halfcycle 0.3.35 → 0.3.37

package/dist/claude-version-probe.d.ts

@@ -0,0 +1,44 @@
+/**
+ * ONE PLACE THAT KNOWS HOW TO ASK THE SHELL FOR CLAUDE CODE'S VERSION.
+ *
+ * `reportClaudeCodeVersion` (`bin.ts`) and `claudeCodeVersion` (`banner-facts.ts`) each used
+ * to call `execFileSync('claude', ['--version'], …)` directly. On Windows, an npm install of
+ * Claude Code puts a `claude.cmd` shim on PATH, never a `claude.exe` — and `execFileSync`
+ * without a shell never runs a `.cmd` file: Node resolves the executable itself, and only a
+ * shell applies the `.cmd` extension rule. So on Windows both probes silently found nothing,
+ * every time, regardless of whether Claude Code was installed.
+ *
+ * The fix routes through `cmd.exe`, the same way Node's own `shell: true` already does on
+ * Windows: `/d` skips AutoRun scripts, `/s` lets the quoted command string carry its own
+ * quoting, and `windowsVerbatimArguments: true` stops Node adding a second layer of quoting
+ * on top of the one already in the argument. Elsewhere (`win32` excluded) this is exactly the
+ * call it always was.
+ *
+ * `platform` and `exec` are both injectable so a test can drive the `win32` arm from a
+ * non-Windows CI runner and assert the literal command and arguments, rather than depending
+ * on the host actually being Windows with Claude Code installed.
+ *
+ * INV-001: Node builtins only.
+ */
+/** The slice of `execFileSync`'s call shape this probe needs. The real function already
+ *  satisfies it, so production code passes no wrapper. */
+export type ClaudeVersionExec = (file: string, args: readonly string[], options: {
+    readonly encoding: 'utf-8';
+    readonly timeout: number;
+    readonly stdio: readonly ['ignore', 'pipe', 'ignore'];
+    readonly windowsVerbatimArguments?: boolean;
+}) => string;
+export interface ClaudeVersionProbeDeps {
+    /** Defaults to `process.platform`. Inject to exercise the `win32` arm elsewhere. */
+    readonly platform?: NodeJS.Platform;
+    /** Defaults to the real `execFileSync`. Inject to assert the call without a shell. */
+    readonly exec?: ClaudeVersionExec;
+}
+/**
+ * Runs `claude --version` for the given platform and returns the parsed `x.y.z`, or
+ * `undefined` for anything that stops that from working: `claude` not on PATH, no answer
+ * inside `timeoutMs`, or an answer with no dotted version in it. Never throws — both
+ * callers' degradation (say nothing) depends on that.
+ */
+export declare function probeClaudeCodeVersion(timeoutMs: number, deps?: ClaudeVersionProbeDeps): string | undefined;
+//# sourceMappingURL=claude-version-probe.d.ts.map

package/dist/claude-version-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-version-probe.d.ts","sourceRoot":"","sources":["../src/claude-version-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH;0DAC0D;AAC1D,MAAM,MAAM,iBAAiB,GAAG,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE;IACP,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;CAC7C,KACE,MAAM,CAAC;AAEZ,MAAM,WAAW,sBAAsB;IACrC,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IACpC,sFAAsF;IACtF,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC;CACnC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,sBAA2B,GAAG,MAAM,GAAG,SAAS,CAqB/G"}

package/dist/confirm-identity.d.ts

@@ -286,6 +286,13 @@ export declare function readDecision(answer: string): IdentityDecision;
  * with no measurement at all — so there is no default to fall back on silently; every
  * caller states `isInteractiveRun()`'s answer, or a value it controls directly in a
  * test.
+ *
+ * THE KEY TO PRESS IS NOT SPELLED HERE (`windows-client-seat`). The interactive arm
+ * composes `SWITCH_ACCOUNT_ANSWER` from `@halfcycle/events`, because delivery's
+ * not-this-account 401 sentence tells the same person the same thing and cannot
+ * import this module. The output is byte-identical to the spelled form it replaced;
+ * `test/credential-wire-contract.test.ts` pins both arms by hash and refuses a
+ * spelled copy of the fragment, or of a placeholder bearer, anywhere in this package.
  */
 export declare function identitySwitchRemedy(home: string | undefined, interactive: boolean): string;
 /**

package/dist/confirm-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"confirm-identity.d.ts","sourceRoot":"","sources":["../src/confirm-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkGG;AAGH,OAAO,EAA4B,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAInF,OAAO,EAAiB,KAAK,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAKtG,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,6CAA6C;AAC7C,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,gBAAgB,GAAG,MAAM,CAAC;AAErE,6FAA6F;AAC7F,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F,MAAM,WAAW,mBAAoB,SAAQ,cAAc;IACzD,8DAA8D;IAC9D,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,gFAAgF;IAChF,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,iEAAiE;IACjE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAeD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,CAAC;IAC/C;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,UAAU,CAC9B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,aAAa,CAAC,CAiBxB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAEtC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,OAAO,UAAQ,GACd,MAAM,CASR;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAE9E;AAoDD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAK7D;AAgKD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,OAAO,GAAG,MAAM,CAO3F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,kBAAkB,EAC9B,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAuD7B"}
+{"version":3,"file":"confirm-identity.d.ts","sourceRoot":"","sources":["../src/confirm-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkGG;AAGH,OAAO,EAAmD,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAI1G,OAAO,EAAiB,KAAK,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAKtG,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,6CAA6C;AAC7C,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,gBAAgB,GAAG,MAAM,CAAC;AAErE,6FAA6F;AAC7F,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F,MAAM,WAAW,mBAAoB,SAAQ,cAAc;IACzD,8DAA8D;IAC9D,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,gFAAgF;IAChF,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,iEAAiE;IACjE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAeD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,CAAC;IAC/C;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,UAAU,CAC9B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,aAAa,CAAC,CAiBxB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAEtC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,eAAe,GAAG,SAAS,EACrC,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,OAAO,UAAQ,GACd,MAAM,CASR;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAE9E;AAoDD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAK7D;AAgKD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,OAAO,GAAG,MAAM,CAO3F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,kBAAkB,EAC9B,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAuD7B"}

package/dist/device-signin.d.ts

@@ -10,8 +10,11 @@
  * SINCE T-25 THERE ARE TWO WAYS THE ANSWER COMES BACK, and `signIn` below is where
  * the choice is made:
  *
- *   LOOPBACK (the default) — the CLI listens on `127.0.0.1`, the page redirects the
- *   browser back to it, and NO CODE IS SHOWN. `loopback-signin.ts` owns the listener.
+ *   LOOPBACK (the default) — the CLI listens on `127.0.0.1` and the page redirects the
+ *   browser back to it, while this file polls control beside that wait, so a sign-in
+ *   approved on any tab or device completes. The user code is printed for a plain
+ *   tab to be compared against; the loopback page shows none. `loopback-signin.ts`
+ *   owns the listener.
  *
  *   DEVICE CODE (the fallback) — the code is printed, the human compares it with the
  *   page, and this file polls. Unchanged, and the right answer whenever the browser
@@ -59,6 +62,7 @@
  *
  * INV-001: Node builtins, the global `fetch` (Node 20), and `@halfcycle/events`.
  */
+import { spawn } from 'node:child_process';
 import { type DeviceAuthStartResponse, type DevicePollApproved } from '@halfcycle/events';
 /**
  * A sign-in that ended without a credential.
@@ -101,6 +105,8 @@ export interface SignInDeps {
     sleep?: (ms: number) => Promise<void>;
     /** The clock the local deadline is measured on. Defaults to `Date.now`. */
     now?: () => number;
+    /** How often either wait says it is still waiting. Defaults to fifteen seconds. */
+    stillWaitingMs?: number;
     /**
      * What signing in is FOR, spliced into `signIn`'s opening line: "Halfcycle needs
      * an account before it can **<reason>** — signing you in through your browser."
@@ -126,22 +132,42 @@ export interface SignInDeps {
     onwardEngagementId?: string;
 }
 /**
- * The platform command that opens a URL in the user's browser, as `{command, args}`.
+ * The platform command that opens a URL in the user's browser, as
+ * `{command, args, windowsVerbatimArguments?}`.
  *
  * A PURE FUNCTION so the argv can be asserted on every platform from any platform —
  * the alternative is a test that only ever checks the branch it happens to be
  * running on, which on this repo's CI would mean the Windows and Linux arms were
  * never looked at.
  *
- * NO SHELL, EVER. The URL is an argv element, so a value containing shell
- * metacharacters is an odd URL and not a command. `start` on Windows is the one
- * that would need a shell, so it is invoked through `cmd /c start ""` with an empty
- * title argument — without that empty string, `start` treats a quoted URL as the
- * window title and opens nothing.
+ * macOS and Linux: NO SHELL, EVER. The URL is an argv element handed straight to
+ * `open`/`xdg-open`, so a value containing shell metacharacters is an odd URL and
+ * not a command.
+ *
+ * `win32` (CHANGED — windows-install-hygiene AC5, the 2026-10-07 walk's F10): the
+ * old form, `{ command: 'cmd', args: ['/c', 'start', '', url] }`, hands `cmd.exe` an
+ * argv array it reassembles into one command line of its own, and that reassembly
+ * quotes nothing — `cmd.exe` then treats an unescaped `&` in the URL as a command
+ * separator. The loopback address carries `port` and `state` after a literal `&`
+ * (`loopbackVerificationUrl`), so the walk saw the first launch open the address cut
+ * at its first `&`, exit 1, and the fallback open a second tab.
+ *
+ * The fix routes through `cmd.exe` the way `probeClaudeCodeVersion`
+ * (`claude-version-probe.ts`) already does for AC3: one argv element carries the
+ * ENTIRE inner command as a single quoted string, and `/d /s` plus
+ * `windowsVerbatimArguments: true` tell `cmd.exe` to strip only the outer pair of
+ * quotes and run what is left — `start "" "<url>"`, the URL still inside its own
+ * quotes, which is what keeps `&`, `|`, `^`, `!` and a space inside one pair of
+ * quotes rather than cut at the first one. `openBrowser` refuses to build this at
+ * all for a URL holding `"` or `%` (see `hasWin32UnsafeOpenerChars`) — a `"` would
+ * close the quoted command early, and `cmd.exe` expands `%` as an
+ * environment-variable reference regardless of quoting, so quoting the URL does
+ * not defend against either.
  */
 export declare function browserOpenCommand(os: string, url: string): {
     command: string;
     args: string[];
+    windowsVerbatimArguments?: boolean;
 };
 /**
  * Is this URL safe to hand to the platform opener?
@@ -153,6 +179,37 @@ export declare function browserOpenCommand(os: string, url: string): {
  * document and a handler-scheme URL would launch whatever claims that scheme.
  */
 export declare function isOpenableUrl(url: string): boolean;
+/**
+ * Does this URL hold a `"`, a `%`, or a C0/DEL control character (U+0000–U+001F,
+ * U+007F) — the bytes `cmd.exe` still interprets, or that reach it unaccounted
+ * for, inside the single-quoted command `browserOpenCommand`'s `win32` arm builds
+ * (windows-install-hygiene AC5; the control-character case added at the
+ * windows-client follow-up wave's T-28 review)?
+ *
+ * A `"` closes that quoted command early, handing `cmd.exe` the remainder of the
+ * URL as a second command. A `%` is expanded by `cmd.exe`'s own command-line
+ * parser as an environment-variable reference — `%PATH%`, `%COMSPEC%` — and that
+ * expansion happens whether or not the text sits inside quotes, so quoting the URL
+ * does not defend against it.
+ *
+ * A CONTROL CHARACTER is refused for a different reason, and a line feed is the
+ * sharp case: `isOpenableUrl` parses the address with the WHATWG `URL`
+ * constructor, which — per spec — strips every ASCII tab and newline from its
+ * input before parsing. So an address carrying a raw `\n` passes `isOpenableUrl`
+ * looking exactly like the clean URL it would be without one, while the
+ * UNSTRIPPED STRING — the one `browserOpenCommand` actually quotes and `spawn`
+ * actually hands to `cmd.exe` — still carries the byte inside the quoted command
+ * line. No other C0 control character or DEL is reasoned about any more than that
+ * one is, so the whole class is refused rather than only the byte a parser
+ * happens to delete.
+ *
+ * Checked only where it matters, by `openBrowser`, and only on `win32`: `open`
+ * (macOS) and `xdg-open` (Linux) take the URL as a bare argv element with no shell
+ * in between, so none of these bytes does anything there — and percent-encoding
+ * is ordinary in an http(s) URL, so refusing `%` on every platform would refuse
+ * addresses that are perfectly safe to open outside `cmd.exe`'s quoting.
+ */
+export declare function hasWin32UnsafeOpenerChars(url: string): boolean;
 /** What was MEASURED when this run tried to open a browser. */
 export interface BrowserOpenAttempt {
     /** A browser was launched. Nobody claims the human looked at it. */
@@ -198,8 +255,25 @@ export interface BrowserOpenAttempt {
  * browser over*; honouring it is not a guess about the machine, and the reason
  * reported says so in those words. Nothing else in this flow reads the environment
  * to decide which path to take.
+ *
+ * ---------------------------------------------------------------------------
+ * `os` IS INJECTABLE (ADDED — AC5), DEFAULTING TO THE REAL PLATFORM, for the same
+ * reason `browserOpenCommand` takes one: a `win32`-only refusal
+ * (`hasWin32UnsafeOpenerChars`) needs to be assertable from this repo's Linux CI
+ * without actually having `cmd.exe` on `PATH`. Every existing caller passes two
+ * arguments and gets the real platform, unchanged.
+ *
+ * `spawnImpl` IS INJECTABLE TOO (ADDED — windows-client T-28 review), for a
+ * narrower reason: `node:child_process`'s `spawn` is a built-in ESM export and
+ * `node:test`'s `mock.method` cannot redefine a core module's property
+ * (`TypeError: Cannot redefine property`, measured), so there was no way for a
+ * test to observe what options actually reached `spawn` — in particular, that
+ * `windowsVerbatimArguments: true` from `browserOpenCommand`'s `win32` arm
+ * survived as far as the call rather than being computed and dropped. Every
+ * existing caller passes two or three arguments and gets the real `spawn`,
+ * unchanged.
  */
-export declare function openBrowser(url: string, env?: NodeJS.ProcessEnv): Promise<BrowserOpenAttempt>;
+export declare function openBrowser(url: string, env?: NodeJS.ProcessEnv, os?: string, spawnImpl?: typeof spawn): Promise<BrowserOpenAttempt>;
 /** True iff this run has no human at the keyboard. */
 export declare function isNonInteractive(env?: NodeJS.ProcessEnv): boolean;
 /** `POST /auth/device/start` — mint a code. Throws `SignInRefused` on a refusal. */
@@ -237,10 +311,12 @@ export declare const LOOPBACK_TIMEOUT_MESSAGE: string;
  * ---------------------------------------------------------------------------
  * THE TWO PATHS, AND HOW THE CHOICE BETWEEN THEM IS MADE.
  *
- *   LOOPBACK — bind `127.0.0.1:0`, put that port in the URL we open, and wait for
- *   the confirmation page to send the browser back. **No code is displayed at all**
- *   (criterion 1): there is nothing for the human to compare, so printing a code
- *   would be printing a value with no use.
+ *   LOOPBACK — bind `127.0.0.1:0`, put that port in the URL we open, and poll
+ *   control while waiting for the confirmation page to send the browser back
+ *   (`pollBesideLoopback`; the redirect only wakes the poll). The USER code is
+ *   printed: the loopback page shows none, but a plain sign-in tab does, and asks
+ *   whether it matches this terminal. *This replaces T-25's "no code is displayed
+ *   at all", withdrawn by the walk-F3 amendment of 2026-10-08.*
  *
  *   DEVICE CODE — print the code, open (or print) the page, and poll. Unchanged from
  *   T-08, still tested, and still correct for every machine whose browser is not the
@@ -267,10 +343,10 @@ export declare const LOOPBACK_TIMEOUT_MESSAGE: string;
  * to a connection error after a successful approval — a page that looks broken for a
  * sign-in that worked.
  *
- * WHAT IS PRINTED AND WHAT IS NOT, on the device-code path: the USER code is printed
- * — it is a selector a human compares between two screens and yields nothing to
- * whoever reads it, since only the device code can claim the credential. The DEVICE
- * code and the credential are printed nowhere, ever, and appear in no URL.
+ * WHAT IS PRINTED AND WHAT IS NOT, on BOTH paths: the USER code is printed — it is a
+ * selector a human compares between two screens and yields nothing to whoever reads
+ * it, since only the device code can claim the credential. The DEVICE code and the
+ * credential are printed nowhere, ever, and appear in no URL.
  */
 export declare function signIn(serviceUrl: string, deps?: SignInDeps & {
     env?: NodeJS.ProcessEnv;

package/dist/device-signin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-signin.d.ts","sourceRoot":"","sources":["../src/device-signin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAIH,OAAO,EAKL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAG3B;;;;;;;;GAQG;AACH,qBAAa,aAAc,SAAQ,KAAK;aAEpB,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM;CAKlB;AAED,gFAAgF;AAChF,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAE7C;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAGV,CAAC;AAE3B;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,QAGsC,CAAC;AAQnF,yEAAyE;AACzE,MAAM,WAAW,UAAU;IACzB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,qDAAqD;IACrD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAcD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,GACV;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAIrC;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOlD;AAaD,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,MAAM,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAmE7B;AAED,sDAAsD;AACtD,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAG9E;AAED,oFAAoF;AACpF,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAsC1F;AAYD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,uBAAuB,EAChC,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,kBAAkB,CAAC,CAmD7B;AAED,uCAAuC;AACvC,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAIF,CAAC;AAiEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAsB,MAAM,CAC1B,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,UAAU,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GAClD,OAAO,CAAC,QAAQ,CAAC,CAmFnB"}
+{"version":3,"file":"device-signin.d.ts","sourceRoot":"","sources":["../src/device-signin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAKL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAExB,MAAM,mBAAmB,CAAC;AAG3B;;;;;;;;GAQG;AACH,qBAAa,aAAc,SAAQ,KAAK;aAEpB,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM;CAKlB;AAED,gFAAgF;AAChF,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAE7C;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,QAGV,CAAC;AAE3B;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,QAGsC,CAAC;AAQnF,yEAAyE;AACzE,MAAM,WAAW,UAAU;IACzB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,qDAAqD;IACrD,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAcD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,GACV;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,wBAAwB,CAAC,EAAE,OAAO,CAAA;CAAE,CAUzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOlD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAO9D;AAaD,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,MAAM,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,EAAE,GAAE,MAAmB,EACvB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CA0E7B;AAED,sDAAsD;AACtD,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAG9E;AAED,oFAAoF;AACpF,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAsC1F;AAuDD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,uBAAuB,EAChC,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC,kBAAkB,CAAC,CA6B7B;AAiBD,uCAAuC;AACvC,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAIF,CAAC;AAkHpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,wBAAsB,MAAM,CAC1B,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,UAAU,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GAClD,OAAO,CAAC,QAAQ,CAAC,CA0FnB"}

package/dist/engagement-credential.d.ts

@@ -23,19 +23,21 @@
  * ---------------------------------------------------------------------------
  * IT IS AN ENV FILE AND NOT JSON, AND THAT IS FORCED — not a preference.
  *
- * Two consumers read this credential and both are POSIX `sh`:
+ * The generated hook scripts read this credential, and they are POSIX `sh`:
  *
  *   - `.claude/hooks/guard-runner.sh` SOURCES it (`set -a; . "$f"; set +a`) so the
  *     runner, which reads only `process.env`, receives its three variables. That is
- *     the INV-001 seam: env loading lives in the hook wiring, never in the binary.
- *   - `.halfcycle/mcp-headers.sh` READS one `KEY=` line out of it.
- *
- * Neither can parse JSON — there is no `jq` in this environment and `node` is not
- * dependable on a desktop-launched session's PATH (the reason `mcp-headers.sh` is
- * `sh` and not node in the first place). So the machine-level file is `KEY=value`
- * lines, exactly as Studio's is, and the ONE field that must come out of the
- * committed pin — the engagement id — is cut out of JSON with `sed`. See
- * `engagementResolutionShell()` for that, and for why `tr -d '\n'` precedes it.
+ *     the INV-001 seam for the hooks: env loading lives in the hook wiring.
+ *   - `.claude/hooks/session-start-marker.sh` tests for it to word its coverage line.
+ *
+ * A shell cannot parse JSON — there is no `jq` in this environment — so the
+ * machine-level file is `KEY=value` lines, exactly as Studio's is, and the ONE field
+ * the shell must take out of the committed pin — the engagement id — is cut out of
+ * JSON with `sed`. See `engagementResolutionShell()` for that, and for why
+ * `tr -d '\n'` precedes it. (The third consumer, the editor's headers command, was a
+ * generated `.halfcycle/mcp-headers.sh` that grepped one line out of this file; since
+ * `windows-client-seat` it is the vendored runner's `mcp-headers` verb, which reads
+ * the file through core's `parseEnvText` and the pin as JSON.)
  *
  * ---------------------------------------------------------------------------
  * THE SEVEN — NOW EIGHT (T-10) — KEYS ARE FOUR THINGS, AND THE COUNT DECIDES WHAT
@@ -99,14 +101,15 @@
 export { ENGAGEMENT_ENV_HEADER, ENGAGEMENTS_DIR_NAME, ENGAGEMENT_ENV_FILENAME, HALFCYCLE_DIR_NAME, NOT_THIS_ACCOUNT_MARKER_FILENAME, parseEnvText, shq, unquote, } from '@halfcycle/core';
 /**
  * The field the committed pin (`.halfcycle/bundle.json`) carries the engagement id
- * under. Named once here because BOTH readers of it — `readEngagementCredential`'s
- * TS caller and the generated POSIX `sed` — must agree on it, and the pin's writer
- * (`writeBundlePin`) is in `install.ts`. A test installs, then runs the generated
- * shell against the real written pin and compares its answer to
- * `engagementEnvPath()`, so writer and both readers are asserted to agree rather
- * than left to match by eye.
+ * under. Its one home is `@halfcycle/core` (`PIN_ENGAGEMENT_ID_FIELD`), because the
+ * runner's connection-headers verb reads the same field and may not import this
+ * package. It is re-exported here so `readEngagementCredential`'s TS caller and the
+ * generated POSIX `sed` keep reading it from this module. A test installs, then runs
+ * the generated shell against the real written pin and compares its answer to
+ * `engagementEnvPath()`, so writer and readers are asserted to agree rather than
+ * left to match by eye.
  */
-export declare const PIN_ENGAGEMENT_ID_FIELD = "engagementId";
+export { PIN_ENGAGEMENT_ID_FIELD } from '@halfcycle/core';
 /**
  * The refusal an engagement id that is not UUID-shaped meets before it becomes a
  * path. A class of its own so a caller can tell "this id cannot name a folder"
@@ -244,10 +247,14 @@ export declare const GUARD_ENV_KEYS: readonly ["GUARD_SERVICE_URL", "GUARD_SERVI
  * keeps the two bound: add a fourth guard variable to `GUARD_ENV_KEYS` and it
  * appears here, required, without anybody remembering this constant exists.
  *
- * The consumer is the generated session-start coverage banner, which prints the
- * missing names to a developer. Naming an address they cannot obtain and do not need
- * in a list of what is missing — beside an instruction to re-run the installer — is
- * the wall this whole change removed, reappearing on a hook script.
+ * The consumer is the install report, which names the keys a covered repository
+ * holds. The generated session-start script used to be a second consumer, looping
+ * over this list to decide whether to print the no-coverage banner; since
+ * `session-start-connection-check` that banner is the runner's, decided by the
+ * guard hook's own `readConfig`, whose required pair this list must keep naming.
+ * Naming an address a developer cannot obtain and does not need in a list of what is
+ * missing — beside an instruction to re-run the installer — is the wall this whole
+ * change removed.
  */
 export declare const GUARD_COVERAGE_REQUIRED_KEYS: ("GUARD_SERVICE_TOKEN" | "GUARD_ENGAGEMENT_ID")[];
 /**
@@ -364,15 +371,18 @@ export declare function writeEngagementEnv(engagementId: string, values: Record<
  * match independent of the file's line breaks. (This repo has paid twice for a
  * pattern that wrapped across lines reading as absent.)
  *
- * **Why not `node`.** `mcp-headers.sh` is `sh` and not node precisely because a
- * desktop-launched session's PATH typically has no version-manager `node`. Using it
- * here would put that back.
+ * **Why `sh` here, though the headers command is now `node`.** This block is
+ * embedded in the generated hook scripts, which are bash; parsing the pin inside
+ * them in shell keeps each hook one process until it `exec`s the runner. The old
+ * reason given here — that a desktop-launched session may have no version-manager
+ * `node` — no longer holds the line: the guard wrapper already ends `exec node`, and
+ * `windows-client-seat` made the editor's headers command a `node` program too.
  *
  * **IT SETS VARIABLES AND PRINTS NOTHING, and that is not a style choice.** The
  * obvious form — print the path and let the caller take it with `$(…)` — puts the
  * function in a SUBSHELL, so the `HALFCYCLE_ENV_PROBLEM` it sets on the failure
- * path never reaches the caller. Measured: under `set -u` (which `mcp-headers.sh`
- * runs with) the caller then dies on `HALFCYCLE_ENV_PROBLEM: unbound variable`
+ * path never reaches the caller. Measured: under `set -u` (which the retired
+ * `mcp-headers.sh` ran with) the caller then dies on `HALFCYCLE_ENV_PROBLEM: unbound variable`
  * instead of printing the reason it was carrying. So the function assigns
  * `HALFCYCLE_ENV_FILE` / `HALFCYCLE_ENV_PROBLEM` / `HALFCYCLE_ENV_ENGAGEMENT` in
  * the CURRENT shell and returns a status, and callers use `if halfcycle_env_file …`.
@@ -388,7 +398,9 @@ export declare function writeEngagementEnv(engagementId: string, values: Record<
  * installer does not rewrite a pin whose id it refuses, so "run npx halfcycle to
  * rewrite it" would be false. The guard wrapper and the session-start marker treat
  * every failure alike (no credential sourced), which is the right answer for this
- * one too; only `mcp-headers.sh` words each case, and it has a `bad-id` arm.
+ * one too. The retired `mcp-headers.sh` was the one caller that worded each case;
+ * the runner's `mcp-headers` verb now does, from its own pin read, with a `bad-id`
+ * arm of its own.
  *
  * **HALFCYCLE_ENV_NOT_THIS_ACCOUNT IS SET ON THE `no-credential` FAILURE PATH TOO
  * (T-02b, `solo-project-ownership`) — that is the state it exists to distinguish.**

package/dist/engagement-credential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engagement-credential.d.ts","sourceRoot":"","sources":["../src/engagement-credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiGG;AAmBH,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,gCAAgC,EAChC,YAAY,EACZ,GAAG,EACH,OAAO,GACR,MAAM,iBAAiB,CAAC;AAgBzB;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AAEtD;;;;GAIG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,YAAY,EAAE,MAAM;CAajC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAE7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAG9E;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAMnF;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,cAAc,8EAIjB,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,4BAA4B,mDAExC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,mMAOtB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAoCrD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EACjD,IAAI,GAAE,SAAS,MAAM,EAAwB,GAC5C,MAAM,CAER;AAMD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAM/B;AAED,8DAA8D;AAC9D,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EACjD,IAAI,CAAC,EAAE,MAAM,EACb,IAAI,GAAE,SAAS,MAAM,EAAwB,GAC5C,eAAe,CAoBjB;AA4BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAsDlD"}
+{"version":3,"file":"engagement-credential.d.ts","sourceRoot":"","sources":["../src/engagement-credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmGG;AAoBH,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,gCAAgC,EAChC,YAAY,EACZ,GAAG,EACH,OAAO,GACR,MAAM,iBAAiB,CAAC;AAgBzB;;;;;;;;;GASG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D;;;;GAIG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,YAAY,EAAE,MAAM;CAajC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAE7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAG9E;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAMnF;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,cAAc,8EAIjB,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,4BAA4B,mDAExC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,mMAOtB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAuCrD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EACjD,IAAI,GAAE,SAAS,MAAM,EAAwB,GAC5C,MAAM,CAER;AAMD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAM/B;AAED,8DAA8D;AAC9D,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EACjD,IAAI,CAAC,EAAE,MAAM,EACb,IAAI,GAAE,SAAS,MAAM,EAAwB,GAC5C,eAAe,CAoBjB;AA4BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAsDlD"}