@krischoichoi/channel-weixin 0.6.0

package/README.md

@@ -0,0 +1,101 @@
+# @krischoichoi/channel-weixin
+
+Weixin / 微信 channel adapter for DeepSeek Harness.
+
+Direct Tencent Weixin iLink integration (QR login, long-poll receive, text/image
+send). This adapter is an upstream-gap source-port: it speaks the iLink
+protocol directly rather than consuming an official host-neutral npm package.
+
+> **Status:** `experimental` — real-Weixin live verification is still pending.
+> The adapter is fully implemented and offline-tested, but it must not claim
+> `tested` until the live platform gate passes.
+
+## Install
+
+```bash
+pnpm add @krischoichoi/channel-weixin
+```
+
+Or install the whole bundle:
+
+```bash
+npx @deepseek-ai/dsh plugin --profile web add -w @krischoichoi/dsh-channels@latest
+```
+
+## Configuration
+
+Weixin has no credential or setup-form fields; the only configurable values are
+network/reconnect tuning (all with defaults). Login happens on the mounted
+adapter, not through YAML.
+
+```yaml
+- id: channels-weixin
+  name: '@krischoichoi/dsh-channels/weixin'
+  inject: [channels, channelControl]
+  config:
+    enabled: true
+    accountId: main
+    ilink:
+      baseUrl: https://ilinkai.weixin.qq.com        # default iLink API base
+      cdnBaseUrl: https://novac2c.cdn.weixin.qq.com/c2c  # default CDN base
+    network:
+      timeoutMs: 15000
+      longPollTimeoutMs: 35000
+    reconnect:
+      enabled: true
+      baseDelayMs: 2000
+      maxDelayMs: 30000
+```
+
+The row above is the one shipped by the bundle patch
+(`packages/channels/cordis.patch.yml`). Two details are easy to get wrong:
+
+- `name` addresses the **bundle** subpath (`@krischoichoi/dsh-channels/weixin`), because
+  the bundle re-exports every plugin from one direct profile dependency. The
+  adapter package `@krischoichoi/channel-weixin` has no `./weixin` subpath of its own.
+- The plugin module itself declares `inject = ['channels']`; the row adds
+  `channelControl`. The loader merges the row's `inject` into the plugin's own,
+  so the two are additive rather than required to be identical.
+
+Login is QR-based: the control plane exposes the QR in Harness Web
+「设置 → 渠道」, or the adapter can be driven headlessly through
+`beginAuth` / `pollAuth` / `submitAuthInput`.
+
+## Capabilities
+
+| Capability | Value |
+| --- | --- |
+| text | ✅ |
+| image | ✅ (Harness-native `saveImage` / `ImageBlock`) |
+| file | ✅ (inbound download + AES decrypt; outbound `uploadMedia` + `sendMedia`) |
+| video | ✅ (inbound download; outbound `sendVideo`) |
+| audio | ❌ (inbound `localData` only; no Tencent 2.4.6 outbound voice path) |
+| markdown / cards / reactions / threads | ❌ |
+| streaming | `buffered` |
+
+## Upstream
+
+| Field | Value |
+| --- | --- |
+| Reference | `Tencent/openclaw-weixin` |
+| Strategy | `source-port` (iLink protocol) |
+| Protocol | `weixin-ilink` |
+| Official package | `@tencent-weixin/openclaw-weixin` |
+
+## Development
+
+```bash
+pnpm --filter @krischoichoi/channel-weixin build
+pnpm --filter @krischoichoi/channel-weixin typecheck
+pnpm --filter @krischoichoi/channel-weixin test
+pnpm --filter @krischoichoi/channel-weixin test:live   # live verification (requires real Weixin)
+```
+
+## Related
+
+- [Repository root](../../README.md)
+- [Weixin live verification runbook](../../docs/weixin-live-verification-runbook.md)
+
+## License
+
+[MIT](../../LICENSE)

package/lib/adapter.d.ts

@@ -0,0 +1,90 @@
+/**
+ * WeixinChannelAdapter — maps the Weixin upstream facade to the stable Channel
+ * Contract.
+ *
+ * This adapter holds ONLY the Channel-contract lifecycle + credential wiring:
+ *   - start(): wired the upstream host env (secrets/storage/ctx) -> load
+ *     credential -> unauthenticated if missing; else start the monitor.
+ *   - send(): map an OutboundMessage to upstream.sendText / sendImage.
+ *   - beginAuth/pollAuth/submitVerifyCode: QR login via the upstream facade.
+ *   - stop(): stop the monitor.
+ *
+ * Endpoint knowledge (iLink endpoints, AES, getuploadurl, CDN query assembly)
+ * lives inside the upstream facade layer — this adapter NEVER touches AES or
+ * getuploadurl details (plan DoD #1 / §78). The upstream is the
+ * `WeixinUpstream` port from `./upstream`.
+ */
+import type { AuthChallenge, AuthInput, AuthStatePoll, ChannelAdapter, ChannelAdapterContext, ChannelCapabilities, ChannelHealth, ChannelTarget, OutboundMessage, SendResult } from '@krischoichoi/channel-core';
+import type { WeixinConfig } from './config.js';
+import type { HttpTransport } from './transport.js';
+import type { WeixinUpstream } from './upstream/port.js';
+import { type WeixinManifest } from './manifest.js';
+export interface WeixinAdapterDeps {
+    /** Injectable transport (tests); defaults to FetchTransport. */
+    transport?: HttpTransport;
+    /** Injectable clock (tests). */
+    now?: () => number;
+    /** Injectable random source for X-WECHAT-UIN (tests). */
+    rand?: () => number;
+    /**
+     * Injectable upstream (tests). Defaults to the real
+     * [createWeixinUpstream]. When supplied, the adapter drives this fake as its
+     * protocol boundary.
+     */
+    upstream?: AdapterUpstreamLike;
+}
+/**
+ * The upstream surface the adapter actually consumes. Narrower than the full
+ * port to keep the fake easy to construct in tests.
+ */
+export type AdapterUpstreamLike = (Pick<WeixinUpstream, 'id' | 'beginQrAuth' | 'pollQrAuth' | 'submitVerifyCode' | 'sendText' | 'sendImage' | 'sendFile' | 'sendVideo' | 'downloadImage' | 'downloadFile' | 'downloadAudio' | 'downloadVideo' | 'hasCredential'> & {
+    bind(env: import('./upstream/port.js').WeixinUpstreamHostEnv): void;
+    loadCredential(): Promise<boolean>;
+    startMonitor(): Promise<void>;
+    stopMonitor(): Promise<void>;
+    startTyping(peer: string): Promise<void>;
+    stopTyping(peer: string): Promise<void>;
+    getHealthInfo(): Promise<{
+        authenticated: boolean;
+        connection: string;
+    }>;
+    get_iLinkClient(): unknown;
+});
+export declare class WeixinAdapter implements ChannelAdapter {
+    readonly id = "weixin";
+    /** Upstream compatibility manifest (read structurally by `channels doctor`). */
+    readonly manifest: WeixinManifest;
+    readonly capabilities: ChannelCapabilities;
+    private readonly config;
+    private readonly upstream;
+    private ctx?;
+    private started;
+    private connected;
+    private readonly startedAt;
+    constructor(config: WeixinConfig, deps?: WeixinAdapterDeps);
+    private requireStarted;
+    start(ctx: ChannelAdapterContext): Promise<void>;
+    /** Start the getUpdates monitor with the currently-wired credential. */
+    private startMonitor;
+    stop(): Promise<void>;
+    send(target: ChannelTarget, message: OutboundMessage): Promise<SendResult>;
+    /** Begin QR login and return the Channel Contract AuthChallenge. */
+    beginAuth(): Promise<AuthChallenge>;
+    /** Poll the active QR challenge. */
+    pollAuth(challenge: AuthChallenge): Promise<AuthStatePoll>;
+    /** Submit a phone-verify code for the active QR challenge (adapter-specific). */
+    submitVerifyCode(code: string): void;
+    /** Generic auth-input hook: maps verification-code inputs to submitVerifyCode. */
+    submitAuthInput(_challenge: AuthChallenge, input: AuthInput): void;
+    getHealth(): Promise<ChannelHealth>;
+    /** Expose the underlying upstream (tests introspection). */
+    get_iLinkClient(): unknown;
+    /** Best-effort typing start (WX6). Failures never break the main flow. */
+    startTyping(conversationId: string): Promise<void>;
+    /** Best-effort typing stop (WX6). Failures never break the main flow. */
+    stopTyping(conversationId: string): Promise<void>;
+    private requireStartedForAuth;
+    private emitConnection;
+    private onConnectionChange;
+}
+//# sourceMappingURL=adapter.d.ts.map

package/lib/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EACV,aAAa,EACb,SAAS,EACT,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,eAAe,EACf,UAAU,EAIX,MAAM,4BAA4B,CAAC;AAGpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAA8B,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAEhF,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,MAAM,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAC9B,IAAI,CAAC,cAAc,EACf,IAAI,GAAG,aAAa,GAAG,YAAY,GAAG,kBAAkB,GACxD,UAAU,GAAG,WAAW,GAAG,UAAU,GAAG,WAAW,GACnD,eAAe,GAAG,cAAc,GAAG,eAAe,GAAG,eAAe,GAAG,eAAe,CAAC,GAC3F;IACA,IAAI,CAAC,GAAG,EAAE,OAAO,oBAAoB,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACpE,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,aAAa,IAAI,OAAO,CAAC;QAAE,aAAa,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzE,eAAe,IAAI,OAAO,CAAC;CAC5B,CACF,CAAC;AAEF,qBAAa,aAAc,YAAW,cAAc;IAClD,QAAQ,CAAC,EAAE,YAAY;IAEvB,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAkB;IAEnD,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAoCxC;IAEF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsB;IAE/C,OAAO,CAAC,GAAG,CAAC,CAAwB;IACpC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,MAAM,EAAE,YAAY,EAAE,IAAI,GAAE,iBAAsB;IAW9D,OAAO,CAAC,cAAc;IAMhB,KAAK,CAAC,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBtD,wEAAwE;YAC1D,YAAY;IAKpB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAOrB,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;IA+ChF,oEAAoE;IAC9D,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC;IAWzC,oCAAoC;IAC9B,QAAQ,CAAC,SAAS,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAUhE,iFAAiF;IACjF,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAKpC,kFAAkF;IAClF,eAAe,CAAC,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,GAAG,IAAI;IAM5D,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC;IAiBzC,4DAA4D;IAC5D,eAAe,IAAI,OAAO;IAI1B,0EAA0E;IACpE,WAAW,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,yEAAyE;IACnE,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvD,OAAO,CAAC,qBAAqB;IAM7B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,kBAAkB;CAI3B"}

package/lib/adapter.js

@@ -0,0 +1,247 @@
+import { ChannelError, collectText } from '@krischoichoi/channel-core';
+import { redactMessage } from './ilink/errors.js';
+import { createWeixinUpstream } from './upstream/index.js';
+import { manifest as weixinManifest } from './manifest.js';
+export class WeixinAdapter {
+    id = 'weixin';
+    /** Upstream compatibility manifest (read structurally by `channels doctor`). */
+    manifest = weixinManifest;
+    capabilities = {
+        text: true,
+        image: true,
+        file: true,
+        audio: false,
+        video: true,
+        markdown: false,
+        cards: false,
+        reactions: false,
+        threads: false,
+        streaming: 'buffered',
+        // Directional per-kind media precision.
+        // CODE-CONFIRMED:
+        //   inbound — TencentWeixinUpstream.enrichInboundMedia downloads + AES
+        //     decrypts image/file/video and download+decrypt+transcodeSilkVoice for
+        //     audio, setting localData before the monitor emits; failures keep the
+        //     part with `ingressFailure`.
+        //   outbound — concrete sendImage/sendFile/sendVideo (uploadMedia +
+        //     sendMedia over iLink 2.4.6) upload real bytes; audio has no Tencent
+        //     2.4.6 outbound path (adapter.send() rejects voice parts with
+        //     CHANNEL_UNSUPPORTED), so it is `unsupported`.
+        // Legacy booleans above stay unchanged (coarse flags).
+        media: {
+            inbound: {
+                image: 'bytes',
+                file: 'bytes',
+                audio: 'bytes',
+                video: 'bytes',
+            },
+            outbound: {
+                image: 'bytes',
+                file: 'bytes',
+                video: 'bytes',
+                audio: 'unsupported',
+            },
+        },
+    };
+    config;
+    upstream;
+    ctx;
+    started = false;
+    connected = false;
+    startedAt;
+    constructor(config, deps = {}) {
+        this.config = config;
+        this.startedAt = deps.now ? deps.now() : Date.now();
+        this.upstream = deps.upstream ?? createWeixinUpstream({
+            config,
+            transport: deps.transport,
+            now: deps.now,
+            rand: deps.rand,
+        });
+    }
+    requireStarted() {
+        if (!this.started || !this.ctx) {
+            throw new ChannelError('CHANNEL_NOT_STARTED', 'weixin adapter is not started');
+        }
+    }
+    async start(ctx) {
+        if (this.started)
+            return;
+        this.ctx = ctx;
+        this.upstream.bind({
+            ctx,
+            secrets: ctx.secrets,
+            storage: ctx.storage,
+            onConnectionChange: (state) => this.onConnectionChange(state),
+        });
+        // Unauthenticated: allow beginAuth/pollAuth flow to configure later.
+        const hasCredential = await this.upstream.loadCredential();
+        if (!hasCredential) {
+            this.started = true;
+            this.emitConnection('disconnected');
+            return;
+        }
+        await this.startMonitor(ctx);
+        this.started = true;
+    }
+    /** Start the getUpdates monitor with the currently-wired credential. */
+    async startMonitor(ctx) {
+        await this.upstream.startMonitor();
+        this.connected = true;
+    }
+    async stop() {
+        if (!this.started)
+            return;
+        await this.upstream.stopMonitor();
+        this.started = false;
+        this.connected = false;
+    }
+    async send(target, message) {
+        this.requireStarted();
+        const to = target.conversationId;
+        const runId = target.runId;
+        const media = outboundMediaParts(message.parts);
+        try {
+            if (hasUnsupportedMediaPart(message.parts)) {
+                throw new ChannelError('CHANNEL_UNSUPPORTED', 'weixin outbound media requires local bytes; voice is not supported');
+            }
+            const text = message.text ?? collectText(message.parts ?? []);
+            let result;
+            if (media.length > 0 && text) {
+                result = await this.upstream.sendText({ to, runId, text });
+            }
+            for (const part of media) {
+                if (part.type === 'image') {
+                    result = await this.upstream.sendImage({
+                        to,
+                        runId,
+                        data: part.localData,
+                        mimeType: part.mimeType,
+                    });
+                }
+                else if (part.type === 'file') {
+                    result = await this.upstream.sendFile({
+                        to,
+                        runId,
+                        data: part.localData,
+                        fileName: part.name ?? 'attachment',
+                        mimeType: part.mimeType,
+                    });
+                }
+                else {
+                    result = await this.upstream.sendVideo({
+                        to,
+                        runId,
+                        data: part.localData,
+                        mimeType: part.mimeType,
+                    });
+                }
+            }
+            return result ?? this.upstream.sendText({ to, runId, text });
+        }
+        catch (error) {
+            const messageText = error instanceof Error ? error.message : String(error);
+            throw new ChannelError('CHANNEL_SEND_FAILED', redactMessage(messageText), { cause: error });
+        }
+    }
+    /** Begin QR login and return the Channel Contract AuthChallenge. */
+    async beginAuth() {
+        this.requireStartedForAuth();
+        const ticket = await this.upstream.beginQrAuth();
+        return {
+            id: ticket.id,
+            instruction: ticket.instruction ?? '请使用微信扫描二维码',
+            qrUrl: ticket.qrUrl,
+            expiresAt: ticket.expiresAt,
+        };
+    }
+    /** Poll the active QR challenge. */
+    async pollAuth(challenge) {
+        this.requireStartedForAuth();
+        const poll = await this.upstream.pollQrAuth(challenge.id);
+        if (poll.state === 'authenticated') {
+            // Persist the fresh credential on the upstream + (re)wire the sender.
+            return { state: 'authenticated', detail: poll.detail };
+        }
+        return { state: poll.state, detail: poll.detail };
+    }
+    /** Submit a phone-verify code for the active QR challenge (adapter-specific). */
+    submitVerifyCode(code) {
+        this.requireStartedForAuth();
+        this.upstream.submitVerifyCode(code);
+    }
+    /** Generic auth-input hook: maps verification-code inputs to submitVerifyCode. */
+    submitAuthInput(_challenge, input) {
+        if (input.kind === 'verification-code') {
+            this.submitVerifyCode(input.value);
+        }
+    }
+    async getHealth() {
+        if (!this.started) {
+            return { status: 'down', detail: 'weixin adapter is not started', authenticated: false };
+        }
+        const info = await this.upstream.getHealthInfo();
+        const { authenticated } = info;
+        if (!authenticated) {
+            return { status: 'down', detail: 'weixin not authenticated', connection: 'disconnected', authenticated: false };
+        }
+        return {
+            status: this.connected ? 'ok' : 'degraded',
+            detail: this.connected ? 'connected' : 'authenticated but receive loop down',
+            connection: this.connected ? 'connected' : 'disconnected',
+            authenticated: true,
+        };
+    }
+    /** Expose the underlying upstream (tests introspection). */
+    get_iLinkClient() {
+        return this.upstream.get_iLinkClient();
+    }
+    /** Best-effort typing start (WX6). Failures never break the main flow. */
+    async startTyping(conversationId) {
+        await this.upstream.startTyping(conversationId);
+    }
+    /** Best-effort typing stop (WX6). Failures never break the main flow. */
+    async stopTyping(conversationId) {
+        await this.upstream.stopTyping(conversationId);
+    }
+    requireStartedForAuth() {
+        if (!this.ctx) {
+            throw new ChannelError('CHANNEL_NOT_STARTED', 'weixin adapter is not started');
+        }
+    }
+    emitConnection(state) {
+        if (!this.ctx)
+            return;
+        void this.ctx
+            .emit({
+            type: 'connection.changed',
+            channel: this.id,
+            accountId: this.config.accountId,
+            state,
+        })
+            .catch(() => undefined);
+    }
+    onConnectionChange(state) {
+        this.connected = state === 'connected';
+        this.emitConnection(state);
+    }
+}
+function outboundMediaParts(parts) {
+    if (!parts)
+        return [];
+    return parts.filter((part) => (part.type === 'image' || part.type === 'file' || part.type === 'video') &&
+        part.localData !== undefined &&
+        part.localData.byteLength > 0);
+}
+/** True when the message carries unsupported or non-uploadable media. */
+function hasUnsupportedMediaPart(parts) {
+    if (!parts)
+        return false;
+    return parts.some((p) => p.type === 'audio' ||
+        ((p.type === 'image' || p.type === 'file' || p.type === 'video') && (!p.localData || p.localData.byteLength === 0)));
+}
+/** Minimal token redaction for send-failure messages (no pattern dependency here). */
+function redactSafe(message) {
+    return message.replace(/(token|authorization|aes_key|context_token)/gi, '<redacted>');
+}
+//# sourceMappingURL=adapter.js.map

package/lib/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGlD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAE,QAAQ,IAAI,cAAc,EAAuB,MAAM,eAAe,CAAC;AAsChF,MAAM,OAAO,aAAa;IACf,EAAE,GAAG,QAAQ,CAAC;IAEvB,gFAAgF;IACvE,QAAQ,GAAmB,cAAc,CAAC;IAE1C,YAAY,GAAwB;QAC3C,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,KAAK;QACZ,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,UAAU;QACrB,wCAAwC;QACxC,kBAAkB;QAClB,uEAAuE;QACvE,4EAA4E;QAC5E,2EAA2E;QAC3E,kCAAkC;QAClC,oEAAoE;QACpE,0EAA0E;QAC1E,mEAAmE;QACnE,oDAAoD;QACpD,uDAAuD;QACvD,KAAK,EAAE;YACL,OAAO,EAAE;gBACP,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,OAAO;aACf;YACD,QAAQ,EAAE;gBACR,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,OAAO;gBACd,KAAK,EAAE,aAAa;aACrB;SACF;KACF,CAAC;IAEe,MAAM,CAAe;IACrB,QAAQ,CAAsB;IAEvC,GAAG,CAAyB;IAC5B,OAAO,GAAG,KAAK,CAAC;IAChB,SAAS,GAAG,KAAK,CAAC;IACT,SAAS,CAAS;IAEnC,YAAY,MAAoB,EAAE,OAA0B,EAAE;QAC5D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACpD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,oBAAoB,CAAC;YACpD,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC/B,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,+BAA+B,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAA0B;QACpC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QAEf,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACjB,GAAG;YACH,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QAEH,qEAAqE;QACrE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC3D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,wEAAwE;IAChE,KAAK,CAAC,YAAY,CAAC,GAA0B;QACnD,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAqB,EAAE,OAAwB;QACxD,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAE3B,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,IAAI,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,oEAAoE,CAAC,CAAC;YACtH,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAC9D,IAAI,MAA8B,CAAC;YACnC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC7B,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC1B,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;wBACrC,EAAE;wBACF,KAAK;wBACL,IAAI,EAAE,IAAI,CAAC,SAAS;wBACpB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAChC,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBACpC,EAAE;wBACF,KAAK;wBACL,IAAI,EAAE,IAAI,CAAC,SAAS;wBACpB,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,YAAY;wBACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;wBACrC,EAAE;wBACF,KAAK;wBACL,IAAI,EAAE,IAAI,CAAC,SAAS;wBACpB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3E,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACjD,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,YAAY;YAC/C,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,KAAK,CAAC,QAAQ,CAAC,SAAwB;QACrC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACnC,sEAAsE;YACtE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACpD,CAAC;IAED,iFAAiF;IACjF,gBAAgB,CAAC,IAAY;QAC3B,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,kFAAkF;IAClF,eAAe,CAAC,UAAyB,EAAE,KAAgB;QACzD,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACvC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,+BAA+B,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAC3F,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QACjD,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;QAC/B,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,0BAA0B,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAClH,CAAC;QACD,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU;YAC1C,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,qCAAqC;YAC5E,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc;YACzD,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC;IAED,4DAA4D;IAC5D,eAAe;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;IACzC,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,WAAW,CAAC,cAAsB;QACtC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IAClD,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,UAAU,CAAC,cAAsB;QACrC,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IACjD,CAAC;IAEO,qBAAqB;QAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,+BAA+B,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,KAAoD;QACzE,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO;QACtB,KAAK,IAAI,CAAC,GAAG;aACV,IAAI,CAAC;YACJ,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,IAAI,CAAC,EAAW;YACzB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAkB;YACzC,KAAK;SACN,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IAEO,kBAAkB,CAAC,KAAoD;QAC7E,IAAI,CAAC,SAAS,GAAG,KAAK,KAAK,WAAW,CAAC;QACvC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;CACF;AAID,SAAS,kBAAkB,CAAC,KAA+B;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAmC,EAAE,CAC5D,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC;QACxE,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,SAAS,CAAC,UAAU,GAAG,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,SAAS,uBAAuB,CAAC,KAA+B;IAC9D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACtB,CAAC,CAAC,IAAI,KAAK,OAAO;QAClB,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CACpH,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,OAAO,CAAC,OAAO,CAAC,+CAA+C,EAAE,YAAY,CAAC,CAAC;AACxF,CAAC"}

package/lib/auth/account-store.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Credential store for Weixin accounts.
+ *
+ * Splits the credential across the two storage boundaries the channel runtime
+ * provides:
+ * - the **token** (secret) lives in the {@link SecretStore};
+ * - the non-secret identity/base-URL metadata lives as JSON in the
+ *   {@link ChannelStorage}.
+ *
+ * An account is "configured" only when both halves exist. Tokens are never
+ * logged, never embedded in emitted events or exception messages, and never
+ * rounded-trip through config dumps.
+ */
+import type { SecretStore } from '@krischoichoi/channel-core';
+export interface WeixinAccountCredential {
+    /** Bot token — the secret. Never logged. */
+    token: string;
+    /** Remote Weixin bot identity (ilink_bot_id). */
+    ilinkBotId: string;
+    /** Weixin user id of the scanning user (when reported). */
+    userId?: string;
+    /** Effective API base URL (redirect-adjusted). */
+    baseUrl: string;
+    /** ISO timestamp when the credential was saved. */
+    savedAt: string;
+}
+export interface AccountCredentialStoreOptions {
+    secrets: SecretStore;
+    storage: import('@krischoichoi/channel-core').ChannelStorage;
+    /** Local DSH account alias; defaults to `main`. */
+    accountId?: string;
+    /** Injectable clock (tests). */
+    now?: () => number;
+}
+/** Helper: one JSON field of the credential metadata. */
+export declare class AccountCredentialStore {
+    private readonly secrets;
+    private readonly storage;
+    private readonly accountId;
+    private readonly now;
+    constructor(options: AccountCredentialStoreOptions);
+    private metaKey;
+    private tokenKey;
+    /** Save (or replace) a credential atomically. */
+    save(credential: WeixinAccountCredential & {
+        token?: string;
+    }): Promise<void>;
+    /** Load the credential; resolves `undefined` when absent or partial. */
+    load(): Promise<WeixinAccountCredential | undefined>;
+    /** Delete the credential (both halves). */
+    delete(): Promise<void>;
+}
+/** Redacted summary of a credential for diagnostics (never includes the token). */
+export declare function redactCredential(c: WeixinAccountCredential): {
+    ilinkBotId: string;
+    userId?: string;
+    baseUrl: string;
+    savedAt: string;
+};
+//# sourceMappingURL=account-store.d.ts.map

package/lib/auth/account-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-store.d.ts","sourceRoot":"","sources":["../../src/auth/account-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAG9D,MAAM,WAAW,uBAAuB;IACtC,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,OAAO,4BAA4B,EAAE,cAAc,CAAC;IAC7D,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAcD,yDAAyD;AACzD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsD;IAC9E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,OAAO,EAAE,6BAA6B;IAOlD,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,QAAQ;IAIhB,iDAAiD;IAC3C,IAAI,CAAC,UAAU,EAAE,uBAAuB,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAenF,wEAAwE;IAClE,IAAI,IAAI,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC;IAsB1D,2CAA2C;IACrC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAG9B;AAED,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,uBAAuB,GAAG;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,CAOA"}

package/lib/auth/account-store.js

@@ -0,0 +1,84 @@
+import { z } from 'zod';
+/** Storage key prefix for the non-secret credential metadata. */
+const META_KEY_PREFIX = 'weixin:credential:';
+const credentialMetadataSchema = z.object({
+    ilinkBotId: z.string().trim().min(1),
+    userId: z.string().trim().min(1).optional(),
+    baseUrl: z.string().url().refine((value) => new URL(value).protocol === 'https:', {
+        message: 'baseUrl must use https',
+    }),
+    savedAt: z.string().trim().min(1),
+});
+/** Helper: one JSON field of the credential metadata. */
+export class AccountCredentialStore {
+    secrets;
+    storage;
+    accountId;
+    now;
+    constructor(options) {
+        this.secrets = options.secrets;
+        this.storage = options.storage;
+        this.accountId = options.accountId ?? 'main';
+        this.now = options.now ?? Date.now;
+    }
+    metaKey() {
+        return `${META_KEY_PREFIX}${this.accountId}`;
+    }
+    tokenKey() {
+        return `weixin:token:${this.accountId}`;
+    }
+    /** Save (or replace) a credential atomically. */
+    async save(credential) {
+        const meta = {
+            ilinkBotId: credential.ilinkBotId,
+            userId: credential.userId,
+            baseUrl: credential.baseUrl,
+            savedAt: credential.savedAt ?? new Date(this.now()).toISOString(),
+        };
+        const parsed = credentialMetadataSchema.safeParse(meta);
+        if (!parsed.success) {
+            throw new TypeError('invalid Weixin credential metadata');
+        }
+        await this.secrets.set(this.tokenKey(), credential.token);
+        await this.storage.set(this.metaKey(), JSON.stringify(parsed.data));
+    }
+    /** Load the credential; resolves `undefined` when absent or partial. */
+    async load() {
+        const token = await this.secrets.get(this.tokenKey());
+        const rawMeta = await this.storage.get(this.metaKey());
+        if (!token || !rawMeta)
+            return undefined;
+        try {
+            const parsedJson = JSON.parse(rawMeta);
+            const parsed = credentialMetadataSchema.safeParse(parsedJson);
+            if (!parsed.success)
+                return undefined;
+            const meta = parsed.data;
+            return {
+                token,
+                ilinkBotId: meta.ilinkBotId,
+                userId: meta.userId,
+                baseUrl: meta.baseUrl,
+                savedAt: meta.savedAt,
+            };
+        }
+        catch {
+            // Corrupt metadata — treat as unauthenticated.
+            return undefined;
+        }
+    }
+    /** Delete the credential (both halves). */
+    async delete() {
+        await Promise.all([this.secrets.delete(this.tokenKey()), this.storage.delete(this.metaKey())]);
+    }
+}
+/** Redacted summary of a credential for diagnostics (never includes the token). */
+export function redactCredential(c) {
+    return {
+        ilinkBotId: c.ilinkBotId,
+        userId: c.userId,
+        baseUrl: c.baseUrl,
+        savedAt: c.savedAt,
+    };
+}
+//# sourceMappingURL=account-store.js.map

package/lib/auth/account-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-store.js","sourceRoot":"","sources":["../../src/auth/account-store.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAwBxB,iEAAiE;AACjE,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE;QAChF,OAAO,EAAE,wBAAwB;KAClC,CAAC;IACF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,OAAO,sBAAsB;IAChB,OAAO,CAAc;IACrB,OAAO,CAAsD;IAC7D,SAAS,CAAS;IAClB,GAAG,CAAe;IAEnC,YAAY,OAAsC;QAChD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;QAC7C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAEO,OAAO;QACb,OAAO,GAAG,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAC/C,CAAC;IAEO,QAAQ;QACd,OAAO,gBAAgB,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1C,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,IAAI,CAAC,UAAwD;QACjE,MAAM,IAAI,GAA2C;YACnD,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;SAClE,CAAC;QACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,IAAI;QACR,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,UAAU,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC;YACtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,OAAO;gBACL,KAAK;gBACL,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;YAC/C,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,MAAM;QACV,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAAC,CAA0B;IAMzD,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,CAAC,CAAC,OAAO;KACnB,CAAC;AACJ,CAAC"}