@engramx/client 0.16.0-rc.2 → 0.16.0-rc.21

package/dist/birthChain.js

@@ -0,0 +1,233 @@
+// birthChain.ts — verify an engram's BIRTH CHAIN: where it came from, proven against the IC root key
+// without trusting the registry that minted it or the engram that holds it.
+//
+// WHAT A BIRTH CHAIN IS. Every engram a registry opens gets a birth record: which engram it is, which
+// engram it was opened from (none for a first engram), its engram number, when it was born, a 32-byte
+// random secret, and the fingerprint of its parent's record. The engram holds its own record and
+// copies of its ancestors' records — root first, its own last — and serves them to its OWNER only
+// (`getBirthChain`); the owner decides whom to show them to. The registry certifies each record's
+// FINGERPRINT, and nothing else about it, as a leaf of its certified tree under
+// ["births", <fingerprint>] with the constant value [0x01] (`getCertifiedBirth`, public).
+//
+// WHAT THIS CHECKS, every step required (a false `verified` names the first failure in `why`):
+//   1. the chain is not empty and every record is version 1 and encodable;
+//   2. each adjacent pair LINKS: the later record names the earlier one as its parent AND carries the
+//      earlier record's fingerprint — recomputed here from the canonical encoding, never read off the
+//      wire;
+//   3. each fingerprint's witness verifies up to the registry's subnet-signed certified data
+//      (`verifyCertifiedLeaf`), with the leaf bytes equal to [0x01];
+//   4. `expectChild`, when given, is the chain's last record.
+// `complete` says whether the chain starts at a first engram (no parent, no parent fingerprint). A run
+// that starts part-way is allowed and still `verified`: an owner may show any contiguous run, and an
+// engram whose oldest ancestors were born before birth records existed holds one.
+//
+// WHAT IT CANNOT TELL YOU. That the records name the engrams you think they do beyond the ids they
+// carry, or anything about who owns them — a record holds no person's identity, by design. Absence:
+// the registry serves no certified proof that a fingerprint is NOT in its tree, so an uncertified
+// link is "not proven", never "proven false".
+//
+// THE ENCODING is the registry's (`BirthRecord.encode`), byte for byte; the golden vector in
+// test/birth-chain.test.ts is the same one the Motoko suite asserts, and a repository test holds the
+// two hex literals equal.
+//
+// Browser-safe: WebCrypto SHA-256, no Node imports.
+import { Actor } from '@icp-sdk/core/agent';
+import { verifyCertifiedLeaf } from './certifiedAudit.js';
+import { registrySubset } from './idl.js';
+export function fromCandidBirthRecord(c) {
+    return {
+        version: c.version,
+        child: c.child,
+        parent: c.parent.length ? c.parent[0] : null,
+        number: c.number,
+        bornAtNs: c.bornAtNs,
+        secret: Uint8Array.from(c.secret),
+        parentFingerprint: c.parentFingerprint.length ? Uint8Array.from(c.parentFingerprint[0]) : null,
+    };
+}
+const DOMAIN_TAG = new TextEncoder().encode('engramx/birth/v1');
+const TWO_64 = 1n << 64n;
+function u64(n, what) {
+    if (n < 0n || n >= TWO_64)
+        throw new Error(`${what} does not fit in an unsigned 64-bit integer`);
+    const out = [];
+    for (let i = 7; i >= 0; i--)
+        out.push(Number((n >> BigInt(i * 8)) & 0xffn));
+    return out;
+}
+/**
+ * The canonical encoding, version 1 (big-endian, no Candid):
+ *
+ *     "engramx/birth/v1"                16 ASCII bytes
+ *     u8 len(child) ‖ child bytes
+ *     u8 0  |  u8 1 ‖ u8 len(parent) ‖ parent bytes
+ *     u64 number
+ *     u64 bornAtNs                      (never negative)
+ *     u8 len(secret) ‖ secret           (len = 32)
+ *     u8 0  |  u8 1 ‖ 32 bytes parentFingerprint
+ *
+ * Throws on a record the registry could never have minted (wrong version, a secret or parent
+ * fingerprint that is not 32 bytes, a negative or oversized number or time).
+ */
+export function encodeBirthRecord(r) {
+    if (r.version !== 1n)
+        throw new Error(`birth record version ${r.version} is not 1`);
+    if (r.secret.length !== 32)
+        throw new Error(`birth record secret is ${r.secret.length} bytes, not 32`);
+    if (r.parentFingerprint && r.parentFingerprint.length !== 32)
+        throw new Error('birth record parent fingerprint is not 32 bytes');
+    const out = [...DOMAIN_TAG];
+    const child = r.child.toUint8Array();
+    out.push(child.length, ...child);
+    if (r.parent) {
+        const p = r.parent.toUint8Array();
+        out.push(1, p.length, ...p);
+    }
+    else
+        out.push(0);
+    out.push(...u64(r.number, 'the engram number'), ...u64(r.bornAtNs, 'the birth time'));
+    out.push(r.secret.length, ...r.secret);
+    if (r.parentFingerprint)
+        out.push(1, ...r.parentFingerprint);
+    else
+        out.push(0);
+    return Uint8Array.from(out);
+}
+/** SHA-256 of the canonical encoding (WebCrypto) — the key of the record's certified leaf. */
+export async function birthFingerprint(r) {
+    const digest = await globalThis.crypto.subtle.digest('SHA-256', encodeBirthRecord(r));
+    return new Uint8Array(digest);
+}
+const hex = (b) => Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('');
+const sameBytes = (a, b) => a === null || b === null ? a === b : a.length === b.length && a.every((x, i) => x === b[i]);
+const asText = (p) => (typeof p === 'string' ? p : p.toText());
+const registryBirthIdl = registrySubset(['getCertifiedBirth']);
+/**
+ * The default witness fetcher: the registry's public `getCertifiedBirth`, through a narrowed view of
+ * the GENERATED registry interface (`registrySubset`), so its signature can never drift from what the
+ * registry serves. Anonymous agents are fine — the read is public and reveals only presence.
+ */
+export function registryBirthWitness(agent, registryId) {
+    const registry = Actor.createActor(registryBirthIdl, { agent, canisterId: registryId });
+    return async (fingerprint) => {
+        const r = (await registry['getCertifiedBirth'](fingerprint));
+        return r.length ? r[0] : null;
+    };
+}
+/**
+ * Verify a birth chain (root first, the engram's own record last) against the registry's certified
+ * fingerprints.
+ *
+ * `fetchWitness` is INJECTED: it is called with each record's fingerprint and returns the registry's
+ * `getCertifiedBirth` reply (or null). Typically
+ * `(fp) => registryActor.getCertifiedBirth(fp).then((r) => (r.length ? r[0] : null))`.
+ * ⟨2026-10-26⟩ TODO(Finish phase): a default fetcher over `registrySubset(['getCertifiedBirth'])`
+ * needs the regenerated registry IDL — `projectService` throws on a method the generated interface
+ * does not carry yet — so it is added when `gen-did.sh` has run.
+ * ⟨DONE 2026-10-26, Finish phase⟩ `gen-did.sh` ran; `fetchWitness` is now optional and defaults to
+ * `registryBirthWitness(agent, registryId)`, a narrowed view of the generated registry interface —
+ * never a hand-declared shape (the drift class ADR-0018 answers).
+ *
+ * The agent's root key must be set (`fetchRootKey()` first, on a local replica only).
+ */
+export async function verifyBirthChain(agent, registryId, records, opts = {}) {
+    const fetchWitness = opts.fetchWitness ?? registryBirthWitness(agent, registryId);
+    const first = records[0];
+    const last = records[records.length - 1];
+    const endsAt = last ? last.child.toText() : null;
+    const complete = first !== undefined && first.parent === null && first.parentFingerprint === null;
+    const fail = (why, links = []) => ({
+        verified: false,
+        complete,
+        endsAt,
+        links,
+        why,
+    });
+    if (records.length === 0)
+        return fail('the chain is empty — there is nothing to verify');
+    // Fingerprints, recomputed from the canonical encoding — never taken from the wire.
+    const rows = [];
+    for (const [i, rec] of records.entries()) {
+        try {
+            rows.push({ rec, fp: await birthFingerprint(rec) });
+        }
+        catch (e) {
+            return fail(`record ${i} (${rec.child.toText()}) cannot be encoded: ${e.message}`);
+        }
+    }
+    // Links: each record names the one before it as its parent AND carries its fingerprint.
+    let linkBreak = null;
+    rows.reduce((prev, cur, i) => {
+        if (prev !== null && linkBreak === null) {
+            if (cur.rec.parent === null || cur.rec.parent.toText() !== prev.rec.child.toText()) {
+                linkBreak = `record ${i} (${cur.rec.child.toText()}) does not name record ${i - 1} (${prev.rec.child.toText()}) as its parent`;
+            }
+            else if (!sameBytes(cur.rec.parentFingerprint, prev.fp)) {
+                linkBreak = `record ${i} (${cur.rec.child.toText()}) does not carry the fingerprint of record ${i - 1}`;
+            }
+        }
+        return cur;
+    }, null);
+    // Witnesses: each fingerprint must be a certified leaf with the constant value [0x01].
+    const utf8 = (s) => new TextEncoder().encode(s);
+    const links = [];
+    for (const { rec, fp } of rows) {
+        const child = rec.child.toText();
+        const fingerprintHex = hex(fp);
+        let reply;
+        try {
+            reply = await fetchWitness(fp);
+        }
+        catch (e) {
+            links.push({
+                child,
+                fingerprintHex,
+                certified: false,
+                why: `the witness could not be fetched: ${e.message}`,
+            });
+            continue;
+        }
+        if (!reply) {
+            links.push({
+                child,
+                fingerprintHex,
+                certified: false,
+                why: 'the registry holds no certified leaf for this fingerprint (no proof either way — an absence is not certified)',
+            });
+            continue;
+        }
+        const leaf = await verifyCertifiedLeaf(agent, registryId, reply, [utf8('births'), fp]);
+        if (!leaf.verified || !leaf.valueBytes) {
+            links.push({ child, fingerprintHex, certified: false, why: leaf.why });
+        }
+        else if (!(leaf.valueBytes.length === 1 && leaf.valueBytes[0] === 1)) {
+            links.push({
+                child,
+                fingerprintHex,
+                certified: false,
+                why: 'the certified leaf is not the constant [0x01]',
+            });
+        }
+        else {
+            links.push({ child, fingerprintHex, certified: true, why: 'ok' });
+        }
+    }
+    if (linkBreak !== null)
+        return fail(linkBreak, links);
+    const uncertified = links.find((l) => !l.certified);
+    if (uncertified)
+        return fail(`the record of ${uncertified.child} is not certified: ${uncertified.why}`, links);
+    if (opts.expectChild !== undefined && asText(opts.expectChild) !== endsAt) {
+        return fail(`the chain ends at ${endsAt}, not at the expected engram ${asText(opts.expectChild)}`, links);
+    }
+    return {
+        verified: true,
+        complete,
+        endsAt,
+        links,
+        why: complete
+            ? 'ok — every record certified and linked, from a first engram'
+            : 'ok — every record certified and linked; the chain starts part-way (an ancestor before it is not shown)',
+    };
+}
+//# sourceMappingURL=birthChain.js.map

package/dist/birthChain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"birthChain.js","sourceRoot":"","sources":["../src/birthChain.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,4EAA4E;AAC5E,EAAE;AACF,sGAAsG;AACtG,sGAAsG;AACtG,iGAAiG;AACjG,kGAAkG;AAClG,kGAAkG;AAClG,gFAAgF;AAChF,0FAA0F;AAC1F,EAAE;AACF,+FAA+F;AAC/F,2EAA2E;AAC3E,sGAAsG;AACtG,sGAAsG;AACtG,aAAa;AACb,6FAA6F;AAC7F,qEAAqE;AACrE,8DAA8D;AAC9D,uGAAuG;AACvG,qGAAqG;AACrG,kFAAkF;AAClF,EAAE;AACF,mGAAmG;AACnG,oGAAoG;AACpG,kGAAkG;AAClG,8CAA8C;AAC9C,EAAE;AACF,6FAA6F;AAC7F,qGAAqG;AACrG,0BAA0B;AAC1B,EAAE;AACF,oDAAoD;AAEpD,OAAO,EAAE,KAAK,EAAkB,MAAM,qBAAqB,CAAC;AAE5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAuB1C,MAAM,UAAU,qBAAqB,CAAC,CAAoB;IACxD,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QAC5C,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACjC,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;KAC/F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAChE,MAAM,MAAM,GAAG,EAAE,IAAI,GAAG,CAAC;AAEzB,SAAS,GAAG,CAAC,CAAS,EAAE,IAAY;IAClC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6CAA6C,CAAC,CAAC;IACjG,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAc;IAC9C,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC;IACpF,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE;QACxB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,MAAM,gBAAgB,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,iBAAiB,CAAC,MAAM,KAAK,EAAE;QAC1D,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,MAAM,GAAG,GAAa,CAAC,GAAG,UAAU,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;IACrC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9B,CAAC;;QAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACtF,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC,iBAAiB;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC;;QACxD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,CAAc;IACnD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAClD,SAAS,EACT,iBAAiB,CAAC,CAAC,CAA4B,CAChD,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AA2BD,MAAM,GAAG,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC9F,MAAM,SAAS,GAAG,CAAC,CAAoB,EAAE,CAAoB,EAAE,EAAE,CAC/D,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9F,MAAM,MAAM,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAEnF,MAAM,gBAAgB,GAAG,cAAc,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAE/D;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAgB,EAChB,UAA8B;IAE9B,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;IACxF,OAAO,KAAK,EAAE,WAAW,EAAE,EAAE;QAC3B,MAAM,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,mBAAmB,CAAE,CAAC,WAAW,CAAC,CAA+B,CAAC;QAC5F,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAgB,EAChB,UAA8B,EAC9B,OAAsB,EACtB,IAAI,GAGA,EAAE;IAEN,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,oBAAoB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,CAAC;IAClG,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAK,GAAuB,EAAE,EAAqB,EAAE,CAAC,CAAC;QAChF,QAAQ,EAAE,KAAK;QACf,QAAQ;QACR,MAAM;QACN,KAAK;QACL,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,iDAAiD,CAAC,CAAC;IAEzF,oFAAoF;IACpF,MAAM,IAAI,GAA2C,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,wBAAyB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAED,wFAAwF;IACxF,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,CAAC,MAAM,CAA8C,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QACxE,IAAI,IAAI,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACxC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnF,SAAS,GAAG,UAAU,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,0BAA0B,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,CAAC;YACjI,CAAC;iBAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC1D,SAAS,GAAG,UAAU,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,8CAA8C,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1G,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,EAAE,IAAI,CAAC,CAAC;IAET,uFAAuF;IACvF,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,KAAK,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,cAAc,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,KAAiC,CAAC;QACtC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK;gBACL,cAAc;gBACd,SAAS,EAAE,KAAK;gBAChB,GAAG,EAAE,qCAAsC,CAAW,CAAC,OAAO,EAAE;aACjE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK;gBACL,cAAc;gBACd,SAAS,EAAE,KAAK;gBAChB,GAAG,EAAE,+GAA+G;aACrH,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACvE,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK;gBACL,cAAc;gBACd,SAAS,EAAE,KAAK;gBAChB,GAAG,EAAE,+CAA+C;aACrD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,iBAAiB,WAAW,CAAC,KAAK,sBAAsB,WAAW,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;IAChG,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,MAAM,EAAE,CAAC;QAC1E,OAAO,IAAI,CACT,qBAAqB,MAAM,gCAAgC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,EACrF,KAAK,CACN,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,QAAQ;QACR,MAAM;QACN,KAAK;QACL,GAAG,EAAE,QAAQ;YACX,CAAC,CAAC,6DAA6D;YAC/D,CAAC,CAAC,wGAAwG;KAC7G,CAAC;AACJ,CAAC"}

package/dist/cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,QAAQ;IAKnB,YAAY,UAAkB,GAAG,EAAE,eAAuB,KAAM;QAJxD,UAAK,GAAG,IAAI,GAAG,EAAiD,CAAC;QAKvE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC;IACjC,CAAC;IAED,GAAG,CAAI,GAAW;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAE7B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC,KAAU,CAAC;IAC1B,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAc,EAAE,KAAc;QAC7C,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAChD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YAClB,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;CACF"}
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,QAAQ;IAKnB,YAAY,OAAO,GAAW,GAAG,EAAE,YAAY,GAAW,KAAM;QAJxD,UAAK,GAAG,IAAI,GAAG,EAAiD,CAAC;QAKvE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC;IACjC,CAAC;IAED,GAAG,CAAI,GAAW;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAE7B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC,KAAU,CAAC;IAC1B,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAc,EAAE,KAAc;QAC7C,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAChD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YAClB,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;CACF"}

package/dist/certifiedAudit.d.ts

@@ -88,3 +88,34 @@ export declare function verifyCertifiedAnchor(agent: HttpAgent, registryId: Prin
     certificate: [] | [Uint8Array | number[]];
     witness: [] | [Uint8Array | number[]] | Uint8Array | number[];
 }): Promise<CertifiedLeaf>;
+/** The IC mainnet root key (133 bytes, DER), pinned. SHA-256 737ba355…f4b6b3 — the same value the
+ *  agent library carries as its mainnet default; test/record-chain.test.ts holds the two equal. */
+export declare const IC_MAINNET_ROOT_KEY_HEX = "308182301d060d2b0601040182dc7c0503010201060c2b0601040182dc7c05030201036100814c0e6ec71fab583b08bd81373c255c3c371b2e84863c98a4f1e08b74235d14fb5d9c0cd546d9685f913a0c0b2cc5341583bf4b4392e467db96d65b9bb4cb717112f8472e0d5a4d14505ffd7484b01291091c5f87b98883463f98091a0baaae";
+export interface HistoricalCertificate {
+    verified: boolean;
+    /** Self-classifying: names the link that failed. Never act on the other fields unless `verified`. */
+    why: string;
+    /** The canister's certified data the subnet signed (a bare head, or a tree root). */
+    certifiedData: Uint8Array | null;
+    /** The certificate's own signed time, nanoseconds since the epoch. */
+    signedTimeNs: bigint | null;
+    /** With a witness and a leaf path (the registry's tree format): the leaf proven under the root. */
+    leaf: Uint8Array | null;
+}
+/**
+ * Verify a certificate of ANY age for one canister and read what it certifies and when.
+ *
+ * Checks, every one required: the BLS signature and its delegation chain verify against `rootKey`
+ * (default: the pinned mainnet key — a local replica's certificate, or one under any other key,
+ * fails here); the delegation covers `canisterId`; the tree carries `/canister/<id>/certified_data`
+ * (a certificate another canister obtained does not — it fails with that said); `/time` is present.
+ * With `witness` and `leafPath`, the witness must reconstruct to the certified root and hold the leaf.
+ * Freshness is NOT checked, by design (the header above says why). Fails closed with a reason.
+ */
+export declare function verifyHistoricalCertificate(args: {
+    certificate: Uint8Array | number[];
+    canisterId: Principal | string;
+    rootKey?: Uint8Array;
+    witness?: Uint8Array | number[] | null;
+    leafPath?: Uint8Array[];
+}): Promise<HistoricalCertificate>;

package/dist/certifiedAudit.js

@@ -204,4 +204,128 @@ export async function verifyCertifiedAnchor(agent, registryId, engramId, reply)
         engram.toUint8Array(),
     ]);
 }
+// ── Historical certificates (2026-10-15, the owner's ruling 6B of 2026-10-14) ──────────────────────
+//
+// EVERY VERIFIER ABOVE IS FRESH-ONLY, and that is right for them: they answer "is this head the one
+// the subnet signs NOW", and `Certificate.create`'s default refuses a certificate more than five
+// minutes old. It is wrong for evidence. What proves "this entry existed by time T" is a certificate
+// whose SIGNED time is T and which covers a head the entry is in — captured right after the write
+// and checked weeks later, by someone who was not there. Nobody can forge the subnet's signature over
+// a past time, so an old certificate is not weaker than a fresh one; it is the point. So this check
+// is EXPLICIT and separate: it accepts a certificate of any age, verifies the signature against a
+// pinned root key (never one fetched from the network being checked), reads the certificate's own
+// signed `/time`, and hands back the certified bytes. The fresh verifiers keep their default.
+//
+// No entry has a certified time of its own: an entry's certified time is the signed time of the
+// earliest certificate one keeps that covers it.
+/** The IC mainnet root key (133 bytes, DER), pinned. SHA-256 737ba355…f4b6b3 — the same value the
+ *  agent library carries as its mainnet default; test/record-chain.test.ts holds the two equal. */
+export const IC_MAINNET_ROOT_KEY_HEX = '308182301d060d2b0601040182dc7c0503010201060c2b0601040182dc7c05030201036100814c0e6ec71fab583b08bd81373c255c3c371b2e84863c98a4f1e08b74235d14fb5d9c0cd546d9685f913a0c0b2cc5341583bf4b4392e467db96d65b9bb4cb717112f8472e0d5a4d14505ffd7484b01291091c5f87b98883463f98091a0baaae';
+const hexBytes = (h) => {
+    const clean = h.trim().toLowerCase();
+    if (!/^([0-9a-f]{2})*$/.test(clean))
+        throw new Error('not an even-length hex string');
+    return Uint8Array.from(clean.match(/../g) ?? [], (b) => parseInt(b, 16));
+};
+/** Unsigned LEB128 — how the state tree encodes `/time` (nanoseconds since the epoch). */
+function leb128(buf) {
+    let out = 0n;
+    let shift = 0n;
+    for (const byte of buf) {
+        out |= BigInt(byte & 0x7f) << shift;
+        if ((byte & 0x80) === 0)
+            break;
+        shift += 7n;
+    }
+    return out;
+}
+/**
+ * Verify a certificate of ANY age for one canister and read what it certifies and when.
+ *
+ * Checks, every one required: the BLS signature and its delegation chain verify against `rootKey`
+ * (default: the pinned mainnet key — a local replica's certificate, or one under any other key,
+ * fails here); the delegation covers `canisterId`; the tree carries `/canister/<id>/certified_data`
+ * (a certificate another canister obtained does not — it fails with that said); `/time` is present.
+ * With `witness` and `leafPath`, the witness must reconstruct to the certified root and hold the leaf.
+ * Freshness is NOT checked, by design (the header above says why). Fails closed with a reason.
+ */
+export async function verifyHistoricalCertificate(args) {
+    const fail = (why) => ({
+        verified: false,
+        why,
+        certifiedData: null,
+        signedTimeNs: null,
+        leaf: null,
+    });
+    const principal = typeof args.canisterId === 'string' ? Principal.fromText(args.canisterId) : args.canisterId;
+    const rootKey = args.rootKey ?? hexBytes(IC_MAINNET_ROOT_KEY_HEX);
+    const certBytes = Uint8Array.from(args.certificate);
+    if (certBytes.length === 0)
+        return fail('no certificate');
+    let cert;
+    try {
+        cert = await Certificate.create({
+            certificate: certBytes,
+            rootKey,
+            principal: { canisterId: principal },
+            disableTimeVerification: true,
+        });
+    }
+    catch (e) {
+        return fail(`the certificate does not verify against ${args.rootKey ? 'the given' : 'the pinned IC mainnet'} root key for canister ${principal.toText()} ` +
+            `(a local replica's certificate, one issued on another subnet, or altered bytes): ${e.message}`);
+    }
+    let timeLookup;
+    let dataLookup;
+    try {
+        timeLookup = cert.lookup_path(['time']);
+        dataLookup = cert.lookup_path(['canister', principal.toUint8Array(), 'certified_data']);
+    }
+    catch (e) {
+        return fail(`certificate tree walk failed: ${e.message}`);
+    }
+    if (timeLookup.status !== LookupPathStatus.Found)
+        return fail('the certificate carries no /time');
+    const signedTimeNs = leb128(new Uint8Array(lookupResultToBuffer(timeLookup)));
+    if (dataLookup.status !== LookupPathStatus.Found) {
+        return fail(`the certificate carries no certified data for ${principal.toText()}: it was issued for another canister`);
+    }
+    const certifiedData = new Uint8Array(lookupResultToBuffer(dataLookup));
+    if (args.witness == null || args.leafPath == null) {
+        return { verified: true, why: 'ok', certifiedData, signedTimeNs, leaf: null };
+    }
+    let tree;
+    try {
+        tree = Cbor.decode(Uint8Array.from(args.witness));
+    }
+    catch {
+        return fail('witness is not decodable CBOR');
+    }
+    let root;
+    try {
+        root = new Uint8Array(await reconstruct(tree));
+    }
+    catch {
+        return fail('witness is decodable CBOR but not a hash tree');
+    }
+    if (root.length !== certifiedData.length || !root.every((b, i) => b === certifiedData[i])) {
+        return fail('the witness root does not match the certified data: the witness is not for this certificate');
+    }
+    let leafLookup;
+    try {
+        leafLookup = lookup_path(args.leafPath, tree);
+    }
+    catch {
+        return fail('witness tree is malformed at the requested path');
+    }
+    if (leafLookup.status !== LookupPathStatus.Found)
+        return fail('the leaf is not in the witness');
+    return {
+        verified: true,
+        why: 'ok',
+        certifiedData,
+        signedTimeNs,
+        leaf: new Uint8Array(lookupResultToBuffer(leafLookup)),
+    };
+}
 //# sourceMappingURL=certifiedAudit.js.map

package/dist/certifiedAudit.js.map

@@ -1 +1 @@
-{"version":3,"file":"certifiedAudit.js","sourceRoot":"","sources":["../src/certifiedAudit.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,iGAAiG;AACjG,mGAAmG;AACnG,kGAAkG;AAClG,iGAAiG;AACjG,EAAE;AACF,mGAAmG;AACnG,mGAAmG;AACnG,8FAA8F;AAC9F,iGAAiG;AACjG,4EAA4E;AAE5E,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAqBpD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAgB,EAChB,UAA8B,EAC9B,OAA2B;IAE3B,MAAM,IAAI,GAAsB,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACjG,IAAI,CAAC,OAAO,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,CAAC,yDAAyD;IAEhG,MAAM,SAAS,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAE/F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;IACJ,CAAC;IAED,IAAI,IAAiB,CAAC;IACtB,IAAI,CAAC;QACH,mFAAmF;QACnF,yFAAyF;QACzF,8BAA8B;QAC9B,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,OAAO;YACP,SAAS,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;YACpC,KAAK,EAAE,gFAAgF;SACxF,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,gGAAgG;IAChG,MAAM,OAAO,GACX,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACpE,CAAC;AAED,mGAAmG;AACnG,+FAA+F;AAC/F,mGAAmG;AACnG,qGAAqG;AACrG,kGAAkG;AAClG,kGAAkG;AAElG,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAErE,MAAM,IAAI,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAUpE,6DAA6D;AAC7D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,2FAA2F;AAC3F,6FAA6F;AAC7F,2FAA2F;AAC3F,wFAAwF;AACxF,MAAM,UAAU,QAAQ,CAAC,CAAU;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC;QAC9F,CAAC,CAAC,CAAC,CAAC,MAAM;YACR,CAAC,CAAE,CAAC,CAAC,CAAC,CAA2B;YACjC,CAAC,CAAC,IAAI;QACR,CAAC,CAAE,CAAkC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAgB,EAChB,UAA8B,EAC9B,KAGC,EACD,IAAkB;IAElB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAiB,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC,SAAS,IAAK,SAAwB,CAAC,MAAM,KAAK,CAAC;QACtD,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,IAAK,OAAsB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAE7F,MAAM,SAAS,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/F,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI;QACvB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAEnF,IAAI,IAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC;YAC9B,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,SAAqB,CAAC;YACnD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;YACpC,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC;IACD,+FAA+F;IAC/F,iGAAiG;IACjG,6FAA6F;IAC7F,iGAAiG;IACjG,2FAA2F;IAC3F,iEAAiE;IACjE,IAAI,MAA2C,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,IAAI,CAAC,iCAAkC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,CAAC,KAAK;QAC1C,OAAO,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,oBAAoB,CAAC,MAAM,CAAE,CAAC,CAAC;IAEpE,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAmB,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC/C,CAAC;IACD,8FAA8F;IAC9F,+FAA+F;IAC/F,iGAAiG;IACjG,4FAA4F;IAC5F,iGAAiG;IACjG,gGAAgG;IAChG,8EAA8E;IAC9E,IAAI,QAAoB,CAAC;IACzB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,WAAW,CAAC,IAAa,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAC/D,CAAC;IACD,IACE,QAAQ,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM;QACxC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,EACjD,CAAC;QACD,OAAO,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,IAAoC,CAAC;IACzC,IAAI,CAAC;QACH,IAAI,GAAG,WAAW,CAAC,IAAa,EAAE,IAAa,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACrF,OAAO,EAAE,UAAU,EAAE,IAAI,UAAU,CAAC,oBAAoB,CAAC,IAAI,CAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAChG,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAgB,EAChB,UAA8B,EAC9B,KAKC;IAED,MAAM,CAAC,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU;QAC9B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACvE,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,QAAoB,CAAC,CAAC;IAC5D,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,UAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,UAAU;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oDAAoD;KAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAgB,EAChB,UAA8B,EAC9B,QAA4B,EAC5B,KAIC;IAED,MAAM,MAAM,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtF,OAAO,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAc,EAAE;QAC5D,IAAI,CAAC,SAAS,CAAC;QACf,MAAM,CAAC,YAAY,EAAE;KACtB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"certifiedAudit.js","sourceRoot":"","sources":["../src/certifiedAudit.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,iGAAiG;AACjG,mGAAmG;AACnG,kGAAkG;AAClG,iGAAiG;AACjG,EAAE;AACF,mGAAmG;AACnG,mGAAmG;AACnG,8FAA8F;AAC9F,iGAAiG;AACjG,4EAA4E;AAE5E,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAqBpD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAgB,EAChB,UAA8B,EAC9B,OAA2B;IAE3B,MAAM,IAAI,GAAsB,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACjG,IAAI,CAAC,OAAO,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,CAAC,yDAAyD;IAEhG,MAAM,SAAS,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAE/F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;IACJ,CAAC;IAED,IAAI,IAAiB,CAAC;IACtB,IAAI,CAAC;QACH,mFAAmF;QACnF,yFAAyF;QACzF,8BAA8B;QAC9B,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,OAAO;YACP,SAAS,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;YACpC,KAAK,EAAE,gFAAgF;SACxF,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,gGAAgG;IAChG,MAAM,OAAO,GACX,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACpE,CAAC;AAED,mGAAmG;AACnG,+FAA+F;AAC/F,mGAAmG;AACnG,qGAAqG;AACrG,kGAAkG;AAClG,kGAAkG;AAElG,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAErE,MAAM,IAAI,GAAG,CAAC,CAAS,EAAc,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAUpE,6DAA6D;AAC7D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,2FAA2F;AAC3F,6FAA6F;AAC7F,2FAA2F;AAC3F,wFAAwF;AACxF,MAAM,UAAU,QAAQ,CAAC,CAAU;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC;QAC9F,CAAC,CAAC,CAAC,CAAC,MAAM;YACR,CAAC,CAAE,CAAC,CAAC,CAAC,CAA2B;YACjC,CAAC,CAAC,IAAI;QACR,CAAC,CAAE,CAAkC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAgB,EAChB,UAA8B,EAC9B,KAGC,EACD,IAAkB;IAElB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAiB,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC,SAAS,IAAK,SAAwB,CAAC,MAAM,KAAK,CAAC;QACtD,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,IAAK,OAAsB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAE7F,MAAM,SAAS,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/F,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI;QACvB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAEnF,IAAI,IAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC;YAC9B,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC,SAAqB,CAAC;YACnD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;YACpC,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC;IACD,+FAA+F;IAC/F,iGAAiG;IACjG,6FAA6F;IAC7F,iGAAiG;IACjG,2FAA2F;IAC3F,iEAAiE;IACjE,IAAI,MAA2C,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,IAAI,CAAC,iCAAkC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,CAAC,KAAK;QAC1C,OAAO,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,oBAAoB,CAAC,MAAM,CAAE,CAAC,CAAC;IAEpE,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAmB,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC/C,CAAC;IACD,8FAA8F;IAC9F,+FAA+F;IAC/F,iGAAiG;IACjG,4FAA4F;IAC5F,iGAAiG;IACjG,gGAAgG;IAChG,8EAA8E;IAC9E,IAAI,QAAoB,CAAC;IACzB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,WAAW,CAAC,IAAa,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAC/D,CAAC;IACD,IACE,QAAQ,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM;QACxC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,EACjD,CAAC;QACD,OAAO,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,IAAoC,CAAC;IACzC,IAAI,CAAC;QACH,IAAI,GAAG,WAAW,CAAC,IAAa,EAAE,IAAa,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACrF,OAAO,EAAE,UAAU,EAAE,IAAI,UAAU,CAAC,oBAAoB,CAAC,IAAI,CAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAChG,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAgB,EAChB,UAA8B,EAC9B,KAKC;IAED,MAAM,CAAC,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU;QAC9B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACvE,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,QAAoB,CAAC,CAAC;IAC5D,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,UAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,UAAU;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,OAAO;QACjB,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oDAAoD;KAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAgB,EAChB,UAA8B,EAC9B,QAA4B,EAC5B,KAIC;IAED,MAAM,MAAM,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtF,OAAO,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAc,EAAE;QAC5D,IAAI,CAAC,SAAS,CAAC;QACf,MAAM,CAAC,YAAY,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED,sGAAsG;AACtG,EAAE;AACF,oGAAoG;AACpG,iGAAiG;AACjG,qGAAqG;AACrG,kGAAkG;AAClG,sGAAsG;AACtG,oGAAoG;AACpG,kGAAkG;AAClG,kGAAkG;AAClG,8FAA8F;AAC9F,EAAE;AACF,gGAAgG;AAChG,iDAAiD;AAEjD;mGACmG;AACnG,MAAM,CAAC,MAAM,uBAAuB,GAClC,4QAA4Q,CAAC;AAE/Q,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAc,EAAE;IACzC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACtF,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC,CAAC;AAEF,0FAA0F;AAC1F,SAAS,MAAM,CAAC,GAAe;IAC7B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM;QAC/B,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAcD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,IAMjD;IACC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAyB,EAAE,CAAC,CAAC;QACpD,QAAQ,EAAE,KAAK;QACf,GAAG;QACH,aAAa,EAAE,IAAI;QACnB,YAAY,EAAE,IAAI;QAClB,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;IACH,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC9F,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC1D,IAAI,IAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC;YAC9B,WAAW,EAAE,SAAS;YACtB,OAAO;YACP,SAAS,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;YACpC,uBAAuB,EAAE,IAAI;SAC9B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,IAAI,CACT,2CAA2C,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,uBAAuB,0BAA0B,SAAS,CAAC,MAAM,EAAE,GAAG;YAC5I,oFAAqF,CAAW,CAAC,OAAO,EAAE,CAC7G,CAAC;IACJ,CAAC;IACD,IAAI,UAA+C,CAAC;IACpD,IAAI,UAA+C,CAAC;IACpD,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACxC,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,IAAI,CAAC,iCAAkC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,gBAAgB,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAClG,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,UAAU,CAAC,oBAAoB,CAAC,UAAU,CAAE,CAAC,CAAC,CAAC;IAC/E,IAAI,UAAU,CAAC,MAAM,KAAK,gBAAgB,CAAC,KAAK,EAAE,CAAC;QACjD,OAAO,IAAI,CACT,iDAAiD,SAAS,CAAC,MAAM,EAAE,sCAAsC,CAC1G,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,oBAAoB,CAAC,UAAU,CAAE,CAAC,CAAC;IACxE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;QAClD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,WAAW,CAAC,IAAa,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,+CAA+C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,OAAO,IAAI,CACT,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,IAAI,UAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,QAAiB,EAAE,IAAa,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,gBAAgB,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAChG,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,GAAG,EAAE,IAAI;QACT,aAAa;QACb,YAAY;QACZ,IAAI,EAAE,IAAI,UAAU,CAAC,oBAAoB,CAAC,UAAU,CAAE,CAAC;KACxD,CAAC;AACJ,CAAC"}

package/dist/claude-setup.d.ts

@@ -1,18 +1,27 @@
 /**
  * Claude setup — generates MCP config for Claude Code and Claude Cowork.
+ *
+ * ⟨2026-10-13, the bloat audit⟩ ONE generator, ONE writer. This file built its own
+ * `mcpServers.engramx` entry while @engramx/mcp's `connect` built another (connect-config.ts), and
+ * the two had drifted: this path was macOS-only, the other per-OS; this one wrote atomically, the
+ * other did not; the mainnet spellings and the session-key variable differed. The entry now comes
+ * from connect-config.ts (`claudeDesktopConfig`), the Claude Desktop path is per-OS here, and
+ * `installMcpConfig` — atomic, refusing a config it cannot parse — is the one writer, which
+ * `@engramx/mcp connect --write` uses too.
  */
+import { type StdioServerEntry } from './connect-config.js';
 export interface ClaudeSetupOptions {
     canisterId: string;
-    sessionKeyPath: string;
+    /** The key file the server reads; omitted, the server reads ~/.engramx/session.key. */
+    sessionKeyPath?: string;
     host?: string;
+    /** The @engramx/mcp version the entry runs. Default: this package's (the packages share one);
+     *  `@engramx/mcp connect` passes its own, since npm can pair it with a later client. */
+    version?: string;
 }
 export interface McpConfig {
     mcpServers: {
-        engramx: {
-            command: string;
-            args: string[];
-            env: Record<string, string>;
-        };
+        engramx: StdioServerEntry;
     };
 }
 /** Generate the MCP server config block for Claude. */

package/dist/claude-setup.js

@@ -1,37 +1,50 @@
 /**
  * Claude setup — generates MCP config for Claude Code and Claude Cowork.
+ *
+ * ⟨2026-10-13, the bloat audit⟩ ONE generator, ONE writer. This file built its own
+ * `mcpServers.engramx` entry while @engramx/mcp's `connect` built another (connect-config.ts), and
+ * the two had drifted: this path was macOS-only, the other per-OS; this one wrote atomically, the
+ * other did not; the mainnet spellings and the session-key variable differed. The entry now comes
+ * from connect-config.ts (`claudeDesktopConfig`), the Claude Desktop path is per-OS here, and
+ * `installMcpConfig` — atomic, refusing a config it cannot parse — is the one writer, which
+ * `@engramx/mcp connect --write` uses too.
  */
 import * as fs from 'fs';
+import * as os from 'os';
 import * as path from 'path';
 import { atomicWriteFileSync } from './path-utils.js';
+import { VERSION } from './version.js';
+import { claudeDesktopConfig } from './connect-config.js';
 /** Generate the MCP server config block for Claude. */
 export function generateMcpConfig(options) {
-    const env = {
-        ENGRAM_CANISTER_ID: options.canisterId,
-        ENGRAM_SESSION_KEY_PATH: options.sessionKeyPath,
-    };
-    if (options.host && options.host !== 'https://ic0.app') {
-        env['ENGRAM_HOST'] = options.host;
+    return claudeDesktopConfig({
+        canisterId: options.canisterId,
+        host: options.host,
+        clientVersion: options.version ?? VERSION,
+        sessionKeyPath: options.sessionKeyPath,
+    });
+}
+/** The default claude_desktop_config.json path for this OS. */
+function claudeDesktopConfigPath(home) {
+    switch (os.platform()) {
+        case 'darwin':
+            return path.join(home, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json');
+        case 'win32':
+            return path.join(process.env['APPDATA'] || path.join(home, 'AppData', 'Roaming'), 'Claude', 'claude_desktop_config.json');
+        default:
+            return path.join(home, '.config', 'Claude', 'claude_desktop_config.json');
     }
-    return {
-        mcpServers: {
-            engramx: {
-                command: 'npx',
-                args: ['-y', '@engramx/mcp'],
-                env,
-            },
-        },
-    };
 }
 /** Return the config paths for each Claude product. */
 export function claudeConfigPaths() {
-    const home = process.env['HOME'] || '';
+    const home = process.env['HOME'] || os.homedir();
     return {
         // Claude Code reads user-scope MCP servers from ~/.claude.json (the file
         // `claude mcp add --scope user` writes). ~/.claude/settings.json does NOT
         // carry mcpServers — writing there is a silent no-op for the user.
         claudeCode: path.join(home, '.claude.json'),
-        claudeDesktop: path.join(home, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json'),
+        // ⟨2026-10-13⟩ Per-OS; it was the macOS path everywhere until the two generators merged.
+        claudeDesktop: claudeDesktopConfigPath(home),
     };
 }
 /**

package/dist/claude-setup.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-setup.js","sourceRoot":"","sources":["../src/claude-setup.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAkBtD,uDAAuD;AACvD,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,MAAM,GAAG,GAA2B;QAClC,kBAAkB,EAAE,OAAO,CAAC,UAAU;QACtC,uBAAuB,EAAE,OAAO,CAAC,cAAc;KAChD,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACvD,GAAG,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IACpC,CAAC;IAED,OAAO;QACL,UAAU,EAAE;YACV,OAAO,EAAE;gBACP,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,CAAC,IAAI,EAAE,cAAc,CAAC;gBAC5B,GAAG;aACJ;SACF;KACF,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,iBAAiB;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACvC,OAAO;QACL,yEAAyE;QACzE,0EAA0E;QAC1E,mEAAmE;QACnE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;QAC3C,aAAa,EAAE,IAAI,CAAC,IAAI,CACtB,IAAI,EACJ,SAAS,EACT,qBAAqB,EACrB,QAAQ,EACR,4BAA4B,CAC7B;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,OAA2B;IAC9E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAC7C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC,CAAC,UAAU,CAAC;IAEf,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3E,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;YACD,QAAQ,GAAG,MAAiC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uEAAuE;YACvE,+EAA+E;YAC/E,MAAM,IAAI,KAAK,CACb,mBAAmB,YAAY,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI;gBACtF,wDAAwD,EAC1D,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAI,QAAQ,CAAC,YAAY,CAA6B,IAAI,EAAE,CAAC;IAC1E,OAAO,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;IACjD,QAAQ,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC;IAEjC,yEAAyE;IACzE,4EAA4E;IAC5E,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"claude-setup.js","sourceRoot":"","sources":["../src/claude-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAyB,MAAM,qBAAqB,CAAC;AAgBjF,uDAAuD;AACvD,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,OAAO,mBAAmB,CAAC;QACzB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,aAAa,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO;QACzC,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;AACL,CAAC;AAED,+DAA+D;AAC/D,SAAS,uBAAuB,CAAC,IAAY;IAC3C,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;QACtB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,IAAI,CACd,IAAI,EACJ,SAAS,EACT,qBAAqB,EACrB,QAAQ,EACR,4BAA4B,CAC7B,CAAC;QACJ,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,EAC/D,QAAQ,EACR,4BAA4B,CAC7B,CAAC;QACJ;YACE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,iBAAiB;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACjD,OAAO;QACL,yEAAyE;QACzE,0EAA0E;QAC1E,mEAAmE;QACnE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;QAC3C,yFAAyF;QACzF,aAAa,EAAE,uBAAuB,CAAC,IAAI,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,OAA2B;IAC9E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAC7C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC,CAAC,UAAU,CAAC;IAEf,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3E,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;YACD,QAAQ,GAAG,MAAiC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,uEAAuE;YACvE,+EAA+E;YAC/E,MAAM,IAAI,KAAK,CACb,mBAAmB,YAAY,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI;gBACtF,wDAAwD,EAC1D,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAI,QAAQ,CAAC,YAAY,CAA6B,IAAI,EAAE,CAAC;IAC1E,OAAO,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;IACjD,QAAQ,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC;IAEjC,yEAAyE;IACzE,4EAA4E;IAC5E,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC9E,CAAC"}

package/dist/cli.d.ts

@@ -1,2 +1,8 @@
 #!/usr/bin/env node
-export {};
+/**
+ * The run this module starts when it is loaded — the command line's whole life.
+ * ⟨2026-10-13⟩ Exported so a test can load the CLI with stubbed network modules and wait for the
+ * command to END (test/pair-migrate.test.ts); before, a test could only wait one tick, which is
+ * enough for --help and not for pair.
+ */
+export declare const finished: Promise<void>;