@axtary/cli 0.0.1 → 0.2.0

package/dist/credentials.d.ts

@@ -0,0 +1,101 @@
+import { spawnSync } from "node:child_process";
+export declare const CREDENTIALS_SCHEMA_VERSION = "axtary.credentials.v0";
+export type CredentialSecretBackendName = "keychain" | "file";
+/** Non-secret record of a connected provider. Safe to print / show in a UI. */
+export type CredentialMetadata = {
+    provider: string;
+    type: "oauth" | "token";
+    source: "oauth" | "manual";
+    scopes: string[];
+    obtainedAt: string;
+    expiresAt: string | null;
+    /** A non-secret label like a Slack team id or workspace name. */
+    account: string | null;
+    /** Non-secret provider routing data, for example Jira cloudId and siteUrl. */
+    context?: Record<string, string>;
+    secretBackend: CredentialSecretBackendName;
+};
+/** Full credential including the secret material. Never logged or serialized to status output. */
+export type StoredCredential = CredentialMetadata & {
+    accessToken: string;
+    refreshToken: string | null;
+};
+export type CredentialSecret = {
+    accessToken: string;
+    refreshToken: string | null;
+};
+/** Pluggable secret storage so the keychain can be swapped for a file (or an in-memory fake in tests). */
+export type CredentialSecretBackend = {
+    readonly name: CredentialSecretBackendName;
+    get(provider: string): Promise<CredentialSecret | null>;
+    set(provider: string, secret: CredentialSecret): Promise<void>;
+    delete(provider: string): Promise<void>;
+};
+/** True when the macOS `security` keychain CLI is usable. */
+export declare function macKeychainAvailable(platform?: NodeJS.Platform, run?: typeof spawnSync): boolean;
+/** macOS keychain-backed secret store (generic passwords under a per-provider service). */
+export declare function createMacKeychainSecretBackend(run?: typeof spawnSync): CredentialSecretBackend;
+export type CredentialStoreOptions = {
+    baseDir?: string;
+    secretBackend?: CredentialSecretBackend;
+    platform?: NodeJS.Platform;
+    run?: typeof spawnSync;
+};
+export declare class CredentialStore {
+    private readonly baseDir;
+    private readonly filePath;
+    private readonly secretBackend;
+    constructor(options?: CredentialStoreOptions);
+    /** The backend chosen for new writes (so callers can report where secrets land). */
+    secretBackendName(): CredentialSecretBackendName;
+    get(provider: string): Promise<StoredCredential | null>;
+    set(input: {
+        provider: string;
+        type: CredentialMetadata["type"];
+        source: CredentialMetadata["source"];
+        accessToken: string;
+        refreshToken?: string | null;
+        scopes?: string[];
+        expiresAt?: string | null;
+        account?: string | null;
+        context?: Record<string, string>;
+    }): Promise<CredentialMetadata>;
+    /**
+     * Write the secret to the preferred backend, then read it back and confirm it
+     * round-trips. If the keychain write did not actually persist a readable
+     * secret — e.g. macOS `security add-generic-password -w` reads the password
+     * from the controlling TTY rather than our piped stdin, storing garbage — fall
+     * back to the portable 0600 file backend instead of silently storing an
+     * unreadable credential. The secret value is never placed on a process argv.
+     */
+    private writeSecretVerified;
+    delete(provider: string): Promise<boolean>;
+    /** Metadata only — never returns secret material. */
+    list(): Promise<CredentialMetadata[]>;
+    private fileSecretBackend;
+    private read;
+    private write;
+}
+/** True once an OAuth credential has lapsed (with a small safety skew). */
+export declare function credentialExpired(credential: Pick<StoredCredential, "expiresAt">, now?: number, skewMs?: number): boolean;
+/**
+ * Resolve a provider token with the broker taking precedence over a raw env
+ * var. A connected, non-expired stored credential wins; otherwise we fall back
+ * to `env[tokenEnv]` (which itself may be populated by a secret manager — see
+ * https://docs.axtary.com/credentials). Returns the token and where it came from.
+ */
+export declare function resolveProviderToken(input: {
+    provider: string;
+    tokenEnv: string;
+    env: Record<string, string | undefined>;
+    store: CredentialStore | null;
+    now?: number;
+}): Promise<{
+    token: string | undefined;
+    source: "broker" | "env" | "missing";
+}>;
+export declare function loadCredentialStore(options?: CredentialStoreOptions): CredentialStore;
+export declare function credentialsBaseDir(): string;
+export declare function credentialsLocation(baseDir?: string): string;
+export declare function removeCredentialsFile(baseDir: string): Promise<void>;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAgB/C,eAAO,MAAM,0BAA0B,0BAA0B,CAAC;AAElE,MAAM,MAAM,2BAA2B,GAAG,UAAU,GAAG,MAAM,CAAC;AAE9D,+EAA+E;AAC/E,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iEAAiE;IACjE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,aAAa,EAAE,2BAA2B,CAAC;CAC5C,CAAC;AAEF,kGAAkG;AAClG,MAAM,MAAM,gBAAgB,GAAG,kBAAkB,GAAG;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF,0GAA0G;AAC1G,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;IAC3C,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACxD,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzC,CAAC;AAoBF,6DAA6D;AAC7D,wBAAgB,oBAAoB,CAClC,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,GAAG,GAAE,OAAO,SAAqB,GAChC,OAAO,CAIT;AAED,2FAA2F;AAC3F,wBAAgB,8BAA8B,CAC5C,GAAG,GAAE,OAAO,SAAqB,GAChC,uBAAuB,CAmDzB;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,OAAO,SAAS,CAAC;CACxB,CAAC;AAmBF,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0B;gBAE5C,OAAO,GAAE,sBAA2B;IAMhD,oFAAoF;IACpF,iBAAiB,IAAI,2BAA2B;IAI1C,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAiBvD,GAAG,CAAC,KAAK,EAAE;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACrC,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA4B/B;;;;;;;OAOG;YACW,mBAAmB;IAmC3B,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAehD,qDAAqD;IAC/C,IAAI,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAK3C,OAAO,CAAC,iBAAiB;YAuBX,IAAI;YAiBJ,KAAK;CAQpB;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,EAC/C,GAAG,GAAE,MAAmB,EACxB,MAAM,SAAS,GACd,OAAO,CAGT;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAA;CAAE,CAAC,CAU/E;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,sBAA2B,GAAG,eAAe,CAEzF;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,MAAyB,GAAG,MAAM,CAE9E;AAGD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1E"}

package/dist/credentials.js

@@ -0,0 +1,277 @@
+import { spawnSync } from "node:child_process";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+// Axtary local credential broker.
+//
+// PRD §10.1: the credential broker runs locally so provider secrets stay on the
+// customer's machine and never reach the hosted control plane. This module is
+// that broker's storage layer: it keeps a 0600 metadata file (which providers
+// are connected, scopes, expiry — never the secret) and stores the actual access
+// tokens in the OS keychain when available, falling back to the same 0600 file.
+//
+// The metadata/secret split means `axtary connections` (status) is secret-safe
+// by construction: it only ever reads metadata, never a token.
+export const CREDENTIALS_SCHEMA_VERSION = "axtary.credentials.v0";
+const KEYCHAIN_SERVICE_PREFIX = "axtary:credential:";
+const KEYCHAIN_ACCOUNT = "axtary";
+function defaultBaseDir() {
+    return process.env.AXTARY_HOME ?? join(homedir(), ".axtary");
+}
+function credentialsFilePath(baseDir) {
+    return join(baseDir, "credentials.json");
+}
+/** True when the macOS `security` keychain CLI is usable. */
+export function macKeychainAvailable(platform = process.platform, run = spawnSync) {
+    if (platform !== "darwin")
+        return false;
+    const probe = run("security", ["help"], { stdio: "ignore" });
+    return probe.status === 0 || probe.status === 1; // `security help` exits non-zero but exists
+}
+/** macOS keychain-backed secret store (generic passwords under a per-provider service). */
+export function createMacKeychainSecretBackend(run = spawnSync) {
+    const service = (provider) => `${KEYCHAIN_SERVICE_PREFIX}${provider}`;
+    return {
+        name: "keychain",
+        async get(provider) {
+            const result = run("security", ["find-generic-password", "-a", KEYCHAIN_ACCOUNT, "-s", service(provider), "-w"], { encoding: "utf8" });
+            if (result.status !== 0 || typeof result.stdout !== "string")
+                return null;
+            try {
+                return JSON.parse(result.stdout.trim());
+            }
+            catch {
+                return null;
+            }
+        },
+        async set(provider, secret) {
+            // Pass the secret on stdin, never on argv. `-w` with no value makes
+            // `security` read the password from the prompt (here, stdin), which
+            // prompts twice ("password" + "retype"), so the payload is written twice.
+            // This keeps the token off the `security` process command line, where
+            // `ps` would otherwise expose it to any same-user process. `-U` updates an
+            // existing item.
+            const payload = JSON.stringify(secret);
+            const result = run("security", [
+                "add-generic-password",
+                "-U",
+                "-a",
+                KEYCHAIN_ACCOUNT,
+                "-s",
+                service(provider),
+                "-w",
+            ], { input: `${payload}\n${payload}\n`, stdio: ["pipe", "ignore", "ignore"] });
+            if (result.status !== 0) {
+                throw new Error("credential_keychain_write_failed");
+            }
+        },
+        async delete(provider) {
+            run("security", ["delete-generic-password", "-a", KEYCHAIN_ACCOUNT, "-s", service(provider)], { stdio: "ignore" });
+        },
+    };
+}
+/**
+ * Resolve the secret backend: explicit override wins; otherwise keychain on
+ * macOS when available, else the 0600 file. `AXTARY_CREDENTIAL_BACKEND=file`
+ * forces the portable file backend (useful in CI / containers).
+ */
+function resolveSecretBackend(options, fileBackend) {
+    if (options.secretBackend)
+        return options.secretBackend;
+    if (process.env.AXTARY_CREDENTIAL_BACKEND === "file")
+        return fileBackend;
+    if (macKeychainAvailable(options.platform, options.run)) {
+        return createMacKeychainSecretBackend(options.run);
+    }
+    return fileBackend;
+}
+export class CredentialStore {
+    baseDir;
+    filePath;
+    secretBackend;
+    constructor(options = {}) {
+        this.baseDir = options.baseDir ?? defaultBaseDir();
+        this.filePath = credentialsFilePath(this.baseDir);
+        this.secretBackend = resolveSecretBackend(options, this.fileSecretBackend());
+    }
+    /** The backend chosen for new writes (so callers can report where secrets land). */
+    secretBackendName() {
+        return this.secretBackend.name;
+    }
+    async get(provider) {
+        const file = await this.read();
+        const metadata = file.credentials[provider];
+        if (!metadata)
+            return null;
+        const backend = metadata.secretBackend === this.secretBackend.name
+            ? this.secretBackend
+            : metadata.secretBackend === "file"
+                ? this.fileSecretBackend()
+                : createMacKeychainSecretBackend();
+        const secret = await backend.get(provider);
+        if (!secret)
+            return null;
+        return { ...metadata, accessToken: secret.accessToken, refreshToken: secret.refreshToken };
+    }
+    async set(input) {
+        const usedBackend = await this.writeSecretVerified(input.provider, {
+            accessToken: input.accessToken,
+            refreshToken: input.refreshToken ?? null,
+        });
+        const metadata = {
+            provider: input.provider,
+            type: input.type,
+            source: input.source,
+            scopes: input.scopes ?? [],
+            obtainedAt: new Date().toISOString(),
+            expiresAt: input.expiresAt ?? null,
+            account: input.account ?? null,
+            context: input.context,
+            secretBackend: usedBackend.name,
+        };
+        const file = await this.read();
+        file.credentials[input.provider] = metadata;
+        if (usedBackend.name !== "file" && file.secrets) {
+            delete file.secrets[input.provider];
+        }
+        await this.write(file);
+        return metadata;
+    }
+    /**
+     * Write the secret to the preferred backend, then read it back and confirm it
+     * round-trips. If the keychain write did not actually persist a readable
+     * secret — e.g. macOS `security add-generic-password -w` reads the password
+     * from the controlling TTY rather than our piped stdin, storing garbage — fall
+     * back to the portable 0600 file backend instead of silently storing an
+     * unreadable credential. The secret value is never placed on a process argv.
+     */
+    async writeSecretVerified(provider, secret) {
+        const primary = this.secretBackend;
+        try {
+            await primary.set(provider, secret);
+            const readBack = await primary.get(provider);
+            if (readBack &&
+                readBack.accessToken === secret.accessToken &&
+                (readBack.refreshToken ?? null) === (secret.refreshToken ?? null)) {
+                return primary;
+            }
+        }
+        catch {
+            // Fall through to the file backend below.
+        }
+        if (primary.name === "file") {
+            throw new Error("credential_secret_write_failed");
+        }
+        // The preferred backend did not round-trip. Remove any partial item it left,
+        // then store the secret in the verifiable 0600 file backend.
+        try {
+            await primary.delete(provider);
+        }
+        catch {
+            // best-effort cleanup
+        }
+        const fileBackend = this.fileSecretBackend();
+        await fileBackend.set(provider, secret);
+        return fileBackend;
+    }
+    async delete(provider) {
+        const file = await this.read();
+        const metadata = file.credentials[provider];
+        if (!metadata)
+            return false;
+        const backend = metadata.secretBackend === "file" ? this.fileSecretBackend() : createMacKeychainSecretBackend();
+        await backend.delete(provider);
+        delete file.credentials[provider];
+        if (file.secrets)
+            delete file.secrets[provider];
+        await this.write(file);
+        return true;
+    }
+    /** Metadata only — never returns secret material. */
+    async list() {
+        const file = await this.read();
+        return Object.values(file.credentials).sort((a, b) => a.provider.localeCompare(b.provider));
+    }
+    fileSecretBackend() {
+        return {
+            name: "file",
+            get: async (provider) => {
+                const file = await this.read();
+                return file.secrets?.[provider] ?? null;
+            },
+            set: async (provider, secret) => {
+                const file = await this.read();
+                file.secrets = file.secrets ?? {};
+                file.secrets[provider] = secret;
+                await this.write(file);
+            },
+            delete: async (provider) => {
+                const file = await this.read();
+                if (file.secrets) {
+                    delete file.secrets[provider];
+                    await this.write(file);
+                }
+            },
+        };
+    }
+    async read() {
+        try {
+            const raw = await readFile(this.filePath, "utf8");
+            const parsed = JSON.parse(raw);
+            return {
+                version: parsed.version ?? CREDENTIALS_SCHEMA_VERSION,
+                credentials: parsed.credentials ?? {},
+                secrets: parsed.secrets,
+            };
+        }
+        catch (error) {
+            if (error.code === "ENOENT") {
+                return { version: CREDENTIALS_SCHEMA_VERSION, credentials: {} };
+            }
+            throw error;
+        }
+    }
+    async write(file) {
+        await mkdir(this.baseDir, { recursive: true, mode: 0o700 });
+        await writeFile(this.filePath, `${JSON.stringify({ ...file, version: CREDENTIALS_SCHEMA_VERSION }, null, 2)}\n`, { mode: 0o600 });
+    }
+}
+/** True once an OAuth credential has lapsed (with a small safety skew). */
+export function credentialExpired(credential, now = Date.now(), skewMs = 30_000) {
+    if (!credential.expiresAt)
+        return false;
+    return new Date(credential.expiresAt).getTime() - skewMs <= now;
+}
+/**
+ * Resolve a provider token with the broker taking precedence over a raw env
+ * var. A connected, non-expired stored credential wins; otherwise we fall back
+ * to `env[tokenEnv]` (which itself may be populated by a secret manager — see
+ * https://docs.axtary.com/credentials). Returns the token and where it came from.
+ */
+export async function resolveProviderToken(input) {
+    if (input.store) {
+        const credential = await input.store.get(input.provider);
+        if (credential && !credentialExpired(credential, input.now)) {
+            return { token: credential.accessToken, source: "broker" };
+        }
+    }
+    const envToken = input.env[input.tokenEnv];
+    if (envToken)
+        return { token: envToken, source: "env" };
+    return { token: undefined, source: "missing" };
+}
+export function loadCredentialStore(options = {}) {
+    return new CredentialStore(options);
+}
+export function credentialsBaseDir() {
+    return defaultBaseDir();
+}
+export function credentialsLocation(baseDir = defaultBaseDir()) {
+    return credentialsFilePath(baseDir);
+}
+// Re-exported for callers that need to clean up a base dir in tests.
+export async function removeCredentialsFile(baseDir) {
+    await rm(credentialsFilePath(baseDir), { force: true });
+    await rm(dirname(credentialsFilePath(baseDir)), { force: true, recursive: true });
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,kCAAkC;AAClC,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,iFAAiF;AACjF,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,+DAA+D;AAE/D,MAAM,CAAC,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AA6ClE,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AACrD,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAElC,SAAS,cAAc;IACrB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,OAAO,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;AAC3C,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,oBAAoB,CAClC,WAA4B,OAAO,CAAC,QAAQ,EAC5C,MAAwB,SAAS;IAEjC,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,4CAA4C;AAC/F,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,8BAA8B,CAC5C,MAAwB,SAAS;IAEjC,MAAM,OAAO,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,GAAG,uBAAuB,GAAG,QAAQ,EAAE,CAAC;IAE9E,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,KAAK,CAAC,GAAG,CAAC,QAAQ;YAChB,MAAM,MAAM,GAAG,GAAG,CAChB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,EAChF,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAC;YACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC1E,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAqB,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM;YACxB,oEAAoE;YACpE,oEAAoE;YACpE,0EAA0E;YAC1E,sEAAsE;YACtE,2EAA2E;YAC3E,iBAAiB;YACjB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,GAAG,CAChB,UAAU,EACV;gBACE,sBAAsB;gBACtB,IAAI;gBACJ,IAAI;gBACJ,gBAAgB;gBAChB,IAAI;gBACJ,OAAO,CAAC,QAAQ,CAAC;gBACjB,IAAI;aACL,EACD,EAAE,KAAK,EAAE,GAAG,OAAO,KAAK,OAAO,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAC3E,CAAC;YACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,QAAQ;YACnB,GAAG,CACD,UAAU,EACV,CAAC,yBAAyB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,EAC5E,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AASD;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,OAA+B,EAC/B,WAAoC;IAEpC,IAAI,OAAO,CAAC,aAAa;QAAE,OAAO,OAAO,CAAC,aAAa,CAAC;IACxD,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,MAAM;QAAE,OAAO,WAAW,CAAC;IACzE,IAAI,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,8BAA8B,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,OAAO,eAAe;IACT,OAAO,CAAS;IAChB,QAAQ,CAAS;IACjB,aAAa,CAA0B;IAExD,YAAY,UAAkC,EAAE;QAC9C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;QACnD,IAAI,CAAC,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,aAAa,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,oFAAoF;IACpF,iBAAiB;QACf,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB;QACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,OAAO,GACX,QAAQ,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa,CAAC,IAAI;YAChD,CAAC,CAAC,IAAI,CAAC,aAAa;YACpB,CAAC,CAAC,QAAQ,CAAC,aAAa,KAAK,MAAM;gBACjC,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE;gBAC1B,CAAC,CAAC,8BAA8B,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,OAAO,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IAC7F,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAUT;QACC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE;YACjE,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;SACzC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAuB;YACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;YAC1B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,aAAa,EAAE,WAAW,CAAC,IAAI;SAChC,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;QAC5C,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEvB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,mBAAmB,CAC/B,QAAgB,EAChB,MAAwB;QAExB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7C,IACE,QAAQ;gBACR,QAAQ,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;gBAC3C,CAAC,QAAQ,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,EACjE,CAAC;gBACD,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,6EAA6E;QAC7E,6DAA6D;QAC7D,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC7C,MAAM,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE5B,MAAM,OAAO,GACX,QAAQ,CAAC,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,8BAA8B,EAAE,CAAC;QAClG,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE/B,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9F,CAAC;IAEO,iBAAiB;QACvB,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;YAC1C,CAAC;YACD,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;gBAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;gBAClC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;gBAChC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBACjB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;oBAC9B,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;YAC1D,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,0BAA0B;gBACrD,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;gBACrC,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,OAAO,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;YAClE,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,IAAoB;QACtC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,SAAS,CACb,IAAI,CAAC,QAAQ,EACb,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,0BAA0B,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAChF,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACJ,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAC/B,UAA+C,EAC/C,MAAc,IAAI,CAAC,GAAG,EAAE,EACxB,MAAM,GAAG,MAAM;IAEf,IAAI,CAAC,UAAU,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,MAAM,IAAI,GAAG,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAM1C;IACC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,UAAU,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACxD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,UAAkC,EAAE;IACtE,OAAO,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,cAAc,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,UAAkB,cAAc,EAAE;IACpE,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAe;IACzD,MAAM,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACpF,CAAC"}

package/dist/cursor-hook.d.ts

@@ -0,0 +1,51 @@
+import { type JsonValue, type NormalizedAction } from "@axtary/actionpass";
+export declare const CURSOR_HOOK_SCHEMA_VERSION = "axtary.cursor_hook.v0";
+export type CursorHookPayload = {
+    hookEventName: string | null;
+    conversationId: string | null;
+    toolName: string;
+    toolInput: Record<string, JsonValue>;
+    /** MCP server identity for a remote (`url`) or local (`command`) server. */
+    url: string | null;
+    command: string | null;
+    workspaceRoot: string | null;
+    userEmail: string | null;
+};
+export type CursorHookPermission = "allow" | "deny" | "ask";
+export type CursorNormalization = {
+    mapped: true;
+    action: NormalizedAction;
+} | {
+    mapped: false;
+    reason: string;
+};
+export type CursorNormalizeOptions = {
+    repoResource?: string;
+    humanOwner?: string;
+    branch?: string;
+};
+export type CursorHookRunInput = {
+    payloadText: string;
+    proxyUrl?: string;
+    repoResource?: string;
+    humanOwner?: string;
+    branch?: string;
+    timeoutMs?: number;
+    fetch?: typeof fetch;
+};
+export type CursorHookRunResult = {
+    schemaVersion: typeof CURSOR_HOOK_SCHEMA_VERSION;
+    /** Internal decision; `no_opinion` emits no permission so Cursor proceeds. */
+    status: "allow" | "ask" | "deny" | "no_opinion";
+    tool: string | null;
+    normalizedTool: string | null;
+    reason: string | null;
+    /** JSON to write to stdout. */
+    output: string;
+    /** Always 0: Cursor fails open on non-zero exits, so decisions live in JSON. */
+    exitCode: number;
+};
+export declare function parseCursorHookPayload(payloadText: string): CursorHookPayload;
+export declare function normalizeCursorToolCall(payload: CursorHookPayload, options?: CursorNormalizeOptions): CursorNormalization;
+export declare function runCursorHook(input: CursorHookRunInput): Promise<CursorHookRunResult>;
+//# sourceMappingURL=cursor-hook.d.ts.map

package/dist/cursor-hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor-hook.d.ts","sourceRoot":"","sources":["../src/cursor-hook.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAuB5B,eAAO,MAAM,0BAA0B,0BAA0B,CAAC;AAElE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACrC,4EAA4E;IAC5E,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAE5D,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC1C;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC,MAAM,MAAM,sBAAsB,GAAG;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,aAAa,EAAE,OAAO,0BAA0B,CAAC;IACjD,8EAA8E;IAC9E,MAAM,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,YAAY,CAAC;IAChD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,CA6C7E;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,iBAAiB,EAC1B,OAAO,GAAE,sBAA2B,GACnC,mBAAmB,CA4ErB;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,mBAAmB,CAAC,CAyF9B"}