@ttctl/cli 0.0.0 → 0.1.0-rc.1

package/dist/commands/auth/init.js

@@ -0,0 +1,387 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Oleksii PELYKH
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import * as p from "@clack/prompts";
+import { z } from "zod";
+import { OP_REF_PATTERN_HINT, OP_REF_PATTERN_SOURCE, writeNewConfig } from "@ttctl/core";
+/**
+ * Compiled `RegExp` for a 1Password item reference, constructed once at
+ * module load from the canonical {@link OP_REF_PATTERN_SOURCE} exported by
+ * `@ttctl/core`. Sharing the source string (rather than the compiled
+ * `RegExp`) keeps the CLI bundle free of Zod while guaranteeing the
+ * pattern stays in lock-step with `OnePasswordReferenceSchema`.
+ */
+const OP_REF_REGEX = new RegExp(OP_REF_PATTERN_SOURCE);
+/**
+ * Email regex for Form B username validation. Permissive — matches what a
+ * Toptal email address looks like without enforcing RFC-5321 strictness.
+ * Form B is a discouraged path; the EmailPasswordSignIn mutation will
+ * reject malformed values at signin time.
+ */
+const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/**
+ * Shape of `op vault list --format json` output (subset). The op CLI
+ * returns more fields per vault; we only consume `id` and `name`.
+ */
+const OpVaultListSchema = z.array(z.object({
+    id: z.string(),
+    name: z.string(),
+}));
+/**
+ * Shape of `op item list --vault <V> --categories Login --format json`
+ * output (subset). The op CLI returns more fields per item; we only
+ * consume `id` and `title`.
+ */
+const OpItemListSchema = z.array(z.object({
+    id: z.string(),
+    title: z.string(),
+}));
+/**
+ * Probe whether the `op` CLI is installed and reachable on PATH. Light
+ * `op --version` invocation — fails fast on `ENOENT` (not installed) and
+ * any other launch failure (signed-out, broken install, etc). Output is
+ * discarded; the only signal is whether the call returned successfully.
+ */
+function detectOpCli() {
+    try {
+        execFileSync("op", ["--version"], { stdio: ["ignore", "ignore", "ignore"] });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Shell out to `op vault list --format json`. Returns the parsed,
+ * zod-validated list; throws on any failure (non-zero exit, parse
+ * failure, schema mismatch). Caller should catch and fall back to
+ * freeform prompt with a stderr warning.
+ */
+function listOpVaults() {
+    const raw = execFileSync("op", ["vault", "list", "--format", "json"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    const parsedJson = JSON.parse(raw);
+    return OpVaultListSchema.parse(parsedJson);
+}
+/**
+ * Shell out to `op item list --vault <vault> --categories Login --format json`.
+ * Filters server-side to LOGIN-category items so the picker only shows
+ * relevant candidates. Returns parsed + zod-validated list; throws on
+ * failure (caller falls back to freeform).
+ */
+function listOpItems(vault) {
+    const raw = execFileSync("op", ["item", "list", "--vault", vault, "--categories", "Login", "--format", "json"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    const parsedJson = JSON.parse(raw);
+    return OpItemListSchema.parse(parsedJson);
+}
+/**
+ * Map an `AuthInitResult` to a process exit code.
+ *
+ *   - `written`           → 0 (success)
+ *   - `refused`/anything  → 1 (non-TTY, exists-without-force, cancelled)
+ *   - `error`             → 1 (any unexpected failure)
+ *
+ * The cancelled / refused-form-B paths are intentionally non-zero — the
+ * shell convention is "exit 0 only on success." A user who hits Ctrl-C
+ * mid-prompt has not bootstrapped a config; subsequent commands assuming
+ * one exists would fail, so signaling success here would mislead scripts.
+ */
+export function exitCodeForInitResult(result) {
+    return result.status === "written" ? 0 : 1;
+}
+/**
+ * Render an `AuthInitResult` for stdout/stderr. Written → confirmation on
+ * stdout naming the path AND the form chosen (per AC). Refusals + errors
+ * → message on stderr.
+ */
+export function formatInitOutput(result) {
+    if (result.status === "written") {
+        const formLabel = result.form === "A" ? "1Password reference" : "literal credentials";
+        return `Wrote config to ${result.path} (form ${result.form}: ${formLabel})`;
+    }
+    return result.message;
+}
+/**
+ * Determine whether the current process has an interactive TTY on stdin.
+ * `@clack/prompts` produces undefined behavior when piped; we refuse
+ * cleanly BEFORE any prompt runs (FR-3.10 / non-TTY refusal AC).
+ *
+ * Exposed for unit tests that can't trivially set the TTY bit on stdin —
+ * tests stub this function to assert both branches deterministically.
+ */
+export function isStdinTty() {
+    // Node typings declare `process.stdin.isTTY?: true` — TS narrows the
+    // value to `true | undefined` and ESLint's
+    // `no-unnecessary-boolean-literal-compare` would object to `=== true`.
+    // Coercing through `unknown` lets us perform the strict equality (the
+    // ONLY check that's safe under runtime test mocks that may set the
+    // property to literal `false`) without tripping the lint rule.
+    return process.stdin.isTTY === true;
+}
+/**
+ * Default op CLI interface — shells out via `execFileSync`. Tests inject
+ * an alternative implementation via the second argument to `runAuthInit`.
+ */
+export const defaultOpCli = {
+    detect: detectOpCli,
+    listVaults: listOpVaults,
+    listItems: listOpItems,
+};
+/**
+ * Resolve the target output path:
+ *   - Explicit `--config <path>` → used verbatim
+ *   - Otherwise → `~/.ttctl.yaml` (POSIX home dotfile, matches the
+ *     resolution chain's only fallback)
+ *
+ * Parent directories are created by `writeNewConfig` (via `mkdir -p`); no
+ * pre-existence check on the parent.
+ */
+function resolveTargetPath(options) {
+    if (options.config !== undefined)
+        return options.config;
+    return join(homedir(), ".ttctl.yaml");
+}
+/**
+ * Compose the YAML content for Form A (1Password reference). Quoted op://
+ * string preserves the canonical scalar style and disambiguates the value
+ * from any future YAML grammar expansion.
+ */
+function composeFormAYaml(ref) {
+    return `auth:\n  credentials: "${ref}"\n`;
+}
+/**
+ * Compose the YAML content for Form B (literal credentials). `username`
+ * and `password` are double-quoted to keep YAML's special-character
+ * grammar from interfering with anything that might appear in a real
+ * credential string. Backslashes / double-quotes are escaped with
+ * defensive replacement.
+ */
+function composeFormBYaml(username, password) {
+    const escape = (v) => v.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+    return `auth:\n  credentials:\n    username: "${escape(username)}"\n    password: "${escape(password)}"\n`;
+}
+/**
+ * Run the `auth init` interactive flow:
+ *
+ *   1. TTY gate — refuse non-TTY stdin BEFORE any prompt (CI safety).
+ *   2. Resolve target path; refuse pre-existing files unless `--force`.
+ *   3. Form selector (A / B).
+ *   4. Form A: detect `op` CLI; on present → vault picker, item picker,
+ *      confirm → compose YAML. On absent OR list-failure → freeform
+ *      `op://` text prompt with regex validation.
+ *   5. Form B: explicit confirmation gate (default `N` aborts cleanly);
+ *      on `Y` → username (email) + password (masked) → compose YAML.
+ *   6. Persist via `writeNewConfig` — atomic temp+rename, mode 0o600,
+ *      sync-root + symlink refusal applies.
+ *   7. Confirmation message names path AND form.
+ *
+ * Cancellation: `@clack/prompts` returns its `isCancel` symbol on
+ * Ctrl-C / Esc at any prompt; we intercept and produce a `cancelled`
+ * result so the user sees an "Aborted" line and exits non-zero (vs. a
+ * silently truncated write).
+ *
+ * Inputs: `options` from commander; `opCli` is dependency-injected so
+ * tests can inject a stubbed implementation without spawning real
+ * `op` subprocesses.
+ */
+export async function runAuthInit(options, opCli = defaultOpCli) {
+    // 1. Non-TTY refusal — first thing, before we touch the prompt library.
+    if (!isStdinTty()) {
+        return {
+            status: "refused",
+            reason: "non-tty",
+            message: "ttctl auth init is interactive; pipe stdin or a TTY is required. " +
+                "Hand-author the config or run on a terminal.",
+        };
+    }
+    const targetPath = resolveTargetPath(options);
+    const force = options.force === true;
+    // 2. Pre-existence gate — surfaced BEFORE any prompt so the user
+    // doesn't waste time entering credentials only to be refused at write
+    // time. `writeNewConfig` re-checks atomically (defense-in-depth
+    // against a TOCTOU window between this check and the open() call), so
+    // the refusal here is purely UX.
+    if (!force && existsSync(targetPath)) {
+        const message = `Refusing to overwrite existing config at ${targetPath}. ` + `Use --force to replace, or edit the file manually.`;
+        return { status: "refused", reason: "exists", message };
+    }
+    p.intro("ttctl auth init");
+    // 3. Form selector. clack returns either Value | Symbol(cancel); we
+    // narrow via isCancel before consuming.
+    const form = await p.select({
+        message: "Choose credentials source",
+        options: [
+            { value: "A", label: "1Password reference (recommended)" },
+            { value: "B", label: "Literal username/password (discouraged)" },
+        ],
+        initialValue: "A",
+    });
+    if (p.isCancel(form)) {
+        p.cancel("Aborted (no file written).");
+        return { status: "refused", reason: "cancelled", message: "Aborted (no file written)." };
+    }
+    let yaml;
+    let chosenForm;
+    if (form === "A") {
+        chosenForm = "A";
+        const ref = await collectFormARef(opCli);
+        if (ref === undefined) {
+            p.cancel("Aborted (no file written).");
+            return { status: "refused", reason: "cancelled", message: "Aborted (no file written)." };
+        }
+        yaml = composeFormAYaml(ref);
+    }
+    else {
+        chosenForm = "B";
+        const literal = await collectFormBLiteral();
+        if (literal === undefined) {
+            p.cancel("Aborted (no file written).");
+            return { status: "refused", reason: "cancelled", message: "Aborted (no file written)." };
+        }
+        yaml = composeFormBYaml(literal.username, literal.password);
+    }
+    // 4. Persist via writeNewConfig — atomic temp+rename. The
+    // `assertSafePath` gate (sync-root, symlink) and the defense-in-depth
+    // existence re-check live inside writeNewConfig; surface any failure
+    // verbatim.
+    try {
+        await writeNewConfig(targetPath, yaml, { force });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        p.cancel(`Failed to write config: ${message}`);
+        return { status: "error", message: `Failed to write config: ${message}` };
+    }
+    const successLine = formatInitOutput({ status: "written", path: targetPath, form: chosenForm });
+    p.outro(successLine);
+    return { status: "written", path: targetPath, form: chosenForm };
+}
+/**
+ * Form A flow: collect a 1Password reference from either the vault/item
+ * picker (when `op` is installed and the listings parse cleanly) or a
+ * freeform text prompt.
+ *
+ * Returns `undefined` on cancellation at any sub-prompt.
+ */
+async function collectFormARef(opCli) {
+    const opAvailable = opCli.detect();
+    if (!opAvailable) {
+        p.log.info("1Password CLI (`op`) not installed; falling back to freeform reference.");
+        return promptFreeformOpRef();
+    }
+    // Vault list — fall back to freeform on any failure (op signed-out,
+    // JSON shape drift, network etc.). The user sees a clear stderr-style
+    // warning before the prompt to explain the fallback.
+    let vaults;
+    try {
+        vaults = opCli.listVaults();
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        p.log.warn(`op vault list failed (${reason}); falling back to freeform reference.`);
+        return promptFreeformOpRef();
+    }
+    if (vaults.length === 0) {
+        p.log.warn("op vault list returned no vaults; falling back to freeform reference.");
+        return promptFreeformOpRef();
+    }
+    const vault = await p.select({
+        message: "Pick a 1Password vault",
+        options: vaults.map((v) => ({ value: v.name, label: v.name })),
+    });
+    if (p.isCancel(vault))
+        return undefined;
+    let items;
+    try {
+        items = opCli.listItems(vault);
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        p.log.warn(`op item list failed (${reason}); falling back to freeform reference.`);
+        return promptFreeformOpRef();
+    }
+    if (items.length === 0) {
+        p.log.warn(`No LOGIN-category items in vault "${vault}"; falling back to freeform reference.`);
+        return promptFreeformOpRef();
+    }
+    const item = await p.select({
+        message: `Pick a LOGIN item from ${vault}`,
+        options: items.map((i) => ({ value: i.title, label: i.title })),
+    });
+    if (p.isCancel(item))
+        return undefined;
+    const ref = `op://${vault}/${item}`;
+    const confirmed = await p.confirm({
+        message: `Confirm: write ${ref} to config?`,
+        initialValue: true,
+    });
+    if (p.isCancel(confirmed) || !confirmed)
+        return undefined;
+    return ref;
+}
+/**
+ * Freeform `op://` reference fallback prompt. Validates input against the
+ * same regex as `OnePasswordReferenceSchema` in core; rejects until the
+ * user enters a valid value or cancels.
+ */
+async function promptFreeformOpRef() {
+    const ref = await p.text({
+        message: "1Password reference (op://[account/]vault/item)",
+        placeholder: "op://Personal/ttctl",
+        validate: (value) => {
+            if (value === undefined || value.length === 0)
+                return "Reference is required.";
+            if (!OP_REF_REGEX.test(value))
+                return OP_REF_PATTERN_HINT;
+            return undefined;
+        },
+    });
+    if (p.isCancel(ref))
+        return undefined;
+    return ref;
+}
+/**
+ * Form B flow: warn-and-confirm gate, then prompt for username (email
+ * regex) and password (masked). Returns `undefined` on any
+ * cancellation OR explicit `N` at the warn-and-confirm gate.
+ */
+async function collectFormBLiteral() {
+    const proceed = await p.confirm({
+        message: "Plaintext credentials in config are discouraged. Prefer Form A (1Password) when possible. Continue?",
+        initialValue: false,
+    });
+    if (p.isCancel(proceed) || !proceed)
+        return undefined;
+    const username = await p.text({
+        message: "Username (Toptal email)",
+        validate: (value) => {
+            if (value === undefined || value.length === 0)
+                return "Username is required.";
+            if (!EMAIL_REGEX.test(value))
+                return "Expected an email address.";
+            return undefined;
+        },
+    });
+    if (p.isCancel(username))
+        return undefined;
+    const password = await p.password({
+        message: "Password",
+        validate: (value) => {
+            if (value === undefined || value.length === 0)
+                return "Password is required.";
+            return undefined;
+        },
+    });
+    if (p.isCancel(password))
+        return undefined;
+    return { username, password };
+}
+//# sourceMappingURL=init.js.map

package/dist/commands/auth/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../src/commands/auth/init.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,oCAAoC;AAEpC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAkBzF;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAEjD;;;GAGG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAC/B,CAAC,CAAC,MAAM,CAAC;IACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CACH,CAAC;AAEF;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAC9B,CAAC,CAAC,MAAM,CAAC;IACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CACH,CAAC;AAEF;;;;;GAKG;AACH,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE;QACpE,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IACH,MAAM,UAAU,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,OAAO,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE;QAC9G,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IACH,MAAM,UAAU,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,OAAO,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAsB;IAC1D,OAAO,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,qBAAqB,CAAC;QACtF,OAAO,mBAAmB,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,IAAI,KAAK,SAAS,GAAG,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU;IACxB,qEAAqE;IACrE,2CAA2C;IAC3C,uEAAuE;IACvE,sEAAsE;IACtE,mEAAmE;IACnE,+DAA+D;IAC/D,OAAQ,OAAO,CAAC,KAAK,CAAC,KAAiB,KAAK,IAAI,CAAC;AACnD,CAAC;AAcD;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAmB;IAC1C,MAAM,EAAE,WAAW;IACnB,UAAU,EAAE,YAAY;IACxB,SAAS,EAAE,WAAW;CACvB,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,OAAwB;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC;IACxD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,0BAA0B,GAAG,KAAK,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,QAAgB,EAAE,QAAgB;IAC1D,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpF,OAAO,yCAAyC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;AAC7G,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAwB,EACxB,QAAwB,YAAY;IAEpC,wEAAwE;IACxE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAClB,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,SAAS;YACjB,OAAO,EACL,mEAAmE;gBACnE,8CAA8C;SACjD,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;IAErC,iEAAiE;IACjE,sEAAsE;IACtE,gEAAgE;IAChE,sEAAsE;IACtE,iCAAiC;IACjC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GACX,4CAA4C,UAAU,IAAI,GAAG,oDAAoD,CAAC;QACpH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC1D,CAAC;IAED,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAE3B,oEAAoE;IACpE,wCAAwC;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,CAAY;QACrC,OAAO,EAAE,2BAA2B;QACpC,OAAO,EAAE;YACP,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,mCAAmC,EAAE;YAC1D,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,yCAAyC,EAAE;SACjE;QACD,YAAY,EAAE,GAAG;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,CAAC,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACvC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;IAC3F,CAAC;IAED,IAAI,IAAY,CAAC;IACjB,IAAI,UAAqB,CAAC;IAE1B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,UAAU,GAAG,GAAG,CAAC;QACjB,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,CAAC,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;YACvC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;QAC3F,CAAC;QACD,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,GAAG,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;QAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;YACvC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;QAC3F,CAAC;QACD,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAED,0DAA0D;IAC1D,sEAAsE;IACtE,qEAAqE;IACrE,YAAY;IACZ,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC,CAAC,MAAM,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;QAC/C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,OAAO,EAAE,EAAE,CAAC;IAC5E,CAAC;IAED,MAAM,WAAW,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAChG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAAC,KAAqB;IAClD,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;IAEnC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QACtF,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED,oEAAoE;IACpE,sEAAsE;IACtE,qDAAqD;IACrD,IAAI,MAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,MAAM,wCAAwC,CAAC,CAAC;QACpF,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACpF,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,MAAM,CAAS;QACnC,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;KAC/D,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAExC,IAAI,KAAsC,CAAC;IAC3C,IAAI,CAAC;QACH,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,MAAM,wCAAwC,CAAC,CAAC;QACnF,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,qCAAqC,KAAK,wCAAwC,CAAC,CAAC;QAC/F,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,CAAS;QAClC,OAAO,EAAE,0BAA0B,KAAK,EAAE;QAC1C,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;KAChE,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAEvC,MAAM,GAAG,GAAG,QAAQ,KAAK,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC;QAChC,OAAO,EAAE,kBAAkB,GAAG,aAAa;QAC3C,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAE1D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB;IAChC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC;QACvB,OAAO,EAAE,iDAAiD;QAC1D,WAAW,EAAE,qBAAqB;QAClC,QAAQ,EAAE,CAAC,KAAyB,EAAE,EAAE;YACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,wBAAwB,CAAC;YAC/E,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,mBAAmB,CAAC;YAC1D,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB;IAChC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC;QAC9B,OAAO,EAAE,qGAAqG;QAC9G,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAEtD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC;QAC5B,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,CAAC,KAAyB,EAAE,EAAE;YACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,uBAAuB,CAAC;YAC9E,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,4BAA4B,CAAC;YAClE,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAE3C,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC;QAChC,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,CAAC,KAAyB,EAAE,EAAE;YACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,uBAAuB,CAAC;YAC9E,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAE3C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC"}

package/dist/commands/auth/signin.d.ts

@@ -0,0 +1,81 @@
+import type { ConfigErrorCode, SignInErrorCode } from "@ttctl/core";
+import type { OutputFormat } from "../../lib/output.js";
+/**
+ * Output format for `ttctl auth signin`. Aligned with the cross-CLI
+ * `OutputFormat` post-#126: `pretty` (default) is the human-readable
+ * confirmation line, `json` emits the `SignInResult` discriminated
+ * union for scripting, `yaml` emits the same shape as block-style YAML.
+ */
+export interface AuthSignInOptions {
+    output: OutputFormat;
+}
+/**
+ * CLI-level error code surfaced in JSON output. Extends `SignInErrorCode`
+ * (from core) with codes specific to the orchestration this command performs
+ * around the core `signIn` call (1Password resolution, token persistence)
+ * plus the `ConfigErrorCode` discriminator from core's resolver. Stable
+ * strings — script consumers can branch on them without pattern-matching
+ * prose messages.
+ */
+export type SignInResultErrorCode = SignInErrorCode | ConfigErrorCode | "ONEPASSWORD_ERROR" | "SAVE_FAILED" | "NO_CREDENTIALS";
+/**
+ * Terminal outcome of `ttctl auth signin`. `signed-in` carries the verified
+ * `email` (the same string passed to `EmailPasswordSignIn`). `error` carries
+ * a stable `code` for scripting plus a human-readable `message` already
+ * containing any actionable hint.
+ */
+export type SignInResult = {
+    status: "signed-in";
+    email: string;
+} | {
+    status: "error";
+    code: SignInResultErrorCode;
+    message: string;
+};
+/**
+ * Map a `SignInResult` to a process exit code:
+ *   - `signed-in`            → 0 (success)
+ *   - `error`/`NETWORK_ERROR` → 2 (transient/retryable — same convention as
+ *     `auth status` `unreachable`)
+ *   - `error`/anything else  → 1 (user-actionable: bad credentials, missing
+ *     1Password CLI, malformed config, MFA required, disk failure)
+ *
+ * The 1/2 split matches `auth status` so shell consumers can compose:
+ * `ttctl auth signin || case $? in 1) ... ;; 2) retry ;; esac`.
+ */
+export declare function exitCodeForSignInResult(result: SignInResult): number;
+/**
+ * Render a `SignInResult` for the human-readable `pretty` format.
+ * Success collapses to a single-line confirmation; failures surface the
+ * underlying message verbatim (the upstream errors already carry
+ * actionable hints — `OnePasswordError` names the install URL,
+ * `ConfigError` names the missing path).
+ */
+export declare function formatSignInPretty(result: SignInResult): string;
+/**
+ * Format a `SignInResult` for the requested output mode. The JSON and
+ * YAML shapes mirror the discriminated union 1:1 — `email` only on
+ * success, `code` and `message` only on error — so callers can consume
+ * the same union structure over the wire.
+ */
+export declare function formatSignInOutput(result: SignInResult, output: OutputFormat): string;
+/**
+ * Run the `auth signin` command end-to-end:
+ *   1. Discover and load `.ttctl.yaml` (`ConfigError` on missing/invalid).
+ *   2. Refuse Form C (token-only, no credentials) per FR-3.3 — signin
+ *      requires `auth.credentials` to be configured.
+ *   3. Resolve credentials — Form A reaches `op` CLI, Form B is literal
+ *      (`OnePasswordError` on Form A failures).
+ *   4. Sign in via `core.signIn`, capturing the bearer token.
+ *   5. Persist the token back to the SAME YAML config under `auth.token`
+ *      via `persistAuthToken` — atomic write, mode 0600, comment fidelity,
+ *      symlink + sync-root refusal.
+ *   6. Emit the result and exit with the corresponding code.
+ *
+ * Errors are routed to stderr; success goes to stdout. `process.exit` is the
+ * terminal step for the same reason as `auth status` — Commander action
+ * handlers otherwise resolve to `undefined` and we'd lose the exit-code
+ * contract that scripts rely on.
+ */
+export declare function runAuthSignIn(options: AuthSignInOptions): Promise<void>;
+//# sourceMappingURL=signin.d.ts.map

package/dist/commands/auth/signin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signin.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/signin.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAIpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAC7B,eAAe,GACf,eAAe,GACf,mBAAmB,GACnB,aAAa,GACb,gBAAgB,CAAC;AAErB;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAIpE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAK/D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAQrF;AA6BD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAM7E"}

package/dist/commands/auth/signin.js

@@ -0,0 +1,145 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright (C) 2026 Oleksii PELYKH
+import { AuthTokenPersistError, ConfigError, OnePasswordError, SignInError, persistAuthToken, resolveCredentials, signIn, } from "@ttctl/core";
+import { resolveConfigForCli } from "../../lib/config-context.js";
+import { formatYaml } from "../../lib/output.js";
+/**
+ * Map a `SignInResult` to a process exit code:
+ *   - `signed-in`            → 0 (success)
+ *   - `error`/`NETWORK_ERROR` → 2 (transient/retryable — same convention as
+ *     `auth status` `unreachable`)
+ *   - `error`/anything else  → 1 (user-actionable: bad credentials, missing
+ *     1Password CLI, malformed config, MFA required, disk failure)
+ *
+ * The 1/2 split matches `auth status` so shell consumers can compose:
+ * `ttctl auth signin || case $? in 1) ... ;; 2) retry ;; esac`.
+ */
+export function exitCodeForSignInResult(result) {
+    if (result.status === "signed-in")
+        return 0;
+    if (result.code === "NETWORK_ERROR")
+        return 2;
+    return 1;
+}
+/**
+ * Render a `SignInResult` for the human-readable `pretty` format.
+ * Success collapses to a single-line confirmation; failures surface the
+ * underlying message verbatim (the upstream errors already carry
+ * actionable hints — `OnePasswordError` names the install URL,
+ * `ConfigError` names the missing path).
+ */
+export function formatSignInPretty(result) {
+    if (result.status === "signed-in") {
+        return `Signed in as ${result.email}`;
+    }
+    return `Sign-in failed (${result.code}): ${result.message}`;
+}
+/**
+ * Format a `SignInResult` for the requested output mode. The JSON and
+ * YAML shapes mirror the discriminated union 1:1 — `email` only on
+ * success, `code` and `message` only on error — so callers can consume
+ * the same union structure over the wire.
+ */
+export function formatSignInOutput(result, output) {
+    if (output === "json") {
+        return JSON.stringify(result);
+    }
+    if (output === "yaml") {
+        return formatYaml(result);
+    }
+    return formatSignInPretty(result);
+}
+/**
+ * Translate a thrown error to a `SignInResult` with the stable error code.
+ * Centralizes the error-class → code mapping so the run loop stays linear.
+ */
+function classifyError(err) {
+    if (err instanceof SignInError) {
+        return { status: "error", code: err.code, message: err.message };
+    }
+    if (err instanceof OnePasswordError) {
+        return { status: "error", code: "ONEPASSWORD_ERROR", message: err.message };
+    }
+    if (err instanceof ConfigError) {
+        return { status: "error", code: err.code, message: err.message };
+    }
+    if (err instanceof AuthTokenPersistError) {
+        // Surface bearer in the rescue line per AC-4 — operator can save manually.
+        const rescue = err.bearerRescue !== undefined ? `\nBearer (rescue): ${err.bearerRescue}` : "";
+        return {
+            status: "error",
+            code: "SAVE_FAILED",
+            message: `${err.message}${rescue}`,
+        };
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    return { status: "error", code: "UNKNOWN", message };
+}
+/**
+ * Run the `auth signin` command end-to-end:
+ *   1. Discover and load `.ttctl.yaml` (`ConfigError` on missing/invalid).
+ *   2. Refuse Form C (token-only, no credentials) per FR-3.3 — signin
+ *      requires `auth.credentials` to be configured.
+ *   3. Resolve credentials — Form A reaches `op` CLI, Form B is literal
+ *      (`OnePasswordError` on Form A failures).
+ *   4. Sign in via `core.signIn`, capturing the bearer token.
+ *   5. Persist the token back to the SAME YAML config under `auth.token`
+ *      via `persistAuthToken` — atomic write, mode 0600, comment fidelity,
+ *      symlink + sync-root refusal.
+ *   6. Emit the result and exit with the corresponding code.
+ *
+ * Errors are routed to stderr; success goes to stdout. `process.exit` is the
+ * terminal step for the same reason as `auth status` — Commander action
+ * handlers otherwise resolve to `undefined` and we'd lose the exit-code
+ * contract that scripts rely on.
+ */
+export async function runAuthSignIn(options) {
+    const result = await performSignIn();
+    const rendered = formatSignInOutput(result, options.output);
+    const stream = result.status === "signed-in" ? process.stdout : process.stderr;
+    stream.write(rendered + "\n");
+    process.exit(exitCodeForSignInResult(result));
+}
+async function performSignIn() {
+    let configResult;
+    try {
+        configResult = resolveConfigForCli();
+    }
+    catch (err) {
+        return classifyError(err);
+    }
+    // Form C refusal (FR-3.3): signin requires credentials. A token-only
+    // config has no credentials to drive EmailPasswordSignIn.
+    const credentialsValue = configResult.config.auth.credentials;
+    if (credentialsValue === undefined) {
+        return {
+            status: "error",
+            code: "NO_CREDENTIALS",
+            message: "ttctl auth signin requires `auth.credentials` to be configured. " +
+                'Add a 1Password reference (`auth.credentials: "op://..."`) or literal ' +
+                "`{ username, password }` to your config and try again.",
+        };
+    }
+    let credentials;
+    try {
+        credentials = resolveCredentials(credentialsValue);
+    }
+    catch (err) {
+        return classifyError(err);
+    }
+    let token;
+    try {
+        ({ token } = await signIn(credentials));
+    }
+    catch (err) {
+        return classifyError(err);
+    }
+    try {
+        await persistAuthToken(configResult.path, token);
+    }
+    catch (err) {
+        return classifyError(err);
+    }
+    return { status: "signed-in", email: credentials.email };
+}
+//# sourceMappingURL=signin.js.map

package/dist/commands/auth/signin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signin.js","sourceRoot":"","sources":["../../../src/commands/auth/signin.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,oCAAoC;AAEpC,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,MAAM,GACP,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAsCjD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAoB;IAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IACrD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,gBAAgB,MAAM,CAAC,KAAK,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,mBAAmB,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAoB,EAAE,MAAoB;IAC3E,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;QACpC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;QACzC,2EAA2E;QAC3E,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,sBAAsB,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,OAAO;YACL,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,EAAE;SACnC,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA0B;IAC5D,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/E,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,IAAI,YAAoD,CAAC;IACzD,IAAI,CAAC;QACH,YAAY,GAAG,mBAAmB,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,qEAAqE;IACrE,0DAA0D;IAC1D,MAAM,gBAAgB,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;IAC9D,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO;YACL,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,gBAAgB;YACtB,OAAO,EACL,kEAAkE;gBAClE,wEAAwE;gBACxE,wDAAwD;SAC3D,CAAC;IACJ,CAAC;IAED,IAAI,WAAkD,CAAC;IACvD,IAAI,CAAC;QACH,WAAW,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,CAAC;QACH,MAAM,gBAAgB,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;AAC3D,CAAC"}