@contextq/cli 0.0.1 → 0.1.0

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzF,OAAO,EAAE,UAAU,EAAqB,MAAM,kBAAkB,CAAC;AAEjE,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAa/C,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACtE,MAAM,IAAI,GAAS,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAE/F,KAAK,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,QAAQ,CAAC,EAAE,CAAC;YACV,KAAK,OAAO;gBACV,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrB,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrB,MAAM;YACR,KAAK,aAAa;gBAChB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC3B,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACvB,MAAM;YACR,KAAK,aAAa;gBAChB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACrB,MAAM;YACR,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACpB,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;oBACzC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,6CAA6C,CAAC,CAAC;gBACtF,CAAC;gBACD,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;gBACjB,MAAM;YACR,CAAC;YACD,KAAK,IAAI,CAAC;YACV,KAAK,QAAQ;gBACX,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR;gBACE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;;;;;;;sDAOwC,WAAW;;gDAEjB,wBAAwB;;;gDAGxB,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;qEAwBH,WAAW;CAC/E,CAAC,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC1C,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,SAAS,KAAK,CAAC,MAAc;IAC3B,MAAM,KAAK,GAA2B;QACpC,OAAO,EAAE,UAAU;QACnB,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,UAAU;QACnB,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,SAAS;KAClB,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,GAAG,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,MAAc;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,EAAE;YACrE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;SAC/C,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;IACtD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAU;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAE/E,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAE7B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,+EAA+E,GAAG,GAAG,CAAC,CAAC;QACnG,iBAAiB,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,wBAAwB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,CAAC;IAE3E,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,WAAW,CAAC;IAEzF,qEAAqE;IACrE,uEAAuE;IACvE,sEAAsE;IACtE,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,qCAAqC;IACrC,MAAM,cAAc,GAA6C,OAAO,CAAC,GAAG,CAAC,eAAe;QAC1F,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW;YACvB,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,CAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjF,IAAI,QAAQ,GAAG,qBAAqB,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAEpG,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC7B,sEAAsE;QACtE,oDAAoD;QACpD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,kCAAkC,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,gFAAgF;gBAC9E,0DAA0D,CAC7D,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,qBAAqB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE/B,qEAAqE;IACrE,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,mEAAmE;IACnE,0CAA0C;IAC1C,IAAI,KAAa,CAAC;IAClB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,SAAiB,CAAC;IACtB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,sEAAsE;QACtE,uEAAuE;QACvE,iEAAiE;QACjE,iEAAiE;QACjE,+DAA+D;QAC/D,qEAAqE;QACrE,yBAAyB;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QAC7C,SAAS,GAAG,YAAY,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACjD,IAAI,OAAO,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,8DAA8D,IAAI,CAAC,SAAS,SAAS,OAAO,GAAG,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,cAAc,SAAS,EAAE,CAAC,CAAC;IAE9D,IAAI,SAAqD,CAAC;IAC1D,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACrC,SAAS,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;QAElG,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QAErG,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1G,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,wFAAwF,CAAC,CAAC;QACtG,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;QAC9F,OAAO,CAAC,GAAG,CAAC,wFAAwF,CAAC,CAAC;QACtG,OAAO,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAC;QACpG,OAAO,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAC;QACpG,OAAO,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC;QACvG,OAAO,CAAC,GAAG,CAAC,2FAA2F,CAAC,CAAC;QACzG,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,2FAA2F,CAAC,CAAC;QACzG,OAAO,CAAC,GAAG,CAAC,2FAA2F,CAAC,CAAC;QACzG,OAAO,CAAC,GAAG,CAAC,0FAA0F,CAAC,CAAC;QACxG,OAAO,CAAC,GAAG,CAAC,8FAA8F,CAAC,CAAC;QAC5G,OAAO,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAC;QAC7F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,eAAe,GAAG,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,KAAK,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IACtH,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5D,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,kBAAkB,MAAM,+BAA+B,CAAC,CAAC;IAC3F,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,IAAI,eAAe,CAAC;QAC3G,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,kBAAkB,MAAM,KAAK,MAAM,mCAAmC,CAAC,CAAC;QACtG,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC/D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,IAAI,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;QAC9F,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;IAChG,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAgC,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC3F,MAAM,QAAQ,GAAG,YAAY;SAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;SACrF,IAAI,CAAC,WAAW,CAAC,CAAC;IACrB,OAAO,CAAC,GAAG,CAAC,cAAc,QAAQ,sCAAsC,CAAC,CAAC;IAE1E,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,qEAAqE;IACrE,0EAA0E;IAC1E,yCAAyC;IACzC,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;QAC1F,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;QAC5F,OAAO,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAaD;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,IAAc;IACzC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,IAAI,GAA4B,EAAE,CAAC;IAEzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,QAAQ,CAAC,EAAE,CAAC;YACV,KAAK,aAAa;gBAChB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC3B,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrB,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrB,MAAM;YACR;gBACE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;gBAC5C,CAAC;gBACD,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAoB;IAC3C,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC;IACpH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,QAAQ,CAAC,MAAM,CAAC;IAErG,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAAC,MAAc,EAAE,MAAc,EAAE,SAAkB;IAClF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;IACjF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,SAAS;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAE5D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACjF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAoB;IAC/C,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAErC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEzG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;QAC9B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,WAAW,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;KACtE,CAAC,CAAC;IAEH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAEpG,OAAO,CAAC,GAAG,CACT,YAAY,MAAM,CAAC,OAAO,CAAC,MAAM,aAAa,MAAM,CAAC,OAAO,CAAC,MAAM,aAAa,MAAM,CAAC,SAAS,CAAC,MAAM,YAAY,CACpH,CAAC;IAEF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,OAAO,CAAC,MAAM,mDAAmD,CAAC,CAAC;QAClG,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,oCAAoC,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7C,SAAS,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YACvB,OAAO,CAAC,KAAK,CAAC,0CAA0C,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;YAC7F,SAAS,EAAE,CAAC;YACZ,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,aAAc,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACrD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,IAAU,CAAC;IACf,IAAI,CAAC;QACH,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,aAAc,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,SAAS,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,CAAC,KAAK,CAAC,8BAA8B,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;QAC7D,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,aAAc,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/mcp-config.d.ts

@@ -0,0 +1,17 @@
+/**
+ * mcp-config.ts — idempotent .mcp.json merge.
+ *
+ * Mirrors skills/contextq/scripts/install-hook.sh's wire_mcp(): never
+ * clobbers an existing .mcp.json, only ever sets/reads the "contextq" key
+ * under mcpServers, and defaults the key value to the ${CONTEXT_API_KEY}
+ * placeholder (safe default -- no secret on disk) unless --embed-key is
+ * passed. Claude Code expands ${VAR} from ITS OWN process environment, not
+ * from the credential file this installer writes -- same documented gap
+ * install-hook.sh warns about.
+ */
+export interface McpWireResult {
+    path: string;
+    action: 'created' | 'added' | 'skipped';
+    detail: string;
+}
+export declare function wireMcpJson(root: string, apiUrl: string, embedKey: boolean, apiKey: string): McpWireResult;

package/dist/mcp-config.js

@@ -0,0 +1,79 @@
+/**
+ * mcp-config.ts — idempotent .mcp.json merge.
+ *
+ * Mirrors skills/contextq/scripts/install-hook.sh's wire_mcp(): never
+ * clobbers an existing .mcp.json, only ever sets/reads the "contextq" key
+ * under mcpServers, and defaults the key value to the ${CONTEXT_API_KEY}
+ * placeholder (safe default -- no secret on disk) unless --embed-key is
+ * passed. Claude Code expands ${VAR} from ITS OWN process environment, not
+ * from the credential file this installer writes -- same documented gap
+ * install-hook.sh warns about.
+ */
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { join } from 'node:path';
+/**
+ * T474: whether `relPath` (relative to `root`) is covered by a gitignore rule.
+ * Returns null when this can't be determined (no git repo at `root`, or git
+ * itself is unavailable) -- callers must treat that as "unknown", not "safe".
+ */
+function isPathGitIgnored(root, relPath) {
+    try {
+        execFileSync('git', ['check-ignore', '-q', '--', relPath], { cwd: root, stdio: 'ignore' });
+        return true;
+    }
+    catch (err) {
+        const status = err.status;
+        if (status === 1)
+            return false;
+        return null;
+    }
+}
+export function wireMcpJson(root, apiUrl, embedKey, apiKey) {
+    const path = join(root, '.mcp.json');
+    const existed = existsSync(path);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    let doc = {};
+    if (existed) {
+        const raw = readFileSync(path, 'utf-8');
+        try {
+            doc = raw.trim() === '' ? {} : JSON.parse(raw);
+        }
+        catch (err) {
+            throw new Error(`.mcp.json exists but is not valid JSON (${err.message}) -- refusing to touch it`);
+        }
+    }
+    doc.mcpServers ??= {};
+    if (doc.mcpServers.contextq) {
+        return { path, action: 'skipped', detail: 'contextq server entry already present' };
+    }
+    // T474: --embed-key is about to write the raw secret to disk -- refuse when
+    // .mcp.json would land in a commit, since that turns a local convenience
+    // flag into a leaked-credential incident the moment someone runs `git add .`.
+    if (embedKey) {
+        const ignored = isPathGitIgnored(root, '.mcp.json');
+        if (ignored === false) {
+            throw new Error('.mcp.json is not covered by .gitignore in this repo -- refusing to write the raw API key into a ' +
+                'file git would track. Add ".mcp.json" to .gitignore first, or re-run without --embed-key to use ' +
+                'the safer ${CONTEXT_API_KEY} placeholder instead.');
+        }
+        if (ignored === null) {
+            console.log('[warn]  could not verify .mcp.json is gitignored (no git repo detected at this path) -- writing the raw key anyway.');
+        }
+    }
+    doc.mcpServers.contextq = {
+        command: 'npx',
+        args: ['-y', '@contextq/mcp'],
+        env: {
+            CONTEXT_API_URL: apiUrl,
+            CONTEXT_API_KEY: embedKey ? apiKey : '${CONTEXT_API_KEY}',
+        },
+    };
+    writeFileSync(path, `${JSON.stringify(doc, null, 2)}\n`);
+    return {
+        path,
+        action: existed ? 'added' : 'created',
+        detail: `contextq server wired (key=${embedKey ? 'embedded literal' : '${CONTEXT_API_KEY} placeholder'})`,
+    };
+}
+//# sourceMappingURL=mcp-config.js.map

package/dist/mcp-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-config.js","sourceRoot":"","sources":["../src/mcp-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAQjC;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe;IACrD,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAI,GAA2B,CAAC,MAAM,CAAC;QACnD,IAAI,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc,EAAE,QAAiB,EAAE,MAAc;IACzF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAEjC,8DAA8D;IAC9D,IAAI,GAAG,GAAQ,EAAE,CAAC;IAClB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2CAA4C,GAAa,CAAC,OAAO,2BAA2B,CAAC,CAAC;QAChH,CAAC;IACH,CAAC;IAED,GAAG,CAAC,UAAU,KAAK,EAAE,CAAC;IACtB,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IACtF,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,8EAA8E;IAC9E,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACpD,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,kGAAkG;gBAChG,kGAAkG;gBAClG,mDAAmD,CACtD,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CACT,qHAAqH,CACtH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,GAAG,CAAC,UAAU,CAAC,QAAQ,GAAG;QACxB,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;QAC7B,GAAG,EAAE;YACH,eAAe,EAAE,MAAM;YACvB,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB;SAC1D;KACF,CAAC;IAEF,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAEzD,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACrC,MAAM,EAAE,8BAA8B,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gCAAgC,GAAG;KAC1G,CAAC;AACJ,CAAC"}

package/dist/platform-cred.d.ts

@@ -0,0 +1,105 @@
+/**
+ * platform-cred.ts — read/write the contextq platform credential file.
+ *
+ * Same path + mode as the existing T144 web installer (src/routes/installer.ts)
+ * and the same path the contextq skill's bash scripts (contextq-api.sh,
+ * install-hook.sh, contextq-boot.sh) and Bun cred-resolve.ts already read:
+ *
+ *   macOS:   ~/Library/Application Support/contextq/credentials
+ *   Windows: %APPDATA%/contextq/credentials
+ *   Linux:   $XDG_CONFIG_HOME/contextq/credentials  (default ~/.config)
+ *
+ * The existing readers disagree on which key names they check: install.sh
+ * (T144) writes CTQ_API_KEY/CTQ_API_URL (read by cred-resolve.ts's Bun path),
+ * while every bash script (contextq-api.sh, install-hook.sh, contextq-boot.sh)
+ * only ever reads CONTEXT_API_KEY/CONTEXT_API_URL from this same file. Rather
+ * than picking a side, this installer writes BOTH pairs so the credential it
+ * writes is visible to every existing reader regardless of that pre-existing
+ * inconsistency.
+ *
+ * Never logs or prints the key value.
+ *
+ * T676: writeCreds() itself remains an unconditional overwrite -- callers
+ * decide when that's appropriate. The safety layer lives in the helpers
+ * below (credsFileExists/credsEqual/backupCredsFile), which index.ts's
+ * runInit() composes into: no write on an ambient env var alone when a
+ * credential file already exists, a timestamped backup before any write
+ * that would actually change an existing file, and a no-op when the new
+ * value is identical to what's already on disk.
+ */
+export interface Creds {
+    apiKey: string;
+    apiUrl: string;
+}
+/**
+ * T676: test-only override so cli/ tests can point every read/write at a
+ * throwaway temp dir instead of the real machine-wide credential path.
+ * Checked first, ahead of every OS-specific branch below. Production never
+ * sets this -- there is no code path that sets it outside a test.
+ */
+export declare function platformCredDir(): string;
+export declare function platformCredFile(): string;
+/** Does a credential file already exist on disk (real or overridden dir)? */
+export declare function credsFileExists(): boolean;
+/** Same apiKey AND same apiUrl -- the "nothing would actually change" case. */
+export declare function credsEqual(a: Creds, b: Creds): boolean;
+/**
+ * Copy whatever credential file is currently on disk to a timestamped
+ * sibling (mode 600, same directory) BEFORE it gets overwritten. Returns
+ * the backup path, or null when there was no existing file to back up.
+ * Never throws on missing source -- callers gate this on credsFileExists().
+ */
+export declare function backupCredsFile(): string | null;
+/** Read whatever is already on disk. Both apiKey/apiUrl are '' when absent. */
+export declare function readExistingCreds(): Creds;
+/**
+ * Write the credential file at mode 0600 (dir at 0700). Overwrites whatever
+ * was there before — callers decide when that's appropriate (explicit --key,
+ * or no existing credential at all).
+ */
+export declare function writeCreds(creds: Creds): string;
+export declare const KEY_RE: RegExp;
+export interface CredentialDecisionInput {
+    /** `--key` flag value, if the caller passed one. */
+    explicitKey?: string;
+    /** Name of whichever ambient env var supplied a key, or null when neither is set. */
+    ambientVarName: 'CONTEXT_API_KEY' | 'CTQ_API_KEY' | null;
+    /** The ambient env var's value; '' when ambientVarName is null. */
+    ambientKey: string;
+    apiUrl: string;
+}
+export interface CredentialDecision {
+    apiKey: string;
+    credLine: string;
+    /**
+     * null only when the caller must fall through to an interactive prompt:
+     * no --key, no ambient env var, and no existing file to fall back to.
+     */
+    action: 'created' | 'rotated' | 'skipped' | null;
+    backupPath: string | null;
+}
+/**
+ * T676: the non-interactive half of `contextq init`'s credential
+ * resolution. Fixes the real incident this task is named for -- a demo run
+ * with only an AMBIENT env var set (direnv-exported CONTEXT_API_KEY from
+ * some repo's .env.local) used to be treated exactly like an explicit
+ * --key, silently overwriting a pre-existing machine-wide credential file
+ * with no backup. Branches, matching T676's required behavior 1-4:
+ *
+ *   1. no --key, ambient env only, file exists -> file untouched, used as-is,
+ *      "skipped" naming the ignored env var
+ *   2. --key given, file exists with a different key or url -> back up the
+ *      existing file (mode 600, timestamped) THEN write, "rotated"
+ *   3. --key given, file exists with the identical key AND url -> no write,
+ *      "skipped (unchanged)"
+ *   4. no existing file at all -> unchanged prior behavior, "created"
+ *      (works from either --key or an ambient env var, since there is
+ *      nothing to protect)
+ *
+ * The one case this function does not resolve on its own is "no --key, no
+ * ambient env var, no existing file" -- action comes back null and the
+ * caller must prompt interactively, then call this function again with the
+ * typed value as `explicitKey` to get a consistent created/rotated/skipped
+ * decision (falls into branch 4 in practice, since there is no file yet).
+ */
+export declare function decideCredentialWrite(input: CredentialDecisionInput): CredentialDecision;

package/dist/platform-cred.js

@@ -0,0 +1,210 @@
+/**
+ * platform-cred.ts — read/write the contextq platform credential file.
+ *
+ * Same path + mode as the existing T144 web installer (src/routes/installer.ts)
+ * and the same path the contextq skill's bash scripts (contextq-api.sh,
+ * install-hook.sh, contextq-boot.sh) and Bun cred-resolve.ts already read:
+ *
+ *   macOS:   ~/Library/Application Support/contextq/credentials
+ *   Windows: %APPDATA%/contextq/credentials
+ *   Linux:   $XDG_CONFIG_HOME/contextq/credentials  (default ~/.config)
+ *
+ * The existing readers disagree on which key names they check: install.sh
+ * (T144) writes CTQ_API_KEY/CTQ_API_URL (read by cred-resolve.ts's Bun path),
+ * while every bash script (contextq-api.sh, install-hook.sh, contextq-boot.sh)
+ * only ever reads CONTEXT_API_KEY/CONTEXT_API_URL from this same file. Rather
+ * than picking a side, this installer writes BOTH pairs so the credential it
+ * writes is visible to every existing reader regardless of that pre-existing
+ * inconsistency.
+ *
+ * Never logs or prints the key value.
+ *
+ * T676: writeCreds() itself remains an unconditional overwrite -- callers
+ * decide when that's appropriate. The safety layer lives in the helpers
+ * below (credsFileExists/credsEqual/backupCredsFile), which index.ts's
+ * runInit() composes into: no write on an ambient env var alone when a
+ * credential file already exists, a timestamped backup before any write
+ * that would actually change an existing file, and a no-op when the new
+ * value is identical to what's already on disk.
+ */
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/**
+ * T676: test-only override so cli/ tests can point every read/write at a
+ * throwaway temp dir instead of the real machine-wide credential path.
+ * Checked first, ahead of every OS-specific branch below. Production never
+ * sets this -- there is no code path that sets it outside a test.
+ */
+export function platformCredDir() {
+    const override = process.env.CTQ_CRED_DIR || process.env.CONTEXTQ_CRED_DIR;
+    if (override)
+        return override;
+    const candidates = CRED_DIR_NAMES.map(platformCredDirFor);
+    return candidates.find((dir) => existsSync(join(dir, 'credentials'))) ?? candidates[0];
+}
+const CRED_DIR_NAMES = ['contextq', 'ctq-brain'];
+function platformCredDirFor(dirName) {
+    const home = homedir();
+    if (process.platform === 'darwin') {
+        return join(home, 'Library', 'Application Support', dirName);
+    }
+    if (process.platform === 'win32') {
+        const appData = process.env.APPDATA ?? join(home, 'AppData', 'Roaming');
+        return join(appData, dirName);
+    }
+    const xdg = process.env.XDG_CONFIG_HOME ?? join(home, '.config');
+    return join(xdg, dirName);
+}
+export function platformCredFile() {
+    return join(platformCredDir(), 'credentials');
+}
+/** Does a credential file already exist on disk (real or overridden dir)? */
+export function credsFileExists() {
+    return existsSync(platformCredFile());
+}
+/** Same apiKey AND same apiUrl -- the "nothing would actually change" case. */
+export function credsEqual(a, b) {
+    return a.apiKey === b.apiKey && a.apiUrl === b.apiUrl;
+}
+function utcTimestamp() {
+    const d = new Date();
+    const pad = (n) => String(n).padStart(2, '0');
+    return (`${d.getUTCFullYear()}${pad(d.getUTCMonth() + 1)}${pad(d.getUTCDate())}` +
+        `T${pad(d.getUTCHours())}${pad(d.getUTCMinutes())}${pad(d.getUTCSeconds())}Z`);
+}
+/**
+ * Copy whatever credential file is currently on disk to a timestamped
+ * sibling (mode 600, same directory) BEFORE it gets overwritten. Returns
+ * the backup path, or null when there was no existing file to back up.
+ * Never throws on missing source -- callers gate this on credsFileExists().
+ */
+export function backupCredsFile() {
+    const file = platformCredFile();
+    if (!existsSync(file))
+        return null;
+    const dir = platformCredDir();
+    const backupPath = join(dir, `credentials.bak-${utcTimestamp()}`);
+    copyFileSync(file, backupPath);
+    chmodSync(backupPath, 0o600);
+    return backupPath;
+}
+function readEnvVal(key, filePath) {
+    if (!existsSync(filePath))
+        return '';
+    try {
+        const content = readFileSync(filePath, 'utf-8');
+        for (const line of content.split('\n')) {
+            if (line.startsWith(`${key}=`))
+                return line.slice(key.length + 1).trim();
+        }
+    }
+    catch {
+        // never throw on a read error — treat as "no credential found"
+    }
+    return '';
+}
+/** Read whatever is already on disk. Both apiKey/apiUrl are '' when absent. */
+export function readExistingCreds() {
+    const file = platformCredFile();
+    const apiKey = readEnvVal('CTQ_API_KEY', file) || readEnvVal('CONTEXT_API_KEY', file);
+    const apiUrl = readEnvVal('CTQ_API_URL', file) || readEnvVal('CONTEXT_API_URL', file);
+    return { apiKey, apiUrl };
+}
+/**
+ * Write the credential file at mode 0600 (dir at 0700). Overwrites whatever
+ * was there before — callers decide when that's appropriate (explicit --key,
+ * or no existing credential at all).
+ */
+export function writeCreds(creds) {
+    const dir = platformCredDir();
+    const file = platformCredFile();
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+    const body = `CTQ_API_KEY=${creds.apiKey}\n` +
+        `CTQ_API_URL=${creds.apiUrl}\n` +
+        `CONTEXT_API_KEY=${creds.apiKey}\n` +
+        `CONTEXT_API_URL=${creds.apiUrl}\n`;
+    writeFileSync(file, body, { mode: 0o600 });
+    chmodSync(file, 0o600);
+    return file;
+}
+export const KEY_RE = /^sk_live_[0-9a-f]{40}$/;
+const LABEL_CREATED = '[create]';
+const LABEL_ROTATED = '[rotate]';
+const LABEL_SKIPPED = '[skip] ';
+/**
+ * T676: the non-interactive half of `contextq init`'s credential
+ * resolution. Fixes the real incident this task is named for -- a demo run
+ * with only an AMBIENT env var set (direnv-exported CONTEXT_API_KEY from
+ * some repo's .env.local) used to be treated exactly like an explicit
+ * --key, silently overwriting a pre-existing machine-wide credential file
+ * with no backup. Branches, matching T676's required behavior 1-4:
+ *
+ *   1. no --key, ambient env only, file exists -> file untouched, used as-is,
+ *      "skipped" naming the ignored env var
+ *   2. --key given, file exists with a different key or url -> back up the
+ *      existing file (mode 600, timestamped) THEN write, "rotated"
+ *   3. --key given, file exists with the identical key AND url -> no write,
+ *      "skipped (unchanged)"
+ *   4. no existing file at all -> unchanged prior behavior, "created"
+ *      (works from either --key or an ambient env var, since there is
+ *      nothing to protect)
+ *
+ * The one case this function does not resolve on its own is "no --key, no
+ * ambient env var, no existing file" -- action comes back null and the
+ * caller must prompt interactively, then call this function again with the
+ * typed value as `explicitKey` to get a consistent created/rotated/skipped
+ * decision (falls into branch 4 in practice, since there is no file yet).
+ */
+export function decideCredentialWrite(input) {
+    const existing = readExistingCreds();
+    const fileExists = credsFileExists();
+    const writeSafely = (newCreds) => {
+        if (!fileExists) {
+            writeCreds(newCreds);
+            return { action: 'created', backupPath: null };
+        }
+        if (credsEqual(existing, newCreds)) {
+            return { action: 'skipped', backupPath: null };
+        }
+        const backupPath = backupCredsFile();
+        writeCreds(newCreds);
+        return { action: 'rotated', backupPath };
+    };
+    if (input.explicitKey) {
+        if (!KEY_RE.test(input.explicitKey)) {
+            throw new Error('the provided API key does not look valid (expected sk_live_<40 hex chars>)');
+        }
+        const apiKey = input.explicitKey;
+        const result = writeSafely({ apiKey, apiUrl: input.apiUrl });
+        const credLine = result.action === 'skipped'
+            ? `${LABEL_SKIPPED} credentials (unchanged)`
+            : result.action === 'rotated'
+                ? `${LABEL_ROTATED} credentials (${platformCredFile()}; previous saved to ${result.backupPath})`
+                : `${LABEL_CREATED} credentials (${platformCredFile()}, mode 600)`;
+        return { apiKey, credLine, action: result.action, backupPath: result.backupPath };
+    }
+    if (fileExists && existing.apiKey) {
+        // Branch 1: an ambient env var, if any, is deliberately never even
+        // validated here -- it is not going to be used, so a garbage value must
+        // not throw.
+        const credLine = input.ambientVarName
+            ? `${LABEL_SKIPPED} credentials (already configured at ${platformCredFile()}; env ${input.ambientVarName} ignored, pass --key to rotate)`
+            : `${LABEL_SKIPPED} credentials (already configured at ${platformCredFile()}; pass --key to rotate)`;
+        return { apiKey: existing.apiKey, credLine, action: 'skipped', backupPath: null };
+    }
+    if (input.ambientKey) {
+        if (!KEY_RE.test(input.ambientKey)) {
+            throw new Error('the provided API key does not look valid (expected sk_live_<40 hex chars>)');
+        }
+        const apiKey = input.ambientKey;
+        const result = writeSafely({ apiKey, apiUrl: input.apiUrl });
+        const credLine = result.action === 'rotated'
+            ? `${LABEL_ROTATED} credentials (${platformCredFile()}; previous saved to ${result.backupPath})`
+            : `${LABEL_CREATED} credentials (${platformCredFile()}, mode 600)`;
+        return { apiKey, credLine, action: result.action, backupPath: result.backupPath };
+    }
+    return { apiKey: '', credLine: '', action: null, backupPath: null };
+}
+//# sourceMappingURL=platform-cred.js.map

package/dist/platform-cred.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-cred.js","sourceRoot":"","sources":["../src/platform-cred.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtG,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAOjC;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC3E,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,WAAW,CAAU,CAAC;AAE1D,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,CAAC,eAAe,EAAE,EAAE,aAAa,CAAC,CAAC;AAChD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe;IAC7B,OAAO,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,UAAU,CAAC,CAAQ,EAAE,CAAQ;IAC3C,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;AACxD,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IACrB,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,OAAO,CACL,GAAG,CAAC,CAAC,cAAc,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE;QACxE,IAAI,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,GAAG,CAC9E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,YAAY,EAAE,EAAE,CAAC,CAAC;IAClE,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC/B,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,QAAgB;IAC/C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB;IAC/B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,UAAU,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,UAAU,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IACtF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAY;IACrC,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAEtB,MAAM,IAAI,GACR,eAAe,KAAK,CAAC,MAAM,IAAI;QAC/B,eAAe,KAAK,CAAC,MAAM,IAAI;QAC/B,mBAAmB,KAAK,CAAC,MAAM,IAAI;QACnC,mBAAmB,KAAK,CAAC,MAAM,IAAI,CAAC;IAEtC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3C,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAE/C,MAAM,aAAa,GAAG,UAAU,CAAC;AACjC,MAAM,aAAa,GAAG,UAAU,CAAC;AACjC,MAAM,aAAa,GAAG,SAAS,CAAC;AAuBhC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA8B;IAClE,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,eAAe,EAAE,CAAC;IAErC,MAAM,WAAW,GAAG,CAClB,QAAe,EAC2D,EAAE;QAC5E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,UAAU,GAAG,eAAe,EAAE,CAAC;QACrC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC,CAAC;IAEF,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC;QACjC,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,QAAQ,GACZ,MAAM,CAAC,MAAM,KAAK,SAAS;YACzB,CAAC,CAAC,GAAG,aAAa,0BAA0B;YAC5C,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS;gBAC3B,CAAC,CAAC,GAAG,aAAa,iBAAiB,gBAAgB,EAAE,uBAAuB,MAAM,CAAC,UAAU,GAAG;gBAChG,CAAC,CAAC,GAAG,aAAa,iBAAiB,gBAAgB,EAAE,aAAa,CAAC;QACzE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;IACpF,CAAC;IAED,IAAI,UAAU,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAClC,mEAAmE;QACnE,wEAAwE;QACxE,aAAa;QACb,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc;YACnC,CAAC,CAAC,GAAG,aAAa,uCAAuC,gBAAgB,EAAE,SAAS,KAAK,CAAC,cAAc,iCAAiC;YACzI,CAAC,CAAC,GAAG,aAAa,uCAAuC,gBAAgB,EAAE,yBAAyB,CAAC;QACvG,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACpF,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC;QAChC,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,QAAQ,GACZ,MAAM,CAAC,MAAM,KAAK,SAAS;YACzB,CAAC,CAAC,GAAG,aAAa,iBAAiB,gBAAgB,EAAE,uBAAuB,MAAM,CAAC,UAAU,GAAG;YAChG,CAAC,CAAC,GAAG,aAAa,iBAAiB,gBAAgB,EAAE,aAAa,CAAC;QACvE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;IACpF,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACtE,CAAC"}

package/dist/prompt.d.ts

@@ -0,0 +1,8 @@
+/**
+ * prompt.ts — masked stdin prompt for the API key, no extra dependency.
+ *
+ * Returns '' immediately when stdin is not a TTY (non-interactive/CI run) --
+ * callers must treat that as "no key available" and fail with a clear
+ * message rather than hang waiting for input that will never arrive.
+ */
+export declare function promptHidden(question: string): Promise<string>;

package/dist/prompt.js

@@ -0,0 +1,53 @@
+/**
+ * prompt.ts — masked stdin prompt for the API key, no extra dependency.
+ *
+ * Returns '' immediately when stdin is not a TTY (non-interactive/CI run) --
+ * callers must treat that as "no key available" and fail with a clear
+ * message rather than hang waiting for input that will never arrive.
+ */
+const CTRL_C = String.fromCharCode(3);
+const CTRL_D = String.fromCharCode(4);
+const DEL = String.fromCharCode(127);
+export async function promptHidden(question) {
+    if (!process.stdin.isTTY)
+        return '';
+    return new Promise((resolve) => {
+        const stdin = process.stdin;
+        const stdout = process.stdout;
+        stdout.write(question);
+        let input = '';
+        const onData = (chunk) => {
+            const char = chunk.toString('utf8');
+            switch (char) {
+                case '\n':
+                case '\r':
+                case CTRL_D:
+                    stdin.setRawMode?.(false);
+                    stdin.pause();
+                    stdin.removeListener('data', onData);
+                    stdout.write('\n');
+                    resolve(input.trim());
+                    break;
+                case CTRL_C:
+                    stdout.write('\n');
+                    process.exit(130);
+                    break;
+                case DEL:
+                case '\b':
+                    if (input.length > 0) {
+                        input = input.slice(0, -1);
+                        stdout.write('\b \b');
+                    }
+                    break;
+                default:
+                    input += char;
+                    stdout.write('*');
+            }
+        };
+        stdin.setRawMode?.(true);
+        stdin.resume();
+        stdin.setEncoding('utf8');
+        stdin.on('data', onData);
+    });
+}
+//# sourceMappingURL=prompt.js.map

package/dist/prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../src/prompt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AACtC,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AACtC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;AAErC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAEpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEvB,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpC,QAAQ,IAAI,EAAE,CAAC;gBACb,KAAK,IAAI,CAAC;gBACV,KAAK,IAAI,CAAC;gBACV,KAAK,MAAM;oBACT,KAAK,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC;oBAC1B,KAAK,CAAC,KAAK,EAAE,CAAC;oBACd,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;oBACrC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACnB,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;oBACtB,MAAM;gBACR,KAAK,MAAM;oBACT,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACnB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAClB,MAAM;gBACR,KAAK,GAAG,CAAC;gBACT,KAAK,IAAI;oBACP,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACrB,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;wBAC3B,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACxB,CAAC;oBACD,MAAM;gBACR;oBACE,KAAK,IAAI,IAAI,CAAC;oBACd,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC,CAAC;QAEF,KAAK,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC;QACzB,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/session-hook.d.ts

@@ -0,0 +1,95 @@
+/**
+ * session-hook.ts — idempotent SessionStart boot-hook merge, for BOTH
+ * Claude Code and Codex CLI (T665).
+ *
+ * Targets <root>/.claude/settings.local.json for Claude Code, NOT
+ * settings.json -- mirroring skills/contextq/scripts/install-hook.sh's own
+ * explicit rule: the baked hook command embeds an absolute $HOME/... path,
+ * which is per-machine and MUST stay in a gitignored file, never a
+ * shared/global settings file (see install-hook.sh header comment).
+ *
+ * Codex's own convention treats project-level `.codex/config.toml` /
+ * `.codex/hooks.json` as "trusted-repo settings" meant to be COMMITTED and
+ * shared across a team (verified against developers.openai.com/codex docs,
+ * 2026-08-20: "Project `.codex/config.toml` -> trusted-repo Codex settings
+ * such as sandbox, MCP, hooks, model, or reasoning defaults") -- there is no
+ * Codex-native equivalent of Claude's settings.json/settings.local.json
+ * split. Since the command we write embeds the SAME per-machine absolute
+ * path either way, wireCodexSessionHook() deliberately breaks from that
+ * convention and gitignores `.codex/hooks.json` itself (see
+ * ensureGitignored below) rather than let a per-machine path get committed
+ * and silently break for every teammate whose contextq skill lives
+ * somewhere else (or isn't installed at all).
+ *
+ * This installer POINTS AT the contextq skill's boot script when it is
+ * already installed globally at ~/.claude/skills/contextq -- it never
+ * copies/vendors the skill tree into the target project (out of this
+ * installer's declared write-scope: .mcp.json, .claude/settings*.json,
+ * .codex/hooks.json, .contextq/, and the credential file only).
+ *
+ * ONE shared code path for both harnesses (T665 requirement), in two
+ * layers:
+ *   - buildBootCommand() is the single command-string builder both writers
+ *     call -- same env vars, same shellQuote()-based escaping, same target
+ *     script.
+ *   - mergeSessionStartHook() is the single read-merge-idempotent-write
+ *     implementation both writers call. Claude's `.claude/settings.local.json`
+ *     and Codex's `.codex/hooks.json` use the IDENTICAL JSON shape for a
+ *     SessionStart entry -- { hooks: { SessionStart: [ { hooks: [ { type:
+ *     'command', command } ] } ] } } (verified against Codex's `hooks.json`
+ *     schema at developers.openai.com/codex/hooks, 2026-08-20) -- so there is
+ *     exactly one implementation of "does this file already have our hook,
+ *     and if not, append it", parameterized by which file path to merge
+ *     into. The two exported writers (wireSessionHook, wireCodexSessionHook)
+ *     are thin wrappers supplying only the path + an optional top-level
+ *     default field Codex's schema additionally supports ("description").
+ */
+export interface HookWireResult {
+    path: string;
+    action: 'wired' | 'skipped';
+    detail: string;
+}
+/**
+ * T656: POSIX single-quote wrap, safe for any input including shell
+ * metacharacters, unbalanced quotes, backticks, `$()`, `;`, etc. This is the
+ * defense-in-depth layer: slug.ts's validateSlug()/sanitizeSlugFallback()
+ * already constrain --agent/--workspace to a safe charset before they reach
+ * here, but this function must make the written command safe on its own,
+ * because a future caller of wireSessionHook()/wireCodexSessionHook() might
+ * bypass that validation (it takes plain strings, not a branded/validated
+ * type) -- every value substituted into the command string, including
+ * bootScript itself, goes through this.
+ *
+ * Standard technique: wrap in single quotes (nothing is interpolated inside
+ * single quotes in POSIX sh/bash), and for each embedded single quote,
+ * close the quote, emit an escaped literal quote, then reopen: ' -> '\''.
+ */
+export declare function shellQuote(value: string): string;
+export declare function ctqBrainBootScript(): string;
+/**
+ * buildBootCommand — the ONE harness-agnostic command builder (T665). Both
+ * wireSessionHook (Claude) and wireCodexSessionHook (Codex) call this to
+ * produce the exact same shell command string. Codex's SessionStart stdin
+ * contract and its `hookSpecificOutput.additionalContext` output shape are
+ * verified (2026-08-20, developers.openai.com/codex/hooks) to match Claude's
+ * field-for-field (session_id, transcript_path, cwd, hook_event_name on
+ * stdin; the same hookSpecificOutput.additionalContext JSON, or plain text,
+ * on stdout) -- so contextq-boot.sh's existing --hook output needs no
+ * per-harness branching, and this builder needs none either.
+ */
+export declare function buildBootCommand(agentSlug: string, workspace: string, bootScript: string): string;
+/**
+ * `bootScriptOverride` exists purely for tests: production callers (index.ts)
+ * always call this with 3 args and get ctqBrainBootScript(), which points at
+ * a real, per-machine, possibly-absent path under $HOME -- tests need to
+ * exercise the "wired" branch deterministically without depending on the
+ * host actually having contextq installed.
+ */
+export declare function wireSessionHook(root: string, agentSlug: string, workspace: string, bootScriptOverride?: string): HookWireResult;
+/**
+ * wireCodexSessionHook — the Codex writer (T665). Same command, same merge
+ * core as wireSessionHook above; only the target path, the top-level
+ * "description" default, and the gitignore step differ. `bootScriptOverride`
+ * exists for the same test-determinism reason as wireSessionHook's.
+ */
+export declare function wireCodexSessionHook(root: string, agentSlug: string, workspace: string, bootScriptOverride?: string): HookWireResult;