@bluenotelogic/harness 0.1.0 → 0.2.0

package/dist/writers.js

@@ -13,8 +13,9 @@
  * `--dry-run` shows precisely what would happen and the merge logic is unit-testable
  * without touching a filesystem.
  */
-import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
-import { dirname } from "node:path";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, statSync, unlinkSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { execFileSync } from "node:child_process";
 /** True when the change would actually alter the file. */
 export function isNoop(c) {
     return c.after === null || c.after === c.before;
@@ -54,88 +55,136 @@ export function planMcpJson(path, existing, servers) {
     doc["mcpServers"] = { ...current, ...servers };
     return { path, before: existing, after: JSON.stringify(doc, null, 2) + "\n" };
 }
-/**
- * `.claude/settings.local.json` — an `env` block Claude Code applies to every session.
- *
- * WHY THIS EXISTS AT ALL: the VS Code extension launches `claude` without sourcing a shell
- * env file, so a `${VAR}` reference in `.mcp.json` would not expand there. This file is how
- * the harness works from the VS Code button rather than only from `source .env && claude`.
- * Only written when a token was minted — the OAuth path needs no env at all.
- */
-export function planSettingsLocal(path, existing, env) {
-    let doc = {};
-    if (existing !== null && existing.trim() !== "") {
-        try {
-            const parsed = JSON.parse(existing);
-            if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-                throw new Error("not a JSON object");
-            }
-            doc = parsed;
-        }
-        catch (e) {
-            return {
-                path,
-                before: existing,
-                after: null,
-                skipped: `existing settings.local.json is not valid JSON (${e.message}) — left untouched.`,
-            };
-        }
-    }
-    const currentEnv = typeof doc["env"] === "object" && doc["env"] !== null && !Array.isArray(doc["env"])
-        ? doc["env"]
-        : {};
-    doc["env"] = { ...currentEnv, ...env };
-    return {
-        path,
-        before: existing,
-        after: JSON.stringify(doc, null, 2) + "\n",
-        note: "holds a plaintext token — make sure .claude/settings.local.json is gitignored",
-    };
-}
 /**
  * Codex `config.toml`.
  *
- * We do NOT parse TOML (that would mean a dependency, and this package has none). Instead:
- * if a `[mcp_servers.<name>]` table already exists we leave the file completely alone and
- * hand the user the snippet; otherwise we APPEND the table. Appending is safe because TOML
- * tables are order-independent, and appending can never corrupt what is already there.
+ * We do NOT parse TOML (that would mean a dependency, and this package has none). The active
+ * writer below owns one explicit marked block, replaces only that block, and refuses ambiguous
+ * unowned conflicts while preserving all unrelated TOML.
  *
  * The token itself never goes in here — it goes to `~/.codex/.env`, referenced by
  * `bearer_token_env_var`, so the config file stays safe to read over someone's shoulder.
  */
+/** Stable Codex approval surface. Token grants still enforce the daily/maintainer boundary. */
+export const CODEX_MAINTAINER_APPROVED_TOOLS = [
+    "memory_bootstrap", "memory_context", "memory_recall", "memory_recall_repo",
+    "memory_propose", "memory_feedback",
+    "memory_scratch_set", "memory_scratch_get", "memory_scratch_delete",
+    "memory_episodic_log", "memory_episodic_recall",
+    "harness_run_start", "harness_run_step", "harness_run_complete", "harness_run_list",
+    "memory_review", "memory_v3_status", "harness_run_release",
+];
+/** Codex config writer for the one block owned by this installer. */
 export function planCodexConfig(path, existing, serverName, mcpUrl, tokenEnvVar) {
+    const start = "# BEGIN @bluenotelogic/harness managed MCP";
+    const end = "# END @bluenotelogic/harness managed MCP";
     const table = `[mcp_servers.${serverName}]`;
-    const block = `\n# Added by @bluenotelogic/harness. Codex cannot do OAuth yet, so it reads a token\n` +
-        `# from the environment; the value lives in ~/.codex/.env, never in this file.\n` +
+    const approvals = CODEX_MAINTAINER_APPROVED_TOOLS.map((tool) => `\n[mcp_servers.${serverName}.tools.${tool}]\napproval_mode = "approve"\n`).join("");
+    const block = `${start}\n` +
+        `# Credentials are environment-only; the owner-restricted value lives in ~/.codex/.env.\n` +
         `${table}\n` +
         `url = "${mcpUrl}"\n` +
-        `bearer_token_env_var = "${tokenEnvVar}"\n`;
-    if (existing !== null && existing.includes(table)) {
+        `bearer_token_env_var = "${tokenEnvVar}"\n` +
+        `default_tools_approval_mode = "prompt"\n` +
+        approvals +
+        `${end}\n`;
+    const base = existing ?? "";
+    const startCount = base.split(start).length - 1;
+    const endCount = base.split(end).length - 1;
+    if (startCount !== endCount || startCount > 1) {
+        return { path, before: existing, after: null, skipped: "ambiguous @bluenotelogic/harness managed-block markers; left untouched" };
+    }
+    if (startCount === 1) {
+        const from = base.indexOf(start);
+        const through = base.indexOf(end, from) + end.length;
+        const after = `${base.slice(0, from)}${block}${base.slice(through).replace(/^\r?\n/, "")}`;
+        return { path, before: existing, after };
+    }
+    const legacy = /\n?# Added by @bluenotelogic\/harness\. Codex cannot do OAuth yet, so it reads a token\r?\n# from the environment; the value lives in ~\/\.codex\/\.env, never in this file\.\r?\n\[mcp_servers\.([^\]\r\n]+)\]\r?\nurl = "[^"\r\n]+"\r?\nbearer_token_env_var = "[A-Za-z_][A-Za-z0-9_]*"\r?\n?/g;
+    const matches = [...base.matchAll(legacy)];
+    if (matches.length > 1) {
+        return { path, before: existing, after: null, skipped: "multiple legacy harness blocks are ambiguous; left untouched" };
+    }
+    if (matches.length === 1) {
+        const match = matches[0];
+        const index = match.index;
+        const without = `${base.slice(0, index)}${base.slice(index + match[0].length)}`.trimEnd();
+        return { path, before: existing, after: `${without}${without ? "\n\n" : ""}${block}` };
+    }
+    // `codex mcp add` writes this exact, tokenless three-line table. It is safe to adopt only
+    // when its URL and env reference already match the requested installation and the table has
+    // no child settings; any different or extended table remains an ambiguous unowned conflict.
+    const childTablePrefix = `[mcp_servers.${serverName}.`;
+    if (base.includes(childTablePrefix)) {
         return {
             path,
             before: existing,
             after: null,
-            skipped: `${table} already present — left untouched. If the URL changed, update it by hand:\n` +
-                block.trim(),
+            skipped: `${table} has unowned child settings; ownership is ambiguous, so it was left untouched.`,
         };
     }
-    const base = existing ?? "";
-    const sep = base === "" || base.endsWith("\n") ? "" : "\n";
-    return { path, before: existing, after: base + sep + block };
+    const exactCliTable = new RegExp(`(?:^|\\r?\\n)${escapeRe(table)}\\r?\\n` +
+        `url = "${escapeRe(mcpUrl)}"\\r?\\n` +
+        `bearer_token_env_var = "${escapeRe(tokenEnvVar)}"\\r?\\n?` +
+        `(?=\\r?\\n\\[|$)`);
+    const cliMatch = base.match(exactCliTable);
+    if (cliMatch?.index !== undefined) {
+        const without = `${base.slice(0, cliMatch.index)}${base.slice(cliMatch.index + cliMatch[0].length)}`.trimEnd();
+        return { path, before: existing, after: `${without}${without ? "\n\n" : ""}${block}` };
+    }
+    if (base.includes(table)) {
+        return {
+            path,
+            before: existing,
+            after: null,
+            skipped: `${table} exists outside the @bluenotelogic/harness managed block; ownership is ambiguous, so it was left untouched.`,
+        };
+    }
+    const withoutTrailing = base.trimEnd();
+    return { path, before: existing, after: `${withoutTrailing}${withoutTrailing ? "\n\n" : ""}${block}` };
 }
-/** `~/.codex/.env` — one KEY=value line, replaced in place if already present. */
-export function planEnvVar(path, existing, key, value) {
+/** The names (never the values) of `names` that a dotenv file defines, in the order given. */
+export function legacyEnvVarsPresent(existing, names) {
+    if (existing === null)
+        return [];
+    return names.filter((name) => new RegExp(`^${escapeRe(name)}=`, "m").test(existing));
+}
+/**
+ * Set `key` in a dotenv file, leaving every other line as it was.
+ *
+ * `legacyAliases` are earlier names for the same credential. They are NOT removed: this used to
+ * delete them, but BNL staff machines still run tools that read BNL_MEMORY_MCP_TOKEN /
+ * CAVEAU_MCP_TOKEN, so a re-install would have broken those tools. The ones present are named
+ * in a notice instead, so the user can remove them once nothing uses them.
+ */
+export function planEnvVar(path, existing, key, value, legacyAliases = []) {
     const line = `${key}=${value}`;
     const base = existing ?? "";
     const re = new RegExp(`^${escapeRe(key)}=.*$`, "m");
     const after = re.test(base)
         ? base.replace(re, line)
         : base + (base === "" || base.endsWith("\n") ? "" : "\n") + line + "\n";
+    const legacy = legacyEnvVarsPresent(existing, legacyAliases.filter((alias) => alias !== key));
+    const them = legacy.length > 1 ? "them" : "it";
     return {
         path,
         before: existing,
         after,
         note: "holds a plaintext token — never commit it",
+        ...(legacy.length
+            ? { notice: `legacy ${legacy.join(", ")} left in place; ${key} is now used, so remove ${them} once nothing uses ${them}` }
+            : {}),
+        sensitive: true,
+    };
+}
+/** Plan one owner-only credential file whose entire contents are the supplied value. */
+export function planCredentialFile(path, existing, value, note = "holds a plaintext token — never commit or share it") {
+    return {
+        path,
+        before: existing,
+        after: `${value.replace(/[\r\n]+$/g, "")}\n`,
+        note,
+        sensitive: true,
     };
 }
 function escapeRe(s) {
@@ -163,8 +212,8 @@ export function assertNoSecret(c) {
     const found = c.after.match(/\b(cmem|mcp)_[A-Za-z0-9_-]{16,}/);
     if (found) {
         throw new Error(`refusing to write what looks like a live token into ${c.path} ` +
-            `(matched ${found[0].slice(0, 8)}…). Tokens belong in ~/.codex/.env or ` +
-            `.claude/settings.local.json, never in a committed config.`);
+            `(matched ${found[0].slice(0, 8)}…). Tokens belong only in ~/.codex/.env, never in a ` +
+            `repository file.`);
     }
 }
 export function readIfExists(path) {
@@ -175,6 +224,137 @@ export function readIfExists(path) {
         return null;
     }
 }
+const UNSAFE_WINDOWS_PRINCIPALS = ["Everyone", "BUILTIN\\Users", "Authenticated Users", "Users"];
+/**
+ * Confirms `icacls <path>` output grants access to nobody broader than the given owner.
+ * Exported (rather than folded into secureCredentialFileWindows) so this has real unit
+ * coverage without shelling out to icacls in a test -- icacls output is the only part of
+ * Windows ACL handling that is pure and deterministic; the actual system calls are not.
+ *
+ * Match a complete principal immediately before `:(`. A plain substring check is unsafe here:
+ * the sandbox-local `CodexSandboxUsers` principal ends in `Users`, so searching for `Users:(`
+ * incorrectly treats that narrow execution group as the broad built-in Users group. The left
+ * boundary deliberately excludes every character valid inside the account names we encounter,
+ * including backslash and hyphen; this also keeps `DAVE-NEW\david` intact.
+ */
+export function assertWindowsAclIsOwnerOnly(icaclsOutput, owner, path) {
+    const hasPrincipal = (principal) => {
+        const escaped = escapeRe(principal);
+        return new RegExp(`(?:^|[^A-Za-z0-9_.\\\\-])${escaped}:\\(`, "im").test(icaclsOutput);
+    };
+    const unsafe = UNSAFE_WINDOWS_PRINCIPALS.filter(hasPrincipal);
+    if (unsafe.length > 0) {
+        throw new Error(`${path} still grants access to ${unsafe.join(", ")} after tightening its ACL`);
+    }
+    // An ACL that granted nothing to anyone would pass the check above while leaving the file
+    // unreadable by its own owner -- a different bug this must not let through silently.
+    if (!hasPrincipal(owner)) {
+        throw new Error(`${path}'s ACL does not grant the current user (${owner}) after tightening it`);
+    }
+}
+/**
+ * Proves a DACL (SDDL form, from Get-Acl) is OWNER-ONLY: protected from inheritance, and every
+ * allow ACE names the current user's SID. This is the authoritative check; the icacls one above
+ * is a denylist of English group names, so it waved through a German `VORDEFINIERT\Benutzer`,
+ * a stray explicit grant to another account, and sandbox groups. SIDs read the same in every
+ * language.
+ */
+export function assertWindowsSddlIsOwnerOnly(sddl, userSid, path) {
+    const dacl = /D:([A-Z]*)((?:\([^)]*\))*)/.exec(sddl);
+    if (!dacl)
+        throw new Error(`could not read the access control list of ${path}`);
+    if (!(dacl[1] ?? "").includes("P")) {
+        throw new Error(`${path} still inherits permissions from its folder after tightening its ACL`);
+    }
+    const allows = [...(dacl[2] ?? "").matchAll(/\(([^)]*)\)/g)]
+        .map((m) => (m[1] ?? "").split(";"))
+        .filter((fields) => fields[0] === "A" || fields[0] === "OA");
+    const others = allows
+        .map((fields) => fields[5] ?? "")
+        .filter((sid) => sid.toUpperCase() !== userSid.toUpperCase());
+    if (others.length > 0) {
+        throw new Error(`${path} still grants access to ${others.join(", ")} besides the current user after tightening ` +
+            `its ACL (if this runs inside a sandbox, run the installer from a normal terminal)`);
+    }
+    if (allows.length === 0) {
+        throw new Error(`${path}'s ACL does not grant the current user after tightening it`);
+    }
+}
+function currentWindowsUserSid() {
+    // By absolute path: from Git Bash, a bare `whoami` resolves to MSYS coreutils, which has no /user.
+    const whoami = join(process.env["SystemRoot"] || "C:\\Windows", "System32", "whoami.exe");
+    const out = execFileSync(whoami, ["/user", "/fo", "csv", "/nh"], { encoding: "utf8", windowsHide: true });
+    const sid = /S-1-\d+(?:-\d+)+/.exec(out)?.[0];
+    if (!sid)
+        throw new Error("cannot determine the current Windows user's SID (whoami /user)");
+    return sid;
+}
+function powershell(command, extraEnv) {
+    // Values travel in the environment, never interpolated into the command text.
+    return execFileSync(join(process.env["SystemRoot"] || "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe"), ["-NoProfile", "-NonInteractive", "-Command", command], { encoding: "utf8", env: { ...process.env, ...extraEnv }, windowsHide: true }).trim();
+}
+function windowsSddl(path) {
+    return powershell("(Get-Acl -LiteralPath $env:BNL_HARNESS_ACL_PATH).Sddl", { BNL_HARNESS_ACL_PATH: path });
+}
+/**
+ * Replace the DACL with exactly one entry, the current user. `icacls /grant:r` cannot do this: it
+ * replaces only the NAMED user's entry. Measured on a machine with Codex's Windows sandbox: every
+ * new file there arrives with an explicit `CodexSandboxUsers:(RX)` entry, which survived
+ * `/inheritance:r /grant:r` and left the credential readable by the sandbox group that runs
+ * agent commands.
+ */
+function setOwnerOnlyDacl(path, userSid) {
+    // GetAccessControl/SetAccessControl on the Access section only. Set-Acl rewrites the audit
+    // section too and fails without SeSecurityPrivilege.
+    powershell("$s = [System.Security.AccessControl.AccessControlSections]::Access; " +
+        "$i = Get-Item -LiteralPath $env:BNL_HARNESS_ACL_PATH; $a = $i.GetAccessControl($s); " +
+        "$a.SetSecurityDescriptorSddlForm('D:PAI(A;;FA;;;' + $env:BNL_HARNESS_ACL_SID + ')', $s); " +
+        "$i.SetAccessControl($a)", { BNL_HARNESS_ACL_PATH: path, BNL_HARNESS_ACL_SID: userSid });
+}
+function currentWindowsUser() {
+    const user = process.env["USERNAME"];
+    if (!user)
+        throw new Error("cannot determine the current Windows user (USERNAME is unset)");
+    const domain = process.env["USERDOMAIN"];
+    return domain ? `${domain}\\${user}` : user;
+}
+function secureCredentialFileWindows(path) {
+    const owner = currentWindowsUser();
+    // /inheritance:r drops whatever ACEs the file inherited from its parent directory;
+    // /grant:r REPLACES any existing explicit grants with exactly this one, rather than adding
+    // to them -- so re-running this on an already-tightened file converges instead of piling up.
+    execFileSync("icacls", [path, "/inheritance:r", "/grant:r", `${owner}:F`], { stdio: "ignore" });
+    const userSid = currentWindowsUserSid();
+    setOwnerOnlyDacl(path, userSid);
+    const verify = execFileSync("icacls", [path], { encoding: "utf8" });
+    assertWindowsAclIsOwnerOnly(verify, owner, path);
+    assertWindowsSddlIsOwnerOnly(windowsSddl(path), userSid, path);
+}
+/**
+ * Restrict a just-written credential file to the current user only, and PROVE it before
+ * returning -- a credential file whose protection could not be verified is worse than none,
+ * and the caller (apply()) deletes what it just wrote when this throws.
+ */
+export function secureCredentialFile(path) {
+    if (process.platform === "win32") {
+        secureCredentialFileWindows(path);
+        return;
+    }
+    chmodSync(path, 0o600);
+    const mode = statSync(path).mode & 0o777;
+    if (mode !== 0o600) {
+        throw new Error(`chmod 0600 did not take effect on ${path} (mode is 0${mode.toString(8)})`);
+    }
+    // Best-effort: the file's own 0600 is the load-bearing protection. A parent directory this
+    // process does not own (so chmod fails) is still reported by the outer try/catch in apply(),
+    // just not treated as fatal on its own -- only the file's own mode is asserted above.
+    try {
+        chmodSync(dirname(path), 0o700);
+    }
+    catch {
+        /* best-effort */
+    }
+}
 export function apply(changes, dryRun) {
     for (const c of changes) {
         if (c.after === null || isNoop(c))
@@ -184,7 +364,27 @@ export function apply(changes, dryRun) {
         const dir = dirname(c.path);
         if (!existsSync(dir))
             mkdirSync(dir, { recursive: true });
-        writeFileSync(c.path, c.after, "utf8");
+        // A credential file is recreated, not rewritten in place: overwriting keeps the old file's
+        // ACL, and `icacls /grant:r` replaces only the named user's entry, so an explicit grant some
+        // earlier tool left on it would survive the tightening.
+        if (c.sensitive && existsSync(c.path))
+            unlinkSync(c.path);
+        writeFileSync(c.path, c.after, c.sensitive ? { encoding: "utf8", mode: 0o600 } : "utf8");
+        if (c.sensitive) {
+            try {
+                secureCredentialFile(c.path);
+            }
+            catch (e) {
+                try {
+                    unlinkSync(c.path);
+                }
+                catch {
+                    /* best-effort -- the thrown error below is what the user sees regardless */
+                }
+                throw new Error(`wrote ${c.path} but could not verify it is protected, so it was removed: ` +
+                    `${e.message}`);
+            }
+        }
     }
 }
 //# sourceMappingURL=writers.js.map

package/dist/writers.js.map

@@ -1 +1 @@
-{"version":3,"file":"writers.js","sourceRoot":"","sources":["../src/writers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAcpC,0DAA0D;AAC1D,MAAM,UAAU,MAAM,CAAC,CAAa;IAClC,OAAO,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,QAAuB,EACvB,OAAgC;IAEhC,IAAI,GAAG,GAA4B,EAAE,CAAC;IAEtC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3E,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;YACD,GAAG,GAAG,MAAiC,CAAC;QAC1C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,IAAI;gBACX,OAAO,EACL,yCAA0C,CAAW,CAAC,OAAO,MAAM;oBACnE,wDAAwD;aAC3D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GACX,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtG,CAAC,CAAE,GAAG,CAAC,YAAY,CAA6B;QAChD,CAAC,CAAC,EAAE,CAAC;IAET,wFAAwF;IACxF,8EAA8E;IAC9E,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;IAE/C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;AAChF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,QAAuB,EACvB,GAA2B;IAE3B,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3E,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;YACD,GAAG,GAAG,MAAiC,CAAC;QAC1C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,mDAAoD,CAAW,CAAC,OAAO,qBAAqB;aACtG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GACd,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjF,CAAC,CAAE,GAAG,CAAC,KAAK,CAA6B;QACzC,CAAC,CAAC,EAAE,CAAC;IACT,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,GAAG,EAAE,CAAC;IACvC,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI;QAC1C,IAAI,EAAE,+EAA+E;KACtF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,QAAuB,EACvB,UAAkB,EAClB,MAAc,EACd,WAAmB;IAEnB,MAAM,KAAK,GAAG,gBAAgB,UAAU,GAAG,CAAC;IAC5C,MAAM,KAAK,GACT,uFAAuF;QACvF,iFAAiF;QACjF,GAAG,KAAK,IAAI;QACZ,UAAU,MAAM,KAAK;QACrB,2BAA2B,WAAW,KAAK,CAAC;IAE9C,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,IAAI;YACX,OAAO,EACL,GAAG,KAAK,6EAA6E;gBACrF,KAAK,CAAC,IAAI,EAAE;SACf,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,GAAG,GAAG,GAAG,KAAK,EAAE,CAAC;AAC/D,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,QAAuB,EACvB,GAAW,EACX,KAAa;IAEb,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC5B,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC;QACxB,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;IAC1E,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,QAAQ;QAChB,KAAK;QACL,IAAI,EAAE,2CAA2C;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,QAAuB,EAAE,IAAY;IACjF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;AACrF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,CAAa;IAC1C,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO;IAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC/D,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,uDAAuD,CAAC,CAAC,IAAI,GAAG;YAC9D,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,wCAAwC;YACxE,2DAA2D,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,OAAqB,EAAE,MAAe;IAC1D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC;YAAE,SAAS;QAC5C,IAAI,MAAM;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;AACH,CAAC"}
+{"version":3,"file":"writers.js","sourceRoot":"","sources":["../src/writers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9G,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAyBlD,0DAA0D;AAC1D,MAAM,UAAU,MAAM,CAAC,CAAa;IAClC,OAAO,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,QAAuB,EACvB,OAAgC;IAEhC,IAAI,GAAG,GAA4B,EAAE,CAAC;IAEtC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3E,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;YACD,GAAG,GAAG,MAAiC,CAAC;QAC1C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,IAAI;gBACX,OAAO,EACL,yCAA0C,CAAW,CAAC,OAAO,MAAM;oBACnE,wDAAwD;aAC3D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GACX,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtG,CAAC,CAAE,GAAG,CAAC,YAAY,CAA6B;QAChD,CAAC,CAAC,EAAE,CAAC;IAET,wFAAwF;IACxF,8EAA8E;IAC9E,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;IAE/C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;AAChF,CAAC;AAED;;;;;;;;;GASG;AACH,+FAA+F;AAC/F,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,kBAAkB,EAAE,gBAAgB,EAAE,eAAe,EAAE,oBAAoB;IAC3E,gBAAgB,EAAE,iBAAiB;IACnC,oBAAoB,EAAE,oBAAoB,EAAE,uBAAuB;IACnE,qBAAqB,EAAE,wBAAwB;IAC/C,mBAAmB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,kBAAkB;IACnF,eAAe,EAAE,kBAAkB,EAAE,qBAAqB;CAClD,CAAC;AAEX,qEAAqE;AACrE,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,QAAuB,EACvB,UAAkB,EAClB,MAAc,EACd,WAAmB;IAEnB,MAAM,KAAK,GAAG,4CAA4C,CAAC;IAC3D,MAAM,GAAG,GAAG,0CAA0C,CAAC;IACvD,MAAM,KAAK,GAAG,gBAAgB,UAAU,GAAG,CAAC;IAC5C,MAAM,SAAS,GAAG,+BAA+B,CAAC,GAAG,CACnD,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,UAAU,UAAU,IAAI,gCAAgC,CACrF,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,MAAM,KAAK,GACT,GAAG,KAAK,IAAI;QACZ,0FAA0F;QAC1F,GAAG,KAAK,IAAI;QACZ,UAAU,MAAM,KAAK;QACrB,2BAA2B,WAAW,KAAK;QAC3C,0CAA0C;QAC1C,SAAS;QACT,GAAG,GAAG,IAAI,CAAC;IAEb,MAAM,IAAI,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5C,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,wEAAwE,EAAE,CAAC;IACpI,CAAC;IACD,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;QACrD,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;QAC3F,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,MAAM,GAAG,kSAAkS,CAAC;IAClT,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,8DAA8D,EAAE,CAAC;IAC1H,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAe,CAAC;QACpC,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAC1F,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC;IACzF,CAAC;IAED,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,MAAM,gBAAgB,GAAG,gBAAgB,UAAU,GAAG,CAAC;IACvD,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,GAAG,KAAK,gFAAgF;SAClG,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,MAAM,CAC9B,gBAAgB,QAAQ,CAAC,KAAK,CAAC,SAAS;QACxC,UAAU,QAAQ,CAAC,MAAM,CAAC,UAAU;QACpC,2BAA2B,QAAQ,CAAC,WAAW,CAAC,WAAW;QAC3D,kBAAkB,CACnB,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC3C,IAAI,QAAQ,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAC/G,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC;IACzF,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,GAAG,KAAK,6GAA6G;SAC/H,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IACvC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,eAAe,GAAG,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC;AACzG,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB,CAAC,QAAuB,EAAE,KAAe;IAC3E,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,QAAuB,EACvB,GAAW,EACX,KAAa,EACb,gBAA0B,EAAE;IAE5B,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC5B,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC;QACxB,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;IAC1E,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9F,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,QAAQ;QAChB,KAAK;QACL,IAAI,EAAE,2CAA2C;QACjD,GAAG,CAAC,MAAM,CAAC,MAAM;YACf,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,GAAG,2BAA2B,IAAI,sBAAsB,IAAI,EAAE,EAAE;YAC1H,CAAC,CAAC,EAAE,CAAC;QACP,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,QAAuB,EACvB,KAAa,EACb,IAAI,GAAG,oDAAoD;IAE3D,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI;QAC5C,IAAI;QACJ,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,QAAuB,EAAE,IAAY;IACjF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;AACrF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,CAAa;IAC1C,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO;IAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC/D,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,uDAAuD,CAAC,CAAC,IAAI,GAAG;YAC9D,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,sDAAsD;YACtF,kBAAkB,CACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,yBAAyB,GAAG,CAAC,UAAU,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAC;AAEjG;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,2BAA2B,CAAC,YAAoB,EAAE,KAAa,EAAE,IAAY;IAC3F,MAAM,YAAY,GAAG,CAAC,SAAiB,EAAW,EAAE;QAClD,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpC,OAAO,IAAI,MAAM,CAAC,4BAA4B,OAAO,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxF,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2BAA2B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAClG,CAAC;IACD,0FAA0F;IAC1F,qFAAqF;IACrF,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2CAA2C,KAAK,uBAAuB,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY,EAAE,OAAe,EAAE,IAAY;IACtF,MAAM,IAAI,GAAG,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,sEAAsE,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;SACzD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACnC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM;SAClB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SAChC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,2BAA2B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,6CAA6C;YAC9F,mFAAmF,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4DAA4D,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB;IAC5B,mGAAmG;IACnG,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,aAAa,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1G,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAC5F,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,QAAgC;IACnE,8EAA8E;IAC9E,OAAO,YAAY,CACjB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,aAAa,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAC3G,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,CAAC,EACtD,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAC9E,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,UAAU,CAAC,uDAAuD,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7G,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe;IACrD,2FAA2F;IAC3F,qDAAqD;IACrD,UAAU,CACR,sEAAsE;QACpE,sFAAsF;QACtF,2FAA2F;QAC3F,yBAAyB,EAC3B,EAAE,oBAAoB,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAC7D,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY;IAC/C,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,mFAAmF;IACnF,2FAA2F;IAC3F,6FAA6F;IAC7F,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,KAAK,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChG,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;IACxC,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACpE,2BAA2B,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjD,4BAA4B,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IACD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IACzC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,2FAA2F;IAC3F,6FAA6F;IAC7F,sFAAsF;IACtF,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,OAAqB,EAAE,MAAe;IAC1D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC;YAAE,SAAS;QAC5C,IAAI,MAAM;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,2FAA2F;QAC3F,6FAA6F;QAC7F,wDAAwD;QACxD,IAAI,CAAC,CAAC,SAAS,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1D,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACzF,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;gBAAC,MAAM,CAAC;oBACP,4EAA4E;gBAC9E,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,SAAS,CAAC,CAAC,IAAI,4DAA4D;oBACzE,GAAI,CAAW,CAAC,OAAO,EAAE,CAC5B,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@bluenotelogic/harness",
-  "version": "0.1.0",
-  "description": "One command to point a machine at Blue Note Memory (mem.bnlgit.com). Writes a TOKENLESS MCP config — OAuth-capable hosts hold their own credentials, so nothing secret lands in a repo file.",
+  "version": "0.2.0",
+  "description": "One command to connect Claude Code, Codex, VS Code, and Google Antigravity to ProofMEM with tokenless native OAuth MCP configuration.",
   "type": "module",
   "bin": {
     "bnl-harness": "dist/index.js"
@@ -9,8 +9,11 @@
   "main": "./dist/index.js",
   "files": [
     "dist",
+    "assets",
     "README.md",
-    "LICENSE"
+    "CHANGELOG.md",
+    "LICENSE",
+    "NOTICE"
   ],
   "scripts": {
     "build": "tsc",
@@ -31,7 +34,8 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://git.bluenotelogic.com/bnl/bnlgit-harness"
+    "url": "https://git.bluenotelogic.com/bnl/bnlgit-harness",
+    "directory": "packages/cli"
   },
   "keywords": [
     "mcp",
@@ -39,6 +43,8 @@
     "oauth",
     "claude-code",
     "codex",
+    "antigravity",
+    "proofmem",
     "bnlgit"
   ],
   "license": "Apache-2.0",