@contextq/cli 0.1.0 → 0.3.0

package/dist/platform-cred.js

@@ -1,210 +0,0 @@
-/**
- * platform-cred.ts — read/write the contextq platform credential file.
- *
- * Same path + mode as the existing T144 web installer (src/routes/installer.ts)
- * and the same path the contextq skill's bash scripts (contextq-api.sh,
- * install-hook.sh, contextq-boot.sh) and Bun cred-resolve.ts already read:
- *
- *   macOS:   ~/Library/Application Support/contextq/credentials
- *   Windows: %APPDATA%/contextq/credentials
- *   Linux:   $XDG_CONFIG_HOME/contextq/credentials  (default ~/.config)
- *
- * The existing readers disagree on which key names they check: install.sh
- * (T144) writes CTQ_API_KEY/CTQ_API_URL (read by cred-resolve.ts's Bun path),
- * while every bash script (contextq-api.sh, install-hook.sh, contextq-boot.sh)
- * only ever reads CONTEXT_API_KEY/CONTEXT_API_URL from this same file. Rather
- * than picking a side, this installer writes BOTH pairs so the credential it
- * writes is visible to every existing reader regardless of that pre-existing
- * inconsistency.
- *
- * Never logs or prints the key value.
- *
- * T676: writeCreds() itself remains an unconditional overwrite -- callers
- * decide when that's appropriate. The safety layer lives in the helpers
- * below (credsFileExists/credsEqual/backupCredsFile), which index.ts's
- * runInit() composes into: no write on an ambient env var alone when a
- * credential file already exists, a timestamped backup before any write
- * that would actually change an existing file, and a no-op when the new
- * value is identical to what's already on disk.
- */
-import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-/**
- * T676: test-only override so cli/ tests can point every read/write at a
- * throwaway temp dir instead of the real machine-wide credential path.
- * Checked first, ahead of every OS-specific branch below. Production never
- * sets this -- there is no code path that sets it outside a test.
- */
-export function platformCredDir() {
-    const override = process.env.CTQ_CRED_DIR || process.env.CONTEXTQ_CRED_DIR;
-    if (override)
-        return override;
-    const candidates = CRED_DIR_NAMES.map(platformCredDirFor);
-    return candidates.find((dir) => existsSync(join(dir, 'credentials'))) ?? candidates[0];
-}
-const CRED_DIR_NAMES = ['contextq', 'ctq-brain'];
-function platformCredDirFor(dirName) {
-    const home = homedir();
-    if (process.platform === 'darwin') {
-        return join(home, 'Library', 'Application Support', dirName);
-    }
-    if (process.platform === 'win32') {
-        const appData = process.env.APPDATA ?? join(home, 'AppData', 'Roaming');
-        return join(appData, dirName);
-    }
-    const xdg = process.env.XDG_CONFIG_HOME ?? join(home, '.config');
-    return join(xdg, dirName);
-}
-export function platformCredFile() {
-    return join(platformCredDir(), 'credentials');
-}
-/** Does a credential file already exist on disk (real or overridden dir)? */
-export function credsFileExists() {
-    return existsSync(platformCredFile());
-}
-/** Same apiKey AND same apiUrl -- the "nothing would actually change" case. */
-export function credsEqual(a, b) {
-    return a.apiKey === b.apiKey && a.apiUrl === b.apiUrl;
-}
-function utcTimestamp() {
-    const d = new Date();
-    const pad = (n) => String(n).padStart(2, '0');
-    return (`${d.getUTCFullYear()}${pad(d.getUTCMonth() + 1)}${pad(d.getUTCDate())}` +
-        `T${pad(d.getUTCHours())}${pad(d.getUTCMinutes())}${pad(d.getUTCSeconds())}Z`);
-}
-/**
- * Copy whatever credential file is currently on disk to a timestamped
- * sibling (mode 600, same directory) BEFORE it gets overwritten. Returns
- * the backup path, or null when there was no existing file to back up.
- * Never throws on missing source -- callers gate this on credsFileExists().
- */
-export function backupCredsFile() {
-    const file = platformCredFile();
-    if (!existsSync(file))
-        return null;
-    const dir = platformCredDir();
-    const backupPath = join(dir, `credentials.bak-${utcTimestamp()}`);
-    copyFileSync(file, backupPath);
-    chmodSync(backupPath, 0o600);
-    return backupPath;
-}
-function readEnvVal(key, filePath) {
-    if (!existsSync(filePath))
-        return '';
-    try {
-        const content = readFileSync(filePath, 'utf-8');
-        for (const line of content.split('\n')) {
-            if (line.startsWith(`${key}=`))
-                return line.slice(key.length + 1).trim();
-        }
-    }
-    catch {
-        // never throw on a read error — treat as "no credential found"
-    }
-    return '';
-}
-/** Read whatever is already on disk. Both apiKey/apiUrl are '' when absent. */
-export function readExistingCreds() {
-    const file = platformCredFile();
-    const apiKey = readEnvVal('CTQ_API_KEY', file) || readEnvVal('CONTEXT_API_KEY', file);
-    const apiUrl = readEnvVal('CTQ_API_URL', file) || readEnvVal('CONTEXT_API_URL', file);
-    return { apiKey, apiUrl };
-}
-/**
- * Write the credential file at mode 0600 (dir at 0700). Overwrites whatever
- * was there before — callers decide when that's appropriate (explicit --key,
- * or no existing credential at all).
- */
-export function writeCreds(creds) {
-    const dir = platformCredDir();
-    const file = platformCredFile();
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
-    chmodSync(dir, 0o700);
-    const body = `CTQ_API_KEY=${creds.apiKey}\n` +
-        `CTQ_API_URL=${creds.apiUrl}\n` +
-        `CONTEXT_API_KEY=${creds.apiKey}\n` +
-        `CONTEXT_API_URL=${creds.apiUrl}\n`;
-    writeFileSync(file, body, { mode: 0o600 });
-    chmodSync(file, 0o600);
-    return file;
-}
-export const KEY_RE = /^sk_live_[0-9a-f]{40}$/;
-const LABEL_CREATED = '[create]';
-const LABEL_ROTATED = '[rotate]';
-const LABEL_SKIPPED = '[skip] ';
-/**
- * T676: the non-interactive half of `contextq init`'s credential
- * resolution. Fixes the real incident this task is named for -- a demo run
- * with only an AMBIENT env var set (direnv-exported CONTEXT_API_KEY from
- * some repo's .env.local) used to be treated exactly like an explicit
- * --key, silently overwriting a pre-existing machine-wide credential file
- * with no backup. Branches, matching T676's required behavior 1-4:
- *
- *   1. no --key, ambient env only, file exists -> file untouched, used as-is,
- *      "skipped" naming the ignored env var
- *   2. --key given, file exists with a different key or url -> back up the
- *      existing file (mode 600, timestamped) THEN write, "rotated"
- *   3. --key given, file exists with the identical key AND url -> no write,
- *      "skipped (unchanged)"
- *   4. no existing file at all -> unchanged prior behavior, "created"
- *      (works from either --key or an ambient env var, since there is
- *      nothing to protect)
- *
- * The one case this function does not resolve on its own is "no --key, no
- * ambient env var, no existing file" -- action comes back null and the
- * caller must prompt interactively, then call this function again with the
- * typed value as `explicitKey` to get a consistent created/rotated/skipped
- * decision (falls into branch 4 in practice, since there is no file yet).
- */
-export function decideCredentialWrite(input) {
-    const existing = readExistingCreds();
-    const fileExists = credsFileExists();
-    const writeSafely = (newCreds) => {
-        if (!fileExists) {
-            writeCreds(newCreds);
-            return { action: 'created', backupPath: null };
-        }
-        if (credsEqual(existing, newCreds)) {
-            return { action: 'skipped', backupPath: null };
-        }
-        const backupPath = backupCredsFile();
-        writeCreds(newCreds);
-        return { action: 'rotated', backupPath };
-    };
-    if (input.explicitKey) {
-        if (!KEY_RE.test(input.explicitKey)) {
-            throw new Error('the provided API key does not look valid (expected sk_live_<40 hex chars>)');
-        }
-        const apiKey = input.explicitKey;
-        const result = writeSafely({ apiKey, apiUrl: input.apiUrl });
-        const credLine = result.action === 'skipped'
-            ? `${LABEL_SKIPPED} credentials (unchanged)`
-            : result.action === 'rotated'
-                ? `${LABEL_ROTATED} credentials (${platformCredFile()}; previous saved to ${result.backupPath})`
-                : `${LABEL_CREATED} credentials (${platformCredFile()}, mode 600)`;
-        return { apiKey, credLine, action: result.action, backupPath: result.backupPath };
-    }
-    if (fileExists && existing.apiKey) {
-        // Branch 1: an ambient env var, if any, is deliberately never even
-        // validated here -- it is not going to be used, so a garbage value must
-        // not throw.
-        const credLine = input.ambientVarName
-            ? `${LABEL_SKIPPED} credentials (already configured at ${platformCredFile()}; env ${input.ambientVarName} ignored, pass --key to rotate)`
-            : `${LABEL_SKIPPED} credentials (already configured at ${platformCredFile()}; pass --key to rotate)`;
-        return { apiKey: existing.apiKey, credLine, action: 'skipped', backupPath: null };
-    }
-    if (input.ambientKey) {
-        if (!KEY_RE.test(input.ambientKey)) {
-            throw new Error('the provided API key does not look valid (expected sk_live_<40 hex chars>)');
-        }
-        const apiKey = input.ambientKey;
-        const result = writeSafely({ apiKey, apiUrl: input.apiUrl });
-        const credLine = result.action === 'rotated'
-            ? `${LABEL_ROTATED} credentials (${platformCredFile()}; previous saved to ${result.backupPath})`
-            : `${LABEL_CREATED} credentials (${platformCredFile()}, mode 600)`;
-        return { apiKey, credLine, action: result.action, backupPath: result.backupPath };
-    }
-    return { apiKey: '', credLine: '', action: null, backupPath: null };
-}
-//# sourceMappingURL=platform-cred.js.map

package/dist/platform-cred.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"platform-cred.js","sourceRoot":"","sources":["../src/platform-cred.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtG,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAOjC;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC3E,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,WAAW,CAAU,CAAC;AAE1D,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,CAAC,eAAe,EAAE,EAAE,aAAa,CAAC,CAAC;AAChD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe;IAC7B,OAAO,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,UAAU,CAAC,CAAQ,EAAE,CAAQ;IAC3C,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;AACxD,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;IACrB,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,OAAO,CACL,GAAG,CAAC,CAAC,cAAc,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE;QACxE,IAAI,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,GAAG,CAC9E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,YAAY,EAAE,EAAE,CAAC,CAAC;IAClE,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC/B,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,QAAgB;IAC/C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB;IAC/B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,UAAU,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,UAAU,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IACtF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAY;IACrC,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAEtB,MAAM,IAAI,GACR,eAAe,KAAK,CAAC,MAAM,IAAI;QAC/B,eAAe,KAAK,CAAC,MAAM,IAAI;QAC/B,mBAAmB,KAAK,CAAC,MAAM,IAAI;QACnC,mBAAmB,KAAK,CAAC,MAAM,IAAI,CAAC;IAEtC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3C,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAE/C,MAAM,aAAa,GAAG,UAAU,CAAC;AACjC,MAAM,aAAa,GAAG,UAAU,CAAC;AACjC,MAAM,aAAa,GAAG,SAAS,CAAC;AAuBhC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA8B;IAClE,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,eAAe,EAAE,CAAC;IAErC,MAAM,WAAW,GAAG,CAClB,QAAe,EAC2D,EAAE;QAC5E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACjD,CAAC;QACD,MAAM,UAAU,GAAG,eAAe,EAAE,CAAC;QACrC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC,CAAC;IAEF,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC;QACjC,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,QAAQ,GACZ,MAAM,CAAC,MAAM,KAAK,SAAS;YACzB,CAAC,CAAC,GAAG,aAAa,0BAA0B;YAC5C,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS;gBAC3B,CAAC,CAAC,GAAG,aAAa,iBAAiB,gBAAgB,EAAE,uBAAuB,MAAM,CAAC,UAAU,GAAG;gBAChG,CAAC,CAAC,GAAG,aAAa,iBAAiB,gBAAgB,EAAE,aAAa,CAAC;QACzE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;IACpF,CAAC;IAED,IAAI,UAAU,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAClC,mEAAmE;QACnE,wEAAwE;QACxE,aAAa;QACb,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc;YACnC,CAAC,CAAC,GAAG,aAAa,uCAAuC,gBAAgB,EAAE,SAAS,KAAK,CAAC,cAAc,iCAAiC;YACzI,CAAC,CAAC,GAAG,aAAa,uCAAuC,gBAAgB,EAAE,yBAAyB,CAAC;QACvG,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACpF,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC;QAChC,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,QAAQ,GACZ,MAAM,CAAC,MAAM,KAAK,SAAS;YACzB,CAAC,CAAC,GAAG,aAAa,iBAAiB,gBAAgB,EAAE,uBAAuB,MAAM,CAAC,UAAU,GAAG;YAChG,CAAC,CAAC,GAAG,aAAa,iBAAiB,gBAAgB,EAAE,aAAa,CAAC;QACvE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;IACpF,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACtE,CAAC"}

package/dist/prompt.d.ts

@@ -1,8 +0,0 @@
-/**
- * prompt.ts — masked stdin prompt for the API key, no extra dependency.
- *
- * Returns '' immediately when stdin is not a TTY (non-interactive/CI run) --
- * callers must treat that as "no key available" and fail with a clear
- * message rather than hang waiting for input that will never arrive.
- */
-export declare function promptHidden(question: string): Promise<string>;

package/dist/prompt.js

@@ -1,53 +0,0 @@
-/**
- * prompt.ts — masked stdin prompt for the API key, no extra dependency.
- *
- * Returns '' immediately when stdin is not a TTY (non-interactive/CI run) --
- * callers must treat that as "no key available" and fail with a clear
- * message rather than hang waiting for input that will never arrive.
- */
-const CTRL_C = String.fromCharCode(3);
-const CTRL_D = String.fromCharCode(4);
-const DEL = String.fromCharCode(127);
-export async function promptHidden(question) {
-    if (!process.stdin.isTTY)
-        return '';
-    return new Promise((resolve) => {
-        const stdin = process.stdin;
-        const stdout = process.stdout;
-        stdout.write(question);
-        let input = '';
-        const onData = (chunk) => {
-            const char = chunk.toString('utf8');
-            switch (char) {
-                case '\n':
-                case '\r':
-                case CTRL_D:
-                    stdin.setRawMode?.(false);
-                    stdin.pause();
-                    stdin.removeListener('data', onData);
-                    stdout.write('\n');
-                    resolve(input.trim());
-                    break;
-                case CTRL_C:
-                    stdout.write('\n');
-                    process.exit(130);
-                    break;
-                case DEL:
-                case '\b':
-                    if (input.length > 0) {
-                        input = input.slice(0, -1);
-                        stdout.write('\b \b');
-                    }
-                    break;
-                default:
-                    input += char;
-                    stdout.write('*');
-            }
-        };
-        stdin.setRawMode?.(true);
-        stdin.resume();
-        stdin.setEncoding('utf8');
-        stdin.on('data', onData);
-    });
-}
-//# sourceMappingURL=prompt.js.map

package/dist/prompt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../src/prompt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AACtC,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AACtC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;AAErC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAEpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEvB,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpC,QAAQ,IAAI,EAAE,CAAC;gBACb,KAAK,IAAI,CAAC;gBACV,KAAK,IAAI,CAAC;gBACV,KAAK,MAAM;oBACT,KAAK,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC;oBAC1B,KAAK,CAAC,KAAK,EAAE,CAAC;oBACd,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;oBACrC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACnB,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;oBACtB,MAAM;gBACR,KAAK,MAAM;oBACT,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACnB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAClB,MAAM;gBACR,KAAK,GAAG,CAAC;gBACT,KAAK,IAAI;oBACP,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACrB,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;wBAC3B,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACxB,CAAC;oBACD,MAAM;gBACR;oBACE,KAAK,IAAI,IAAI,CAAC;oBACd,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC,CAAC;QAEF,KAAK,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC;QACzB,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/session-hook.d.ts

@@ -1,95 +0,0 @@
-/**
- * session-hook.ts — idempotent SessionStart boot-hook merge, for BOTH
- * Claude Code and Codex CLI (T665).
- *
- * Targets <root>/.claude/settings.local.json for Claude Code, NOT
- * settings.json -- mirroring skills/contextq/scripts/install-hook.sh's own
- * explicit rule: the baked hook command embeds an absolute $HOME/... path,
- * which is per-machine and MUST stay in a gitignored file, never a
- * shared/global settings file (see install-hook.sh header comment).
- *
- * Codex's own convention treats project-level `.codex/config.toml` /
- * `.codex/hooks.json` as "trusted-repo settings" meant to be COMMITTED and
- * shared across a team (verified against developers.openai.com/codex docs,
- * 2026-08-20: "Project `.codex/config.toml` -> trusted-repo Codex settings
- * such as sandbox, MCP, hooks, model, or reasoning defaults") -- there is no
- * Codex-native equivalent of Claude's settings.json/settings.local.json
- * split. Since the command we write embeds the SAME per-machine absolute
- * path either way, wireCodexSessionHook() deliberately breaks from that
- * convention and gitignores `.codex/hooks.json` itself (see
- * ensureGitignored below) rather than let a per-machine path get committed
- * and silently break for every teammate whose contextq skill lives
- * somewhere else (or isn't installed at all).
- *
- * This installer POINTS AT the contextq skill's boot script when it is
- * already installed globally at ~/.claude/skills/contextq -- it never
- * copies/vendors the skill tree into the target project (out of this
- * installer's declared write-scope: .mcp.json, .claude/settings*.json,
- * .codex/hooks.json, .contextq/, and the credential file only).
- *
- * ONE shared code path for both harnesses (T665 requirement), in two
- * layers:
- *   - buildBootCommand() is the single command-string builder both writers
- *     call -- same env vars, same shellQuote()-based escaping, same target
- *     script.
- *   - mergeSessionStartHook() is the single read-merge-idempotent-write
- *     implementation both writers call. Claude's `.claude/settings.local.json`
- *     and Codex's `.codex/hooks.json` use the IDENTICAL JSON shape for a
- *     SessionStart entry -- { hooks: { SessionStart: [ { hooks: [ { type:
- *     'command', command } ] } ] } } (verified against Codex's `hooks.json`
- *     schema at developers.openai.com/codex/hooks, 2026-08-20) -- so there is
- *     exactly one implementation of "does this file already have our hook,
- *     and if not, append it", parameterized by which file path to merge
- *     into. The two exported writers (wireSessionHook, wireCodexSessionHook)
- *     are thin wrappers supplying only the path + an optional top-level
- *     default field Codex's schema additionally supports ("description").
- */
-export interface HookWireResult {
-    path: string;
-    action: 'wired' | 'skipped';
-    detail: string;
-}
-/**
- * T656: POSIX single-quote wrap, safe for any input including shell
- * metacharacters, unbalanced quotes, backticks, `$()`, `;`, etc. This is the
- * defense-in-depth layer: slug.ts's validateSlug()/sanitizeSlugFallback()
- * already constrain --agent/--workspace to a safe charset before they reach
- * here, but this function must make the written command safe on its own,
- * because a future caller of wireSessionHook()/wireCodexSessionHook() might
- * bypass that validation (it takes plain strings, not a branded/validated
- * type) -- every value substituted into the command string, including
- * bootScript itself, goes through this.
- *
- * Standard technique: wrap in single quotes (nothing is interpolated inside
- * single quotes in POSIX sh/bash), and for each embedded single quote,
- * close the quote, emit an escaped literal quote, then reopen: ' -> '\''.
- */
-export declare function shellQuote(value: string): string;
-export declare function ctqBrainBootScript(): string;
-/**
- * buildBootCommand — the ONE harness-agnostic command builder (T665). Both
- * wireSessionHook (Claude) and wireCodexSessionHook (Codex) call this to
- * produce the exact same shell command string. Codex's SessionStart stdin
- * contract and its `hookSpecificOutput.additionalContext` output shape are
- * verified (2026-08-20, developers.openai.com/codex/hooks) to match Claude's
- * field-for-field (session_id, transcript_path, cwd, hook_event_name on
- * stdin; the same hookSpecificOutput.additionalContext JSON, or plain text,
- * on stdout) -- so contextq-boot.sh's existing --hook output needs no
- * per-harness branching, and this builder needs none either.
- */
-export declare function buildBootCommand(agentSlug: string, workspace: string, bootScript: string): string;
-/**
- * `bootScriptOverride` exists purely for tests: production callers (index.ts)
- * always call this with 3 args and get ctqBrainBootScript(), which points at
- * a real, per-machine, possibly-absent path under $HOME -- tests need to
- * exercise the "wired" branch deterministically without depending on the
- * host actually having contextq installed.
- */
-export declare function wireSessionHook(root: string, agentSlug: string, workspace: string, bootScriptOverride?: string): HookWireResult;
-/**
- * wireCodexSessionHook — the Codex writer (T665). Same command, same merge
- * core as wireSessionHook above; only the target path, the top-level
- * "description" default, and the gitignore step differ. `bootScriptOverride`
- * exists for the same test-determinism reason as wireSessionHook's.
- */
-export declare function wireCodexSessionHook(root: string, agentSlug: string, workspace: string, bootScriptOverride?: string): HookWireResult;

package/dist/session-hook.js

@@ -1,217 +0,0 @@
-/**
- * session-hook.ts — idempotent SessionStart boot-hook merge, for BOTH
- * Claude Code and Codex CLI (T665).
- *
- * Targets <root>/.claude/settings.local.json for Claude Code, NOT
- * settings.json -- mirroring skills/contextq/scripts/install-hook.sh's own
- * explicit rule: the baked hook command embeds an absolute $HOME/... path,
- * which is per-machine and MUST stay in a gitignored file, never a
- * shared/global settings file (see install-hook.sh header comment).
- *
- * Codex's own convention treats project-level `.codex/config.toml` /
- * `.codex/hooks.json` as "trusted-repo settings" meant to be COMMITTED and
- * shared across a team (verified against developers.openai.com/codex docs,
- * 2026-08-20: "Project `.codex/config.toml` -> trusted-repo Codex settings
- * such as sandbox, MCP, hooks, model, or reasoning defaults") -- there is no
- * Codex-native equivalent of Claude's settings.json/settings.local.json
- * split. Since the command we write embeds the SAME per-machine absolute
- * path either way, wireCodexSessionHook() deliberately breaks from that
- * convention and gitignores `.codex/hooks.json` itself (see
- * ensureGitignored below) rather than let a per-machine path get committed
- * and silently break for every teammate whose contextq skill lives
- * somewhere else (or isn't installed at all).
- *
- * This installer POINTS AT the contextq skill's boot script when it is
- * already installed globally at ~/.claude/skills/contextq -- it never
- * copies/vendors the skill tree into the target project (out of this
- * installer's declared write-scope: .mcp.json, .claude/settings*.json,
- * .codex/hooks.json, .contextq/, and the credential file only).
- *
- * ONE shared code path for both harnesses (T665 requirement), in two
- * layers:
- *   - buildBootCommand() is the single command-string builder both writers
- *     call -- same env vars, same shellQuote()-based escaping, same target
- *     script.
- *   - mergeSessionStartHook() is the single read-merge-idempotent-write
- *     implementation both writers call. Claude's `.claude/settings.local.json`
- *     and Codex's `.codex/hooks.json` use the IDENTICAL JSON shape for a
- *     SessionStart entry -- { hooks: { SessionStart: [ { hooks: [ { type:
- *     'command', command } ] } ] } } (verified against Codex's `hooks.json`
- *     schema at developers.openai.com/codex/hooks, 2026-08-20) -- so there is
- *     exactly one implementation of "does this file already have our hook,
- *     and if not, append it", parameterized by which file path to merge
- *     into. The two exported writers (wireSessionHook, wireCodexSessionHook)
- *     are thin wrappers supplying only the path + an optional top-level
- *     default field Codex's schema additionally supports ("description").
- */
-import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-const MARKER = /contextq-boot\.sh|contextq.*boot/;
-/**
- * T656: POSIX single-quote wrap, safe for any input including shell
- * metacharacters, unbalanced quotes, backticks, `$()`, `;`, etc. This is the
- * defense-in-depth layer: slug.ts's validateSlug()/sanitizeSlugFallback()
- * already constrain --agent/--workspace to a safe charset before they reach
- * here, but this function must make the written command safe on its own,
- * because a future caller of wireSessionHook()/wireCodexSessionHook() might
- * bypass that validation (it takes plain strings, not a branded/validated
- * type) -- every value substituted into the command string, including
- * bootScript itself, goes through this.
- *
- * Standard technique: wrap in single quotes (nothing is interpolated inside
- * single quotes in POSIX sh/bash), and for each embedded single quote,
- * close the quote, emit an escaped literal quote, then reopen: ' -> '\''.
- */
-export function shellQuote(value) {
-    return `'${value.split("'").join("'\\''")}'`;
-}
-export function ctqBrainBootScript() {
-    return join(homedir(), '.claude', 'skills', 'contextq', 'scripts', 'contextq-boot.sh');
-}
-/**
- * buildBootCommand — the ONE harness-agnostic command builder (T665). Both
- * wireSessionHook (Claude) and wireCodexSessionHook (Codex) call this to
- * produce the exact same shell command string. Codex's SessionStart stdin
- * contract and its `hookSpecificOutput.additionalContext` output shape are
- * verified (2026-08-20, developers.openai.com/codex/hooks) to match Claude's
- * field-for-field (session_id, transcript_path, cwd, hook_event_name on
- * stdin; the same hookSpecificOutput.additionalContext JSON, or plain text,
- * on stdout) -- so contextq-boot.sh's existing --hook output needs no
- * per-harness branching, and this builder needs none either.
- */
-export function buildBootCommand(agentSlug, workspace, bootScript) {
-    return (`CONTEXTQ_AGENT_SLUG=${shellQuote(agentSlug)} CONTEXTQ_WORKSPACE=${shellQuote(workspace)} ` +
-        `CONTEXTQ_WRITE_WORKSPACE=${shellQuote(workspace)} CONTEXTQ_READ_SCOPE=own+global ` +
-        `bash ${shellQuote(bootScript)} --hook`);
-}
-/**
- * mergeSessionStartHook — the ONE shared read-merge-idempotent-write core
- * (T665). See the file header for why this is safe to share verbatim
- * between Claude's settings.local.json and Codex's hooks.json.
- */
-function mergeSessionStartHook(target, command, wiredDetail) {
-    const { path, dir, topLevelDefaults } = target;
-    const existed = existsSync(path);
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    let doc = {};
-    if (existed) {
-        const raw = readFileSync(path, 'utf-8');
-        try {
-            doc = raw.trim() === '' ? {} : JSON.parse(raw);
-        }
-        catch (err) {
-            throw new Error(`${path} exists but is not valid JSON (${err.message}) -- refusing to touch it`);
-        }
-    }
-    if (topLevelDefaults) {
-        for (const [key, value] of Object.entries(topLevelDefaults)) {
-            if (doc[key] === undefined)
-                doc[key] = value;
-        }
-    }
-    doc.hooks ??= {};
-    doc.hooks.SessionStart ??= [];
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const already = doc.hooks.SessionStart.some((entry) => (entry?.hooks ?? []).some((h) => typeof h.command === 'string' && MARKER.test(h.command)));
-    if (already) {
-        return { path, action: 'skipped', detail: 'SessionStart contextq-boot hook already present' };
-    }
-    doc.hooks.SessionStart.push({ hooks: [{ type: 'command', command }] });
-    mkdirSync(dir, { recursive: true });
-    writeFileSync(path, `${JSON.stringify(doc, null, 2)}\n`);
-    return { path, action: 'wired', detail: wiredDetail };
-}
-/**
- * `bootScriptOverride` exists purely for tests: production callers (index.ts)
- * always call this with 3 args and get ctqBrainBootScript(), which points at
- * a real, per-machine, possibly-absent path under $HOME -- tests need to
- * exercise the "wired" branch deterministically without depending on the
- * host actually having contextq installed.
- */
-export function wireSessionHook(root, agentSlug, workspace, bootScriptOverride) {
-    const path = join(root, '.claude', 'settings.local.json');
-    const bootScript = bootScriptOverride ?? ctqBrainBootScript();
-    if (!existsSync(bootScript)) {
-        return {
-            path,
-            action: 'skipped',
-            detail: 'contextq skill not found at ~/.claude/skills/contextq -- MCP tools and the task ' +
-                'manifest are wired, but the memory boot hook needs the skill installed separately first',
-        };
-    }
-    const command = buildBootCommand(agentSlug, workspace, bootScript);
-    return mergeSessionStartHook({ path, dir: join(root, '.claude') }, command, `SessionStart boot hook wired (agent=${agentSlug}, workspace=${workspace})`);
-}
-/**
- * T665: whether `<root>/.codex/config.toml` ALSO declares an inline
- * `[hooks]`/`[[hooks.X]]` table. Codex's own docs (developers.openai.com/
- * codex/hooks, 2026-08-20) state that when one config layer holds both a
- * `hooks.json` file and an inline `[hooks]` table, "Codex loads both and
- * warns. Prefer one representation per layer." -- we always write
- * `hooks.json`, so this surfaces that collision to the installer's own
- * output instead of leaving it as a silent Codex-side warning nobody sees.
- */
-function hasInlineHooksTable(root) {
-    const configPath = join(root, '.codex', 'config.toml');
-    if (!existsSync(configPath))
-        return false;
-    const raw = readFileSync(configPath, 'utf-8');
-    return /^\s*\[{1,2}hooks(\.|\])/m.test(raw);
-}
-/**
- * T665: `.codex/hooks.json` is gitignored the same way `.claude/settings.local.json`
- * effectively is (see the file header) -- but Codex has no built-in
- * settings.json/settings.local.json split, so THIS installer has to be the
- * one to add the .gitignore line, not Codex itself.
- */
-function ensureGitignored(root, pattern) {
-    if (!existsSync(join(root, '.git')))
-        return;
-    const gitignorePath = join(root, '.gitignore');
-    const existing = existsSync(gitignorePath) ? readFileSync(gitignorePath, 'utf-8') : '';
-    const existingLines = new Set(existing.split('\n').map((line) => line.trim()));
-    if (existingLines.has(pattern))
-        return;
-    const block = '\n# .codex/hooks.json embeds a per-machine absolute path (the contextq boot\n' +
-        '# hook command) -- gitignored the same way .claude/settings.local.json is.\n' +
-        '# Each teammate who wants it needs to run `npx contextq init` themselves.\n' +
-        `${pattern}\n`;
-    appendFileSync(gitignorePath, block);
-}
-/**
- * wireCodexSessionHook — the Codex writer (T665). Same command, same merge
- * core as wireSessionHook above; only the target path, the top-level
- * "description" default, and the gitignore step differ. `bootScriptOverride`
- * exists for the same test-determinism reason as wireSessionHook's.
- */
-export function wireCodexSessionHook(root, agentSlug, workspace, bootScriptOverride) {
-    const path = join(root, '.codex', 'hooks.json');
-    const bootScript = bootScriptOverride ?? ctqBrainBootScript();
-    if (!existsSync(bootScript)) {
-        return {
-            path,
-            action: 'skipped',
-            detail: 'contextq skill not found at ~/.claude/skills/contextq -- the memory boot hook needs ' +
-                'the skill installed separately first',
-        };
-    }
-    const command = buildBootCommand(agentSlug, workspace, bootScript);
-    const trustNote = 'Codex requires this hook to be TRUSTED before it runs -- start `codex` in this repo and ' +
-        'approve it at the hook-trust prompt (or review/trust via `/hooks` in a session)';
-    const inlineWarning = hasInlineHooksTable(root)
-        ? ` -- WARNING: .codex/config.toml also declares an inline [hooks] table; Codex loads both hooks.json and the inline table and warns on every run. Prefer one representation per layer.`
-        : '';
-    const result = mergeSessionStartHook({
-        path,
-        dir: join(root, '.codex'),
-        topLevelDefaults: {
-            description: 'ContextQ boot hook (managed by `npx contextq init` -- re-run the installer to update, do not hand-edit)',
-        },
-    }, command, `SessionStart boot hook wired (agent=${agentSlug}, workspace=${workspace}). ${trustNote}.${inlineWarning}`);
-    if (result.action === 'wired') {
-        ensureGitignored(root, '.codex/hooks.json');
-    }
-    return result;
-}
-//# sourceMappingURL=session-hook.js.map

package/dist/session-hook.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-hook.js","sourceRoot":"","sources":["../src/session-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7F,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,MAAM,GAAG,kCAAkC,CAAC;AAQlD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,SAAiB,EAAE,UAAkB;IACvF,OAAO,CACL,uBAAuB,UAAU,CAAC,SAAS,CAAC,uBAAuB,UAAU,CAAC,SAAS,CAAC,GAAG;QAC3F,4BAA4B,UAAU,CAAC,SAAS,CAAC,kCAAkC;QACnF,QAAQ,UAAU,CAAC,UAAU,CAAC,SAAS,CACxC,CAAC;AACJ,CAAC;AASD;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,MAAmB,EAAE,OAAe,EAAE,WAAmB;IACtF,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;IAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,8DAA8D;IAC9D,IAAI,GAAG,GAAQ,EAAE,CAAC;IAClB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kCAAmC,GAAa,CAAC,OAAO,2BAA2B,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC5D,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;IACjB,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,EAAE,CAAC;IAE9B,8DAA8D;IAC9D,MAAM,OAAO,GAAI,GAAG,CAAC,KAAK,CAAC,YAAsB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC/D,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAuB,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAChH,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IAChG,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAEvE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAEzD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,SAAiB,EACjB,SAAiB,EACjB,kBAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,kBAAkB,IAAI,kBAAkB,EAAE,CAAC;IAE9D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,MAAM,EACJ,kFAAkF;gBAClF,yFAAyF;SAC5F,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAEnE,OAAO,qBAAqB,CAC1B,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EACpC,OAAO,EACP,uCAAuC,SAAS,eAAe,SAAS,GAAG,CAC5E,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,OAAO,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe;IACrD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO;IAE5C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/E,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO;IAEvC,MAAM,KAAK,GACT,+EAA+E;QAC/E,8EAA8E;QAC9E,6EAA6E;QAC7E,GAAG,OAAO,IAAI,CAAC;IAEjB,cAAc,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,SAAiB,EACjB,SAAiB,EACjB,kBAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,kBAAkB,IAAI,kBAAkB,EAAE,CAAC;IAE9D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,SAAS;YACjB,MAAM,EACJ,sFAAsF;gBACtF,sCAAsC;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACnE,MAAM,SAAS,GACb,0FAA0F;QAC1F,iFAAiF,CAAC;IACpF,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,CAAC;QAC7C,CAAC,CAAC,sLAAsL;QACxL,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,MAAM,GAAG,qBAAqB,CAClC;QACE,IAAI;QACJ,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,gBAAgB,EAAE;YAChB,WAAW,EAAE,yGAAyG;SACvH;KACF,EACD,OAAO,EACP,uCAAuC,SAAS,eAAe,SAAS,MAAM,SAAS,IAAI,aAAa,EAAE,CAC3G,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC9B,gBAAgB,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}