@mininglamp-oss/cc-channel-octo 1.0.1-dev.0ac574a

package/dist/configure.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The Anthropic SDK appends `/v1/messages` to ANTHROPIC_BASE_URL. A gateway
+ * pasted with a trailing `/v1` would otherwise yield `/v1/v1/messages` (404,
+ * misreported as a model error). Strip a trailing `/v1` (optionally with a
+ * slash) so the stored base is the host root. Pure for unit testing.
+ */
+export declare function normalizeGatewayUrl(raw: string): string;
+export declare function configure(gatewayUrl: string, apiKey: string, configPath?: string, opts?: {
+    model?: string;
+    apiUrl?: string;
+}): void;

package/dist/configure.js

@@ -0,0 +1,106 @@
+/**
+ * `configure` subcommand backend: write the LLM gateway URL + API key into the
+ * global config's `sdk` block. Daemon-driven one-click install calls
+ * `cc-channel-octo configure --gateway-url <url> --api-key <key>`.
+ *
+ * Independent of loadConfig(): loadConfig requires apiUrl (bot binding comes
+ * later via the provision flow), but install must be able to write gateway+key
+ * before any bot exists. So this does a raw read-merge-write of the JSON file,
+ * touching only sdk.anthropicBaseUrl + sdk.apiKey.
+ */
+import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync, renameSync, unlinkSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { DEFAULT_CONFIG_PATH } from './config.js';
+import { isAllowedApiUrl } from './url-policy.js';
+/**
+ * The Anthropic SDK appends `/v1/messages` to ANTHROPIC_BASE_URL. A gateway
+ * pasted with a trailing `/v1` would otherwise yield `/v1/v1/messages` (404,
+ * misreported as a model error). Strip a trailing `/v1` (optionally with a
+ * slash) so the stored base is the host root. Pure for unit testing.
+ */
+export function normalizeGatewayUrl(raw) {
+    return raw.trim().replace(/\/v1\/?$/i, '');
+}
+export function configure(gatewayUrl, apiKey, configPath, opts) {
+    if (!gatewayUrl)
+        throw new Error('configure: --gateway-url is required');
+    if (!apiKey)
+        throw new Error('configure: --api-key is required');
+    // The gateway receives the API key + all prompt/response content, so it gets
+    // the same SSRF policy as apiUrl (mirrors loadConfig's anthropicBaseUrl check).
+    if (!isAllowedApiUrl(gatewayUrl)) {
+        throw new Error(`configure: unsafe --gateway-url ${gatewayUrl} (must be https:// or http://localhost)`);
+    }
+    // apiUrl is the Octo IM server (cc's top-level config.apiUrl). The daemon
+    // passes its server url at install time so the zero-bot idle gateway can boot
+    // (loadConfig requires apiUrl). Same SSRF policy as the gateway url.
+    if (opts?.apiUrl && !isAllowedApiUrl(opts.apiUrl)) {
+        throw new Error(`configure: unsafe --api-url ${opts.apiUrl} (must be https:// or http://localhost)`);
+    }
+    const normalizedUrl = normalizeGatewayUrl(gatewayUrl);
+    const path = configPath ?? DEFAULT_CONFIG_PATH;
+    let existing = {};
+    if (existsSync(path)) {
+        try {
+            const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+            // Validate that the root is a plain object before treating it as one.
+            if (!(parsed && typeof parsed === 'object' && !Array.isArray(parsed))) {
+                throw new Error(`configure: existing config at ${path} is not a JSON object`);
+            }
+            existing = parsed;
+        }
+        catch (err) {
+            // Re-throw the clear "not a JSON object" error as-is; wrap parse errors.
+            if (err instanceof Error && err.message.includes('is not a JSON object')) {
+                throw err;
+            }
+            throw new Error(`configure: failed to parse ${path}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    // Narrow the existing sdk block to a plain object before merging (the file is
+    // untyped JSON; repo lint forbids `any`, so read it as unknown + narrow).
+    const existingSdk = existing.sdk && typeof existing.sdk === 'object' && !Array.isArray(existing.sdk)
+        ? existing.sdk
+        : {};
+    const merged = {
+        ...existing,
+        sdk: { ...existingSdk, anthropicBaseUrl: normalizedUrl, apiKey },
+    };
+    // Write model only when provided; omitting it PRESERVES any existing sdk.model
+    // (the existingSdk spread above) so a re-configure that just rotates the key
+    // never wipes the model. Resetting model→default is intentionally not a
+    // configure feature (add an explicit --clear-model later if ever needed).
+    if (opts?.model) {
+        merged.sdk.model = opts.model;
+    }
+    // The Octo IM server url lives at the top level (not under sdk).
+    if (opts?.apiUrl) {
+        merged.apiUrl = opts.apiUrl;
+    }
+    mkdirSync(dirname(path), { recursive: true });
+    // Atomic write: temp file in same directory with 0600 mode, then rename.
+    // `wx` (exclusive create) refuses to write through a pre-existing file or a
+    // symlink prepositioned at the temp path — important for a secret-bearing
+    // writer. The pid+timestamp name makes a real collision practically impossible.
+    const tmpPath = `${path}.tmp-${process.pid}-${Date.now()}`;
+    try {
+        writeFileSync(tmpPath, JSON.stringify(merged, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
+        renameSync(tmpPath, path);
+        // Belt-and-suspenders: force 0600 on the final file too.
+        chmodSync(path, 0o600);
+    }
+    catch (err) {
+        // Best-effort cleanup of OUR temp file — but if the failure was EEXIST, the
+        // path already existed and is not ours to delete.
+        if (err.code !== 'EEXIST') {
+            try {
+                unlinkSync(tmpPath);
+            }
+            catch {
+                /* already gone or never created — fine */
+            }
+        }
+        throw new Error(`configure: failed to write ${path}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+//# sourceMappingURL=configure.js.map

package/dist/configure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure.js","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAC/G,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEjD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,UAAkB,EAClB,MAAc,EACd,UAAmB,EACnB,IAA0C;IAE1C,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACxE,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IAChE,6EAA6E;IAC7E,gFAAgF;IAChF,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,mCAAmC,UAAU,yCAAyC,CAAC,CAAA;IACzG,CAAC;IACD,0EAA0E;IAC1E,8EAA8E;IAC9E,qEAAqE;IACrE,IAAI,IAAI,EAAE,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,MAAM,yCAAyC,CAAC,CAAA;IACtG,CAAC;IACD,MAAM,aAAa,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAA;IACrD,MAAM,IAAI,GAAG,UAAU,IAAI,mBAAmB,CAAA;IAC9C,IAAI,QAAQ,GAA4B,EAAE,CAAA;IAC1C,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAY,CAAA;YACjE,sEAAsE;YACtE,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,uBAAuB,CAAC,CAAA;YAC/E,CAAC;YACD,QAAQ,GAAG,MAAiC,CAAA;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBACzE,MAAM,GAAG,CAAA;YACX,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC5G,CAAC;IACH,CAAC;IACD,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,WAAW,GACf,QAAQ,CAAC,GAAG,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC9E,CAAC,CAAE,QAAQ,CAAC,GAA+B;QAC3C,CAAC,CAAC,EAAE,CAAA;IACR,MAAM,MAAM,GAA4B;QACtC,GAAG,QAAQ;QACX,GAAG,EAAE,EAAE,GAAG,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,EAAE;KACjE,CAAA;IACD,+EAA+E;IAC/E,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,GAA+B,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;IAC5D,CAAC;IACD,iEAAiE;IACjE,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;QACjB,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC7B,CAAC;IACD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE7C,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,gFAAgF;IAChF,MAAM,OAAO,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;IAC1D,IAAI,CAAC;QACH,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3F,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QACzB,yDAAyD;QACzD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4EAA4E;QAC5E,kDAAkD;QAClD,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,UAAU,CAAC,OAAO,CAAC,CAAA;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC5G,CAAC;AACH,CAAC"}

package/dist/cron-evaluator.d.ts

@@ -0,0 +1,53 @@
+/**
+ * #115: Cron schedule evaluation — pure functions, no I/O.
+ *
+ * Supports two schedule forms:
+ *  - **5-field cron** `"minute hour dom month dow"` — each field is `*`, an
+ *    integer, `*` + `/step`, an `a-b` range, or a comma list of those. Standard
+ *    Unix semantics: dom/dow are OR'd when both are restricted (a task fires when
+ *    either matches), matching cron's historical behavior.
+ *  - **one-shot ISO datetime** `"2026-06-09T09:00:00Z"` — fires once at that
+ *    instant, then never again.
+ *
+ * Kept dependency-free (a tiny evaluator beats pulling a cron library for this).
+ *
+ * TIMEZONE: cron fields are matched against the gateway process's LOCAL time
+ * (`Date#getHours()` etc.), so `"0 9 * * *"` means 9am in the server's timezone.
+ * One-shot ISO datetimes are absolute instants (honor any offset/`Z` in the
+ * string). Set `TZ=...` on the process to control cron-field interpretation.
+ */
+/** A parsed 5-field cron expression: each field is the set of allowed values. */
+export interface ParsedCron {
+    minute: Set<number>;
+    hour: Set<number>;
+    dom: Set<number>;
+    month: Set<number>;
+    dow: Set<number>;
+    /** True when dom/dow were both restricted (affects OR semantics). */
+    domRestricted: boolean;
+    dowRestricted: boolean;
+}
+/** Parse a 5-field cron expression. Returns null when invalid. */
+export declare function parseCronExpression(expr: string): ParsedCron | null;
+/** True when `date` (local time) matches the parsed cron. */
+export declare function matchesCron(p: ParsedCron, date: Date): boolean;
+/** Heuristic: is this schedule a one-shot ISO datetime (vs a cron expr)? */
+export declare function isOneShotSchedule(schedule: string): boolean;
+/**
+ * Strictly parse a one-shot ISO-8601 datetime → Unix ms, or null if invalid.
+ *
+ * `new Date()` alone is too lenient (e.g. it rolls "2026-13-13T…" into a real
+ * but wrong instant instead of rejecting it). We additionally require the
+ * canonical shape via regex AND verify the authored wall-clock fields name a
+ * real calendar instant, so an out-of-range month/day/hour can't sneak through
+ * as a silently shifted time — for ALL zone forms (Z, ±hh:mm, or none).
+ */
+export declare function parseOneShot(schedule: string): number | null;
+/**
+ * Compute the next fire time (Unix ms) strictly after `fromMs`, or null when
+ * there is none (a past/invalid one-shot, or an impossible cron).
+ *
+ * - one-shot ISO: its instant if still in the future, else null.
+ * - cron: scan minute-by-minute from the next whole minute, up to ~366 days.
+ */
+export declare function computeNextRun(schedule: string, recurring: boolean, fromMs: number): number | null;

package/dist/cron-evaluator.js

@@ -0,0 +1,191 @@
+/**
+ * #115: Cron schedule evaluation — pure functions, no I/O.
+ *
+ * Supports two schedule forms:
+ *  - **5-field cron** `"minute hour dom month dow"` — each field is `*`, an
+ *    integer, `*` + `/step`, an `a-b` range, or a comma list of those. Standard
+ *    Unix semantics: dom/dow are OR'd when both are restricted (a task fires when
+ *    either matches), matching cron's historical behavior.
+ *  - **one-shot ISO datetime** `"2026-06-09T09:00:00Z"` — fires once at that
+ *    instant, then never again.
+ *
+ * Kept dependency-free (a tiny evaluator beats pulling a cron library for this).
+ *
+ * TIMEZONE: cron fields are matched against the gateway process's LOCAL time
+ * (`Date#getHours()` etc.), so `"0 9 * * *"` means 9am in the server's timezone.
+ * One-shot ISO datetimes are absolute instants (honor any offset/`Z` in the
+ * string). Set `TZ=...` on the process to control cron-field interpretation.
+ */
+const FIELD_RANGES = [
+    ['minute', 0, 59],
+    ['hour', 0, 23],
+    ['dom', 1, 31],
+    ['month', 1, 12],
+    ['dow', 0, 6], // 0 = Sunday
+];
+/** Expand one cron field into a set of allowed integers, or null if invalid. */
+function parseField(raw, min, max) {
+    const out = new Set();
+    for (const part of raw.split(',')) {
+        const seg = part.trim();
+        if (seg === '')
+            return null;
+        // step: "*/n" or "a-b/n" or "a/n"
+        let stepStr;
+        let rangeStr = seg;
+        const slash = seg.indexOf('/');
+        if (slash !== -1) {
+            rangeStr = seg.slice(0, slash);
+            stepStr = seg.slice(slash + 1);
+        }
+        let step = 1;
+        if (stepStr !== undefined) {
+            if (!/^\d+$/.test(stepStr))
+                return null;
+            step = Number(stepStr);
+            if (step < 1)
+                return null;
+        }
+        let lo;
+        let hi;
+        if (rangeStr === '*') {
+            lo = min;
+            hi = max;
+        }
+        else if (/^\d+$/.test(rangeStr)) {
+            lo = hi = Number(rangeStr);
+            // A bare number with a step (e.g. "5/10") means "from 5 to max, step".
+            if (stepStr !== undefined)
+                hi = max;
+        }
+        else {
+            const m = /^(\d+)-(\d+)$/.exec(rangeStr);
+            if (!m)
+                return null;
+            lo = Number(m[1]);
+            hi = Number(m[2]);
+        }
+        if (lo < min || hi > max || lo > hi)
+            return null;
+        for (let v = lo; v <= hi; v += step)
+            out.add(v);
+    }
+    return out.size > 0 ? out : null;
+}
+/** Parse a 5-field cron expression. Returns null when invalid. */
+export function parseCronExpression(expr) {
+    const fields = expr.trim().split(/\s+/);
+    if (fields.length !== 5)
+        return null;
+    const sets = [];
+    for (let i = 0; i < 5; i++) {
+        const [, min, max] = FIELD_RANGES[i];
+        const set = parseField(fields[i], min, max);
+        if (!set)
+            return null;
+        sets.push(set);
+    }
+    return {
+        minute: sets[0],
+        hour: sets[1],
+        dom: sets[2],
+        month: sets[3],
+        dow: sets[4],
+        domRestricted: fields[2] !== '*',
+        dowRestricted: fields[4] !== '*',
+    };
+}
+/** True when `date` (local time) matches the parsed cron. */
+export function matchesCron(p, date) {
+    if (!p.minute.has(date.getMinutes()))
+        return false;
+    if (!p.hour.has(date.getHours()))
+        return false;
+    if (!p.month.has(date.getMonth() + 1))
+        return false;
+    const domOk = p.dom.has(date.getDate());
+    const dowOk = p.dow.has(date.getDay());
+    // Standard cron OR semantics: if BOTH dom and dow are restricted, match when
+    // EITHER matches; otherwise both (the unrestricted one is always true) must.
+    if (p.domRestricted && p.dowRestricted)
+        return domOk || dowOk;
+    return domOk && dowOk;
+}
+/** Heuristic: is this schedule a one-shot ISO datetime (vs a cron expr)? */
+export function isOneShotSchedule(schedule) {
+    // Cron exprs are space-separated fields; ISO datetimes contain 'T' and no spaces.
+    return schedule.includes('T') && !/\s/.test(schedule.trim());
+}
+/**
+ * Strictly parse a one-shot ISO-8601 datetime → Unix ms, or null if invalid.
+ *
+ * `new Date()` alone is too lenient (e.g. it rolls "2026-13-13T…" into a real
+ * but wrong instant instead of rejecting it). We additionally require the
+ * canonical shape via regex AND verify the authored wall-clock fields name a
+ * real calendar instant, so an out-of-range month/day/hour can't sneak through
+ * as a silently shifted time — for ALL zone forms (Z, ±hh:mm, or none).
+ */
+export function parseOneShot(schedule) {
+    const s = schedule.trim();
+    // YYYY-MM-DDThh:mm(:ss(.fff)?)? with optional Z or ±hh:mm offset.
+    const m = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(?:\.\d{1,3})?)?(Z|[+-]\d{2}:\d{2})?$/.exec(s);
+    if (!m)
+        return null;
+    const t = new Date(s).getTime();
+    if (Number.isNaN(t))
+        return null;
+    // Reject lenient rollover. Calendar validity (is "Feb 31" a real date? is hour
+    // 25 valid?) is INDEPENDENT of the timezone, so validate the authored
+    // wall-clock fields with a zone-free UTC round-trip probe: if Date.UTC had to
+    // roll any field over, the rendered field won't match what the user wrote.
+    // This catches offset rollover (e.g. 2026-02-31T00:00:00+08:00) too — the old
+    // code skipped the check for numeric offsets and let it roll into March.
+    const yr = Number(m[1]);
+    const mo = Number(m[2]);
+    const day = Number(m[3]);
+    const hh = Number(m[4]);
+    const mm = Number(m[5]);
+    const ss = m[6] !== undefined ? Number(m[6]) : 0;
+    const probe = new Date(Date.UTC(yr, mo - 1, day, hh, mm, ss));
+    if (probe.getUTCFullYear() !== yr ||
+        probe.getUTCMonth() !== mo - 1 ||
+        probe.getUTCDate() !== day ||
+        probe.getUTCHours() !== hh ||
+        probe.getUTCMinutes() !== mm ||
+        probe.getUTCSeconds() !== ss) {
+        return null;
+    }
+    return t;
+}
+/**
+ * Compute the next fire time (Unix ms) strictly after `fromMs`, or null when
+ * there is none (a past/invalid one-shot, or an impossible cron).
+ *
+ * - one-shot ISO: its instant if still in the future, else null.
+ * - cron: scan minute-by-minute from the next whole minute, up to ~366 days.
+ */
+export function computeNextRun(schedule, recurring, fromMs) {
+    if (isOneShotSchedule(schedule)) {
+        const t = parseOneShot(schedule);
+        if (t === null)
+            return null;
+        return t > fromMs ? t : null;
+    }
+    const parsed = parseCronExpression(schedule);
+    if (!parsed)
+        return null;
+    void recurring; // cron exprs are inherently recurring; flag kept for symmetry
+    // Start at the next whole minute boundary after fromMs.
+    const start = new Date(fromMs);
+    start.setSeconds(0, 0);
+    start.setMinutes(start.getMinutes() + 1);
+    const MAX_MINUTES = 366 * 24 * 60;
+    const cursor = new Date(start);
+    for (let i = 0; i < MAX_MINUTES; i++) {
+        if (matchesCron(parsed, cursor))
+            return cursor.getTime();
+        cursor.setMinutes(cursor.getMinutes() + 1);
+    }
+    return null; // impossible schedule (e.g. Feb 31)
+}
+//# sourceMappingURL=cron-evaluator.js.map

package/dist/cron-evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron-evaluator.js","sourceRoot":"","sources":["../src/cron-evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAcH,MAAM,YAAY,GAAuF;IACvG,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;IACjB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;IACf,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;IACd,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;IAChB,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,aAAa;CAC7B,CAAC;AAEF,gFAAgF;AAChF,SAAS,UAAU,CAAC,GAAW,EAAE,GAAW,EAAE,GAAW;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAC5B,kCAAkC;QAClC,IAAI,OAA2B,CAAC;QAChC,IAAI,QAAQ,GAAG,GAAG,CAAC;QACnB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC/B,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxC,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YACvB,IAAI,IAAI,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5B,CAAC;QACD,IAAI,EAAU,CAAC;QACf,IAAI,EAAU,CAAC;QACf,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,GAAG,GAAG,CAAC;YACT,EAAE,GAAG,GAAG,CAAC;QACX,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3B,uEAAuE;YACvE,IAAI,OAAO,KAAK,SAAS;gBAAE,EAAE,GAAG,GAAG,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpB,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACjD,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACf,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACb,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACZ,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACd,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACZ,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;QAChC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;KACjC,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,WAAW,CAAC,CAAa,EAAE,IAAU;IACnD,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,aAAa;QAAE,OAAO,KAAK,IAAI,KAAK,CAAC;IAC9D,OAAO,KAAK,IAAI,KAAK,CAAC;AACxB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,kFAAkF;IAClF,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC1B,kEAAkE;IAClE,MAAM,CAAC,GAAG,0FAA0F,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7G,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAChC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,+EAA+E;IAC/E,sEAAsE;IACtE,8EAA8E;IAC9E,2EAA2E;IAC3E,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9D,IACE,KAAK,CAAC,cAAc,EAAE,KAAK,EAAE;QAC7B,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC;QAC9B,KAAK,CAAC,UAAU,EAAE,KAAK,GAAG;QAC1B,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE;QAC1B,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE;QAC5B,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,SAAkB,EAAE,MAAc;IACjF,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/B,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,KAAK,SAAS,CAAC,CAAC,8DAA8D;IAC9E,wDAAwD;IACxD,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvB,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC;QACzD,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,oCAAoC;AACnD,CAAC"}

package/dist/cron-fire-marker.d.ts

@@ -0,0 +1,24 @@
+/**
+ * #115: Cron-fire authenticity marker.
+ *
+ * Synthetic cron messages bypass the group @mention gate. To stop a malicious
+ * group member from forging that bypass by putting `_cronFire: true` in a real
+ * message payload, the scheduler stamps each synthetic message with a secret
+ * nonce generated ONCE at process start, and the router accepts the bypass only
+ * when the nonce matches. The nonce never leaves the process (it is not derived
+ * from anything an attacker can observe), so an inbound WS message cannot carry
+ * the right value.
+ *
+ * Shared in its own tiny module so both `cron-scheduler` (stamp) and
+ * `session-router` (verify) depend on it without a circular import.
+ */
+/** Per-process secret. Regenerated each start — synthetic messages are
+ *  in-memory and short-lived, so a fresh nonce per process is fine. */
+export declare const CRON_FIRE_NONCE: string;
+/** Payload key carrying the nonce on a synthetic cron message. */
+export declare const CRON_FIRE_NONCE_KEY = "_cronFireNonce";
+/** True only for a genuine in-process cron fire (marker + matching nonce). */
+export declare function isAuthenticCronFire(payload: {
+    _cronFire?: unknown;
+    [k: string]: unknown;
+}): boolean;

package/dist/cron-fire-marker.js

@@ -0,0 +1,25 @@
+/**
+ * #115: Cron-fire authenticity marker.
+ *
+ * Synthetic cron messages bypass the group @mention gate. To stop a malicious
+ * group member from forging that bypass by putting `_cronFire: true` in a real
+ * message payload, the scheduler stamps each synthetic message with a secret
+ * nonce generated ONCE at process start, and the router accepts the bypass only
+ * when the nonce matches. The nonce never leaves the process (it is not derived
+ * from anything an attacker can observe), so an inbound WS message cannot carry
+ * the right value.
+ *
+ * Shared in its own tiny module so both `cron-scheduler` (stamp) and
+ * `session-router` (verify) depend on it without a circular import.
+ */
+import { randomBytes } from 'node:crypto';
+/** Per-process secret. Regenerated each start — synthetic messages are
+ *  in-memory and short-lived, so a fresh nonce per process is fine. */
+export const CRON_FIRE_NONCE = randomBytes(16).toString('hex');
+/** Payload key carrying the nonce on a synthetic cron message. */
+export const CRON_FIRE_NONCE_KEY = '_cronFireNonce';
+/** True only for a genuine in-process cron fire (marker + matching nonce). */
+export function isAuthenticCronFire(payload) {
+    return payload._cronFire === true && payload[CRON_FIRE_NONCE_KEY] === CRON_FIRE_NONCE;
+}
+//# sourceMappingURL=cron-fire-marker.js.map

package/dist/cron-fire-marker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron-fire-marker.js","sourceRoot":"","sources":["../src/cron-fire-marker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;uEACuE;AACvE,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAE/D,kEAAkE;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAEpD,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CAAC,OAAsD;IACxF,OAAO,OAAO,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,mBAAmB,CAAC,KAAK,eAAe,CAAC;AACxF,CAAC"}

package/dist/cron-scheduler.d.ts

@@ -0,0 +1,46 @@
+/**
+ * #115: Cron scheduler — a resident per-bot loop that fires due tasks.
+ *
+ * Every tick it loads the bot's cron.json, and for each enabled task whose
+ * `nextRun` is past, synthesizes a BotMessage (the task's prompt as a Text
+ * message, bound to the task's session coords, marked `_cronFire`) and hands it
+ * to `onFire` — which the gateway wires to the same `onInbound` real messages
+ * use, so a fired task runs through the entire normal pipeline.
+ *
+ * Best-effort throughout: a failing task is logged and skipped, never crashing
+ * the loop. Missed tasks (process was down across their window) fire ONCE on
+ * catch-up, then advance to the next future occurrence — no thundering herd.
+ */
+import type { BotMessage } from './octo/types.js';
+import { CronStore, type CronTask } from './cron-store.js';
+/** How often the scheduler scans cron.json (ms). 30s → ≤30s firing latency. */
+export declare const CRON_TICK_MS = 30000;
+export interface CronSchedulerOptions {
+    cronStore: CronStore;
+    /**
+     * Invoked with a synthetic BotMessage when a task is due (= onInbound). Fire
+     * is non-blocking; the scheduler does not await it and nextRun advances
+     * regardless (a failed fire is logged at the handler's own catch site —
+     * attributed to the task via the `cron:<id>:<ts>` message_id — not retried, to
+     * avoid an error loop hammering the channel).
+     */
+    onFire: (msg: BotMessage) => void;
+    /** Log prefix, e.g. "[bot-id] " in multi-bot mode. */
+    label?: string;
+}
+/** Build the synthetic inbound message for a fired task. */
+export declare function synthesizeCronMessage(task: CronTask): BotMessage;
+export declare class CronScheduler {
+    private readonly opts;
+    private timer;
+    constructor(opts: CronSchedulerOptions);
+    /** Arm the periodic scan. Idempotent. */
+    start(): void;
+    /** Stop scanning. */
+    stop(): void;
+    /**
+     * One scan: fire due tasks, advance/drop them, persist. Exposed for tests.
+     * Never throws.
+     */
+    tick(): void;
+}

package/dist/cron-scheduler.js

@@ -0,0 +1,114 @@
+/**
+ * #115: Cron scheduler — a resident per-bot loop that fires due tasks.
+ *
+ * Every tick it loads the bot's cron.json, and for each enabled task whose
+ * `nextRun` is past, synthesizes a BotMessage (the task's prompt as a Text
+ * message, bound to the task's session coords, marked `_cronFire`) and hands it
+ * to `onFire` — which the gateway wires to the same `onInbound` real messages
+ * use, so a fired task runs through the entire normal pipeline.
+ *
+ * Best-effort throughout: a failing task is logged and skipped, never crashing
+ * the loop. Missed tasks (process was down across their window) fire ONCE on
+ * catch-up, then advance to the next future occurrence — no thundering herd.
+ */
+import { MessageType } from './octo/types.js';
+import { computeNextRun } from './cron-evaluator.js';
+import { CRON_FIRE_NONCE, CRON_FIRE_NONCE_KEY } from './cron-fire-marker.js';
+/** How often the scheduler scans cron.json (ms). 30s → ≤30s firing latency. */
+export const CRON_TICK_MS = 30_000;
+/** Build the synthetic inbound message for a fired task. */
+export function synthesizeCronMessage(task) {
+    return {
+        message_id: `cron:${task.id}:${Date.now()}`,
+        message_seq: 0,
+        from_uid: task.fromUid,
+        from_name: task.fromName,
+        channel_id: task.channelId,
+        channel_type: task.channelType,
+        timestamp: Math.floor(Date.now() / 1000),
+        payload: {
+            type: MessageType.Text,
+            content: task.prompt,
+            // Synthetic marker + per-process nonce: lets the router bypass the group
+            // @mention gate for genuine in-process cron fires only (see
+            // session-router isCronFire / cron-fire-marker). A forged inbound payload
+            // can set `_cronFire` but cannot know the secret nonce. Allowed by the
+            // MessagePayload index signature; never set on real inbound messages.
+            _cronFire: true,
+            [CRON_FIRE_NONCE_KEY]: CRON_FIRE_NONCE,
+        },
+    };
+}
+export class CronScheduler {
+    opts;
+    timer = null;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    /** Arm the periodic scan. Idempotent. */
+    start() {
+        if (this.timer)
+            return;
+        this.timer = setInterval(() => this.tick(), CRON_TICK_MS);
+        this.timer.unref(); // never keep the process alive on the cron loop alone
+    }
+    /** Stop scanning. */
+    stop() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = null;
+        }
+    }
+    /**
+     * One scan: fire due tasks, advance/drop them, persist. Exposed for tests.
+     * Never throws.
+     */
+    tick() {
+        const now = Date.now();
+        // Single atomic read-modify-write: fire due tasks and persist the survivor
+        // set in one synchronous pass, so a concurrent tool create/delete (which
+        // also goes through cronStore.update) can't lose updates against us.
+        try {
+            this.opts.cronStore.update((tasks) => {
+                const survivors = [];
+                let changed = false;
+                for (const task of tasks) {
+                    if (!task.enabled || task.nextRun === null || task.nextRun > now) {
+                        survivors.push(task);
+                        continue;
+                    }
+                    changed = true;
+                    // Due. Fire (best-effort; onFire is fire-and-forget).
+                    const lateMin = Math.round((now - task.nextRun) / 60_000);
+                    if (lateMin >= 1) {
+                        console.warn(`[cc-channel-octo] ${this.opts.label ?? ''}cron: task ${task.id} (${task.schedule}) ` +
+                            `fired ${lateMin} min late (catch-up)`);
+                    }
+                    try {
+                        // Fire-and-forget: onFire (= onInbound) drives the full pipeline,
+                        // which swallows its own errors and posts a user-facing reply. A
+                        // FAILED fire is attributed to this task at handleMessage's catch
+                        // site (via the `cron:<id>:<ts>` message_id) — not here, because the
+                        // returned value is void and never rejects.
+                        this.opts.onFire(synthesizeCronMessage(task));
+                    }
+                    catch (err) {
+                        console.error(`[cc-channel-octo] ${this.opts.label ?? ''}cron: onFire threw for ${task.id}: ${String(err)}`);
+                    }
+                    task.lastRun = now;
+                    if (task.recurring) {
+                        task.nextRun = computeNextRun(task.schedule, true, now);
+                        survivors.push(task); // keep; next future occurrence (or null → inert)
+                    }
+                    // one-shot: drop (not pushed to survivors)
+                }
+                // Return the SAME reference when nothing fired so update() skips the write.
+                return changed ? survivors : tasks;
+            });
+        }
+        catch (err) {
+            console.error(`[cc-channel-octo] ${this.opts.label ?? ''}cron: tick failed: ${String(err)}`);
+        }
+    }
+}
+//# sourceMappingURL=cron-scheduler.js.map

package/dist/cron-scheduler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron-scheduler.js","sourceRoot":"","sources":["../src/cron-scheduler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG9C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE7E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AAgBnC,4DAA4D;AAC5D,MAAM,UAAU,qBAAqB,CAAC,IAAc;IAClD,OAAO;QACL,UAAU,EAAE,QAAQ,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;QAC3C,WAAW,EAAE,CAAC;QACd,QAAQ,EAAE,IAAI,CAAC,OAAO;QACtB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,YAAY,EAAE,IAAI,CAAC,WAA0B;QAC7C,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACxC,OAAO,EAAE;YACP,IAAI,EAAE,WAAW,CAAC,IAAI;YACtB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,yEAAyE;YACzE,4DAA4D;YAC5D,0EAA0E;YAC1E,uEAAuE;YACvE,sEAAsE;YACtE,SAAS,EAAE,IAAI;YACf,CAAC,mBAAmB,CAAC,EAAE,eAAe;SACvC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,aAAa;IAGK;IAFrB,KAAK,GAA0C,IAAI,CAAC;IAE5D,YAA6B,IAA0B;QAA1B,SAAI,GAAJ,IAAI,CAAsB;IAAG,CAAC;IAE3D,yCAAyC;IACzC,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,YAAY,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,sDAAsD;IAC5E,CAAC;IAED,qBAAqB;IACrB,IAAI;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,IAAI;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,2EAA2E;QAC3E,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACnC,MAAM,SAAS,GAAe,EAAE,CAAC;gBACjC,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;wBACjE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBACrB,SAAS;oBACX,CAAC;oBACD,OAAO,GAAG,IAAI,CAAC;oBACf,sDAAsD;oBACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;oBAC1D,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;wBACjB,OAAO,CAAC,IAAI,CACV,qBAAqB,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,cAAc,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,IAAI;4BACnF,SAAS,OAAO,sBAAsB,CACzC,CAAC;oBACJ,CAAC;oBACD,IAAI,CAAC;wBACH,kEAAkE;wBAClE,iEAAiE;wBACjE,kEAAkE;wBAClE,qEAAqE;wBACrE,4CAA4C;wBAC5C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;oBAChD,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,CAAC,KAAK,CACX,qBAAqB,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,0BAA0B,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9F,CAAC;oBACJ,CAAC;oBACD,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC;oBACnB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;wBACnB,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;wBACxD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,iDAAiD;oBACzE,CAAC;oBACD,2CAA2C;gBAC7C,CAAC;gBACD,4EAA4E;gBAC5E,OAAO,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;YACrC,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,sBAAsB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;CACF"}