@mininglamp-oss/cc-channel-octo 1.0.1-dev.0ac574a

package/dist/stream-relay.js

@@ -0,0 +1,243 @@
+/**
+ * Stream Relay — typing heartbeat + message splitting + plain sendMessage delivery.
+ *
+ * Consumes an AsyncIterable<string> of text chunks and delivers them to Octo
+ * via plain sendMessage with intelligent splitting.
+ *
+ * Design constraints:
+ * - Knows nothing about Claude SDK — input is a generic async text stream.
+ * - All Octo API calls go through the api.ts functions (no raw fetch).
+ * - Typing indicators keep the user informed while chunks accumulate.
+ */
+import { sendTyping, sendMessage, } from "./octo/api.js";
+import { resolveMentions } from "./mention-utils.js";
+// ─── Constants ──────────────────────────────────────────────────────────────
+/** Interval (ms) between typing indicator pings. */
+const TYPING_INTERVAL_MS = 5_000;
+/** Maximum characters per message segment. */
+const MAX_SEGMENT_CHARS = 3_500;
+/** Default maximum accumulated response length before truncation (Q32). */
+const DEFAULT_MAX_RESPONSE_CHARS = 524_288; // 512 KB
+/** Truncation suffix appended when response exceeds limit. */
+const TRUNCATION_SUFFIX = '\n\n[response truncated]';
+/**
+ * Adjust a candidate split position so it does not fall strictly inside any
+ * protected range. If splitAt lands inside [start, end), prefer pushing back
+ * to `start` (move the protected unit whole to the next segment).
+ *
+ * Returns the adjusted split position, or null if pulling back would land at 0.
+ */
+function adjustSplitForProtectedRanges(splitAt, protectedRanges) {
+    for (const range of protectedRanges) {
+        if (splitAt > range.start && splitAt < range.end) {
+            // Pull BACK to range.start so the protected unit moves whole to next seg.
+            if (range.start > 0)
+                return range.start;
+            // Range starts at 0 — can't pull back. Caller will deal.
+            return null;
+        }
+    }
+    return splitAt;
+}
+/**
+ * Split a long text into segments at natural boundaries.
+ *
+ * Priority: paragraph break (\n\n) > newline (\n) > space > hard cut.
+ * Each segment is at most `maxChars` characters.
+ *
+ * `protectedRanges` (P0-1): byte ranges that must NOT be split through. Used
+ * by deliver() to keep resolved @name mentions intact — a name like
+ * "@John Smith Junior" must be sent as one unit so the corresponding
+ * MentionEntity offset/length lands cleanly in one segment.
+ */
+export function splitMessage(text, maxChars = MAX_SEGMENT_CHARS, protectedRanges = []) {
+    if (maxChars < 1) {
+        throw new Error(`splitMessage: maxChars must be >= 1, got ${maxChars}`);
+    }
+    if (text.length <= maxChars)
+        return [text];
+    const segments = [];
+    let remaining = text;
+    let consumed = 0;
+    while (remaining.length > 0) {
+        if (remaining.length <= maxChars) {
+            segments.push(remaining);
+            break;
+        }
+        const chunk = remaining.slice(0, maxChars);
+        // Translate global ranges to local offsets relative to remaining.
+        const localRanges = protectedRanges
+            .filter(r => r.end > consumed && r.start < consumed + remaining.length)
+            .map(r => ({ start: r.start - consumed, end: r.end - consumed }));
+        let splitAt = -1;
+        function tryCandidate(candidate) {
+            const adj = adjustSplitForProtectedRanges(candidate, localRanges);
+            if (adj === null || adj <= 0 || adj > maxChars)
+                return false;
+            splitAt = adj;
+            return true;
+        }
+        // 1. Paragraph break (\n\n) — prefer the last one within range.
+        const paraIdx = chunk.lastIndexOf("\n\n");
+        if (paraIdx > 0)
+            tryCandidate(paraIdx + 2);
+        // 2. Newline (\n)
+        if (splitAt === -1) {
+            const nlIdx = chunk.lastIndexOf("\n");
+            if (nlIdx > 0)
+                tryCandidate(nlIdx + 1);
+        }
+        // 3. Space
+        if (splitAt === -1) {
+            const spIdx = chunk.lastIndexOf(" ");
+            if (spIdx > 0)
+                tryCandidate(spIdx + 1);
+        }
+        // 4. Hard cut — avoid splitting surrogate pairs AND protected ranges.
+        if (splitAt === -1) {
+            splitAt = maxChars;
+            // If the cut falls between a surrogate pair, back up one code unit.
+            const code = remaining.charCodeAt(splitAt - 1);
+            if (code >= 0xD800 && code <= 0xDBFF)
+                splitAt--;
+            // If the cut falls inside a protected range, pull back to its start.
+            // Pathological case (range starts at 0 and exceeds maxChars): we fall
+            // back to maxChars and accept the broken mention rather than infinite
+            // loop. In practice an @[uid:name] is far shorter than maxChars=3500.
+            const adj = adjustSplitForProtectedRanges(splitAt, localRanges);
+            if (adj !== null && adj > 0)
+                splitAt = Math.min(adj, maxChars);
+        }
+        segments.push(remaining.slice(0, splitAt));
+        remaining = remaining.slice(splitAt);
+        consumed += splitAt;
+    }
+    return segments;
+}
+// ─── StreamRelay ────────────────────────────────────────────────────────────
+export class StreamRelay {
+    /**
+     * Deliver an async stream of text chunks to an Octo channel.
+     *
+     * 1. Starts a typing indicator heartbeat (5 s interval).
+     * 2. Accumulates all chunks from the async iterable.
+     * 3. Sends the accumulated text via plain sendMessage with splitting.
+     * 4. Always cleans up the typing heartbeat.
+     */
+    async deliver(channelId, channelType, chunks, apiUrl, botToken, maxResponseChars = DEFAULT_MAX_RESPONSE_CHARS, memberMap, isValidUid) {
+        // --- Typing heartbeat ---
+        const typingParams = { apiUrl, botToken, channelId, channelType };
+        // Fire one immediately — don't wait for the first interval tick.
+        sendTyping(typingParams).catch(() => { });
+        const typingTimer = setInterval(() => {
+            sendTyping(typingParams).catch(() => { });
+        }, TYPING_INTERVAL_MS);
+        try {
+            // Accumulate all chunks, with truncation guard (Q32).
+            let accumulated = "";
+            let truncated = false;
+            // If the agent stream throws mid-way (network blip, non-recoverable SDK
+            // error after partial output), we still want to deliver what we have
+            // instead of dropping a real partial reply on the floor — then re-throw so
+            // the caller's error path still runs. Capture the error and flush below.
+            let streamError;
+            try {
+                for await (const chunk of chunks) {
+                    accumulated += chunk;
+                    // Q32: Stop accumulating once limit is reached to prevent unbounded memory.
+                    if (accumulated.length > maxResponseChars) {
+                        // P1-6: cut at code-unit boundary, but back off if it lands inside
+                        // a surrogate pair (would produce an orphan high surrogate = invalid
+                        // Unicode). Mirrors splitMessage's hard-cut surrogate guard.
+                        let cutAt = maxResponseChars;
+                        const code = accumulated.charCodeAt(cutAt - 1);
+                        if (code >= 0xD800 && code <= 0xDBFF)
+                            cutAt--;
+                        accumulated = accumulated.slice(0, cutAt) + TRUNCATION_SUFFIX;
+                        truncated = true;
+                        break;
+                    }
+                }
+            }
+            catch (err) {
+                streamError = err;
+                console.error(`[stream-relay] agent stream threw after ${accumulated.length} char(s); flushing partial output: ${String(err)}`);
+            }
+            if (truncated) {
+                console.warn(`[stream-relay] Response truncated at ${maxResponseChars} chars`);
+            }
+            // Send accumulated text via plain messages with splitting.
+            if (accumulated.length > 0) {
+                // P0-1: Resolve @[uid:name] structured mentions and @name ONCE on the
+                // full accumulated text, BEFORE splitting. This guarantees splitMessage
+                // cannot break a structured mention across segments — by the time
+                // splitMessage runs, @[uid:name] is already @name. We additionally
+                // pass each resolved @name as a ProtectedRange so splitMessage avoids
+                // cutting through names that contain spaces (e.g. "John Smith").
+                const { finalContent, mentionEntities: globalEntities, mentionAll, } = resolveMentions(accumulated, memberMap, isValidUid);
+                const protectedRanges = globalEntities.map(e => ({
+                    start: e.offset,
+                    end: e.offset + e.length,
+                }));
+                const segments = splitMessage(finalContent, undefined, protectedRanges);
+                let segStart = 0;
+                let mentionAllConsumed = false;
+                for (const segment of segments) {
+                    const segEnd = segStart + segment.length;
+                    // Partition entities falling within this segment, re-rebase to
+                    // segment-local offsets. Server expects per-message offsets.
+                    const segEntities = globalEntities
+                        .filter(e => e.offset >= segStart && e.offset + e.length <= segEnd)
+                        .map(e => ({ uid: e.uid, offset: e.offset - segStart, length: e.length }));
+                    const segUids = segEntities.map(e => e.uid);
+                    // mentionAll only applies to one segment (the first). Avoids spamming
+                    // @所有人 notifications when a reply spans multiple chunks.
+                    //
+                    // Design choice (王大锤 PR#45 review note): we attach mentionAll to the
+                    // FIRST segment unconditionally, not to the segment that actually
+                    // contains the resolved "@all"/"@所有人" text. Three reasons:
+                    //   1. mentionAll on the Octo API is a wire-level notification flag,
+                    //      independent of where the literal "@all" text appears.
+                    //   2. The first segment is always sent first — attaching the flag
+                    //      there minimizes notification latency.
+                    //   3. The literal text may have been resolved/rewritten by the LLM
+                    //      into multiple positions; pinning to segment 0 is unambiguous.
+                    // Alternative considered: scan each segment for @all literal and
+                    // attach the flag only to segments containing it. Rejected because
+                    // it would double-notify when @all appears more than once.
+                    const useMentionAll = mentionAll && !mentionAllConsumed;
+                    if (useMentionAll)
+                        mentionAllConsumed = true;
+                    try {
+                        await sendMessage({
+                            apiUrl,
+                            botToken,
+                            channelId,
+                            channelType,
+                            content: segment,
+                            ...(segUids.length > 0 ? { mentionUids: segUids } : {}),
+                            ...(segEntities.length > 0 ? { mentionEntities: segEntities } : {}),
+                            ...(useMentionAll ? { mentionAll: true } : {}),
+                        });
+                    }
+                    catch (err) {
+                        console.error(`[stream-relay] sendMessage failed for segment (${segment.length} chars), continuing: ${String(err)}`);
+                        // Continue sending remaining segments — don't let one failure drop the rest
+                    }
+                    segStart = segEnd;
+                }
+            }
+            // If accumulated is empty, the agent produced no output — nothing to send.
+            // If the stream threw mid-way, we've now flushed whatever partial text was
+            // accumulated; re-throw so the caller's error handling still runs (it will
+            // not double-send — the partial was delivered here, the caller only logs /
+            // surfaces the failure).
+            if (streamError !== undefined)
+                throw streamError;
+        }
+        finally {
+            clearInterval(typingTimer);
+        }
+    }
+}
+//# sourceMappingURL=stream-relay.js.map

package/dist/stream-relay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-relay.js","sourceRoot":"","sources":["../src/stream-relay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EACL,UAAU,EACV,WAAW,GACZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,+EAA+E;AAE/E,oDAAoD;AACpD,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,8CAA8C;AAC9C,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,2EAA2E;AAC3E,MAAM,0BAA0B,GAAG,OAAO,CAAC,CAAC,SAAS;AAErD,8DAA8D;AAC9D,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AAYrD;;;;;;GAMG;AACH,SAAS,6BAA6B,CACpC,OAAe,EACf,eAAiC;IAEjC,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,OAAO,GAAG,KAAK,CAAC,KAAK,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;YACjD,0EAA0E;YAC1E,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC,KAAK,CAAC;YACxC,yDAAyD;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,WAAmB,iBAAiB,EACpC,kBAAoC,EAAE;IAEtC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzB,MAAM;QACR,CAAC;QAED,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC3C,kEAAkE;QAClE,MAAM,WAAW,GAAG,eAAe;aAChC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,QAAQ,IAAI,CAAC,CAAC,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC;aACtE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC;QAEpE,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;QACjB,SAAS,YAAY,CAAC,SAAiB;YACrC,MAAM,GAAG,GAAG,6BAA6B,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAClE,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC7D,OAAO,GAAG,GAAG,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QAED,gEAAgE;QAChE,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,OAAO,GAAG,CAAC;YAAE,YAAY,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAE3C,kBAAkB;QAClB,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACnB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,KAAK,GAAG,CAAC;gBAAE,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;QAED,WAAW;QACX,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACnB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,KAAK,GAAG,CAAC;gBAAE,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;QAED,sEAAsE;QACtE,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACnB,OAAO,GAAG,QAAQ,CAAC;YACnB,oEAAoE;YACpE,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YAC/C,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM;gBAAE,OAAO,EAAE,CAAC;YAChD,qEAAqE;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,MAAM,GAAG,GAAG,6BAA6B,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAChE,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACjE,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,QAAQ,IAAI,OAAO,CAAC;IACtB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAE/E,MAAM,OAAO,WAAW;IACtB;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,SAAiB,EACjB,WAAwB,EACxB,MAA6B,EAC7B,MAAc,EACd,QAAgB,EAChB,mBAA2B,0BAA0B,EACrD,SAA+B,EAC/B,UAAqC;QAErC,2BAA2B;QAC3B,MAAM,YAAY,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;QAClE,iEAAiE;QACjE,UAAU,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,UAAU,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC3C,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAEvB,IAAI,CAAC;YACH,sDAAsD;YACtD,IAAI,WAAW,GAAG,EAAE,CAAC;YACrB,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,wEAAwE;YACxE,qEAAqE;YACrE,2EAA2E;YAC3E,yEAAyE;YACzE,IAAI,WAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBACjC,WAAW,IAAI,KAAK,CAAC;oBACrB,4EAA4E;oBAC5E,IAAI,WAAW,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;wBAC1C,mEAAmE;wBACnE,qEAAqE;wBACrE,6DAA6D;wBAC7D,IAAI,KAAK,GAAG,gBAAgB,CAAC;wBAC7B,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;wBAC/C,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM;4BAAE,KAAK,EAAE,CAAC;wBAC9C,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,iBAAiB,CAAC;wBAC9D,SAAS,GAAG,IAAI,CAAC;wBACjB,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,WAAW,GAAG,GAAG,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,2CAA2C,WAAW,CAAC,MAAM,sCAAsC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClI,CAAC;YACD,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,wCAAwC,gBAAgB,QAAQ,CAAC,CAAC;YACjF,CAAC;YAED,2DAA2D;YAC3D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,sEAAsE;gBACtE,wEAAwE;gBACxE,kEAAkE;gBAClE,mEAAmE;gBACnE,sEAAsE;gBACtE,iEAAiE;gBACjE,MAAM,EACJ,YAAY,EACZ,eAAe,EAAE,cAAc,EAC/B,UAAU,GACX,GAAG,eAAe,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;gBAExD,MAAM,eAAe,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBAC/C,KAAK,EAAE,CAAC,CAAC,MAAM;oBACf,GAAG,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM;iBACzB,CAAC,CAAC,CAAC;gBAEJ,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;gBACxE,IAAI,QAAQ,GAAG,CAAC,CAAC;gBACjB,IAAI,kBAAkB,GAAG,KAAK,CAAC;gBAC/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,MAAM,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;oBACzC,+DAA+D;oBAC/D,6DAA6D;oBAC7D,MAAM,WAAW,GAAG,cAAc;yBAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC;yBAClE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;oBAC7E,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBAE5C,sEAAsE;oBACtE,yDAAyD;oBACzD,EAAE;oBACF,qEAAqE;oBACrE,kEAAkE;oBAClE,2DAA2D;oBAC3D,qEAAqE;oBACrE,6DAA6D;oBAC7D,mEAAmE;oBACnE,6CAA6C;oBAC7C,oEAAoE;oBACpE,qEAAqE;oBACrE,iEAAiE;oBACjE,mEAAmE;oBACnE,2DAA2D;oBAC3D,MAAM,aAAa,GAAG,UAAU,IAAI,CAAC,kBAAkB,CAAC;oBACxD,IAAI,aAAa;wBAAE,kBAAkB,GAAG,IAAI,CAAC;oBAE7C,IAAI,CAAC;wBACH,MAAM,WAAW,CAAC;4BAChB,MAAM;4BACN,QAAQ;4BACR,SAAS;4BACT,WAAW;4BACX,OAAO,EAAE,OAAO;4BAChB,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACvD,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACnE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBAC/C,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,CAAC,KAAK,CAAC,kDAAkD,OAAO,CAAC,MAAM,wBAAwB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBACrH,4EAA4E;oBAC9E,CAAC;oBACD,QAAQ,GAAG,MAAM,CAAC;gBACpB,CAAC;YACH,CAAC;YACD,2EAA2E;YAC3E,2EAA2E;YAC3E,2EAA2E;YAC3E,2EAA2E;YAC3E,yBAAyB;YACzB,IAAI,WAAW,KAAK,SAAS;gBAAE,MAAM,WAAW,CAAC;QACnD,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,WAAW,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;CACF"}

package/dist/url-policy.d.ts

@@ -0,0 +1,103 @@
+/**
+ * URL policy — shared SSRF defense + URL validation utilities.
+ *
+ * Stage 6 W1: consolidates URL validation that was previously duplicated and
+ * inconsistent across inbound.ts and config.ts.
+ *
+ * Three public surfaces:
+ *   - isPrivateOrLocalAddress(address): IP-range check (IPv4 + IPv6 + v4-mapped)
+ *   - assertPublicUrl(url): throws if a URL resolves to a private/local address
+ *   - fetchWithRedirectGuard(url, init): fetch() wrapper that re-validates on every redirect
+ *   - isAllowedApiUrl(url): boot-time apiUrl validation (https any non-private host, http localhost only)
+ */
+/**
+ * Reject IP literals/resolved IPs in private/loopback/link-local/CGN ranges.
+ *
+ * Covers IPv4 + IPv6 forms including:
+ *   - IPv6 dotted-quad v4-mapped: `::ffff:127.0.0.1`
+ *   - IPv6 hex v4-mapped: `::ffff:7f00:1` (S5 — was a bypass of original PR#34 fix)
+ *   - IPv4-compatible IPv6: `::7f00:1` (deprecated but resolvable)
+ *
+ * NOTE: DNS rebinding remains a residual risk. We validate at lookup time;
+ * the OS resolver may return a different IP at fetch time. Mitigated by short
+ * TTLs and the fact that an attacker would need to control authoritative DNS
+ * for a domain we trust. For full protection, callers can pin IP and connect
+ * by IP — not done here to preserve TLS SNI and CDN routing.
+ */
+export declare function isPrivateOrLocalAddress(address: string): boolean;
+/**
+ * Validate a URL's host is publicly routable. Throws on:
+ *   - non-http(s) scheme
+ *   - IP literal in private/loopback/link-local range
+ *   - hostname resolving to ANY private/local address
+ */
+export declare function assertPublicUrl(rawUrl: string): Promise<void>;
+/**
+ * Per-hop init callback for fetchWithRedirectGuard.
+ *
+ * Called for each hop with the URL about to be fetched (initial URL on hop
+ * 0, redirect Location on later hops). Returns the RequestInit to use for
+ * that hop. Allows callers to scope credentials per-hop — e.g. drop
+ * Authorization when the target host changes.
+ *
+ * Receives `previousUrl` so the callback can compare host transitions
+ * (initial → hop 1) without re-parsing.
+ */
+export type PerHopInit = (currentUrl: string, previousUrl: string | null) => RequestInit & {
+    signal?: AbortSignal;
+};
+/**
+ * Fetch wrapper that re-validates SSRF on every HTTP redirect (S2).
+ *
+ * Default `fetch()` follows redirects automatically — an attacker can register
+ * `https://attacker.com` that 302's to `http://127.0.0.1/admin`, completely
+ * bypassing `assertPublicUrl(originalUrl)`. This wrapper sets
+ * `redirect: 'manual'` and manually walks the chain, validating each hop.
+ *
+ * Callers should still call `assertPublicUrl(url)` once upfront; this wrapper
+ * handles ONLY the redirect chain. The reason for the split: assertPublicUrl
+ * fails fast before any network I/O for the obvious cases.
+ *
+ * **Credential safety (S1 follow-up fix, addressed in PR#38 re-review):**
+ *
+ * The `init` parameter is REUSED on every hop, which means any headers in it
+ * (e.g. Authorization) follow the redirect chain. This is the SAME bug as
+ * default `fetch()` does — a same-host request that 302s to attacker.com
+ * sends the Authorization header to the attacker.
+ *
+ * Two modes:
+ *   1. Static `init` — backward-compatible, headers flow on every hop.
+ *      Caller is responsible for either (a) only using this for URLs they
+ *      control end-to-end, or (b) not including sensitive headers.
+ *   2. `perHopInit` callback — caller decides per-hop what init to use,
+ *      typically scoping Authorization to apiUrl host only. Recommended
+ *      whenever Authorization is involved.
+ *
+ * If both are provided, `perHopInit` wins. If neither is provided, an
+ * empty init is used.
+ */
+export declare function fetchWithRedirectGuard(url: string, init?: (RequestInit & {
+    signal?: AbortSignal;
+}) | PerHopInit): Promise<Response>;
+/**
+ * Boot-time apiUrl SSRF check (S6).
+ *
+ * Stricter than `assertPublicUrl`: requires either `https:` to a NON-private
+ * host, or `http:` to an explicit localhost form (for local development only).
+ *
+ * S6 fix: previously `https://` was allowed to ANY host including 127.0.0.1
+ * because we only checked protocol. Now we also reject private IPs for https.
+ */
+export declare function isAllowedApiUrl(url: string): boolean;
+/**
+ * Boot-time WebSocket URL validation — the transport-integrity counterpart to
+ * isAllowedApiUrl.
+ *
+ * The WuKongIM payload layer is AES-CBC WITHOUT an authentication tag, so message
+ * integrity rests entirely on the transport. An unencrypted `ws://` link lets a
+ * network attacker bit-flip ciphertext undetected (silent corruption / DoS).
+ * Require `wss://` for any non-loopback host; permit plaintext `ws://` only to an
+ * explicit localhost form (local dev / a co-located reverse proxy that terminates
+ * TLS). Mirrors the http→localhost-only carve-out in isAllowedApiUrl.
+ */
+export declare function isAllowedWsUrl(url: string): boolean;

package/dist/url-policy.js

@@ -0,0 +1,290 @@
+/**
+ * URL policy — shared SSRF defense + URL validation utilities.
+ *
+ * Stage 6 W1: consolidates URL validation that was previously duplicated and
+ * inconsistent across inbound.ts and config.ts.
+ *
+ * Three public surfaces:
+ *   - isPrivateOrLocalAddress(address): IP-range check (IPv4 + IPv6 + v4-mapped)
+ *   - assertPublicUrl(url): throws if a URL resolves to a private/local address
+ *   - fetchWithRedirectGuard(url, init): fetch() wrapper that re-validates on every redirect
+ *   - isAllowedApiUrl(url): boot-time apiUrl validation (https any non-private host, http localhost only)
+ */
+import { lookup as dnsLookup } from "node:dns/promises";
+import { isIP } from "node:net";
+/**
+ * Reject IP literals/resolved IPs in private/loopback/link-local/CGN ranges.
+ *
+ * Covers IPv4 + IPv6 forms including:
+ *   - IPv6 dotted-quad v4-mapped: `::ffff:127.0.0.1`
+ *   - IPv6 hex v4-mapped: `::ffff:7f00:1` (S5 — was a bypass of original PR#34 fix)
+ *   - IPv4-compatible IPv6: `::7f00:1` (deprecated but resolvable)
+ *
+ * NOTE: DNS rebinding remains a residual risk. We validate at lookup time;
+ * the OS resolver may return a different IP at fetch time. Mitigated by short
+ * TTLs and the fact that an attacker would need to control authoritative DNS
+ * for a domain we trust. For full protection, callers can pin IP and connect
+ * by IP — not done here to preserve TLS SNI and CDN routing.
+ */
+export function isPrivateOrLocalAddress(address) {
+    const fam = isIP(address);
+    if (fam === 4) {
+        return isPrivateIPv4(address);
+    }
+    if (fam === 6) {
+        const lower = address.toLowerCase();
+        // ::1 loopback
+        if (lower === "::1" || lower === "0:0:0:0:0:0:0:1")
+            return true;
+        // :: unspecified
+        if (lower === "::" || lower === "0:0:0:0:0:0:0:0")
+            return true;
+        // fc00::/7 unique local addresses (fc.. and fd..)
+        if (lower.startsWith("fc") || lower.startsWith("fd"))
+            return true;
+        // fe80::/10 link-local (fe80..febf)
+        if (lower.startsWith("fe8") || lower.startsWith("fe9") ||
+            lower.startsWith("fea") || lower.startsWith("feb"))
+            return true;
+        // S5 fix: ::ffff:<v4-mapped> — both dotted-quad AND hex forms.
+        // URL.hostname normalizes `::ffff:127.0.0.1` → `::ffff:7f00:1` so a regex
+        // matching only the dotted-quad form (original PR#34 implementation) was
+        // bypassable. Cover both representations.
+        const v4MappedDot = lower.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+        if (v4MappedDot)
+            return isPrivateIPv4(v4MappedDot[1]);
+        const v4MappedHex = lower.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+        if (v4MappedHex) {
+            const dotted = decodeEmbeddedV4(v4MappedHex[1], v4MappedHex[2]);
+            if (dotted)
+                return isPrivateIPv4(dotted);
+        }
+        // IPv4-compatible IPv6: `::a.b.c.d` (deprecated form, but resolvable).
+        const v4CompatDot = lower.match(/^::(\d+\.\d+\.\d+\.\d+)$/);
+        if (v4CompatDot)
+            return isPrivateIPv4(v4CompatDot[1]);
+        // IPv4-compatible IPv6 hex form: `::a:b` where a:b decodes to dotted-quad.
+        const v4CompatHex = lower.match(/^::([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+        if (v4CompatHex) {
+            const dotted = decodeEmbeddedV4(v4CompatHex[1], v4CompatHex[2]);
+            if (dotted)
+                return isPrivateIPv4(dotted);
+        }
+        // NAT64 well-known prefix 64:ff9b::/96 — the last 32 bits embed an IPv4
+        // address. A name resolving to e.g. `64:ff9b::7f00:1` (= 127.0.0.1) on a
+        // NAT64-enabled host would otherwise reach loopback. The embedded v4 is the
+        // final two hextets (dotted-quad form `64:ff9b::a.b.c.d` is also accepted).
+        if (lower.startsWith("64:ff9b:")) {
+            const dotTail = lower.match(/(\d+\.\d+\.\d+\.\d+)$/);
+            if (dotTail)
+                return isPrivateIPv4(dotTail[1]);
+            const hexTail = lower.match(/:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+            if (hexTail) {
+                const embedded = decodeEmbeddedV4(hexTail[1], hexTail[2]);
+                if (embedded)
+                    return isPrivateIPv4(embedded);
+            }
+        }
+        // 6to4 2002::/16 — bits 16..47 embed an IPv4 address (2002:V4hi:V4lo::/48).
+        const sixToFour = lower.match(/^2002:([0-9a-f]{1,4}):([0-9a-f]{1,4}):/);
+        if (sixToFour) {
+            const embedded = decodeEmbeddedV4(sixToFour[1], sixToFour[2]);
+            if (embedded && isPrivateIPv4(embedded))
+                return true;
+        }
+        return false;
+    }
+    // Not a valid IP literal — caller should resolve via DNS first.
+    return false;
+}
+/** Decode two IPv6 hextets (hex strings) into a dotted-quad IPv4 string. */
+function decodeEmbeddedV4(hiHex, loHex) {
+    const high = parseInt(hiHex, 16);
+    const low = parseInt(loHex, 16);
+    if (Number.isNaN(high) || Number.isNaN(low))
+        return null;
+    return `${(high >> 8) & 0xff}.${high & 0xff}.${(low >> 8) & 0xff}.${low & 0xff}`;
+}
+function isPrivateIPv4(address) {
+    const parts = address.split(".").map(Number);
+    if (parts.length !== 4 || parts.some(p => Number.isNaN(p) || p < 0 || p > 255)) {
+        return false;
+    }
+    const [a, b] = parts;
+    // 127.0.0.0/8 loopback
+    if (a === 127)
+        return true;
+    // 10.0.0.0/8 private
+    if (a === 10)
+        return true;
+    // 172.16.0.0/12 private
+    if (a === 172 && b >= 16 && b <= 31)
+        return true;
+    // 192.168.0.0/16 private
+    if (a === 192 && b === 168)
+        return true;
+    // 169.254.0.0/16 link-local (includes AWS/GCP metadata 169.254.169.254)
+    if (a === 169 && b === 254)
+        return true;
+    // 100.64.0.0/10 CGN (carrier-grade NAT, shared address space)
+    if (a === 100 && b >= 64 && b <= 127)
+        return true;
+    // 0.0.0.0/8 unspecified / current network
+    if (a === 0)
+        return true;
+    return false;
+}
+/**
+ * Validate a URL's host is publicly routable. Throws on:
+ *   - non-http(s) scheme
+ *   - IP literal in private/loopback/link-local range
+ *   - hostname resolving to ANY private/local address
+ */
+export async function assertPublicUrl(rawUrl) {
+    const u = new URL(rawUrl);
+    // Reject non-http(s) schemes — gopher://, file://, dict:// etc.
+    if (u.protocol !== "http:" && u.protocol !== "https:") {
+        throw new Error(`Refusing to fetch non-http(s) URL: ${u.protocol}`);
+    }
+    const host = u.hostname;
+    // IPv6 hostnames come bracketed in URL.hostname — strip for isIP/dns.
+    const bareHost = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+    // Reject IP literals in private/loopback/link-local ranges immediately.
+    if (isIP(bareHost)) {
+        if (isPrivateOrLocalAddress(bareHost)) {
+            throw new Error(`Refusing to fetch private/local address: ${bareHost}`);
+        }
+        return;
+    }
+    // Resolve hostname — reject if ANY resolved address is private/local.
+    const addresses = await dnsLookup(bareHost, { all: true });
+    if (addresses.length === 0) {
+        throw new Error(`DNS resolution returned no addresses for: ${bareHost}`);
+    }
+    for (const { address } of addresses) {
+        if (isPrivateOrLocalAddress(address)) {
+            throw new Error(`Refusing to fetch ${bareHost}: resolves to private/local address ${address}`);
+        }
+    }
+}
+/** Maximum HTTP redirects to follow before giving up. */
+const MAX_REDIRECTS = 10;
+/**
+ * Fetch wrapper that re-validates SSRF on every HTTP redirect (S2).
+ *
+ * Default `fetch()` follows redirects automatically — an attacker can register
+ * `https://attacker.com` that 302's to `http://127.0.0.1/admin`, completely
+ * bypassing `assertPublicUrl(originalUrl)`. This wrapper sets
+ * `redirect: 'manual'` and manually walks the chain, validating each hop.
+ *
+ * Callers should still call `assertPublicUrl(url)` once upfront; this wrapper
+ * handles ONLY the redirect chain. The reason for the split: assertPublicUrl
+ * fails fast before any network I/O for the obvious cases.
+ *
+ * **Credential safety (S1 follow-up fix, addressed in PR#38 re-review):**
+ *
+ * The `init` parameter is REUSED on every hop, which means any headers in it
+ * (e.g. Authorization) follow the redirect chain. This is the SAME bug as
+ * default `fetch()` does — a same-host request that 302s to attacker.com
+ * sends the Authorization header to the attacker.
+ *
+ * Two modes:
+ *   1. Static `init` — backward-compatible, headers flow on every hop.
+ *      Caller is responsible for either (a) only using this for URLs they
+ *      control end-to-end, or (b) not including sensitive headers.
+ *   2. `perHopInit` callback — caller decides per-hop what init to use,
+ *      typically scoping Authorization to apiUrl host only. Recommended
+ *      whenever Authorization is involved.
+ *
+ * If both are provided, `perHopInit` wins. If neither is provided, an
+ * empty init is used.
+ */
+export async function fetchWithRedirectGuard(url, init = {}) {
+    const buildInit = typeof init === "function" ? init : () => init;
+    let currentUrl = url;
+    let previousUrl = null;
+    for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+        // Re-validate on every hop (including the first, in case of caller mistake).
+        await assertPublicUrl(currentUrl);
+        const hopInit = buildInit(currentUrl, previousUrl);
+        const resp = await fetch(currentUrl, { ...hopInit, redirect: "manual" });
+        // 3xx — follow manually after validation.
+        if (resp.status >= 300 && resp.status < 400) {
+            const location = resp.headers.get("location");
+            if (!location) {
+                return resp;
+            }
+            const next = new URL(location, currentUrl).toString();
+            previousUrl = currentUrl;
+            currentUrl = next;
+            try {
+                await resp.body?.cancel();
+            }
+            catch { /* ignore */ }
+            continue;
+        }
+        return resp;
+    }
+    throw new Error(`Refusing to follow more than ${MAX_REDIRECTS} redirects (started at ${url})`);
+}
+/**
+ * Boot-time apiUrl SSRF check (S6).
+ *
+ * Stricter than `assertPublicUrl`: requires either `https:` to a NON-private
+ * host, or `http:` to an explicit localhost form (for local development only).
+ *
+ * S6 fix: previously `https://` was allowed to ANY host including 127.0.0.1
+ * because we only checked protocol. Now we also reject private IPs for https.
+ */
+export function isAllowedApiUrl(url) {
+    try {
+        const parsed = new URL(url);
+        const host = parsed.hostname.toLowerCase();
+        const bareHost = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+        if (parsed.protocol === "https:") {
+            // Allow https to any non-private host. https://127.0.0.1 is suspicious
+            // (could be a self-signed mitmproxy if NODE_TLS_REJECT_UNAUTHORIZED=0).
+            if (isIP(bareHost) && isPrivateOrLocalAddress(bareHost))
+                return false;
+            return true;
+        }
+        if (parsed.protocol === "http:") {
+            return host === "localhost" || host === "127.0.0.1" || host === "[::1]";
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Boot-time WebSocket URL validation — the transport-integrity counterpart to
+ * isAllowedApiUrl.
+ *
+ * The WuKongIM payload layer is AES-CBC WITHOUT an authentication tag, so message
+ * integrity rests entirely on the transport. An unencrypted `ws://` link lets a
+ * network attacker bit-flip ciphertext undetected (silent corruption / DoS).
+ * Require `wss://` for any non-loopback host; permit plaintext `ws://` only to an
+ * explicit localhost form (local dev / a co-located reverse proxy that terminates
+ * TLS). Mirrors the http→localhost-only carve-out in isAllowedApiUrl.
+ */
+export function isAllowedWsUrl(url) {
+    try {
+        const parsed = new URL(url);
+        const host = parsed.hostname.toLowerCase();
+        const bareHost = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+        if (parsed.protocol === "wss:") {
+            if (isIP(bareHost) && isPrivateOrLocalAddress(bareHost))
+                return false;
+            return true;
+        }
+        if (parsed.protocol === "ws:") {
+            return host === "localhost" || host === "127.0.0.1" || host === "[::1]";
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=url-policy.js.map

package/dist/url-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-policy.js","sourceRoot":"","sources":["../src/url-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1B,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACpC,eAAe;QACf,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,iBAAiB;YAAE,OAAO,IAAI,CAAC;QAChE,iBAAiB;QACjB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,iBAAiB;YAAE,OAAO,IAAI,CAAC;QAC/D,kDAAkD;QAClD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAClE,oCAAoC;QACpC,IACE,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAClD,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,+DAA+D;QAC/D,0EAA0E;QAC1E,yEAAyE;QACzE,0CAA0C;QAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACjE,IAAI,WAAW;YAAE,OAAO,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC5E,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,IAAI,MAAM;gBAAE,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;QACD,uEAAuE;QACvE,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC5D,IAAI,WAAW;YAAE,OAAO,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,2EAA2E;QAC3E,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACvE,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,IAAI,MAAM;gBAAE,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;QACD,wEAAwE;QACxE,yEAAyE;QACzE,4EAA4E;QAC5E,4EAA4E;QAC5E,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACrD,IAAI,OAAO;gBAAE,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACjE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1D,IAAI,QAAQ;oBAAE,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,4EAA4E;QAC5E,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACxE,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,IAAI,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;QACvD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,gEAAgE;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,SAAS,gBAAgB,CAAC,KAAa,EAAE,KAAa;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QAC/E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACrB,uBAAuB;IACvB,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC3B,qBAAqB;IACrB,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,wBAAwB;IACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,yBAAyB;IACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,wEAAwE;IACxE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,8DAA8D;IAC9D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,0CAA0C;IAC1C,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc;IAClD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAE1B,gEAAgE;IAChE,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;IACxB,sEAAsE;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvF,wEAAwE;IACxE,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnB,IAAI,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO;IACT,CAAC;IAED,sEAAsE;IACtE,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;QACpC,IAAI,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,qBAAqB,QAAQ,uCAAuC,OAAO,EAAE,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,MAAM,aAAa,GAAG,EAAE,CAAC;AAkBzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAW,EACX,OAA8D,EAAE;IAEhE,MAAM,SAAS,GACb,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;IAEjD,IAAI,UAAU,GAAG,GAAG,CAAC;IACrB,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC;QAC9C,6EAA6E;QAC7E,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC;QAElC,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEzE,0CAA0C;QAC1C,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;YACtD,WAAW,GAAG,UAAU,CAAC;YACzB,UAAU,GAAG,IAAI,CAAC;YAClB,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,aAAa,0BAA0B,GAAG,GAAG,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEvF,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,uEAAuE;YACvE,wEAAwE;YACxE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,uBAAuB,CAAC,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,OAAO,CAAC;QAC1E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEvF,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,uBAAuB,CAAC,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,OAAO,CAAC;QAC1E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}