@engramx/client 0.16.0-rc.20 → 0.16.0-rc.22

package/dist/openEngram.js

@@ -31,11 +31,39 @@
 //
 // This module holds the whole command so a test can drive it with a stub engram and no network;
 // cli.ts only parses flags and passes the terminal in.
+//
+// ⟨ADDED 2026-11-02, the child build's stage 8 — the owner's rulings "1-4 all as you recommended",
+// "choice 4 without hand over" and "1 yes, but the child can ask again", and the build's resolution
+// L20⟩ THE SIGN-IN, THE SEAL AND THE VERSION CHECK. An engram opened this way is born with a sign-in:
+// the person running the agent, on a second credential. The sign-in approves what the key file
+// cannot (payments over the limits, sellers, trading keys, lifting freezes, guardians) and alone opens
+// the sealed copy of this key; the key file keeps every everyday act and can loosen nothing. The
+// command now:
+//   2a  reads the version of the engram it opens through and REFUSES one older than
+//       SIGN_IN_FLOOR_VERSION (L20) — an older engram cannot carry a sign-in to the registry, and an
+//       engram opened with none keeps small limits for life;
+//   2b  settles the sign-in BEFORE anything is spent: `--sign-in <principal>` (checked by
+//       `signInRefusal`), `--no-sign-in` (the "small limits for life, no recovery" warning), or — only
+//       at a terminal and without `--yes` — the registry's offer (`getChildSignInOffer`, read as the
+//       lasting key) printed in full with "is this yours?", else a pasted principal. A run with no
+//       terminal, or with `--yes`, and neither flag is REFUSED: `--yes` alone never picks a sign-in,
+//       because nobody would have confirmed it;
+//   4   opens with that sign-in (`openChild({ signIn })` on the engram);
+//   4b  seals a copy of the lasting key to the sign-in and stores it in the opened engram as its owner
+//       (`sealOpenedEngram`), retried for up to a minute (the engram is seconds old). A failed seal
+//       does not fail the command: the engram is open, and the printed `seal-key` command finishes it.
+// WHAT WOULD MAKE THIS WRONG: the engram's door accepting a sign-in this kit refuses or the reverse
+// (both follow the registry's three rules plus the session key); the offer disclosing an owner for an
+// engram that is not a first engram (the registry answers none then, and the kit never offers one).
 import * as fs from 'fs';
 import * as path from 'path';
+import { Actor, HttpAgent } from '@icp-sdk/core/agent';
+import { Principal } from '@icp-sdk/core/principal';
 import { loadSessionKey } from './auth.js';
 import { EngramClient } from './EngramClient.js';
-import { CanisterRefusal } from './wire.js';
+import { sealToPrincipal } from './encryption.js';
+import { registrySubset } from './idl.js';
+import { CanisterRefusal, unwrapResult } from './wire.js';
 import { VERSION, pairCommand } from './version.js';
 /**
  * ⟨2026-10-06⟩ A path as one shell word: as-is when it holds only characters no shell treats
@@ -49,6 +77,84 @@ export function shellWord(s) {
 /** The sentence printed when the owner has allowed nothing. Exported for the test. */
 export const NOT_ALLOWED = 'The owner of the wallet has not allowed this agent to open an engram of its own. ' +
     'Ask the owner to set it on the Access page.';
+/**
+ * ⟨ADDED 2026-11-02, the build's resolution L20⟩ The first release whose engram carries a sign-in to
+ * the registry when it opens another (`openChild({ signIn })`). An engram older than this cannot: an
+ * rc.21 engram serves only `openChildEngram()` and would open with NO sign-in — for life — so the
+ * command refuses before anything is spent.
+ * WHAT WOULD MAKE THIS WRONG: the release that ships the sign-in being cut under another number
+ * (then this constant moves with it, in the same commit as the cut).
+ */
+export const SIGN_IN_FLOOR_VERSION = '0.16.0-rc.22';
+/** ⟨ADDED 2026-11-02, stage 8⟩ Printed before opening with no sign-in. Exported for the test. */
+export const NO_SIGN_IN_WARNING = 'Opening with no sign-in: this engram keeps small limits for life. Nothing can approve a payment ' +
+    'over them, add a seller or lift a freeze, and no sealed copy of this key is kept, so a lost key ' +
+    'file cannot be recovered. Nobody can add a sign-in later.';
+/** ⟨ADDED 2026-11-02, stage 8⟩ Printed when the stored copy is confirmed. Exported for the test. */
+export const SEALED_LINE = 'A sealed copy of this key is stored in the engram; only your sign-in can open it.';
+/**
+ * ⟨ADDED 2026-11-02, stage 8⟩ Compare two release versions (`major.minor.patch` with an optional
+ * `-rc.N`; a release candidate sorts BEFORE its release, and rc numbers compare as numbers, so rc.3 is
+ * older than rc.22). Negative, zero or positive like a sort comparator; null when either is not of
+ * that form — the caller then refuses, because it cannot tell.
+ */
+export function compareVersions(a, b) {
+    const parse = (v) => {
+        const m = /^(\d+)\.(\d+)\.(\d+)(?:-rc\.(\d+))?$/.exec(v.trim());
+        if (!m)
+            return null;
+        return [Number(m[1]), Number(m[2]), Number(m[3]), m[4] === undefined ? Infinity : Number(m[4])];
+    };
+    const x = parse(a);
+    const y = parse(b);
+    if (!x || !y)
+        return null;
+    for (let i = 0; i < 4; i++) {
+        if (x[i] !== y[i])
+            return x[i] < y[i] ? -1 : 1;
+    }
+    return 0;
+}
+/** The management canister's id and any opaque canister id — the registry's `Funnel.isCanisterPrincipal`
+ *  (1 to 10 bytes, the last one 1), plus the empty id, as the engram's `OwnerSignIn.candidateRefusal`. */
+function isCanister(p) {
+    const b = p.toUint8Array();
+    return b.length === 0 || (b.length <= 10 && b[b.length - 1] === 1);
+}
+/**
+ * ⟨ADDED 2026-11-02, stage 8⟩ Why `text` cannot be the opened engram's sign-in, or null when it can.
+ * The registry's and the engram's doors refuse the same (defence in depth: this refusal comes before
+ * anything is spent and names the remedy):
+ *   · text that is not a principal;
+ *   · the anonymous principal — nobody can sign in as it;
+ *   · the lasting key — the sign-in is a SECOND credential, never the key file that owns the engram;
+ *   · the session key — a key the agent's software holds would approve its own requests;
+ *   · a canister, the management canister included — a canister is never a person's sign-in.
+ */
+export function signInRefusal(text, keys) {
+    let p;
+    try {
+        p = Principal.fromText(text.trim());
+    }
+    catch {
+        return `"${text}" is not a principal. A sign-in's principal looks like xxxxx-xxxxx-…-xxx.`;
+    }
+    if (p.isAnonymous()) {
+        return 'The sign-in named is the anonymous principal, which nobody can sign in as.';
+    }
+    if (p.toText() === keys.root.toText()) {
+        return ("The sign-in named is this agent's lasting key — the key file that will own the engram. " +
+            'The sign-in is your second credential, never that key.');
+    }
+    if (p.toText() === keys.session.toText()) {
+        return ('The sign-in named is the key this agent calls with. The sign-in is your own sign-in, never a ' +
+            "key the agent's software holds.");
+    }
+    if (isCanister(p)) {
+        return 'The sign-in named is a canister, not a person’s sign-in.';
+    }
+    return null;
+}
 function resolveHome(p) {
     return p.startsWith('~') ? path.join(process.env['HOME'] || '', p.slice(1)) : p;
 }
@@ -76,6 +182,95 @@ function refusalText(e) {
         return e.text;
     return e instanceof Error ? e.message : String(e);
 }
+const sameBytes = (a, b) => a.length === b.length && a.every((x, i) => x === b[i]);
+/** The lasting key: its identity and its 32 bytes (the seal's plaintext). Throws with the reason. */
+function loadLastingKey(rootFile) {
+    const identity = loadSessionKey(rootFile); // checks: no symlink, mode 0600, 32 bytes
+    return { identity, seed: new Uint8Array(fs.readFileSync(rootFile)) };
+}
+/** The registry's offer read, signed by the lasting key (the door's own admission fact: that key has
+ *  an open engagement on the engram it opens through). A narrowed view of the generated interface. */
+function registryAs(identity, host) {
+    return (registryId) => {
+        const agent = HttpAgent.createSync({ identity, host, shouldFetchRootKey: isLocalHost(host) });
+        const actor = Actor.createActor(registrySubset(['getChildSignInOffer']), {
+            agent,
+            canisterId: registryId,
+        });
+        return {
+            async getChildSignInOffer(parent) {
+                const ok = unwrapResult(await actor['getChildSignInOffer'](parent), 'getChildSignInOffer');
+                return {
+                    parentOwner: ok.parentOwner[0] ?? null,
+                    parentIsFirstEngram: ok.parentIsFirstEngram,
+                    parentActive: ok.parentActive,
+                };
+            },
+        };
+    };
+}
+const SEAL_RETRY_FOR_MS = 60000;
+const SEAL_RETRY_EVERY_MS = 5000;
+/**
+ * ⟨ADDED 2026-11-02, stage 8⟩ Seal the lasting key to `signIn` and store it in the opened engram as
+ * its owner, then read the stored copy back and require it to be the copy made here. Retried for up to
+ * a minute on anything that may pass (a network error, `#Unavailable`). A `#Conflict` on the store
+ * means a copy is already held: if it is byte for byte the one made here, an earlier attempt landed
+ * (its reply was lost) and the seal is done; otherwise someone else stored first — a copy this kit
+ * cannot check, which it says (the Challenge's C2.11), never "sealed". Any other refusal stops at once.
+ * Returns null on success, else the reason.
+ */
+async function sealOpenedEngram(opened, ownerKey, signIn, deps) {
+    const deadline = deps.now() + SEAL_RETRY_FOR_MS;
+    let ciphertext = null;
+    for (;;) {
+        try {
+            if (!ciphertext) {
+                const verificationKey = await opened.getKeyBackupVerificationKey();
+                ciphertext = await deps.seal(ownerKey, verificationKey, signIn);
+            }
+            // ⟨CORRECTED 2026-11-03, the pre-gate fixes (stage-8 review m2), beside the comment below⟩ A
+            // `#Conflict` is not only "a copy is already held": the store also answers it for "no sign-in
+            // seated" (the named person declined in the seconds before the seal) and "a first engram". So
+            // the store's own sentence is kept, and when the read-back then finds no copy at all, THAT
+            // sentence is the reason — never the read-back's "holds no sealed copy", which hid why.
+            let conflict = null;
+            try {
+                await opened.storeKeyBackup(ciphertext);
+            }
+            catch (e) {
+                if (!(e instanceof CanisterRefusal && e.kind === 'Conflict'))
+                    throw e;
+                // A copy is already held: ours (an earlier attempt landed) or someone else's.
+                conflict = e.text;
+            }
+            let stored;
+            try {
+                stored = await opened.getKeyBackupCiphertext();
+            }
+            catch (e) {
+                if (conflict !== null && e instanceof CanisterRefusal && e.kind === 'NotFound')
+                    return conflict;
+                throw e;
+            }
+            if (sameBytes(stored, ciphertext))
+                return null;
+            // ⟨2026-11-03, the pre-gate fixes⟩ The last sentence now says HOW the sign-in finds out: both
+            // ways it can open the copy check that it opens to this engram's owner key, and say so if not.
+            return ('the engram already holds a sealed copy that is not the one made here, so this kit cannot ' +
+                'tell whether it is a copy of this key. Only your sign-in can find out, by opening it — an ' +
+                "owner console's check of the sealed copy, or the owner kit's --recover-key — each of which " +
+                "says whether it opens to this engram's owner key.");
+        }
+        catch (e) {
+            const why = refusalText(e);
+            const passes = !(e instanceof CanisterRefusal) || e.kind === 'Unavailable' || e.kind === 'Other';
+            if (!passes || deps.now() >= deadline)
+                return why;
+            await deps.sleep(SEAL_RETRY_EVERY_MS);
+        }
+    }
+}
 /**
  * Open an engram of this agent's own through the engram it works in. Prints what it does; returns
  * the exit code (and, on success, what was opened). Never throws for a refusal — every refusal is
@@ -86,6 +281,7 @@ export async function openEngram(options, deps) {
     const keyPath = options.keyPath || '~/.engramx/session.key';
     const rootKeyPath = options.rootKeyPath || '~/.engramx/root.key';
     const rootFile = path.resolve(resolveHome(rootKeyPath));
+    const host = options.host || 'https://ic0.app';
     // 1. The lasting key: it must already exist. It is never created here — a new lasting key is a
     //    new agent, and it would own the engram this opens.
     if (!present(rootFile)) {
@@ -94,24 +290,26 @@ export async function openEngram(options, deps) {
             'If the lasting key is in another file, pass --root-key <path>.');
         return { exitCode: 1 };
     }
-    let rootPrincipal;
+    let root;
     try {
-        rootPrincipal = loadSessionKey(rootFile).getPrincipal().toText();
+        root = loadLastingKey(rootFile);
     }
     catch (e) {
         io.err(`Cannot use the lasting key at ${rootFile}: ${e.message}. ` +
             'Nothing was opened, and the file was not changed.');
         return { exitCode: 1 };
     }
+    const rootPrincipal = root.identity.getPrincipal();
+    // ⟨2026-11-02, stage 8⟩ Two names for the sign-in is no name: refused before anything is read.
+    if (options.signIn !== undefined && options.noSignIn) {
+        io.err('--sign-in and --no-sign-in were both given; pass one. Nothing was opened.');
+        return { exitCode: 1 };
+    }
     let engram;
     try {
         engram =
             deps.engram ??
-                new EngramClient({
-                    canisterId: options.canisterId,
-                    sessionKeyPath: keyPath,
-                    host: options.host || 'https://ic0.app',
-                });
+                new EngramClient({ canisterId: options.canisterId, sessionKeyPath: keyPath, host });
     }
     catch (e) {
         io.err(`Cannot use the key for this engram (${keyPath}): ${e.message}`);
@@ -133,18 +331,112 @@ export async function openEngram(options, deps) {
     // The engram makes the lasting key it holds for this agent the owner. If that is not the key in
     // this file, the file could not act as the owner of what is opened — stop before anything leaves.
     const recordedRoot = allowance.root.toText();
-    if (recordedRoot !== rootPrincipal) {
-        io.err(`The lasting key at ${rootFile} is ${rootPrincipal}, but this agent was paired with ` +
+    if (recordedRoot !== rootPrincipal.toText()) {
+        io.err(`The lasting key at ${rootFile} is ${rootPrincipal.toText()}, but this agent was paired with ` +
             `${options.canisterId} under the lasting key ${recordedRoot}, and the engram would make ` +
             `${recordedRoot} the owner of what it opens. Pass --root-key with the file that holds ` +
             `${recordedRoot}. Nothing was opened.`);
         return { exitCode: 1 };
     }
+    // 2a. ⟨2026-11-02, L20⟩ The engram opened through must carry a sign-in to the registry.
+    let version;
+    try {
+        version = (await engram.status()).version;
+    }
+    catch (e) {
+        io.err(`Could not read the version of the engram you open through (${refusalText(e)}). ` +
+            'Nothing was opened.');
+        return { exitCode: 1 };
+    }
+    const cmp = compareVersions(version, SIGN_IN_FLOOR_VERSION);
+    if (cmp === null || cmp < 0) {
+        io.err(`The engram you open through runs ${version || 'an unnamed version'}; opening an engram through ` +
+            `it needs ${SIGN_IN_FLOOR_VERSION} or later, because an older one cannot give what it opens ` +
+            'a sign-in. Upgrade the engram you open through first. Nothing was opened.');
+        return { exitCode: 1 };
+    }
+    // The registry that opens it: read here because the offer comes from it, and printed afterwards in
+    // the owner kit's command. Public; a failure is said, never invented.
+    const registry = await engram.getSpawnedBy().then((p) => p?.toText() ?? null, () => null);
+    // 2b. ⟨2026-11-02, stage 8⟩ The sign-in, settled before anything is spent.
+    const keys = { root: rootPrincipal, session: engram.getPrincipal() };
+    const asking = Boolean(options.interactive) && !options.yes;
+    let signIn;
+    if (options.signIn !== undefined) {
+        const why = signInRefusal(options.signIn, keys);
+        if (why) {
+            io.err(`${why} Nothing was opened.`);
+            return { exitCode: 1 };
+        }
+        signIn = Principal.fromText(options.signIn.trim());
+    }
+    else if (options.noSignIn) {
+        io.out(NO_SIGN_IN_WARNING);
+        signIn = null;
+    }
+    else if (!asking) {
+        io.err('Name this engram’s sign-in: pass --sign-in <principal> (your own sign-in, a second ' +
+            'credential) or --no-sign-in (small limits for life, and no recovery of this key). ' +
+            '--yes never picks one. Nothing was opened.');
+        return { exitCode: 1 };
+    }
+    else {
+        let offered = null;
+        if (registry) {
+            try {
+                const offer = await (deps.registry ?? registryAs(root.identity, host))(registry).getChildSignInOffer(Principal.fromText(options.canisterId));
+                if (offer.parentIsFirstEngram && offer.parentOwner)
+                    offered = offer.parentOwner;
+            }
+            catch (e) {
+                io.out(`(The owner of the engram you open through could not be read: ${refusalText(e)})`);
+            }
+        }
+        let chosen = null;
+        if (offered) {
+            const p = offered.toText();
+            // ⟨CORRECTED 2026-11-03, the pre-gate fixes (stage-8 review m3; the Challenge's C2.10: "the copy
+            // must say so")⟩ The offer ended "…lifts freezes and opens the sealed copy of this key." It did
+            // not say what opening the copy MEANS: the sign-in can restore this key and act as this engram's
+            // owner in full. This is the sentence where a "y" hands someone the engram, so it says so now.
+            io.out(`The engram you open through belongs to ${p}. If that is you, it becomes this engram's ` +
+                'sign-in: it approves payments over the limits, adds sellers, approves trading keys, lifts ' +
+                'freezes and opens the sealed copy of this key — so it can restore this key and act as ' +
+                "this engram's owner in full. Say yes only if that is you.");
+            if (await io.confirm(`Is ${p} yours?`))
+                chosen = p;
+        }
+        if (chosen === null) {
+            const pasted = (await io.ask("Paste the principal of your sign-in (your Internet Identity's, or a second key file's), " +
+                'or press Enter to open without one:')).trim();
+            if (pasted === '') {
+                io.out(NO_SIGN_IN_WARNING);
+                if (!(await io.confirm('Open it with no sign-in?'))) {
+                    io.out('Nothing was opened.');
+                    return { exitCode: 0 };
+                }
+            }
+            else {
+                chosen = pasted;
+            }
+        }
+        if (chosen !== null) {
+            const why = signInRefusal(chosen, keys);
+            if (why) {
+                io.err(`${why} Nothing was opened.`);
+                return { exitCode: 1 };
+            }
+            signIn = Principal.fromText(chosen);
+        }
+        else {
+            signIn = null;
+        }
+    }
     // 3. The one warning the owner kit already carries, before anything happens.
     io.out(`The engram you are about to open will be owned by this agent's lasting key, which lives on ` +
         `this machine (${rootFile}). Whoever holds that file owns that engram. Back it up; loss is ` +
         'permanent loss of ownership.');
-    if (!options.yes && options.interactive) {
+    if (asking) {
         if (!(await io.confirm('Open it?'))) {
             io.out('Nothing was opened.');
             return { exitCode: 0 };
@@ -153,22 +445,47 @@ export async function openEngram(options, deps) {
     // 4. Ask.
     let opened;
     try {
-        opened = await engram.openChildEngram();
+        opened = await engram.openChildEngram(signIn ?? undefined);
     }
     catch (e) {
         io.err(refusalText(e));
         return { exitCode: 1 };
     }
     const openedText = opened.toText();
-    const registry = await engram.getSpawnedBy().then((p) => p?.toText() ?? null, () => null);
-    const host = options.host;
-    const hostFlags = host ? (isLocalHost(host) ? ` --local --host ${host}` : ` --host ${host}`) : '';
+    const hostFlags = options.host
+        ? isLocalHost(options.host)
+            ? ` --local --host ${options.host}`
+            : ` --host ${options.host}`
+        : '';
     const registryFlag = registry ? ` --registry ${registry}` : '';
     // ⟨2026-10-06⟩ Pinned to this build's version and the key file printed as one shell word — the
     // header's dated correction says why.
     const ownerCommand = `npx @engramx/owner@${VERSION} --connect --key-file ${shellWord(rootFile)}${registryFlag}${hostFlags}`;
     io.out(`Opened an engram of your own: ${openedText}`);
-    io.out(`Owner: this agent's lasting key (${rootPrincipal})`);
+    io.out(`Owner: this agent's lasting key (${rootPrincipal.toText()})`);
+    // 4b. ⟨2026-11-02, stage 8⟩ The seal. The opening cannot be undone; the seal can be retried.
+    let sealed = false;
+    if (signIn) {
+        io.out(`Sign-in: ${signIn.toText()}`);
+        const why = await sealOpenedEngram((deps.opened ??
+            ((id) => new EngramClient({ canisterId: id, sessionKeySeed: root.seed, host })))(openedText), root.seed, signIn, {
+            seal: deps.seal ?? sealToPrincipal,
+            sleep: deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))),
+            now: deps.now ?? Date.now,
+        });
+        if (why === null) {
+            sealed = true;
+            io.out(SEALED_LINE);
+        }
+        else {
+            io.err(`The sealed copy of this key was not stored: ${why}`);
+            io.err('The engram is open. Store the copy with:');
+            io.err(`  npx @engramx/client@${VERSION} seal-key --engram ${openedText} --root-key ${shellWord(rootFile)} --sign-in ${signIn.toText()}${options.host ? ` --host ${options.host}` : ''}`);
+        }
+    }
+    else {
+        io.out('Sign-in: none — this engram keeps small limits for life.');
+    }
     io.out('');
     io.out('Pair an agent of your own into it:');
     io.out(`  ${ownerCommand}`);
@@ -176,10 +493,88 @@ export async function openEngram(options, deps) {
         io.out('  (The registry could not be read just now: add --registry with its id, or set ENGRAMX_REGISTRY.)');
     }
     io.out('  (It prints the pairing command for that agent; add --agent-name to label it.)');
-    io.out('Set its limits, ceiling and guardians as its owner by calling the engram with the same key');
+    // ⟨CORRECTED 2026-11-02, stage 8⟩ Said "Set its limits, ceiling and guardians as its owner by
+    // calling the engram with the same key" — false for an engram opened this way from rc.22: its key
+    // file can loosen nothing, and guardians are seated by its sign-in.
+    io.out('As its owner, the same key file pays within its limits, pairs agents, freezes and tightens; it ' +
+        'loosens nothing — approvals, sellers, lifting a freeze and guardians are for its sign-in');
     // ⟨CORRECTED 2026-10-06⟩ Said "(the owner kit creates and connects; …)" — false from rc.3: the
     // kit no longer creates engrams (the owner's ruling of 2026-10-05).
     io.out('(the owner kit shows that engram and connects agents to it; every other owner method is a direct call — see its README, "Acting as an owner").');
-    return { exitCode: 0, opened: openedText, owner: rootPrincipal };
+    return {
+        exitCode: 0,
+        opened: openedText,
+        owner: rootPrincipal.toText(),
+        signIn: signIn ? signIn.toText() : null,
+        sealed,
+    };
+}
+/**
+ * ⟨ADDED 2026-11-02, stage 8⟩ `seal-key`: the seal alone, for an engram whose opening printed that the
+ * copy was not stored. Signed by the lasting key (the engram's owner). It seals ONLY for the sign-in
+ * the engram has seated — a copy sealed for anyone else could never be opened, and the store is set
+ * once — and refuses an engram that already holds a copy.
+ */
+export async function sealKey(options, deps) {
+    const { io } = deps;
+    const rootFile = path.resolve(resolveHome(options.rootKeyPath || '~/.engramx/root.key'));
+    const host = options.host || 'https://ic0.app';
+    let root;
+    try {
+        root = loadLastingKey(rootFile);
+    }
+    catch (e) {
+        io.err(`Cannot use the lasting key at ${rootFile}: ${e.message}. Nothing was stored.`);
+        return { exitCode: 1 };
+    }
+    const opened = (deps.opened ?? ((id) => new EngramClient({ canisterId: id, sessionKeySeed: root.seed, host })))(options.canisterId);
+    let view;
+    try {
+        view = await opened.getOwnerSignIn();
+    }
+    catch (e) {
+        io.err(`${refusalText(e)} Nothing was stored.`);
+        return { exitCode: 1 };
+    }
+    if (view.openedFrom.length === 0) {
+        io.err(`Engram ${options.canisterId} was not opened through another engram; its owner holds its own ` +
+            'key, and there is no sign-in to seal a copy for. Nothing was stored.');
+        return { exitCode: 1 };
+    }
+    const seated = view.ownerSignIn[0] ?? null;
+    if (!seated) {
+        io.err(`Engram ${options.canisterId} has no sign-in seated, so nobody could open a copy. Nothing was stored.`);
+        return { exitCode: 1 };
+    }
+    if (options.signIn !== undefined && options.signIn.trim() !== seated.toText()) {
+        io.err(`The engram's sign-in is ${seated.toText()}, not ${options.signIn.trim()}; a copy sealed for ` +
+            'anyone else could never be opened. Nothing was stored.');
+        return { exitCode: 1 };
+    }
+    let status;
+    try {
+        status = await opened.getKeyBackupStatus();
+    }
+    catch (e) {
+        io.err(`${refusalText(e)} Nothing was stored.`);
+        return { exitCode: 1 };
+    }
+    if (status.sealed) {
+        const forWhom = status.sealedFor[0]?.toText() ?? 'nobody named';
+        io.err(`Engram ${options.canisterId} already holds a sealed copy (for ${forWhom}); the copy is stored ` +
+            `once.${status.matchesSignIn ? '' : ' It is not sealed for the sign-in seated now.'} Nothing was stored.`);
+        return { exitCode: 1 };
+    }
+    const why = await sealOpenedEngram(opened, root.seed, seated, {
+        seal: deps.seal ?? sealToPrincipal,
+        sleep: deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))),
+        now: deps.now ?? Date.now,
+    });
+    if (why !== null) {
+        io.err(`The sealed copy of this key was not stored: ${why}`);
+        return { exitCode: 1 };
+    }
+    io.out(SEALED_LINE);
+    return { exitCode: 0 };
 }
 //# sourceMappingURL=openEngram.js.map

package/dist/openEngram.js.map

@@ -1 +1 @@
-{"version":3,"file":"openEngram.js","sourceRoot":"","sources":["../src/openEngram.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,2FAA2F;AAC3F,4FAA4F;AAC5F,mGAAmG;AACnG,6EAA6E;AAC7E,EAAE;AACF,qGAAqG;AACrG,mGAAmG;AACnG,oGAAoG;AACpG,gGAAgG;AAChG,+FAA+F;AAC/F,iEAAiE;AACjE,kGAAkG;AAClG,kGAAkG;AAClG,oGAAoG;AACpG,mFAAmF;AACnF,oGAAoG;AACpG,6FAA6F;AAC7F,sGAAsG;AACtG,gGAAgG;AAChG,kGAAkG;AAClG,mGAAmG;AACnG,qGAAqG;AACrG,iGAAiG;AACjG,iGAAiG;AACjG,2FAA2F;AAC3F,uEAAuE;AACvE,EAAE;AACF,gGAAgG;AAChG,uDAAuD;AAEvD,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,CAAS;IACjC,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAClF,CAAC;AAyCD,sFAAsF;AACtF,MAAM,CAAC,MAAM,WAAW,GACtB,mFAAmF;IACnF,6CAA6C,CAAC;AAEhD,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACjC,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,WAAW,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,CAAC,YAAY,eAAe;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IAChD,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAA0B,EAC1B,IAAqD;IAErD,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAExD,+FAA+F;IAC/F,wDAAwD;IACxD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvB,EAAE,CAAC,GAAG,CACJ,oCAAoC,QAAQ,iBAAiB;YAC3D,KAAK,WAAW,EAAE,MAAM;YACxB,gEAAgE,CACnE,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,CAAC;IACnE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,EAAE,CAAC,GAAG,CACJ,iCAAiC,QAAQ,KAAM,CAAW,CAAC,OAAO,IAAI;YACpE,mDAAmD,CACtD,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IAED,IAAI,MAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM;YACJ,IAAI,CAAC,MAAM;gBACX,IAAI,YAAY,CAAC;oBACf,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,cAAc,EAAE,OAAO;oBACvB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,iBAAiB;iBACxC,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,uCAAuC,OAAO,MAAO,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IAED,kDAAkD;IAClD,IAAI,SAA4B,CAAC;IACjC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,IAAI,SAAS,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QAC/B,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACpB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IAED,gGAAgG;IAChG,kGAAkG;IAClG,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IAC7C,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;QACnC,EAAE,CAAC,GAAG,CACJ,sBAAsB,QAAQ,OAAO,aAAa,mCAAmC;YACnF,GAAG,OAAO,CAAC,UAAU,0BAA0B,YAAY,8BAA8B;YACzF,GAAG,YAAY,wEAAwE;YACvF,GAAG,YAAY,uBAAuB,CACzC,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IAED,6EAA6E;IAC7E,EAAE,CAAC,GAAG,CACJ,6FAA6F;QAC3F,iBAAiB,QAAQ,mEAAmE;QAC5F,8BAA8B,CACjC,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACpC,EAAE,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YAC9B,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED,UAAU;IACV,IAAI,MAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;IAEnC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC,IAAI,CAC/C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,IAAI,EAC1B,GAAG,EAAE,CAAC,IAAI,CACX,CAAC;IAEF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,eAAe,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,+FAA+F;IAC/F,sCAAsC;IACtC,MAAM,YAAY,GAAG,sBAAsB,OAAO,yBAAyB,SAAS,CAAC,QAAQ,CAAC,GAAG,YAAY,GAAG,SAAS,EAAE,CAAC;IAE5H,EAAE,CAAC,GAAG,CAAC,iCAAiC,UAAU,EAAE,CAAC,CAAC;IACtD,EAAE,CAAC,GAAG,CAAC,oCAAoC,aAAa,GAAG,CAAC,CAAC;IAC7D,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACX,EAAE,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAC7C,EAAE,CAAC,GAAG,CAAC,KAAK,YAAY,EAAE,CAAC,CAAC;IAC5B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,EAAE,CAAC,GAAG,CACJ,mGAAmG,CACpG,CAAC;IACJ,CAAC;IACD,EAAE,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;IAC1F,EAAE,CAAC,GAAG,CACJ,4FAA4F,CAC7F,CAAC;IACF,+FAA+F;IAC/F,oEAAoE;IACpE,EAAE,CAAC,GAAG,CACJ,gJAAgJ,CACjJ,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AACnE,CAAC"}
+{"version":3,"file":"openEngram.js","sourceRoot":"","sources":["../src/openEngram.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,2FAA2F;AAC3F,4FAA4F;AAC5F,mGAAmG;AACnG,6EAA6E;AAC7E,EAAE;AACF,qGAAqG;AACrG,mGAAmG;AACnG,oGAAoG;AACpG,gGAAgG;AAChG,+FAA+F;AAC/F,iEAAiE;AACjE,kGAAkG;AAClG,kGAAkG;AAClG,oGAAoG;AACpG,mFAAmF;AACnF,oGAAoG;AACpG,6FAA6F;AAC7F,sGAAsG;AACtG,gGAAgG;AAChG,kGAAkG;AAClG,mGAAmG;AACnG,qGAAqG;AACrG,iGAAiG;AACjG,iGAAiG;AACjG,2FAA2F;AAC3F,uEAAuE;AACvE,EAAE;AACF,gGAAgG;AAChG,uDAAuD;AAEvD,EAAE;AACF,mGAAmG;AACnG,oGAAoG;AACpG,sGAAsG;AACtG,+FAA+F;AAC/F,uGAAuG;AACvG,iGAAiG;AACjG,eAAe;AACf,oFAAoF;AACpF,qGAAqG;AACrG,6DAA6D;AAC7D,0FAA0F;AAC1F,uGAAuG;AACvG,qGAAqG;AACrG,mGAAmG;AACnG,qGAAqG;AACrG,gDAAgD;AAChD,yEAAyE;AACzE,uGAAuG;AACvG,oGAAoG;AACpG,uGAAuG;AACvG,oGAAoG;AACpG,sGAAsG;AACtG,oGAAoG;AAEpG,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE1C,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE1D,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,CAAS;IACjC,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAClF,CAAC;AAqGD,sFAAsF;AACtF,MAAM,CAAC,MAAM,WAAW,GACtB,mFAAmF;IACnF,6CAA6C,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAEpD,iGAAiG;AACjG,MAAM,CAAC,MAAM,kBAAkB,GAC7B,kGAAkG;IAClG,kGAAkG;IAClG,2DAA2D,CAAC;AAE9D,oGAAoG;AACpG,MAAM,CAAC,MAAM,WAAW,GACtB,mFAAmF,CAAC;AAEtF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,KAAK,GAAG,CAAC,CAAS,EAA2C,EAAE;QACnE,MAAM,CAAC,GAAG,sCAAsC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC,CAAC;IACF,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,CAAC,CAAC,CAAE;YAAE,OAAO,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;0GAC0G;AAC1G,SAAS,UAAU,CAAC,CAAY;IAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,CAAC;IAC3B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,IAA6C;IAE7C,IAAI,CAAY,CAAC;IACjB,IAAI,CAAC;QACH,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,IAAI,2EAA2E,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACpB,OAAO,4EAA4E,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,OAAO,CACL,yFAAyF;YACzF,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACzC,OAAO,CACL,+FAA+F;YAC/F,iCAAiC,CAClC,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAClB,OAAO,0DAA0D,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACjC,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,WAAW,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,CAAC,YAAY,eAAe;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IAChD,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAa,EAAE,CAAa,EAAE,EAAE,CACjD,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEzD,qGAAqG;AACrG,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,0CAA0C;IACrF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED;sGACsG;AACtG,SAAS,UAAU,CAAC,QAAkB,EAAE,IAAY;IAClD,OAAO,CAAC,UAAU,EAAE,EAAE;QACpB,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9F,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,qBAAqB,CAAC,CAAC,EAAE;YACvE,KAAK;YACL,UAAU,EAAE,UAAU;SACvB,CAAC,CAAC;QACH,OAAO;YACL,KAAK,CAAC,mBAAmB,CAAC,MAAM;gBAC9B,MAAM,EAAE,GAAG,YAAY,CACrB,MAAM,KAAK,CAAC,qBAAqB,CAAE,CAAC,MAAM,CAAC,EAC3C,qBAAqB,CACtB,CAAC;gBACF,OAAO;oBACL,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI;oBACtC,mBAAmB,EAAE,EAAE,CAAC,mBAAmB;oBAC3C,YAAY,EAAE,EAAE,CAAC,YAAY;iBAC9B,CAAC;YACJ,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,KAAM,CAAC;AACjC,MAAM,mBAAmB,GAAG,IAAK,CAAC;AAElC;;;;;;;;GAQG;AACH,KAAK,UAAU,gBAAgB,CAC7B,MAAoB,EACpB,QAAoB,EACpB,MAAiB,EACjB,IAA8D;IAE9D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC;IAChD,IAAI,UAAU,GAAsB,IAAI,CAAC;IACzC,SAAS,CAAC;QACR,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,2BAA2B,EAAE,CAAC;gBACnE,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;YAClE,CAAC;YACD,6FAA6F;YAC7F,8FAA8F;YAC9F,8FAA8F;YAC9F,2FAA2F;YAC3F,wFAAwF;YACxF,IAAI,QAAQ,GAAkB,IAAI,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,CAAC,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;oBAAE,MAAM,CAAC,CAAC;gBACtE,8EAA8E;gBAC9E,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC;YACpB,CAAC;YACD,IAAI,MAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,MAAM,CAAC,sBAAsB,EAAE,CAAC;YACjD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,YAAY,eAAe,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;oBAC5E,OAAO,QAAQ,CAAC;gBAClB,MAAM,CAAC,CAAC;YACV,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,8FAA8F;YAC9F,+FAA+F;YAC/F,OAAO,CACL,2FAA2F;gBAC3F,4FAA4F;gBAC5F,6FAA6F;gBAC7F,mDAAmD,CACpD,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,MAAM,GACV,CAAC,CAAC,CAAC,YAAY,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;YACpF,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,OAAO,GAAG,CAAC;YAClD,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAA0B,EAC1B,IAAoB;IAEpB,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,iBAAiB,CAAC;IAE/C,+FAA+F;IAC/F,wDAAwD;IACxD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvB,EAAE,CAAC,GAAG,CACJ,oCAAoC,QAAQ,iBAAiB;YAC3D,KAAK,WAAW,EAAE,MAAM;YACxB,gEAAgE,CACnE,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,IAAI,IAA8C,CAAC;IACnD,IAAI,CAAC;QACH,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,EAAE,CAAC,GAAG,CACJ,iCAAiC,QAAQ,KAAM,CAAW,CAAC,OAAO,IAAI;YACpE,mDAAmD,CACtD,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;IAEnD,+FAA+F;IAC/F,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrD,EAAE,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;QACpF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IAED,IAAI,MAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM;YACJ,IAAI,CAAC,MAAM;gBACX,IAAI,YAAY,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,uCAAuC,OAAO,MAAO,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IAED,kDAAkD;IAClD,IAAI,SAA4B,CAAC;IACjC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,IAAI,SAAS,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QAC/B,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACpB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IAED,gGAAgG;IAChG,kGAAkG;IAClG,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IAC7C,IAAI,YAAY,KAAK,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5C,EAAE,CAAC,GAAG,CACJ,sBAAsB,QAAQ,OAAO,aAAa,CAAC,MAAM,EAAE,mCAAmC;YAC5F,GAAG,OAAO,CAAC,UAAU,0BAA0B,YAAY,8BAA8B;YACzF,GAAG,YAAY,wEAAwE;YACvF,GAAG,YAAY,uBAAuB,CACzC,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IAED,wFAAwF;IACxF,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;IAC5C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,EAAE,CAAC,GAAG,CACJ,8DAA8D,WAAW,CAAC,CAAC,CAAC,KAAK;YAC/E,qBAAqB,CACxB,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IAC5D,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAC5B,EAAE,CAAC,GAAG,CACJ,oCAAoC,OAAO,IAAI,oBAAoB,8BAA8B;YAC/F,YAAY,qBAAqB,4DAA4D;YAC7F,2EAA2E,CAC9E,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IAED,mGAAmG;IACnG,sEAAsE;IACtE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC,IAAI,CAC/C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,IAAI,EAC1B,GAAG,EAAE,CAAC,IAAI,CACX,CAAC;IAEF,2EAA2E;IAC3E,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;IAC5D,IAAI,MAAwB,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,GAAG,EAAE,CAAC;YACR,EAAE,CAAC,GAAG,CAAC,GAAG,GAAG,sBAAsB,CAAC,CAAC;YACrC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC5B,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC3B,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;SAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnB,EAAE,CAAC,GAAG,CACJ,qFAAqF;YACnF,oFAAoF;YACpF,4CAA4C,CAC/C,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,GAAqB,IAAI,CAAC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CACpE,QAAQ,CACT,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC9D,IAAI,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,WAAW;oBAAE,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC;YAClF,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,EAAE,CAAC,GAAG,CAAC,gEAAgE,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;QACD,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAC3B,iGAAiG;YACjG,gGAAgG;YAChG,iGAAiG;YACjG,+FAA+F;YAC/F,EAAE,CAAC,GAAG,CACJ,0CAA0C,CAAC,6CAA6C;gBACtF,4FAA4F;gBAC5F,wFAAwF;gBACxF,2DAA2D,CAC9D,CAAC;YACF,IAAI,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;gBAAE,MAAM,GAAG,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,CACb,MAAM,EAAE,CAAC,GAAG,CACV,0FAA0F;gBACxF,qCAAqC,CACxC,CACF,CAAC,IAAI,EAAE,CAAC;YACT,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;gBAClB,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBAC3B,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC;oBACpD,EAAE,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;oBAC9B,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;gBACzB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,MAAM,CAAC;YAClB,CAAC;QACH,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxC,IAAI,GAAG,EAAE,CAAC;gBACR,EAAE,CAAC,GAAG,CAAC,GAAG,GAAG,sBAAsB,CAAC,CAAC;gBACrC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YACzB,CAAC;YACD,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,EAAE,CAAC,GAAG,CACJ,6FAA6F;QAC3F,iBAAiB,QAAQ,mEAAmE;QAC5F,8BAA8B,CACjC,CAAC;IACF,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACpC,EAAE,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YAC9B,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED,UAAU;IACV,IAAI,MAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;IAEnC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI;QAC5B,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;YACzB,CAAC,CAAC,mBAAmB,OAAO,CAAC,IAAI,EAAE;YACnC,CAAC,CAAC,WAAW,OAAO,CAAC,IAAI,EAAE;QAC7B,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,eAAe,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,+FAA+F;IAC/F,sCAAsC;IACtC,MAAM,YAAY,GAAG,sBAAsB,OAAO,yBAAyB,SAAS,CAAC,QAAQ,CAAC,GAAG,YAAY,GAAG,SAAS,EAAE,CAAC;IAE5H,EAAE,CAAC,GAAG,CAAC,iCAAiC,UAAU,EAAE,CAAC,CAAC;IACtD,EAAE,CAAC,GAAG,CAAC,oCAAoC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEtE,6FAA6F;IAC7F,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAM,EAAE,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,CACE,IAAI,CAAC,MAAM;YACX,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAChF,CAAC,UAAU,CAAC,EACb,IAAI,CAAC,IAAI,EACT,MAAM,EACN;YACE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,eAAe;YAClC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YACpE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG;SAC1B,CACF,CAAC;QACF,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,GAAG,IAAI,CAAC;YACd,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,GAAG,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAC;YAC7D,EAAE,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;YACnD,EAAE,CAAC,GAAG,CACJ,yBAAyB,OAAO,sBAAsB,UAAU,eAAe,SAAS,CAAC,QAAQ,CAAC,cAAc,MAAM,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAClL,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;IACrE,CAAC;IAED,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACX,EAAE,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAC7C,EAAE,CAAC,GAAG,CAAC,KAAK,YAAY,EAAE,CAAC,CAAC;IAC5B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,EAAE,CAAC,GAAG,CACJ,mGAAmG,CACpG,CAAC;IACJ,CAAC;IACD,EAAE,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;IAC1F,8FAA8F;IAC9F,kGAAkG;IAClG,oEAAoE;IACpE,EAAE,CAAC,GAAG,CACJ,iGAAiG;QAC/F,0FAA0F,CAC7F,CAAC;IACF,+FAA+F;IAC/F,oEAAoE;IACpE,EAAE,CAAC,GAAG,CACJ,gJAAgJ,CACjJ,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,aAAa,CAAC,MAAM,EAAE;QAC7B,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI;QACvC,MAAM;KACP,CAAC;AACJ,CAAC;AAYD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAAuB,EACvB,IAAiD;IAEjD,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,iBAAiB,CAAC;IAC/C,IAAI,IAA8C,CAAC;IACnD,IAAI,CAAC;QACH,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,EAAE,CAAC,GAAG,CACJ,iCAAiC,QAAQ,KAAM,CAAW,CAAC,OAAO,uBAAuB,CAC1F,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,MAAM,GAAG,CACb,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAC/F,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtB,IAAI,IAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;QAChD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,EAAE,CAAC,GAAG,CACJ,UAAU,OAAO,CAAC,UAAU,kEAAkE;YAC5F,sEAAsE,CACzE,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,EAAE,CAAC,GAAG,CACJ,UAAU,OAAO,CAAC,UAAU,0EAA0E,CACvG,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9E,EAAE,CAAC,GAAG,CACJ,2BAA2B,MAAM,CAAC,MAAM,EAAE,SAAS,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,sBAAsB;YAC5F,wDAAwD,CAC3D,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,EAAE,CAAC;IAC7C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;QAChD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,cAAc,CAAC;QAChE,EAAE,CAAC,GAAG,CACJ,UAAU,OAAO,CAAC,UAAU,qCAAqC,OAAO,wBAAwB;YAC9F,QAAQ,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,+CAA+C,sBAAsB,CAC5G,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE;QAC5D,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,eAAe;QAClC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACpE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG;KAC1B,CAAC,CAAC;IACH,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,EAAE,CAAC,GAAG,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAC;QAC7D,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACpB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACzB,CAAC"}

package/dist/types.d.ts

@@ -64,6 +64,14 @@ export type BackupMetadata = Engram.BackupMetadata;
 export type BackupRetention = Engram.BackupRetention;
 export type ApprovalStatus = Engram.ApprovalStatus;
 export type ApprovalRequest = Engram.ApprovalRequest;
+/** ⟨2026-11-02, the child build's stage 8⟩ What `getOwnerSignIn()` answers: whether the engram was
+ *  opened through another, its sign-in (the owner's second credential), whether the caller is it, and
+ *  any decline or waiting ask. Named caller: the `seal-key` command (openEngram.ts), which seals only
+ *  for the sign-in the engram has seated. */
+export type OwnerSignInView = Engram.OwnerSignInView;
+/** ⟨2026-11-02, stage 8⟩ What `getKeyBackupStatus()` answers: whether the engram holds a sealed copy
+ *  of its owner's key, for whom, since when, and whether it is sealed for the sign-in seated now. */
+export type KeyBackupStatus = Engram.KeyBackupStatus;
 /** A memory file with its content decoded to text (decrypted first on an encrypted engram). */
 export interface MemoryFile {
     path: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@engramx/client",
-  "version": "0.16.0-rc.20",
+  "version": "0.16.0-rc.22",
   "description": "Client SDK for EngramX — persistent, decentralized memory for AI agents on the Internet Computer",
   "license": "Apache-2.0",
   "author": "EngramX <developer@engramx.ai>",
@@ -53,7 +53,7 @@
     "@icp-sdk/core": "^6.1.1"
   },
   "dependencies": {
-    "@engramx/idl": "0.16.0-rc.20",
+    "@engramx/idl": "0.16.0-rc.22",
     "@icp-sdk/core": "^6.1.1",
     "@icp-sdk/vetkeys": "0.7.0",
     "@noble/curves": "^2.4.0"