigned file is not refused. What changes is
+ * what this CLI is entitled to say about the statuses and dates. Mirrors
+ * loadKeysFromFile in cmd/cli/keys.go. */
 async function loadKeys(path) {
     let entries;
+    let keyList;
     try {
-        entries = parseKeyEntries(JSON.parse(await readFile(path, "utf-8")));
+        const doc = parseKeyListDocument(JSON.parse(await readFile(path, "utf-8")));
+        entries = doc.keys;
+        // A statement that will not verify is a verdict; one that will not PARSE
+        // is a hard error, exactly as in Go: someone signed something the reader
+        // cannot read, and continuing as though the file were merely unsigned
+        // would throw that fact away.
+        keyList = await verifyKeyList(nodeCrypto, doc, new Date());
     }
     catch (e) {
         die(e.message + "\n");
@@ -98,23 +120,151 @@ async function loadKeys(path) {
         }
         map.set(pki.keyId, pki);
     }
-    return map;
+    return { keys: map, keyList };
 }
-async function checkRevocation(apiUrl, apiKey, certId) {
-    const res = await fetch(`${apiUrl}/v1/certificates/${certId}/revocation-status`, {
-        headers: { Authorization: `Bearer ${apiKey}` },
-    });
+/** Retrieve the SIGNED status statement for a certificate.
+ *
+ * It replaces a GET of /v1/certificates/{id}/revocation-status, which returned
+ * a bare {"status": "..."} with no signature over it. That answer was the API's
+ * word — or the word of whatever --api-url happened to point at — and this CLI
+ * printed it. Nothing about it was checkable, so a network attacker, a stale
+ * proxy or a wrong URL could suppress a revocation and the reader could not
+ * tell. Every field of this response that the verdict acts on is covered by the
+ * issuer's signature.
+ *
+ * No Authorization header is sent. The endpoint takes none, and sending an API
+ * key to an arbitrary --api-url is a credential leak the check never needed. */
+async function fetchStatusStatement(apiUrl, certId) {
+    const res = await fetch(`${apiUrl.replace(/\/+$/, "")}/v1/certificates/${certId}/status`);
     if (!res.ok)
-        throw new Error(`Revocation check failed: HTTP ${res.status}`);
-    return (await res.json()).data;
+        throw new Error(`HTTP ${res.status}`);
+    return unwrapStatusStatement(await res.json());
+}
+/** The API wraps every response in {"data": ...}; a caller may hand over either
+ * the envelope or the document inside it. Mirrors
+ * core.ParseCertificateStatusDocument, so this CLI and the Go one cannot
+ * disagree about which shape the endpoint returns. Exported for testing.
+ *
+ * A document that does not parse THROWS, and the caller turns that into a
+ * warning and a VALID_REVOCATION_UNKNOWN verdict. That is deliberate: an answer
+ * this build cannot read is silence about revocation, not a finding about the
+ * certificate. Handing a half-read document to the verifier instead would
+ * report "status statement signature is invalid" — a claim about the issuer —
+ * when what actually happened is that something returned nonsense.
+ *
+ * `status` itself is NOT validated against a known set. A statement saying
+ * SUSPENDED is a statement this build cannot read, and the verifier already has
+ * the right answer for that: it authenticates the signature first, then reports
+ * VALID_REVOCATION_UNKNOWN. Refusing it here would discard the statement before
+ * anyone authenticated it. */
+export function unwrapStatusStatement(parsed) {
+    if (parsed === null || typeof parsed !== "object") {
+        throw new Error("status statement: response is not a JSON object");
+    }
+    let doc = parsed;
+    if (doc.certificate_id === undefined && doc.data !== null && typeof doc.data === "object") {
+        doc = doc.data;
+    }
+    for (const f of ["certificate_id", "status", "key_id"]) {
+        if (typeof doc[f] !== "string" || doc[f] === "")
+            throw new Error(`status statement: ${f} is missing`);
+    }
+    for (const f of ["statement_issued_at", "statement_expires_at"])
+        requireRfc3339(doc, f);
+    if (doc.revoked_at != null)
+        requireRfc3339(doc, "revoked_at");
+    if (typeof doc.sth_tree_size !== "number")
+        throw new Error("status statement: sth_tree_size is not a number");
+    // Refuse a short or long value rather than letting it through: a truncated
+    // signature or root hash that reaches the verifier is checked against bytes
+    // nobody sent.
+    requireHex(doc, "sth_root_hash", 32);
+    requireHex(doc, "signature", 64);
+    return doc;
+}
+function requireRfc3339(doc, field) {
+    const v = doc[field];
+    if (typeof v !== "string" || Number.isNaN(Date.parse(v))) {
+        throw new Error(`status statement: ${field} is not RFC 3339`);
+    }
+}
+function requireHex(doc, field, bytes) {
+    const v = doc[field];
+    if (typeof v !== "string" || !new RegExp(`^[0-9a-fA-F]{${bytes * 2}}$`).test(v)) {
+        throw new Error(`status statement: ${field} is not ${bytes} bytes of hex`);
+    }
 }
+/** The verdicts a reader can act on, and therefore the ones that exit 0.
+ *
+ * VALID_REVOCATION_UNKNOWN is here. It is the verdict every offline run now
+ * carries, and it means what an offline run has always meant: the document
+ * verified, and nothing was learned about revocation. Failing it would turn
+ * every existing `burnledger check` red overnight while telling the reader
+ * nothing new — the honest words are on the first line, where a human reads
+ * them, and the exit code keeps the meaning it was given. The soft KEY verdicts
+ * still exit 1, unchanged: those need a human before the record is relied on. */
+const USABLE_VERDICTS = new Set(["VALID", VALID_REVOCATION_UNKNOWN]);
+/** The verdict word for an authenticated statement that says REVOKED.
+ *
+ * It is derived from VerificationError.code, never from the error's prose and
+ * never from the statement's own `status` field: every other rejection on the
+ * status path — unknown key, revoked key, bad signature, a statement about a
+ * different certificate — means the statement could not be authenticated, and
+ * rendering one of those as "REVOKED" would report an unauthenticated document
+ * as a fact about this certificate. */
+const REVOKED = "REVOKED";
 /** The pass/fail decision behind the exit code. A signature failure, a
- * transparency FAILURE (thrown, not NOT_AVAILABLE), or an online-confirmed
- * revocation all make the certificate invalid. Exported for testing. */
-export function certVerdict(sigResult, transparencyFailed, online, revocation) {
-    return (sigResult === "VALID" &&
-        !transparencyFailed &&
-        !(online && revocation?.status === "REVOKED"));
+ * revocation, or a transparency FAILURE (thrown, not NOT_AVAILABLE) all make
+ * the certificate unusable. Revocation is no longer a separate input: it is
+ * part of the verdict verifyCertificateWithStatus returns. Exported for
+ * testing.
+ *
+ * An INCONSISTENT anchor refuses, mirroring exitCode in cmd/cli/check.go. It is
+ * not a doubt: it is a proof, from the issuer's own signatures, that the head a
+ * statement was anchored to is not a prefix of the head the log now publishes.
+ * An anchor that could NOT be checked does not refuse — the reader is told so,
+ * and the statement still stands on its own signature. */
+export function certVerdict(sigResult, transparencyFailed, anchor) {
+    if (anchor?.verdict === ANCHOR_INCONSISTENT)
+        return false;
+    return USABLE_VERDICTS.has(sigResult) && !transparencyFailed;
+}
+/** Verdicts that are neither a pass nor a refusal, and what each one leaves
+ * unestablished. ADR-017 §2 calls them results a reader must be SHOWN; the
+ * verdict string alone leaves them to guess which half of the check is
+ * missing. Mirrors softKeyVerdictNote in cmd/cli/format.go. */
+const SOFT_KEY_VERDICTS = {
+    VALID_KEY_WINDOW_UNKNOWN: "signatures verify; the signing key states a validity interval and this " +
+        "certificate carries no transparency proof to date it against",
+    VALID_KEY_COMPROMISED_LATER: "signatures verify and appear to predate the key's compromise; " +
+        "confirm against the witness's record",
+};
+/** What a VALID_REVOCATION_UNKNOWN verdict leaves unestablished, and there are
+ * two ways to arrive at it.
+ *
+ * Offline it is the ordinary case and always was: nothing was asked, so nothing
+ * is known. Online it means the ask failed — a status endpoint that did not
+ * answer, an answer this build could not read, or one whose window had closed.
+ * Both are silence about revocation, and silence is reported as unknown. This
+ * CLI used to report both as VALID, which reads as "checked and not revoked".
+ * Mirrors revocationUnknownOffline/Online in cmd/cli/format.go. */
+const REVOCATION_UNKNOWN_OFFLINE = "offline — nothing was asked about revocation, so nothing is known; " +
+    "re-run with --online to fetch a signed status statement";
+const REVOCATION_UNKNOWN_ONLINE = "no usable signed status statement — the issuer said nothing this " +
+    "build could read about revocation, which is not the same as saying the record is live";
+/**
+ * The certificate formats whose signing payload covers enclave_pcr0.
+ * Mirrors core.SignatureCoversEnclavePCR0 (core/payload.go).
+ *
+ * A SET, not a single version, and a predicate rather than an equality test.
+ * It was `=== "5.0"`, which silently stopped being true the moment v6 was
+ * added: v6 signs the measurement exactly as v5 does, and this CLI told the
+ * reader the field was under no signature while the Go CLI said the opposite
+ * about the same file.
+ */
+const ENCLAVE_PCR0_SIGNED_IN = Object.freeze(["5.0", "6.0"]);
+function signatureCoversEnclavePcr0(version) {
+    return ENCLAVE_PCR0_SIGNED_IN.includes(version);
 }
 /** Byte fields arrive as number arrays (Go [N]byte) or strings; show hex. */
 function displayHash(v) {
@@ -123,25 +273,54 @@ function displayHash(v) {
     }
     return String(v);
 }
-export function formatOutput(cert, sigResult, transparency, transparencyFailed, revocation, online) {
+export function formatOutput(cert, sigResult, transparency, transparencyFailed, status, online, anchor, keyList) {
     const id = cert.certificate_id.slice(0, 6);
     const sub = displayHash(cert.subject.identifier_hash);
     const att = cert.attestation;
     const L = [];
-    if (sigResult !== "VALID")
-        return `Certificate dc_${id}: INVALID (${sigResult})\n`;
-    if (transparencyFailed)
-        return `Certificate dc_${id}: INVALID (transparency: ${transparency})\n`;
-    if (online && revocation?.status === "REVOKED") {
-        L.push(`Certificate dc_${id}: INVALID (REVOKED)`);
-        if (revocation.reason)
-            L.push(`  Revocation reason: ${revocation.reason}`);
+    // A proven-inconsistent anchor outranks every verdict below it, including
+    // REVOKED. The issuer has contradicted itself about an append-only structure,
+    // so nothing it says about this record — revoked or live — can be taken at
+    // face value, and printing "REVOKED" or "VALID" here would answer a question
+    // that is no longer the important one. Mirrors formatResult in
+    // cmd/cli/format.go, which puts this branch in the same place.
+    if (anchor?.verdict === ANCHOR_INCONSISTENT) {
+        L.push(`Verification record dc_${id}: INVALID (LOG_ANCHOR_INCONSISTENT)`);
+        L.push(`  ${anchor.detail}`);
+        L.push(`  The certificate itself verified as ${sigResult}; the issuer's log is what does not add up.`);
+        pushStatementEvidence(L, status);
+        return L.join("\n") + "\n";
+    }
+    // A soft key verdict is not a forgery: every signature verified, and what
+    // could not be established is the key's authority. "INVALID" would send an
+    // auditor hunting for tampering that is not there, and "VALID" — which this
+    // CLI printed — claims a check that did not happen.
+    const note = SOFT_KEY_VERDICTS[sigResult];
+    if (note !== undefined)
+        return `Verification record dc_${id}: ${sigResult} (${note})\n`;
+    // Revocation is now a signed fact, so the reader gets the evidence with the
+    // verdict: who said it, when, and which log entry it points at.
+    if (sigResult === REVOKED) {
+        L.push(`Verification record dc_${id}: INVALID (REVOKED)`);
+        pushStatementEvidence(L, status);
+        pushAnchorEvidence(L, anchor);
         return L.join("\n") + "\n";
     }
-    const tag = online ? "" : " (offline — revocation status not checked)";
-    L.push(`Certificate dc_${id}: VALID${tag}`);
+    if (!USABLE_VERDICTS.has(sigResult))
+        return `Verification record dc_${id}: INVALID (${sigResult})\n`;
+    if (transparencyFailed)
+        return `Verification record dc_${id}: INVALID (transparency: ${transparency})\n`;
+    // The two usable verdicts. VALID is sayable without a qualifier for the first
+    // time: it is reached only when a fresh statement, signed by a key from the
+    // key file and naming this certificate, said ACTIVE. Everything short of that
+    // is VALID_REVOCATION_UNKNOWN and says so in the verdict itself, not in a
+    // footnote a script will never read.
+    const tag = sigResult === VALID_REVOCATION_UNKNOWN
+        ? `${VALID_REVOCATION_UNKNOWN} (${online ? REVOCATION_UNKNOWN_ONLINE : REVOCATION_UNKNOWN_OFFLINE})`
+        : "VALID (a signed status statement says this record is live)";
+    L.push(`Verification record dc_${id}: ${tag}`);
     L.push(`  Subject: sha256:${sub.slice(0, 6)}...`);
-    L.push(`  Canonical version: ${cert.certificate_format_version}`);
+    L.push(`  Format version: ${cert.certificate_format_version}`);
     // v3 carries ONE system list at the top level, with both counts on each
     // record. Reading att.systems here is what made this CLI die on every real
     // v3 certificate with "Cannot read properties of null" — the attestation
@@ -159,10 +338,23 @@ export function formatOutput(cert, sigResult, transparency, transparencyFailed,
     // Its own line, never appended to a verdict (ADR-020), and worded so it
     // cannot be read as a checked fact: nothing offline can verify a measurement.
     // Proof is the NSM attestation document.
+    //
+    // The attribution differs by version. From v5 the field is inside the signing
+    // payload, so it is the signer's claim about itself. On v4 — the format that
+    // is actually issued, and into which the enclave writes its real measurement —
+    // no signature covers it, so calling it the signer's claim names an author
+    // nothing established: it is whatever the last holder of the file wrote.
     const issuer = cert.issuer;
     const pcr0 = issuer?.enclave_pcr0;
     if (typeof pcr0 === "string" && pcr0 !== "") {
-        L.push(`  Enclave image (claimed by signer, not verified here): ${pcr0}`);
+        const version = cert.certificate_format_version;
+        if (signatureCoversEnclavePcr0(version)) {
+            L.push(`  Enclave image (claimed by signer, not verified here): ${pcr0}`);
+        }
+        else {
+            L.push(`  Enclave image (format ${version} puts this field under no signature — ` +
+                `unattributable, not verified here): ${pcr0}`);
+        }
     }
     if (transparency === "INCLUDED") {
         const t = cert.transparency;
@@ -171,10 +363,90 @@ export function formatOutput(cert, sigResult, transparency, transparencyFailed,
     else {
         L.push(`  Transparency log: ${transparency === "NOT_AVAILABLE" ? "not included" : transparency}`);
     }
-    if (online && revocation)
-        L.push(`  Revocation status: ${revocation.status}`);
+    pushStatementEvidence(L, status);
+    pushAnchorEvidence(L, anchor);
+    pushKeyListEvidence(L, keyList);
     return L.join("\n") + "\n";
 }
+/** Where the key statuses this verdict rests on came from, printed on every
+ * run — including the ordinary one, where the answer is "an unsigned list".
+ *
+ * ADR-017 §5a's point is not that an unsigned key list is unusable. It is that
+ * the two halves of a key set have different lifetimes: key_id is
+ * sha256(public_key), so every key's IDENTITY is self-checking offline forever,
+ * while its status and dates are only as good as the endpoint they were
+ * fetched from and the moment they were fetched. Mirrors writeKeyListEvidence
+ * in cmd/cli/format.go, word for word, so the four verifiers say one thing. */
+function pushKeyListEvidence(L, e) {
+    if (e === undefined)
+        return;
+    if (!e.present) {
+        L.push("  Key statuses: unsigned key list — identities are self-checking " +
+            "(key_id = sha256(public_key)); statuses and dates are not evidenced");
+        return;
+    }
+    if (e.result === KEY_LIST_VALID) {
+        L.push(`  Key statuses: signed key_list.v3, VALID until ${e.expiresAt}`);
+        if (e.selfSigned) {
+            // Said out loud, every time. A list that vouches for itself proves only
+            // that whoever wrote it holds the key it names, and a reader who does
+            // not know that will read "VALID" as more than it is.
+            L.push("  Key list trust: the list is signed by a key inside itself — " +
+                "trust-on-first-use, not proof; pin this file and compare it on later runs");
+        }
+        return;
+    }
+    if (e.result === KEY_LIST_STALE) {
+        L.push(`  Key statuses: signed key_list.v3, but its window closed at ${e.expiresAt} — ` +
+            "the identities still check, the statuses no longer do");
+        return;
+    }
+    L.push(`  Key statuses: signed key_list.v3 did NOT verify (${e.result}) — ` +
+        "treat its statuses and dates as unevidenced");
+}
+/** Whether the statement's log anchor was tested, and how it came out.
+ *
+ * The UNVERIFIED line matters as much as the CONFIRMED one. A statement whose
+ * anchor could not be checked is a statement that rests entirely on its
+ * issuer's signature, and a reader who is not told that will assume the stronger
+ * thing — which is the mistake this whole command has been correcting. Mirrors
+ * writeAnchorEvidence in cmd/cli/format.go. */
+function pushAnchorEvidence(L, anchor) {
+    if (anchor === undefined)
+        return;
+    L.push(`  Statement log anchor: ${anchor.verdict} (${anchor.detail})`);
+}
+/** What the signed statement said, and by whom.
+ *
+ * Nothing is printed when there is no statement: the verdict line has already
+ * told the reader that revocation is unknown, and a "Revocation status: n/a"
+ * line here would put a word where there is no evidence.
+ *
+ * `Statement signed by` is not decoration. The verdict rests on that key, the
+ * key came from the reader's own --keys file, and naming it is what lets an
+ * auditor say which key they are trusting rather than "the API said so".
+ * Mirrors writeStatementEvidence in cmd/cli/format.go. */
+function pushStatementEvidence(L, status) {
+    if (status === undefined)
+        return;
+    L.push(`  Revocation status: ${String(status.status)} (signed status statement)`);
+    L.push(`  Statement signed by: ${String(status.key_id)}`);
+    L.push(`  Statement valid: ${formatTimestamp(status.statement_issued_at)} to ` +
+        `${formatTimestamp(status.statement_expires_at)}`);
+    // The head the issuer had seen when it spoke. Printed as evidence; whether it
+    // is a prefix of the head the log publishes now is a separate question, and
+    // the "Statement log anchor" line below answers it (anchor.ts).
+    L.push(`  Statement anchored to: tree size ${String(status.sth_tree_size)}, ` +
+        `root ${displayHash(status.sth_root_hash)}`);
+    if (status.revoked_at != null)
+        L.push(`  Revoked at: ${formatTimestamp(status.revoked_at)}`);
+    if (status.replacement_certificate_id != null) {
+        L.push(`  Replaced by: ${String(status.replacement_certificate_id)}`);
+    }
+    if (status.revocation_log_index != null) {
+        L.push(`  Revocation log entry: #${String(status.revocation_log_index)}`);
+    }
+}
 /** Accept the raw API response too: GET /v1/certificates/{id} nests the
  * signed certificate as data.certificate. Exported for testing. */
 export function unwrapCertificate(parsed) {
@@ -190,13 +462,51 @@ export function unwrapCertificate(parsed) {
 async function main() {
     const args = parseArgs(process.argv);
     const cert = unwrapCertificate(JSON.parse(await readFile(args.certPath, "utf-8")));
-    const keys = await loadKeys(args.keysPath);
+    const { keys, keyList } = await loadKeys(args.keysPath);
+    // Fetched first, because the verdict now depends on it. A status statement is
+    // an input to the verdict, not a footnote printed beside one:
+    // verifyCertificateWithStatus answers REVOKED, VALID or
+    // VALID_REVOCATION_UNKNOWN from the same call, and splitting that decision
+    // across two checks is how this CLI ended up printing VALID for a certificate
+    // whose revocation it had never established.
+    let status;
+    let anchor;
+    if (args.online) {
+        try {
+            status = await fetchStatusStatement(args.apiUrl, cert.certificate_id);
+        }
+        catch (e) {
+            // Non-fatal, and NOT a pass. Leaving `status` undefined sends the verdict
+            // to VALID_REVOCATION_UNKNOWN rather than to VALID: an endpoint that did
+            // not answer has said nothing about revocation, and the older code
+            // reported that silence as a clean bill of health.
+            process.stderr.write(`warning: signed status statement unavailable: ${e instanceof Error ? e.message : String(e)}\n`);
+        }
+        // The statement's anchor is only checkable against the log, and only with a
+        // key the reader already holds. A statement signed by a key that is not in
+        // --keys cannot be authenticated at all, so there is nothing to anchor and
+        // no anchor line is printed. See anchor.ts for what this does and does not
+        // close.
+        if (status !== undefined) {
+            const key = keys.get(status.key_id);
+            if (key !== undefined) {
+                anchor = await checkStatementAnchor(nodeCrypto, args.apiUrl, status, key);
+            }
+        }
+    }
+    // The verifier's own verdict, never a hardcoded word. VALID_KEY_WINDOW_UNKNOWN
+    // and VALID_KEY_COMPROMISED_LATER are cases verifyCertificateWithStatus
+    // deliberately refused to call VALID, and this is the tool an auditor runs in
+    // a script — the one whose exit code gets trusted.
     let sigResult = "VALID";
     try {
-        await verifyCertificate(nodeCrypto, cert, keys);
+        sigResult = await verifyCertificateWithStatus(nodeCrypto, cert, keys, status ?? null);
     }
     catch (e) {
-        sigResult = e instanceof Error ? e.message : "unknown error";
+        if (e instanceof VerificationError && e.code === CERTIFICATE_REVOKED)
+            sigResult = REVOKED;
+        else
+            sigResult = e instanceof Error ? e.message : "unknown error";
     }
     // NOT_AVAILABLE (no proof) is a legitimate result; only a thrown error is a
     // transparency FAILURE and must fail the verdict + exit code.
@@ -209,11 +519,8 @@ async function main() {
         transparency = e instanceof Error ? e.message : "unknown error";
         transparencyFailed = true;
     }
-    let revocation;
-    if (args.online)
-        revocation = await checkRevocation(args.apiUrl, args.apiKey, cert.certificate_id);
-    const valid = certVerdict(sigResult, transparencyFailed, args.online, revocation);
-    process.stdout.write(formatOutput(cert, sigResult, transparency, transparencyFailed, revocation, args.online));
+    const valid = certVerdict(sigResult, transparencyFailed, anchor);
+    process.stdout.write(formatOutput(cert, sigResult, transparency, transparencyFailed, status, args.online, anchor, keyList));
     process.exit(valid ? 0 : 1);
 }
 // Only run as a CLI entry point — importing this module (e.g. from tests) must

package/dist/esm/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AACA;mDACmD;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,eAAe,EAAiB,MAAM,WAAW,CAAC;AAI3D,MAAM,KAAK,GAAG,kGAAkG,CAAC;AAEjH,SAAS,GAAG,CAAC,GAAW,IAAW,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhF,SAAS,SAAS,CAAC,IAAc;IAG/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,QAAQ,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,EAAE,MAAM,GAAG,KAAK,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC;IAC3E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAAC,CAAC;aAC5E,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAAC,CAAC;aACjF,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;QAAC,CAAC;aACxC,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAAC,CAAC;aACrF,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAAC,CAAC;;YACrF,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,GAAG,CAAC,wCAAwC,CAAC,CAAC;IAC1E,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAE,CAAW,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACxD,CAAC;AAED;mFACmF;AACnF,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EAAE,MAAc,EAAE,GAAuC;IAEvE,MAAM,KAAK,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACjH,MAAM,KAAK,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACjH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAE,CAAW,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,kBAAkB;QAClB,IAAI,CAAC,CAAC,UAAU,KAAK,aAAa,IAAI,CAAC,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACvE,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,GAAG,8DAA8D,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE;gBACrD,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,QAAQ,EAAE,CAAC,CAAC,SAAS,IAAI,SAAS;gBAClC,eAAe,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;aACjD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,uBAAwB,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,6EAA6E;QAC7E,4EAA4E;QAC5E,oDAAoD;QACpD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC;YACrD,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,uCAAuC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;YACnE,GAAG,CAAC,4CAA4C,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,MAAc,EAAE,MAAc;IAC3E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,oBAAoB,MAAM,oBAAoB,EAAE;QAC/E,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;KAC/C,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAoD,EAAC,IAAI,CAAC;AAClF,CAAC;AAED;;wEAEwE;AACxE,MAAM,UAAU,WAAW,CACzB,SAAiB,EACjB,kBAA2B,EAC3B,MAAe,EACf,UAA0C;IAE1C,OAAO,CACL,SAAS,KAAK,OAAO;QACrB,CAAC,kBAAkB;QACnB,CAAC,CAAC,MAAM,IAAI,UAAU,EAAE,MAAM,KAAK,SAAS,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,OAAQ,CAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,IAAU,EAAE,SAAiB,EAAE,YAAoB,EAAE,kBAA2B,EAChF,UAA2D,EAAE,MAAe;IAE5E,MAAM,EAAE,GAAI,IAAI,CAAC,cAAyB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,WAAW,CAAE,IAAI,CAAC,OAAmC,CAAC,eAAe,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,IAAI,CAAC,WAAsC,CAAC;IACxD,MAAM,CAAC,GAAa,EAAE,CAAC;IAEvB,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,kBAAkB,EAAE,cAAc,SAAS,KAAK,CAAC;IACnF,IAAI,kBAAkB;QAAE,OAAO,kBAAkB,EAAE,4BAA4B,YAAY,KAAK,CAAC;IACjG,IAAI,MAAM,IAAI,UAAU,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/C,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;QAClD,IAAI,UAAU,CAAC,MAAM;YAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,4CAA4C,CAAC;IACvE,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,UAAU,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,0BAAoC,EAAE,CAAC,CAAC;IAE5E,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,oEAAoE;IACpE,0CAA0C;IAC1C,MAAM,GAAG,GAAI,IAAI,CAAC,OAAqC,IAAI,EAAE,CAAC;IAC9D,CAAC,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3G,CAAC,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAI,CAAC,CAAC,cAAyB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC,CAAC,IAAI,CAAC,oBAAoB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAI,CAAC,CAAC,cAAyB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,WAAqB,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAqB,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAEV,wEAAwE;IACxE,8EAA8E;IAC9E,yCAAyC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAA6C,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,EAAE,YAAY,CAAC;IAClC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC,2DAA2D,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,YAAuC,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,WAAqB,yBAAyB,CAAC,CAAC;IACzF,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,uBAAuB,YAAY,KAAK,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,MAAM,IAAI,UAAU;QAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAC7B,CAAC;AAED;mEACmE;AACnE,MAAM,UAAU,iBAAiB,CAAC,MAAY;IAC5C,IAAI,IAAI,GAAG,MAAM,CAAC;IAClB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,IAAI,GAAG,IAAI,CAAC,IAAY,CAAC;IAClF,IACE,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QAChE,IAAI,CAAC,WAAoB,CAAC,MAAM,KAAK,SAAS,EAC/C,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,WAAmB,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAS,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE3C,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,IAAI,CAAC;QAAC,MAAM,iBAAiB,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IACxD,OAAO,CAAC,EAAE,CAAC;QAAC,SAAS,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IAAC,CAAC;IAE3E,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,YAAY,GAAG,eAAe,CAAC;IACnC,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,CAAC;QAAC,YAAY,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IACxE,OAAO,CAAC,EAAE,CAAC;QAAC,YAAY,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QAAC,kBAAkB,GAAG,IAAI,CAAC;IAAC,CAAC;IAEzG,IAAI,UAA2D,CAAC;IAChE,IAAI,IAAI,CAAC,MAAM;QAAE,UAAU,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAwB,CAAC,CAAC;IAE7G,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,kBAAkB,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAElF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,kBAAkB,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/G,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,uEAAuE;AACvE,gFAAgF;AAChF,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AACA;mDACmD;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,2BAA2B,EAC3B,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,aAAa,GAGd,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAqB,MAAM,aAAa,CAAC;AAQ3F,MAAM,KAAK,GAAG,kFAAkF,CAAC;AAEjG,SAAS,GAAG,CAAC,GAAW,IAAW,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhF,SAAS,SAAS,CAAC,IAAc;IAG/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,QAAQ,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,EAAE,MAAM,GAAG,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC;IAC9D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAAC,CAAC;aAC5E,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAAC,CAAC;aACjF,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;QAAC,CAAC;aACxC,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAAC,CAAC;QAC1F,2EAA2E;QAC3E,2EAA2E;QAC3E,2DAA2D;aACtD,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAAC,CAAC;;YACnF,GAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,GAAG,CAAC,wCAAwC,CAAC,CAAC;IAC1E,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAE,CAAW,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;gCAQgC;AAChC,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EAAE,GAAuC;IAEvD,MAAM,KAAK,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACjH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;0CAK0C;AAC1C,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,OAAmB,CAAC;IACxB,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5E,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;QACnB,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,8BAA8B;QAC9B,OAAO,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAE,CAAW,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,kBAAkB;QAClB,IAAI,CAAC,CAAC,UAAU,KAAK,aAAa,IAAI,CAAC,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACvE,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI,GAAG,8DAA8D,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,GAAkB,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE;gBACrD,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,QAAQ,EAAE,CAAC,CAAC,SAAS,IAAI,SAAS;gBAClC,eAAe,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;aACjD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,uBAAwB,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,6EAA6E;QAC7E,4EAA4E;QAC5E,oDAAoD;QACpD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC;YACrD,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,uCAAuC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;YACnE,GAAG,CAAC,4CAA4C,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;gFAWgF;AAChF,KAAK,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAc;IAChE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,MAAM,SAAS,CAAC,CAAC;IAC1F,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,OAAO,qBAAqB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;8BAgB8B;AAC9B,MAAM,UAAU,qBAAqB,CAAC,MAAe;IACnD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,GAAG,GAAG,MAAyB,CAAC;IACpC,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1F,GAAG,GAAG,GAAG,CAAC,IAAuB,CAAC;IACpC,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACxG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,sBAAsB,CAAC;QAAE,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACxF,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI;QAAE,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC9D,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC9G,2EAA2E;IAC3E,4EAA4E;IAC5E,eAAe;IACf,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;IACrC,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB,EAAE,KAAa;IACzD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,kBAAkB,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAoB,EAAE,KAAa,EAAE,KAAa;IACpE,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,MAAM,CAAC,gBAAgB,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,WAAW,KAAK,eAAe,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED;;;;;;;;iFAQiF;AACjF,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC;AAE1F;;;;;;;uCAOuC;AACvC,MAAM,OAAO,GAAG,SAAS,CAAC;AAE1B;;;;;;;;;;0DAU0D;AAC1D,MAAM,UAAU,WAAW,CACzB,SAAiB,EAAE,kBAA2B,EAAE,MAAqB;IAErE,IAAI,MAAM,EAAE,OAAO,KAAK,mBAAmB;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC;AAC/D,CAAC;AAED;;;+DAG+D;AAC/D,MAAM,iBAAiB,GAA2B;IAChD,wBAAwB,EACtB,yEAAyE;QACzE,8DAA8D;IAChE,2BAA2B,EACzB,gEAAgE;QAChE,sCAAsC;CACzC,CAAC;AAEF;;;;;;;;mEAQmE;AACnE,MAAM,0BAA0B,GAC9B,qEAAqE;IACrE,yDAAyD,CAAC;AAC5D,MAAM,yBAAyB,GAC7B,mEAAmE;IACnE,uFAAuF,CAAC;AAE1F;;;;;;;;;GASG;AACH,MAAM,sBAAsB,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAEhF,SAAS,0BAA0B,CAAC,OAAe;IACjD,OAAO,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,OAAQ,CAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,IAAU,EAAE,SAAiB,EAAE,YAAoB,EAAE,kBAA2B,EAChF,MAAmC,EAAE,MAAe,EAAE,MAAqB,EAC3E,OAAyB;IAEzB,MAAM,EAAE,GAAI,IAAI,CAAC,cAAyB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,WAAW,CAAE,IAAI,CAAC,OAAmC,CAAC,eAAe,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,IAAI,CAAC,WAAsC,CAAC;IACxD,MAAM,CAAC,GAAa,EAAE,CAAC;IAEvB,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,+DAA+D;IAC/D,+DAA+D;IAC/D,IAAI,MAAM,EAAE,OAAO,KAAK,mBAAmB,EAAE,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,qCAAqC,CAAC,CAAC;QAC1E,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,IAAI,CAAC,wCAAwC,SAAS,6CAA6C,CAAC,CAAC;QACvG,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,0BAA0B,EAAE,KAAK,SAAS,KAAK,IAAI,KAAK,CAAC;IACxF,4EAA4E;IAC5E,gEAAgE;IAChE,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,qBAAqB,CAAC,CAAC;QAC1D,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACjC,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,0BAA0B,EAAE,cAAc,SAAS,KAAK,CAAC;IACrG,IAAI,kBAAkB;QAAE,OAAO,0BAA0B,EAAE,4BAA4B,YAAY,KAAK,CAAC;IAEzG,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,qCAAqC;IACrC,MAAM,GAAG,GAAG,SAAS,KAAK,wBAAwB;QAChD,CAAC,CAAC,GAAG,wBAAwB,KAAK,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,0BAA0B,GAAG;QACpG,CAAC,CAAC,4DAA4D,CAAC;IACjE,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,0BAAoC,EAAE,CAAC,CAAC;IAEzE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,oEAAoE;IACpE,0CAA0C;IAC1C,MAAM,GAAG,GAAI,IAAI,CAAC,OAAqC,IAAI,EAAE,CAAC;IAC9D,CAAC,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3G,CAAC,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAI,CAAC,CAAC,cAAyB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC,CAAC,IAAI,CAAC,oBAAoB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAI,CAAC,CAAC,cAAyB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,WAAqB,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAqB,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAEV,wEAAwE;IACxE,8EAA8E;IAC9E,yCAAyC;IACzC,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,MAA6C,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,EAAE,YAAY,CAAC;IAClC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,0BAAoC,CAAC;QAC1D,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,2DAA2D,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,IAAI,CACJ,2BAA2B,OAAO,wCAAwC;gBACxE,uCAAuC,IAAI,EAAE,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,YAAuC,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,WAAqB,yBAAyB,CAAC,CAAC;IACzF,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,uBAAuB,YAAY,KAAK,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,qBAAqB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACjC,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9B,mBAAmB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAC7B,CAAC;AAED;;;;;;;;+EAQ+E;AAC/E,SAAS,mBAAmB,CAAC,CAAW,EAAE,CAA8B;IACtE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO;IAC5B,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACf,CAAC,CAAC,IAAI,CAAC,mEAAmE;YACxE,qEAAqE,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YACjB,wEAAwE;YACxE,sEAAsE;YACtE,sDAAsD;YACtD,CAAC,CAAC,IAAI,CAAC,gEAAgE;gBACrE,2EAA2E,CAAC,CAAC;QACjF,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAChC,CAAC,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC,SAAS,KAAK;YACrF,uDAAuD,CAAC,CAAC;QAC3D,OAAO;IACT,CAAC;IACD,CAAC,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC,MAAM,MAAM;QACzE,6CAA6C,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;+CAM+C;AAC/C,SAAS,kBAAkB,CAAC,CAAW,EAAE,MAAgC;IACvE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,CAAC,CAAC,IAAI,CAAC,2BAA2B,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;0DAS0D;AAC1D,SAAS,qBAAqB,CAAC,CAAW,EAAE,MAAmC;IAC7E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,CAAC,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAClF,CAAC,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,IAAI,CAAC,sBAAsB,eAAe,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM;QAC5E,GAAG,eAAe,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACrD,8EAA8E;IAC9E,4EAA4E;IAC5E,gEAAgE;IAChE,CAAC,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI;QAC3E,QAAQ,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI;QAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7F,IAAI,MAAM,CAAC,0BAA0B,IAAI,IAAI,EAAE,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,IAAI,IAAI,EAAE,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;mEACmE;AACnE,MAAM,UAAU,iBAAiB,CAAC,MAAY;IAC5C,IAAI,IAAI,GAAG,MAAM,CAAC;IAClB,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,IAAI,GAAG,IAAI,CAAC,IAAY,CAAC;IAClF,IACE,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QAChE,IAAI,CAAC,WAAoB,CAAC,MAAM,KAAK,SAAS,EAC/C,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,WAAmB,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAS,CAAC,CAAC;IAC3F,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAExD,8EAA8E;IAC9E,8DAA8D;IAC9D,wDAAwD;IACxD,2EAA2E;IAC3E,8EAA8E;IAC9E,6CAA6C;IAC7C,IAAI,MAAmC,CAAC;IACxC,IAAI,MAAgC,CAAC;IACrC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,cAAwB,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0EAA0E;YAC1E,yEAAyE;YACzE,mEAAmE;YACnE,mDAAmD;YACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iDAAiD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAChG,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,SAAS;QACT,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAgB,CAAC,CAAC;YAC9C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,wEAAwE;IACxE,8EAA8E;IAC9E,mDAAmD;IACnD,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,IAAI,CAAC;QAAC,SAAS,GAAG,MAAM,2BAA2B,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC;IAAC,CAAC;IAC9F,OAAO,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,YAAY,iBAAiB,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB;YAAE,SAAS,GAAG,OAAO,CAAC;;YACrF,SAAS,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IACpE,CAAC;IAED,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,YAAY,GAAG,eAAe,CAAC;IACnC,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,CAAC;QAAC,YAAY,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IACxE,OAAO,CAAC,EAAE,CAAC;QAAC,YAAY,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QAAC,kBAAkB,GAAG,IAAI,CAAC;IAAC,CAAC;IAEzG,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAEjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CACtG,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,uEAAuE;AACvE,gFAAgF;AAChF,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/esm/client.d.ts

@@ -3,14 +3,25 @@
  * Single class — Node.js is all-async, no sync/async split needed.
  * Pagination uses AsyncIterable<T> via Paginator.
  */
-import type { ApiKeyListItem, ApiKeyResponse, Attestation, BatchAttestationResponse, CertificateResponse, CertificateStats, ConsistencyProof, InclusionProof, LogEntry, Profile, RevocationStatus, SignedTreeHead, System, SystemHealth, VerifyResult, Webhook, WebhookDelivery, WebhookRotateResponse } from "./models.js";
+import type { ApiKeyListItem, ApiKeyResponse, Attestation, BatchAttestationResponse, BatchRevokeResponse, CertificateResponse, CertificateStats, ConsistencyProof, InclusionProof, LogEntry, Profile, RevocationStatus, SignedTreeHead, System, SystemHealth, VerifyResult, Webhook, WebhookDelivery, WebhookRotateResponse } from "./models.js";
 import { Paginator } from "./pagination.js";
 export interface BurnLedgerOptions {
     apiKey: string;
     baseUrl?: string;
     timeout?: number;
     maxRetries?: number;
+    /**
+     * Team to act as, sent as X-Team-ID beside the key.
+     *
+     * Omit it and the API uses the caller's default team — the first one they
+     * joined — which is the right answer for a single-team account and the wrong
+     * one for anybody else.
+     */
+    teamId?: string;
 }
+/** Per-call cap on POST /v1/certificates/batch-revoke, the same 100 the
+ * server enforces (service.maxBatchRevoke). Chunk larger sets by this. */
+export declare const MAX_BATCH_REVOKE = 100;
 export declare class BurnLedger {
     private readonly transport;
     constructor(opts: BurnLedgerOptions);
@@ -69,6 +80,11 @@ export declare class BurnLedger {
     revokeCertificate(certificateId: string, opts: {
         reason: string;
     }): Promise<CertificateResponse>;
+    /** Revokes up to MAX_BATCH_REVOKE records under one reason. Partial
+     * completion is the normal case, not an exception: inspect `errors`. */
+    batchRevokeCertificates(certificateIds: string[], opts: {
+        reason: string;
+    }): Promise<BatchRevokeResponse>;
     getCertificateStats(): Promise<CertificateStats>;
     exportCertificates(opts?: {
         format?: "csv" | "jsonl";
@@ -93,9 +109,17 @@ export declare class BurnLedger {
     listApiKeys(opts?: {
         limit?: number;
     }): Paginator<ApiKeyListItem>;
-    createApiKey(): Promise<ApiKeyResponse>;
+    /** Create an API key. `teamId` pins it to one team the caller belongs to:
+     * a pinned key always acts for that team and refuses a conflicting
+     * `X-Team-ID` with 403. Omitted means unpinned — the server resolves the
+     * team per request, as every key created before pinning existed does. */
+    createApiKey(params?: {
+        teamId?: string;
+    }): Promise<ApiKeyResponse>;
     revokeApiKey(keyId: string): Promise<void>;
     getMe(): Promise<Profile>;
+    /** Rename the account. `email` must be the current address: changing it
+     * needs a dashboard session, and an API key is refused with 403. */
     updateMe(params: {
         name: string;
         email: string;