1/**
2 * CLI helper: insert/remove the live variant mode script tag in the project's
3 * main HTML entry point.
4 *
5 * On first live run, the agent generates `.impeccable/live/config.json`
6 * with the project's insertion target (framework-specific). On
7 * every subsequent run, this script handles insert/remove deterministically
8 * with zero LLM involvement.
9 *
10 * Usage:
11 *   node live-inject.mjs --port PORT   # Insert the live script tag
12 *   node live-inject.mjs --remove      # Remove the live script tag
13 *   node live-inject.mjs --check       # Check whether live config exists
14 */
15 
16import fs from 'node:fs';
17import path from 'node:path';
18import { fileURLToPath } from 'node:url';
19import { resolveLiveConfigPath } from './lib/impeccable-paths.mjs';
20import {
21  applySvelteKitLiveAdapter,
22  detectSvelteKitProject,
23  removeSvelteKitLiveAdapter,
24} from './live/sveltekit-adapter.mjs';
25 
26const __dirname = path.dirname(fileURLToPath(import.meta.url));
27const CONFIG_PATH = resolveLiveConfigPath({ cwd: process.cwd(), scriptsDir: __dirname });
28const MARKER_OPEN_TEXT = 'impeccable-live-start';
29const MARKER_CLOSE_TEXT = 'impeccable-live-end';
30const IGNORE_MARKER_OPEN = '# impeccable-live-ignore-start';
31const IGNORE_MARKER_CLOSE = '# impeccable-live-ignore-end';
32 
33export const LIVE_IGNORE_PATTERNS = Object.freeze([
34  '.impeccable/hook.cache.json',
35  '.impeccable/hook.pending.json',
36  '.impeccable/config.local.json',
37  '.impeccable/live/server.json',
38  '.impeccable/live/sessions/',
39  '.impeccable/live/previews/',
40  '.impeccable/live/annotations/',
41  '.impeccable/live/cache/',
42  '.impeccable/live/manual-edit-apply-transaction.json',
43  '.impeccable/live/manual-edit-events.jsonl',
44  '.impeccable/live/manual-edit-evidence/',
45  '.impeccable/live/pending-manual-edits.json',
46  '.impeccable/live/deferred-svelte-component-accepts.json',
47  '.impeccable-live.json',
48  '.impeccable-live/',
49  'node_modules/.impeccable-live/',
50  'src/lib/impeccable/ImpeccableLiveRoot.svelte',
51  'src/lib/impeccable/__runtime.js',
52  'src/lib/impeccable/[0-9a-f]*/',
53]);
54 
55/**
56 * Hard-excluded directory patterns. These are NEVER user-facing pages and
57 * matching them would silently inject tracking scripts into third-party
58 * code. The user cannot turn these off via config — they are the floor.
59 */
60const HARD_EXCLUDES = [
61  '**/node_modules/**',
62  '**/.git/**',
63];
64 
65export async function injectCli() {
66  const args = process.argv.slice(2);
67 
68  if (args.includes('--help') || args.includes('-h')) {
69    console.log(`Usage: node live-inject.mjs [options]
70 
71Insert or remove the live mode script tag in the project's HTML entry point.
72Reads configuration from .impeccable/live/config.json.
73 
74Modes:
75  --port PORT   Insert script tag pointing at http://localhost:PORT/live.js
76  --remove      Remove the script tag (if present)
77  --check       Print whether .impeccable/live/config.json exists and its content
78 
79Output (JSON):
80  { ok, file, inserted|removed, config? }`);
81    process.exit(0);
82  }
83 
84  if (args.includes('--check')) {
85    if (!fs.existsSync(CONFIG_PATH)) {
86      console.log(JSON.stringify({ ok: false, error: 'config_missing', path: CONFIG_PATH }));
87      process.exit(0);
88    }
89    let cfg;
90    try {
91      cfg = JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8'));
92    } catch (err) {
93      console.log(JSON.stringify({ ok: false, error: 'config_invalid', message: err.message, path: CONFIG_PATH }));
94      return;
95    }
96    try {
97      validateConfig(cfg);
98    } catch (err) {
99      console.log(JSON.stringify({ ok: false, error: 'config_invalid', message: err.message, path: CONFIG_PATH }));
100      return;
101    }
102    console.log(JSON.stringify({ ok: true, config: cfg, path: CONFIG_PATH }));
103    return;
104  }
105 
106  // Load config
107  if (!fs.existsSync(CONFIG_PATH)) {
108    console.error(JSON.stringify({ ok: false, error: 'config_missing', path: CONFIG_PATH }));
109    process.exit(1);
110  }
111  const config = JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf-8'));
112  validateConfig(config);
113 
114  const resolvedFiles = resolveFiles(process.cwd(), config);
115  const svelteKit = detectSvelteKitProject(process.cwd(), config);
116 
117  if (args.includes('--remove')) {
118    if (svelteKit) {
119      const adapterResult = removeSvelteKitLiveAdapter({ cwd: process.cwd(), config });
120      console.log(JSON.stringify({ ok: true, adapter: 'sveltekit', results: [adapterResult] }));
121      return;
122    }
123    const results = resolvedFiles.map((relFile) => {
124      const absFile = path.resolve(process.cwd(), relFile);
125      if (!fs.existsSync(absFile)) return { file: relFile, error: 'file_not_found' };
126      const content = fs.readFileSync(absFile, 'utf-8');
127      const detagged = removeTag(content, config.commentSyntax);
128      const updated = revertCspMeta(detagged);
129      if (updated === content) return { file: relFile, removed: false, note: 'no tag present' };
130      fs.writeFileSync(absFile, updated, 'utf-8');
131      return {
132        file: relFile,
133        removed: detagged !== content,
134        cspReverted: updated !== detagged,
135      };
136    });
137    console.log(JSON.stringify({ ok: true, results }));
138    return;
139  }
140 
141  // Insert mode — need --port
142  const portIdx = args.indexOf('--port');
143  const port = portIdx !== -1 ? parseInt(args[portIdx + 1], 10) : NaN;
144  if (!Number.isFinite(port)) {
145    console.error(JSON.stringify({ ok: false, error: 'missing_port' }));
146    process.exit(1);
147  }
148  const gitIgnore = ensureLiveGitIgnores(process.cwd());
149 
150  if (svelteKit) {
151    const adapterResult = applySvelteKitLiveAdapter({ cwd: process.cwd(), port, config });
152    console.log(JSON.stringify({ ok: true, port, adapter: 'sveltekit', gitIgnore, results: [adapterResult] }));
153    return;
154  }
155 
156  const results = resolvedFiles.map((relFile) => {
157    const absFile = path.resolve(process.cwd(), relFile);
158    if (!fs.existsSync(absFile)) return { file: relFile, error: 'file_not_found' };
159    const content = fs.readFileSync(absFile, 'utf-8');
160    const withoutOld = revertCspMeta(removeTag(content, config.commentSyntax));
161    const withTag = insertTag(withoutOld, config, port, relFile);
162    if (withTag === withoutOld) {
163      return { file: relFile, error: 'insertion_point_not_found', anchor: config.insertBefore || config.insertAfter };
164    }
165    const updated = patchCspMeta(withTag, port);
166    fs.writeFileSync(absFile, updated, 'utf-8');
167    return {
168      file: relFile,
169      inserted: true,
170      cspPatched: updated !== withTag,
171    };
172  });
173  const anyInserted = results.some((r) => r.inserted);
174  console.log(JSON.stringify({ ok: anyInserted, port, gitIgnore, results }));
175  if (!anyInserted) process.exit(1);
176}
177 
178export function ensureLiveGitIgnores(cwd = process.cwd()) {
179  const target = resolveIgnoreTarget(cwd);
180  const existing = fs.existsSync(target.path) ? fs.readFileSync(target.path, 'utf-8') : '';
181  const block = [
182    IGNORE_MARKER_OPEN,
183    ...LIVE_IGNORE_PATTERNS,
184    IGNORE_MARKER_CLOSE,
185  ].join('\n');
186  const markerRe = new RegExp(`${escapeRegExp(IGNORE_MARKER_OPEN)}[\\s\\S]*?${escapeRegExp(IGNORE_MARKER_CLOSE)}`);
187 
188  let updated;
189  if (markerRe.test(existing)) {
190    updated = existing.replace(markerRe, block);
191  } else {
192    const prefix = existing.length === 0 ? '' : existing.endsWith('\n') ? existing : existing + '\n';
193    updated = `${prefix}${prefix.endsWith('\n\n') || prefix === '' ? '' : '\n'}${block}\n`;
194  }
195 
196  if (updated !== existing) {
197    fs.mkdirSync(path.dirname(target.path), { recursive: true });
198    fs.writeFileSync(target.path, updated, 'utf-8');
199  }
200 
201  return {
202    file: path.relative(cwd, target.path).split(path.sep).join('/'),
203    mode: target.mode,
204    changed: updated !== existing,
205    patterns: [...LIVE_IGNORE_PATTERNS],
206  };
207}
208 
209function resolveIgnoreTarget(cwd) {
210  const gitExcludePath = resolveGitInfoExcludePath(cwd);
211  if (gitExcludePath) {
212    return { path: gitExcludePath, mode: 'git-info-exclude' };
213  }
214  return { path: path.join(cwd, '.gitignore'), mode: 'gitignore' };
215}
216 
217function resolveGitInfoExcludePath(cwd) {
218  const dotGit = path.join(cwd, '.git');
219  if (!fs.existsSync(dotGit)) return null;
220 
221  const stat = fs.statSync(dotGit);
222  if (stat.isDirectory()) return path.join(dotGit, 'info', 'exclude');
223  if (!stat.isFile()) return null;
224 
225  const body = fs.readFileSync(dotGit, 'utf-8').trim();
226  const match = body.match(/^gitdir:\s*(.+)$/i);
227  if (!match) return null;
228  const gitDir = path.isAbsolute(match[1]) ? match[1] : path.resolve(cwd, match[1]);
229  return path.join(gitDir, 'info', 'exclude');
230}
231 
232function escapeRegExp(value) {
233  return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
234}
235 
236/**
237 * Expand config.files (which may contain glob patterns) into a literal list
238 * of existing file paths relative to rootDir. Literal entries pass through;
239 * glob patterns are expanded via fs.globSync. HARD_EXCLUDES and config.exclude
240 * are applied as filters. Duplicates are removed. Order is preserved by
241 * first appearance.
242 */
243export function resolveFiles(rootDir, config) {
244  const patterns = config.files;
245  const userExcludes = Array.isArray(config.exclude) ? config.exclude : [];
246  const allExcludes = [...HARD_EXCLUDES, ...userExcludes];
247  const excludeRegexes = allExcludes.map(globToRegex);
248 
249  const isExcluded = (relPath) => excludeRegexes.some((re) => re.test(relPath));
250  const isGlob = (s) => /[*?[]/.test(s);
251 
252  const seen = new Set();
253  const out = [];
254  for (const pat of patterns) {
255    if (!isGlob(pat)) {
256      // Literal path — include even if it doesn't exist yet; the caller
257      // reports file_not_found per-entry. Exclude list doesn't apply to
258      // explicit literal entries (user named it on purpose).
259      if (!seen.has(pat)) {
260        seen.add(pat);
261        out.push(pat);
262      }
263      continue;
264    }
265    let matches;
266    try {
267      matches = fs.globSync(pat, { cwd: rootDir, withFileTypes: true });
268    } catch {
269      continue;
270    }
271    for (const ent of matches) {
272      if (!ent.isFile || !ent.isFile()) continue;
273      const abs = path.join(ent.parentPath || ent.path || rootDir, ent.name);
274      const rel = path.relative(rootDir, abs).split(path.sep).join('/');
275      if (isExcluded(rel)) continue;
276      if (seen.has(rel)) continue;
277      seen.add(rel);
278      out.push(rel);
279    }
280  }
281  return out;
282}
283 
284/**
285 * Convert a glob pattern to a RegExp. Supports:
286 *   **  → any number of path segments (including zero)
287 *   *   → any chars except `/`
288 *   ?   → any single char except `/`
289 * Paths are normalized to forward slashes before matching.
290 */
291function globToRegex(pattern) {
292  let re = '';
293  let i = 0;
294  while (i < pattern.length) {
295    const c = pattern[i];
296    if (c === '*') {
297      if (pattern[i + 1] === '*') {
298        // ** — any number of segments, including zero. Handle the common
299        // **/ and /** forms so `a/**/b` matches `a/b` as well as `a/x/y/b`.
300        if (pattern[i + 2] === '/') {
301          re += '(?:.*/)?';
302          i += 3;
303        } else {
304          re += '.*';
305          i += 2;
306        }
307      } else {
308        re += '[^/]*';
309        i += 1;
310      }
311    } else if (c === '?') {
312      re += '[^/]';
313      i += 1;
314    } else if (/[.+^${}()|[\]\\]/.test(c)) {
315      re += '\\' + c;
316      i += 1;
317    } else {
318      re += c;
319      i += 1;
320    }
321  }
322  return new RegExp('^' + re + '$');
323}
324 
325// ---------------------------------------------------------------------------
326// Core operations
327// ---------------------------------------------------------------------------
328 
329function validateConfig(cfg) {
330  if (!cfg || typeof cfg !== 'object') throw new Error('config.json must be an object');
331  if (!Array.isArray(cfg.files) || cfg.files.length === 0) {
332    throw new Error('config.files (non-empty string array) required');
333  }
334  if (!cfg.files.every((f) => typeof f === 'string' && f.length > 0)) {
335    throw new Error('config.files must contain only non-empty strings');
336  }
337  if (cfg.exclude !== undefined) {
338    if (!Array.isArray(cfg.exclude)) {
339      throw new Error('config.exclude, if present, must be a string array');
340    }
341    if (!cfg.exclude.every((f) => typeof f === 'string' && f.length > 0)) {
342      throw new Error('config.exclude must contain only non-empty strings');
343    }
344  }
345  if (typeof cfg.insertBefore !== 'string' && typeof cfg.insertAfter !== 'string') {
346    throw new Error('config.insertBefore or config.insertAfter (string) required');
347  }
348  if (cfg.commentSyntax !== 'html' && cfg.commentSyntax !== 'jsx') {
349    throw new Error("config.commentSyntax must be 'html' or 'jsx'");
350  }
351  if (cfg.cspChecked !== undefined && typeof cfg.cspChecked !== 'boolean') {
352    throw new Error("config.cspChecked, if present, must be a boolean");
353  }
354}
355 
356function commentOpen(syntax) { return syntax === 'jsx' ? '{/*' : '<!--'; }
357function commentClose(syntax) { return syntax === 'jsx' ? '*/}' : '-->'; }
358 
359function buildTagBlock(syntax, port, filePath) {
360  const open = commentOpen(syntax);
361  const close = commentClose(syntax);
362  // Astro processes <script> tags by default and rewrites src to its own
363  // bundled URL. is:inline opts out so the literal external src survives.
364  const isAstro = typeof filePath === 'string' && filePath.endsWith('.astro');
365  const scriptAttrs = isAstro ? 'is:inline ' : '';
366  return (
367    open + ' ' + MARKER_OPEN_TEXT + ' ' + close + '\n' +
368    '<script ' + scriptAttrs + 'src="http://localhost:' + port + '/live.js"></script>\n' +
369    open + ' ' + MARKER_CLOSE_TEXT + ' ' + close + '\n'
370  );
371}
372 
373function detectLineEnding(content) {
374  if (content.includes('\r\n')) return '\r\n';
375  if (content.includes('\r')) return '\r';
376  return '\n';
377}
378 
379function normalizeLineEndings(content, lineEnding) {
380  return lineEnding === '\n' ? content : content.replace(/\n/g, lineEnding);
381}
382 
383function readLineEndingAt(content, index) {
384  if (content[index] === '\r' && content[index + 1] === '\n') return '\r\n';
385  if (content[index] === '\n') return '\n';
386  if (content[index] === '\r') return '\r';
387  return '';
388}
389 
390function insertTag(content, config, port, filePath) {
391  const lineEnding = detectLineEnding(content);
392  const block = normalizeLineEndings(buildTagBlock(config.commentSyntax, port, filePath), lineEnding);
393  // insertBefore: match the LAST occurrence. Anchors like `</body>` naturally
394  // belong at the end, and the same literal can appear earlier in code blocks
395  // within rendered documentation pages.
396  if (config.insertBefore) {
397    const idx = content.lastIndexOf(config.insertBefore);
398    if (idx === -1) return content;
399    return content.slice(0, idx) + block + content.slice(idx);
400  }
401  // insertAfter: match the FIRST occurrence — typical anchors like `<head>` or
402  // `<body>` open near the top of the document.
403  const idx = content.indexOf(config.insertAfter);
404  if (idx === -1) return content;
405  const after = idx + config.insertAfter.length;
406  // Preserve an existing trailing newline if the anchor already has one.
407  // Slice the remainder from the original anchor offset, not prefix.length:
408  // in the no-newline case prefix is one char longer than the anchor (the
409  // appended '\n'), so slicing by prefix.length would drop the first real
410  // character after the anchor (#227).
411  const existingNewline = readLineEndingAt(content, after);
412  const prefix = content.slice(0, after) + (existingNewline || lineEnding);
413  const rest = content.slice(after + existingNewline.length);
414  return prefix + block + rest;
415}
416 
417/**
418 * Remove the live script block. Matches either HTML or JSX comment markers
419 * regardless of config (so stale tags from a wrong config can still be cleaned).
420 *
421 * Indent-preserving: captures any whitespace immediately preceding the opener
422 * marker and re-emits it in place of the removed block. `insertTag` inserted
423 * the block *after* the original line's indent and *before* the anchor (e.g.
424 * `</body>`), which moved the indent onto the opener line and left the anchor
425 * unindented. Replacing the whole block (plus its trailing newline) with just
426 * the captured indent hands the indent back to the anchor that follows.
427 */
428function removeTag(content, _syntax) {
429  const patterns = [
430    /([ \t]*)<!--\s*impeccable-live-start\s*-->[\s\S]*?<!--\s*impeccable-live-end\s*-->([ \t]*(?:\r\n|\n|\r|$)?)/,
431    /([ \t]*)\{\/\*\s*impeccable-live-start\s*\*\/\}[\s\S]*?\{\/\*\s*impeccable-live-end\s*\*\/\}([ \t]*(?:\r\n|\n|\r|$)?)/,
432  ];
433  for (const pat of patterns) {
434    let changed = false;
435    let next = content;
436    do {
437      content = next;
438      next = content.replace(pat, (_match, leadingIndent, trailing = '') => {
439        if (/[\r\n]/.test(trailing)) return leadingIndent;
440        return leadingIndent || trailing || '';
441      });
442      if (next !== content) changed = true;
443    } while (next !== content);
444    if (changed) return next;
445  }
446  return content;
447}
448 
449// ---------------------------------------------------------------------------
450// Content-Security-Policy meta-tag patcher
451//
452// When the user's HTML carries `<meta http-equiv="Content-Security-Policy">`,
453// the cross-origin load of /live.js (and the SSE/POST connection back to
454// localhost:PORT) is blocked unless the CSP explicitly allows that origin.
455//
456// On insert: append `http://localhost:PORT` to `script-src` and `connect-src`,
457// and stash the original `content` value in a `data-impeccable-csp-original`
458// attribute (base64) so revert is exact.
459//
460// On remove: detect the marker attribute, decode it, restore the original
461// content value verbatim, drop the marker.
462//
463// Header-based CSP (Next.js headers, Nuxt routeRules, SvelteKit kit.csp,
464// shared helpers) is NOT patched here — those need framework-specific config
465// edits and are handled via the existing detect-csp.mjs reference output.
466// Only the in-source meta-tag form gets the auto-patch.
467// ---------------------------------------------------------------------------
468 
469const CSP_MARKER_ATTR = 'data-impeccable-csp-original';
470 
471function findCspMetaTags(content) {
472  const out = [];
473  const tagRe = /<meta\s+([^>]*?)\/?>/gis;
474  let m;
475  while ((m = tagRe.exec(content)) !== null) {
476    const attrs = m[1];
477    if (!/(http-equiv|httpEquiv)\s*=\s*(['"])Content-Security-Policy\2/i.test(attrs)) continue;
478    out.push({ start: m.index, end: m.index + m[0].length, full: m[0], attrs });
479  }
480  return out;
481}
482 
483function getAttr(attrs, name) {
484  const re = new RegExp(`\\b${name}\\s*=\\s*(['"])([\\s\\S]*?)\\1`, 'i');
485  const m = attrs.match(re);
486  return m ? { quote: m[1], value: m[2], full: m[0] } : null;
487}
488 
489function appendOriginToDirective(csp, directive, origin) {
490  const re = new RegExp(`(^|;)(\\s*)(${directive})\\s+([^;]*)`, 'i');
491  const m = csp.match(re);
492  if (m) {
493    const tokens = m[4].trim().split(/\s+/);
494    if (tokens.includes(origin)) return csp;
495    return csp.replace(re, `${m[1]}${m[2]}${m[3]} ${[...tokens, origin].join(' ')}`);
496  }
497  // Directive missing — add it. Use 'self' + origin so we don't inadvertently
498  // narrow the policy compared to the default-src fallback (most users with
499  // an explicit CSP have 'self' there).
500  return csp.trim().replace(/;?\s*$/, '') + `; ${directive} 'self' ${origin}`;
501}
502 
503export function patchCspMeta(content, port) {
504  const tags = findCspMetaTags(content);
505  if (tags.length === 0) return content;
506  const origin = `http://localhost:${port}`;
507 
508  // Walk last-to-first so prior splices don't invalidate later indices.
509  let result = content;
510  for (let i = tags.length - 1; i >= 0; i--) {
511    const tag = tags[i];
512    const attrs = tag.attrs;
513    if (getAttr(attrs, CSP_MARKER_ATTR)) continue; // already patched
514    const contentAttr = getAttr(attrs, 'content');
515    if (!contentAttr) continue;
516 
517    const original = contentAttr.value;
518    let patched = original;
519    patched = appendOriginToDirective(patched, 'script-src', origin);
520    patched = appendOriginToDirective(patched, 'connect-src', origin);
521    // The shader overlay during 'generating' creates a screenshot via
522    // URL.createObjectURL, producing a `blob:` URL — img-src 'self' rejects
523    // those. Add `blob:` so the overlay doesn't throw a CSP violation.
524    patched = appendOriginToDirective(patched, 'img-src', 'blob:');
525    if (patched === original) continue;
526 
527    const newContentAttr = `content=${contentAttr.quote}${patched}${contentAttr.quote}`;
528    const marker = `${CSP_MARKER_ATTR}="${Buffer.from(original, 'utf-8').toString('base64')}"`;
529    // The tagRe captures any whitespace between the last attribute and the
530    // closing `/>` as part of `attrs`. Naively appending ` ${marker}` after
531    // a replace would land it BEFORE that trailing space, leaving a double
532    // space inside attrs and clobbering the space before `/>`. Split off
533    // the trailing whitespace, splice the marker into the attribute body,
534    // and re-append the original trailing whitespace so a self-closing
535    // `<meta … />` round-trips byte-for-byte.
536    const trailingWs = (attrs.match(/[ \t]*$/) || [''])[0];
537    const attrsBody = attrs.slice(0, attrs.length - trailingWs.length);
538    const newAttrs = attrsBody.replace(contentAttr.full, newContentAttr) + ' ' + marker + trailingWs;
539    const newTag = tag.full.replace(attrs, newAttrs);
540 
541    result = result.slice(0, tag.start) + newTag + result.slice(tag.end);
542  }
543  return result;
544}
545 
546export function revertCspMeta(content) {
547  const tags = findCspMetaTags(content);
548  if (tags.length === 0) return content;
549 
550  let result = content;
551  for (let i = tags.length - 1; i >= 0; i--) {
552    const tag = tags[i];
553    const origAttr = getAttr(tag.attrs, CSP_MARKER_ATTR);
554    if (!origAttr) continue;
555    const contentAttr = getAttr(tag.attrs, 'content');
556    if (!contentAttr) continue;
557 
558    let originalValue;
559    try { originalValue = Buffer.from(origAttr.value, 'base64').toString('utf-8'); }
560    catch { continue; }
561 
562    const newContentAttr = `content=${contentAttr.quote}${originalValue}${contentAttr.quote}`;
563    let newAttrs = tag.attrs.replace(contentAttr.full, newContentAttr);
564    // Drop the marker attribute and any single space immediately preceding it.
565    newAttrs = newAttrs.replace(new RegExp(`\\s*${origAttr.full}`), '');
566    const newTag = tag.full.replace(tag.attrs, newAttrs);
567 
568    result = result.slice(0, tag.start) + newTag + result.slice(tag.end);
569  }
570  return result;
571}
572 
573// ---------------------------------------------------------------------------
574// Auto-execute
575// ---------------------------------------------------------------------------
576 
577const _running = process.argv[1];
578if (_running?.endsWith('live-inject.mjs') || _running?.endsWith('live-inject.mjs/')) {
579  injectCli();
580}
581 
582export { insertTag, removeTag, validateConfig, buildTagBlock };
583// patchCspMeta + revertCspMeta are exported above where they're defined.
584