@krischoichoi/channel-dingtalk 0.6.0

package/lib/definition.d.ts

@@ -0,0 +1,53 @@
+/**
+ * DingTalkChannelDefinition — the universal Control Plane spec for DingTalk.
+ *
+ * Advertises the channel's setup surface (AppKey as a plain text field, the
+ * AppSecret as a credentialed secret field pointing at
+ * `DSH_CHANNEL_DINGTALK_MAIN_CLIENT_SECRET`), reports configured state by
+ * combining config + the credentials seam, persists non-secret config patches
+ * into an internal snapshot, and builds the adapter — resolving SDK-mode
+ * credentials through the injected credentials seam and injecting them as
+ * `deps.clientSecret` (mirrors channel-qq deps.appSecret).
+ *
+ * The view is fully offline-testable: pass a fake credentials seam and fake
+ * transport/sdkClient via deps. No secret value ever leaves the seam.
+ */
+import { type ChannelDefinition } from '@krischoichoi/channel-control';
+import type { DingTalkConfig } from './config.js';
+import { type DingTalkAdapterDeps } from './adapter.js';
+/** Structural credential seam (matches the channel-control CredentialSeam). */
+export interface DingTalkCredentialSeam {
+    resolve(ref: string): Promise<{
+        value: string;
+        source: string;
+    } | undefined>;
+    describe(ref: string): Promise<{
+        configured: boolean;
+        writable: boolean;
+        source?: string;
+    }>;
+    set(ref: string, value: string): Promise<void>;
+}
+export interface DingTalkDefinitionOptions {
+    config: DingTalkConfig;
+    deps: DingTalkAdapterDeps;
+    /** The injected ctx.credentials seam (never the secret values themselves). */
+    credentials: DingTalkCredentialSeam;
+    /** Durable store for the non-secret setup field when the host provides one. */
+    persistSetup?: (patch: {
+        upstream: Pick<DingTalkConfig['upstream'], 'clientId'>;
+    }) => Promise<void>;
+    /** Durable store for the enabled intent (doc §21) when the host provides one. */
+    persistEnabled?: (enabled: boolean) => Promise<void>;
+    /** Reconcile the runtime after device registration writes new credentials. */
+    onAuthCompleted?: () => Promise<void>;
+}
+/**
+ * Official DingTalk developer console (open-dev) — one-step entry to the app
+ * list, not the marketing homepage. When the app's clientId is known the link
+ * deep-links to that app (`#/app?clientId=`), mirroring openclaw-toolkit.
+ */
+export declare const DINGTALK_OPEN_PLATFORM_URL = "https://open-dev.dingtalk.com";
+export declare function dingtalkConsoleUrl(clientId: string | undefined): string;
+export declare function createDingTalkDefinition(options: DingTalkDefinitionOptions): ChannelDefinition;
+//# sourceMappingURL=definition.d.ts.map

package/lib/definition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition.d.ts","sourceRoot":"","sources":["../src/definition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,KAAK,iBAAiB,EAIvB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,cAAc,EAA0B,MAAM,aAAa,CAAC;AAE1E,OAAO,EAAmB,KAAK,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAOzE,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,OAAO,CACL,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;IAC1D,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5F,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,cAAc,CAAC;IACvB,IAAI,EAAE,mBAAmB,CAAC;IAC1B,8EAA8E;IAC9E,WAAW,EAAE,sBAAsB,CAAC;IACpC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpG,iFAAiF;IACjF,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAeD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,kCAAkC,CAAC;AAE1E,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAKvE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG,iBAAiB,CAiI9F"}

package/lib/definition.js

@@ -0,0 +1,227 @@
+/**
+ * DingTalkChannelDefinition — the universal Control Plane spec for DingTalk.
+ *
+ * Advertises the channel's setup surface (AppKey as a plain text field, the
+ * AppSecret as a credentialed secret field pointing at
+ * `DSH_CHANNEL_DINGTALK_MAIN_CLIENT_SECRET`), reports configured state by
+ * combining config + the credentials seam, persists non-secret config patches
+ * into an internal snapshot, and builds the adapter — resolving SDK-mode
+ * credentials through the injected credentials seam and injecting them as
+ * `deps.clientSecret` (mirrors channel-qq deps.appSecret).
+ *
+ * The view is fully offline-testable: pass a fake credentials seam and fake
+ * transport/sdkClient via deps. No secret value ever leaves the seam.
+ */
+import {} from '@krischoichoi/channel-control';
+import { ControlError } from '@krischoichoi/channel-control';
+import { DINGTALK_CLIENT_SECRET_REF } from './config.js';
+import { DingTalkAdapter } from './adapter.js';
+import { resolveVolatileConfig } from '@krischoichoi/channel-core';
+import { beginDingTalkDeviceAuth, pollDingTalkDeviceAuth, } from './auth/device-registration.js';
+/** Non-secret config keys accepted by saveConfig (deep-merged sub-objects). */
+const SAVABLE_KEYS = [
+    'baseUrl',
+    'timeoutMs',
+    'longPollTimeoutMs',
+    'reconnect',
+    'dedup',
+    'card',
+    'accountId',
+    'upstream.mode',
+    'upstream.clientId',
+];
+/**
+ * Official DingTalk developer console (open-dev) — one-step entry to the app
+ * list, not the marketing homepage. When the app's clientId is known the link
+ * deep-links to that app (`#/app?clientId=`), mirroring openclaw-toolkit.
+ */
+export const DINGTALK_OPEN_PLATFORM_URL = 'https://open-dev.dingtalk.com';
+export function dingtalkConsoleUrl(clientId) {
+    const id = clientId?.trim();
+    return id
+        ? `${DINGTALK_OPEN_PLATFORM_URL}/#/app?clientId=${encodeURIComponent(id)}`
+        : `${DINGTALK_OPEN_PLATFORM_URL}/#/app`;
+}
+export function createDingTalkDefinition(options) {
+    const { config, deps, credentials } = options;
+    // Internal mutable snapshot that saveConfig patches and createAdapter reads,
+    // so the control plane can persist changes without rewriting plugin config.
+    const state = cloneConfig(config);
+    const clientSecretRef = () => state.upstream.clientSecretRef ?? DINGTALK_CLIENT_SECRET_REF;
+    const setup = {
+        fields: [
+            { name: 'clientId', kind: 'text', secret: false, configured: Boolean(state.upstream.clientId), writable: true },
+            { name: 'clientSecret', kind: 'secret', secret: true, configured: false, writable: true, ref: clientSecretRef() },
+        ],
+        authMethods: ['device', 'credentials'],
+        setupUrl: dingtalkConsoleUrl(state.upstream.clientId),
+    };
+    const refreshSetup = () => {
+        setup.fields = [
+            { name: 'clientId', kind: 'text', secret: false, configured: Boolean(state.upstream.clientId), writable: true },
+            { name: 'clientSecret', kind: 'secret', secret: true, configured: false, writable: true, ref: clientSecretRef() },
+        ];
+        setup.setupUrl = dingtalkConsoleUrl(state.upstream.clientId);
+    };
+    const saveConfig = async (patch) => {
+        applyPatch(state, patch);
+        refreshSetup();
+        if (patch.clientId !== undefined || isPlainObject(patch.upstream) && patch.upstream.clientId !== undefined) {
+            await options.persistSetup?.({ upstream: { clientId: state.upstream.clientId } });
+        }
+    };
+    return {
+        id: 'dingtalk',
+        get enabled() {
+            return state.enabled;
+        },
+        async setEnabled(enabled) {
+            state.enabled = enabled;
+            await options.persistEnabled?.(enabled);
+        },
+        setup,
+        async getConfiguredState() {
+            if (state.upstream.mode === 'gateway') {
+                const baseUrlConfigured = Boolean(state.baseUrl);
+                const fields = {
+                    clientId: { configured: false, writable: true },
+                    clientSecret: { configured: false, writable: true },
+                    baseUrl: { configured: baseUrlConfigured, writable: true },
+                };
+                return { configured: baseUrlConfigured, fields };
+            }
+            // SDK mode: configured when clientId is set and the secret credential is configured.
+            const clientIdConfigured = Boolean(state.upstream.clientId);
+            const secretDescribed = await credentials.describe(clientSecretRef());
+            const fields = {
+                clientId: { configured: clientIdConfigured, writable: true, value: state.upstream.clientId },
+                clientSecret: {
+                    configured: secretDescribed.configured,
+                    writable: secretDescribed.writable,
+                    source: secretDescribed.source,
+                },
+            };
+            return { configured: clientIdConfigured && secretDescribed.configured, fields };
+        },
+        saveConfig,
+        async beginAuth(input) {
+            if (input.method !== 'device') {
+                throw new ControlError('AUTH_NOT_SUPPORTED', 'dingtalk supports device authorization or credentials setup');
+            }
+            return beginDingTalkDeviceAuth({
+                baseUrl: process.env.DINGTALK_REGISTRATION_BASE_URL,
+                source: process.env.DINGTALK_REGISTRATION_SOURCE,
+            });
+        },
+        async pollAuth(session) {
+            const result = await pollDingTalkDeviceAuth(session);
+            if (result.credentials) {
+                await credentials.set(clientSecretRef(), result.credentials.clientSecret);
+                await saveConfig({ clientId: result.credentials.clientId });
+                await options.onAuthCompleted?.();
+            }
+            return result.status;
+        },
+        snapshotConfig: () => cloneConfig(state),
+        async restoreConfig(saved) {
+            const restored = cloneConfig(saved);
+            Object.assign(state, restored);
+            state.reconnect = restored.reconnect;
+            state.dedup = restored.dedup;
+            state.card = restored.card;
+            state.upstream = restored.upstream;
+            refreshSetup();
+            await options.persistSetup?.({ upstream: { clientId: state.upstream.clientId } });
+        },
+        async createAdapter() {
+            let resolvedSecret;
+            if (state.upstream.mode === 'sdk') {
+                const ref = clientSecretRef();
+                const credential = await credentials.resolve(ref);
+                resolvedSecret = credential?.value;
+                if (!resolvedSecret) {
+                    throw new Error(`dingtalk credential "${ref}" is not configured`);
+                }
+            }
+            const adapterDeps = resolvedSecret ? { ...deps, clientSecret: resolvedSecret } : deps;
+            return new DingTalkAdapter(state, adapterDeps);
+        },
+        autoStart: true,
+        // The official robot callback supplies `isInAtList`; the stream upstream
+        // validates and forwards it as `message.activation.mentionedBot`.
+        access: {
+            directMessages: true,
+            groups: true,
+            mentions: true,
+            ownerDiscovery: 'claim',
+            identityLabels: { user: 'DingTalk Sender ID', group: 'DingTalk Conversation ID' },
+            defaults: { requireMention: true },
+        },
+    };
+}
+function cloneConfig(config) {
+    // Harness 0.2.0: volatile fields arrive as `Volatile<T>` handles; unwrap
+    // them once so the snapshot (and everything reading it) sees plain values.
+    const plain = resolveVolatileConfig(config);
+    return {
+        ...plain,
+        reconnect: { ...plain.reconnect },
+        dedup: { ...plain.dedup },
+        card: { ...plain.card },
+        upstream: { ...plain.upstream },
+    };
+}
+/**
+ * Deep-merge a non-secret config patch into a mutable snapshot. Accepts both
+ * the flat dotted form (`upstream.mode`) and the nested object form
+ * (`upstream: { mode }`); sub-objects (reconnect/dedup/card/upstream) are
+ * merged shallowly so a partial patch updates only the supplied keys. Secret
+ * values are intentionally never accepted here.
+ */
+function applyPatch(state, patch) {
+    for (const key of Object.keys(patch)) {
+        const value = patch[key];
+        if (value === undefined)
+            continue;
+        if (key === 'reconnect' && isPlainObject(value)) {
+            Object.assign(state.reconnect, value);
+        }
+        else if (key === 'dedup' && isPlainObject(value)) {
+            Object.assign(state.dedup, value);
+        }
+        else if (key === 'card' && isPlainObject(value)) {
+            Object.assign(state.card, value);
+        }
+        else if (key === 'upstream' && isPlainObject(value)) {
+            mergeUpstream(state.upstream, value);
+        }
+        else if (key === 'upstream.mode' && (value === 'sdk' || value === 'gateway')) {
+            state.upstream.mode = value;
+        }
+        else if (key === 'upstream.clientId' && typeof value === 'string') {
+            state.upstream.clientId = value;
+        }
+        else if (key === 'clientId' && typeof value === 'string') {
+            // Web setup fields use a flat, user-facing name; the runtime config
+            // keeps the value under upstream.
+            state.upstream.clientId = value;
+        }
+        else if (SAVABLE_KEYS.includes(key)) {
+            state[key] = value;
+        }
+        // Unknown / secret keys are silently ignored (the control plane rejects
+        // secret field names before reaching us; this is a final safety net).
+    }
+}
+function mergeUpstream(upstream, patch) {
+    if (patch.mode !== undefined)
+        upstream.mode = patch.mode;
+    if (patch.clientId !== undefined)
+        upstream.clientId = patch.clientId;
+    if (patch.clientSecretRef !== undefined)
+        upstream.clientSecretRef = patch.clientSecretRef;
+}
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=definition.js.map

package/lib/definition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition.js","sourceRoot":"","sources":["../src/definition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAKN,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,eAAe,EAA4B,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AAwBvC,+EAA+E;AAC/E,MAAM,YAAY,GAAG;IACnB,SAAS;IACT,WAAW;IACX,mBAAmB;IACnB,WAAW;IACX,OAAO;IACP,MAAM;IACN,WAAW;IACX,eAAe;IACf,mBAAmB;CACX,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,+BAA+B,CAAC;AAE1E,MAAM,UAAU,kBAAkB,CAAC,QAA4B;IAC7D,MAAM,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,OAAO,EAAE;QACP,CAAC,CAAC,GAAG,0BAA0B,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,EAAE;QAC1E,CAAC,CAAC,GAAG,0BAA0B,QAAQ,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAkC;IACzE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAC9C,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAElC,MAAM,eAAe,GAAG,GAAW,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,IAAI,0BAA0B,CAAC;IAEnG,MAAM,KAAK,GAA2B;QACpC,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC/G,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE;SAClH;QACD,WAAW,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC;QACtC,QAAQ,EAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACtD,CAAC;IAEF,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,KAAK,CAAC,MAAM,GAAG;YACb,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC/G,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE;SAClH,CAAC;QACF,KAAK,CAAC,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/D,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,EAAE,KAA8B,EAAiB,EAAE;QACzE,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzB,YAAY,EAAE,CAAC;QACf,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3G,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,UAAU;QACd,IAAI,OAAO;YACT,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,OAAgB;YAC/B,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;YACxB,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QAED,KAAK;QAEL,KAAK,CAAC,kBAAkB;YACtB,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACjD,MAAM,MAAM,GAA8B;oBACxC,QAAQ,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAC/C,YAAY,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;oBACnD,OAAO,EAAE,EAAE,UAAU,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC3D,CAAC;gBACF,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;YACnD,CAAC;YACD,qFAAqF;YACrF,MAAM,kBAAkB,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC5D,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC;YACtE,MAAM,MAAM,GAA8B;gBACxC,QAAQ,EAAE,EAAE,UAAU,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE;gBAC5F,YAAY,EAAE;oBACZ,UAAU,EAAE,eAAe,CAAC,UAAU;oBACtC,QAAQ,EAAE,eAAe,CAAC,QAAQ;oBAClC,MAAM,EAAE,eAAe,CAAC,MAAM;iBAC/B;aACF,CAAC;YACF,OAAO,EAAE,UAAU,EAAE,kBAAkB,IAAI,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAClF,CAAC;QAED,UAAU;QAEV,KAAK,CAAC,SAAS,CAAC,KAAqB;YACnC,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,6DAA6D,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,uBAAuB,CAAC;gBAC7B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B;gBACnD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B;aACjD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,OAAO;YACpB,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvB,MAAM,WAAW,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;gBAC1E,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC5D,MAAM,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;YACpC,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;QAED,cAAc,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC;QACxC,KAAK,CAAC,aAAa,CAAC,KAAc;YAChC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAuB,CAAC,CAAC;YACtD,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC/B,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;YACrC,KAAK,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;YAC7B,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC3B,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;YACnC,YAAY,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,KAAK,CAAC,aAAa;YACjB,IAAI,cAAkC,CAAC;YACvC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAClD,cAAc,GAAG,UAAU,EAAE,KAAK,CAAC;gBACnC,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,qBAAqB,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;YACD,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtF,OAAO,IAAI,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACjD,CAAC;QAED,SAAS,EAAE,IAAI;QACf,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,EAAE;YACN,cAAc,EAAE,IAAI;YACpB,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,IAAI;YACd,cAAc,EAAE,OAAO;YACvB,cAAc,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,0BAA0B,EAAE;YACjF,QAAQ,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;SACnC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAsB;IACzC,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO;QACL,GAAG,KAAK;QACR,SAAS,EAAE,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE;QACjC,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE;QACzB,IAAI,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE;QACvB,QAAQ,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,KAAqB,EAAE,KAA8B;IACvE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,GAAG,KAAK,WAAW,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,GAAG,KAAK,OAAO,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpC,CAAC;aAAM,IAAI,GAAG,KAAK,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,GAAG,KAAK,UAAU,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACtD,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAwC,CAAC,CAAC;QAC1E,CAAC;aAAM,IAAI,GAAG,KAAK,eAAe,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;YAC/E,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC;QAC9B,CAAC;aAAM,IAAI,GAAG,KAAK,mBAAmB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpE,KAAK,CAAC,QAAQ,CAAC,QAAQ,GAAG,KAAK,CAAC;QAClC,CAAC;aAAM,IAAI,GAAG,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3D,oEAAoE;YACpE,kCAAkC;YAClC,KAAK,CAAC,QAAQ,CAAC,QAAQ,GAAG,KAAK,CAAC;QAClC,CAAC;aAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAoC,CAAC,EAAE,CAAC;YACtE,KAA4C,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC7D,CAAC;QACD,wEAAwE;QACxE,sEAAsE;IACxE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,QAAgC,EAAE,KAAsC;IAC7F,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACzD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,QAAQ,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACrE,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,QAAQ,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;AAC5F,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/lib/image-hydrator.d.ts

@@ -0,0 +1,213 @@
+/**
+ * DingTalk inbound image/file/media hydration.
+ *
+ * After the pure mapper (`mapInbound`) produces the stable `MessageReceived`
+ * shape, this module walks the binary parts and turns a genuine `http(s)`
+ * locator into trusted bytes on the part itself:
+ *
+ * ```text
+ * ImagePart.url (real http(s) URL)
+ *   -> SecureRemoteMediaFetcher.fetchBounded()
+ *   -> ImagePart.localData + mimeType
+ *   -> existing Harness saveImage()/ImageBlock path (host owns that)
+ * ```
+ *
+ * Audio/video parts (`hydrateMedia`) follow the identical
+ * URL-or-opaque rule: a genuine http(s) URL is fetched through the secure
+ * fetcher; an opaque handle (downloadCode / mediaId) is moved to
+ * `resourceRef` and resolved through the official DingTalk OpenAPI port —
+ * `POST /v1.0/robot/messageFiles/download { downloadCode, robotCode }` returns
+ * a `downloadUrl`, which is then fetched as bounded bytes (the same seam the
+ * official connector oracle `@dingtalk-real-ai/dingtalk-connector@0.8.24`
+ * uses for voice/video).
+ *
+ * This module performs NO platform-protocol implementation. It only calls the
+ * shared secure host boundary (`@krischoichoi/channel-core` `SecureRemoteMediaFetcher`)
+ * — it never re-implements DingTalk download logic.
+ *
+ * Failure handling: a download failure never blocks text
+ * delivery. On failure we KEEP the original locator, stamp a stable
+ * de-identified `ingressFailure` code on the part (mapped through the core
+ * `toIngressFailureCode` seam) and let the message continue to emit unaltered.
+ *
+ * mediaId/opaque handle handling: DingTalk modern robot picture
+ * messages deliver a real `picture.url` (see `stream-upstream.ts` →
+ * `picUrl`), so the common ingress is the URL path above. If a part carries
+ * an opaque locator instead (a `mediaId` that is not a genuine http(s) URL),
+ * we move it to `resourceRef` and do NOT attempt a generic fetch — resolving
+ * an opaque handle is exclusively the platform upstream job and is left to
+ * the `DingTalkOpenApiPort.resolveMedia(...)` milestone (§32A). We never
+ * invent an HTTP downloader for a mediaId.
+ */
+import type { MessagePart } from '@krischoichoi/channel-core';
+import { SecureRemoteMediaFetcher, type BinaryIngressFailureCode, type FetchBoundedResult } from '@krischoichoi/channel-core';
+import type { MediaResolverLike } from './openapi-port.js';
+/** Default hard byte cap for a downloaded image (20 MiB). */
+export declare const IMAGE_MAX_BYTES: number;
+/** Default read-idle timeout (no body chunk for N ms -> fail). */
+export declare const IMAGE_IDLE_TIMEOUT_MS = 15000;
+/**
+ * One image part locator classified by the hydrator. A genuine http(s) URL is
+ * fetched; an opaque locator (e.g. a bare mediaId) is deferred to the OpenAPI
+ * resolution path and never fetched.
+ */
+export interface ResolvedImageLocator {
+    kind: 'http-url' | 'opaque';
+    /** Part array index (for diagnostics). */
+    index: number;
+    /** The locator string that will be fetched / deferred. */
+    locator: string;
+}
+/**
+ * Identify the http(s)-fetchable image parts in a message content. Opaque
+ * (non-http) locators are surfaced separately so the ingestion policy can
+ * route them to `resourceRef`.
+ */
+export declare function findFetchableImages(parts: readonly MessagePart[]): ResolvedImageLocator[];
+/**
+ * Structural sub-surface of `SecureRemoteMediaFetcher` the hydrator depends
+ * on — lets tests inject a plain fake fetcher without a real global `fetch`.
+ */
+export interface RemoteMediaFetchLike {
+    fetchBounded(url: string, options: {
+        maxBytes: number;
+        idleTimeoutMs?: number;
+        timeoutMs?: number;
+        allowHttp?: boolean;
+        signal?: AbortSignal;
+    }): Promise<FetchBoundedResult>;
+}
+/** Options for one hydration pass over a message content parts. */
+export interface HydrateImagesOptions {
+    /**
+     * The secure remote media fetcher. Injectable for offline tests; defaults to
+     * a real `SecureRemoteMediaFetcher` bound to the global `fetch`.
+     */
+    secureFetch?: SecureRemoteMediaFetcher | RemoteMediaFetchLike;
+    /** Abort signal threaded from the adapter context for prompt teardown. */
+    signal?: AbortSignal;
+    /** Hard byte cap per image (default 20 MiB). */
+    maxBytes?: number;
+    /** Read-idle timeout ms (default 15s). */
+    idleTimeoutMs?: number;
+    /**
+     * DingTalk OpenAPI media resolver used to turn an opaque image handle
+     * (picMediaId / downloadCode) into trusted bytes. Injectable for
+     * offline tests; when absent, opaque handles stay on `resourceRef` and are
+     * left unresolved (the message still delivers, as a text placeholder).
+     */
+    resolveMedia?: MediaResolverLike;
+    /**
+     * Per-message download context from the inbound callback (official schema):
+     * the `downloadCode` (and `robotCode`) the official
+     * `/v1.0/robot/messageFiles/download` API needs. Transient upstream state —
+     * never persisted into core parts.
+     */
+    downloadContext?: {
+        downloadCode?: string;
+        robotCode?: string;
+    };
+    /** Diagnostic callback; receives the original error without changing delivery. */
+    onFailure?: (error: unknown, part: MessagePart) => void;
+}
+/**
+ * Hydrate image parts in place: mutate `parts` so every image with a genuine
+ * http(s) URL carries `localData` + `mimeType` (preferring the fetcher MIME
+ * type) on success, and `ingressFailure` on failure. Opaque locators are
+ * moved to `resourceRef` and left unresolved (OpenAPI milestone).
+ *
+ * This never throws and never blocks text delivery — any image failure only
+ * annotates the part.
+ */
+export declare function hydrateImages(parts: MessagePart[], options?: HydrateImagesOptions): Promise<void>;
+/** Default hard byte cap for a downloaded generic file (50 MiB). */
+export declare const FILE_MAX_BYTES: number;
+/**
+ * Options for one generic-file hydration pass.
+ * @extends HydrateImagesOptions
+ */
+export interface HydrateFilesOptions {
+    /**
+     * The secure remote media fetcher used for genuine http(s) file URLs.
+     * Injectable for offline tests; defaults to a real `SecureRemoteMediaFetcher`.
+     */
+    secureFetch?: SecureRemoteMediaFetcher | RemoteMediaFetchLike;
+    /**
+     * The OpenAPI media resolver used to turn an opaque file mediaId into trusted
+     * bytes. Injectable for offline tests. When absent, opaque file
+     * handles are deferred to `resourceRef` and left unresolved.
+     */
+    resolveMedia?: MediaResolverLike;
+    /** Abort signal threaded from the adapter context for prompt teardown. */
+    signal?: AbortSignal;
+    /** Hard byte cap per file (default 50 MiB). */
+    maxBytes?: number;
+    /** Read-idle timeout ms (default 15s). */
+    idleTimeoutMs?: number;
+    /**
+     * Per-message download context (official schema): `downloadCode` +
+     * `robotCode` for the official /v1.0/robot/messageFiles/download API.
+     * Transient upstream state — never persisted onto core parts.
+     */
+    downloadContext?: {
+        downloadCode?: string;
+        robotCode?: string;
+    };
+}
+/**
+ * Hydrate generic file parts in place:
+ *   - http(s) url  -> SecureRemoteMediaFetcher -> `localData` + `mimeType` + `size`
+ *   - opaque mediaId -> move to `resourceRef` -> `resolveMedia` -> `localData`
+ * On failure the original locator is kept and a stable `ingressFailure` is
+ * stamped — this never throws and never blocks text delivery.
+ */
+export declare function hydrateFiles(parts: MessagePart[], options?: HydrateFilesOptions): Promise<void>;
+/** Default hard byte cap for a downloaded audio/video resource (100 MiB). */
+export declare const MEDIA_MAX_BYTES: number;
+/**
+ * Options for one audio/video hydration pass.
+ * @extends HydrateFilesOptions
+ */
+export interface HydrateMediaOptions {
+    /**
+     * The secure remote media fetcher used for genuine http(s) audio/video URLs.
+     * Injectable for offline tests; defaults to a real `SecureRemoteMediaFetcher`.
+     */
+    secureFetch?: SecureRemoteMediaFetcher | RemoteMediaFetchLike;
+    /**
+     * The OpenAPI media resolver used to turn an opaque audio/video handle
+     * (downloadCode / mediaId) into trusted bytes. Injectable for
+     * offline tests. When absent, opaque handles stay on `resourceRef`.
+     */
+    resolveMedia?: MediaResolverLike;
+    /** Abort signal threaded from the adapter context for prompt teardown. */
+    signal?: AbortSignal;
+    /** Hard byte cap per audio/video resource (default 100 MiB). */
+    maxBytes?: number;
+    /** Read-idle timeout ms (default 15s). */
+    idleTimeoutMs?: number;
+    /**
+     * Per-message download context (official schema): `downloadCode` +
+     * `robotCode` for the official /v1.0/robot/messageFiles/download API.
+     * Transient upstream state — never persisted onto core parts.
+     */
+    downloadContext?: {
+        downloadCode?: string;
+        robotCode?: string;
+    };
+}
+/**
+ * Hydrate audio/video parts in place. Audio/video follow the
+ * exact same URL-or-opaque resolution as image/file:
+ *   - http(s) url  -> SecureRemoteMediaFetcher -> `localData` + `mimeType` + `size`
+ *   - opaque handle -> move to `resourceRef` -> `resolveMedia` (official
+ *     `messageFiles/download` seam) -> `localData`
+ * The apply step delegates to core `applyHydrationResult`, so success clears
+ * `ingressFailure`, failures write ONLY a stable `ingressFailure` (never
+ * fabricating bytes), and this never throws / never blocks text delivery.
+ */
+export declare function hydrateMedia(parts: MessagePart[], options?: HydrateMediaOptions): Promise<void>;
+/** Convenience factory returning a real secure fetcher bound to global fetch. */
+export declare function defaultSecureFetcher(): SecureRemoteMediaFetcher;
+export type { BinaryIngressFailureCode };
+//# sourceMappingURL=image-hydrator.d.ts.map

package/lib/image-hydrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-hydrator.d.ts","sourceRoot":"","sources":["../src/image-hydrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,EAAuB,WAAW,EAAa,MAAM,4BAA4B,CAAC;AAC9F,OAAO,EAEL,wBAAwB,EAExB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,iBAAiB,EAAiB,MAAM,mBAAmB,CAAC;AAE1E,6DAA6D;AAC7D,eAAO,MAAM,eAAe,QAAmB,CAAC;AAChD,kEAAkE;AAClE,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAQ5C;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC5B,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,oBAAoB,EAAE,CASzF;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;QACjC,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACjC;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,WAAW,CAAC,EAAE,wBAAwB,GAAG,oBAAoB,CAAC;IAC9D,0EAA0E;IAC1E,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;OAKG;IACH,eAAe,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,kFAAkF;IAClF,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC;CACzD;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyD3G;AAED,oEAAoE;AACpE,eAAO,MAAM,cAAc,QAAmB,CAAC;AAE/C;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,WAAW,CAAC,EAAE,wBAAwB,GAAG,oBAAoB,CAAC;IAC9D;;;;OAIG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,0EAA0E;IAC1E,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,eAAe,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkDzG;AAOD,6EAA6E;AAC7E,eAAO,MAAM,eAAe,QAAoB,CAAC;AAEjD;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,WAAW,CAAC,EAAE,wBAAwB,GAAG,oBAAoB,CAAC;IAC9D;;;;OAIG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,0EAA0E;IAC1E,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,eAAe,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE;AAED;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgDzG;AAkBD,iFAAiF;AACjF,wBAAgB,oBAAoB,IAAI,wBAAwB,CAE/D;AAGD,YAAY,EAAE,wBAAwB,EAAE,CAAC"}