@moxxy/plugin-channel-imessage 0.29.0

package/dist/keys.js

@@ -0,0 +1,111 @@
+/**
+ * Vault keys + pure handle helpers shared by the channel, its subcommands, and
+ * the interactive setup wizard. Kept in their own module (the signal/whatsapp
+ * `keys.ts` pattern) so wizard helpers can import them without pulling in the
+ * plugin's full index (or, worse, socket.io-client — which stays behind a lazy
+ * import in `bluebubbles-client.ts`).
+ *
+ * Note on custody: the BlueBubbles server (a native macOS app) holds the actual
+ * iMessage identity + message store. The moxxy vault only stores the localhost
+ * server URL, its password, and two JSON handle arrays — the allow-list of OTHER
+ * people who may drive the agent, and the owner's own handle(s) that enable
+ * texting moxxy from your own devices (the "self-chat").
+ */
+/** Vault key for the BlueBubbles server URL (e.g. http://localhost:1234). */
+export const IMESSAGE_SERVER_URL_KEY = 'imessage_server_url';
+/** Env override for the server URL — beats the vault (shared precedence). */
+export const IMESSAGE_SERVER_URL_ENV = 'MOXXY_IMESSAGE_SERVER_URL';
+/** Vault key for the BlueBubbles server password. */
+export const IMESSAGE_SERVER_PASSWORD_KEY = 'imessage_server_password';
+/** Env override for the server password — beats the vault. */
+export const IMESSAGE_SERVER_PASSWORD_ENV = 'MOXXY_IMESSAGE_SERVER_PASSWORD';
+/**
+ * Vault key for the allow-list: a JSON array of iMessage handles (E.164 phone
+ * numbers and/or Apple-ID emails) that OTHER people may use to drive the
+ * session. The owner's own handle is NOT listed here — it lives in
+ * {@link IMESSAGE_OWNER_HANDLES_KEY} so an inbound from a friend and an outbound
+ * from the owner stay distinguishable (never react to the owner's private
+ * conversations with allow-listed friends).
+ */
+export const IMESSAGE_ALLOWED_HANDLES_KEY = 'imessage_allowed_handles';
+/**
+ * Vault key for the owner's OWN handle(s): a JSON array of the account owner's
+ * E.164 numbers / Apple-ID emails. A message the account itself sent
+ * (`isFromMe`) drives a turn only when it lands in a 1:1 chat with one of these
+ * handles — i.e. the owner texting their own "self-chat" from any Apple device.
+ * Empty (the default) means self-chat is off and every `isFromMe` message is
+ * dropped (fail closed); the friend allow-list path is unaffected.
+ */
+export const IMESSAGE_OWNER_HANDLES_KEY = 'imessage_owner_handles';
+/** E.164 shape: `+` then 7–15 digits, no leading zero. */
+export const E164_RE = /^\+[1-9]\d{6,14}$/;
+/** Pragmatic email shape (Apple-ID handles). Deliberately loose but anchored. */
+export const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/** Whether a normalized string is a plausible iMessage handle. */
+export function isHandle(value) {
+    return E164_RE.test(value) || EMAIL_RE.test(value);
+}
+/**
+ * Canonical handle for allow-list comparisons: trimmed, and lowercased when it
+ * is an email (Apple-ID handles are case-insensitive). Phone numbers are left
+ * as-is (they are already digits + `+`).
+ */
+export function normalizeHandle(raw) {
+    const trimmed = raw.trim();
+    return trimmed.includes('@') ? trimmed.toLowerCase() : trimmed;
+}
+/**
+ * Parse a stored handle list. Returns `[]` for a missing OR corrupt value
+ * rather than throwing — a corrupt vault entry must degrade to "nobody extra is
+ * allowed" (fail closed), never crash the channel or silently allow. Non-string
+ * entries and entries that are neither an E.164 number nor an email are dropped.
+ */
+export function parseHandleList(raw) {
+    if (!raw)
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    if (!Array.isArray(parsed))
+        return [];
+    const out = new Set();
+    for (const entry of parsed) {
+        if (typeof entry !== 'string')
+            continue;
+        const handle = normalizeHandle(entry);
+        if (isHandle(handle))
+            out.add(handle);
+    }
+    return [...out];
+}
+/**
+ * Parse the chat GUID BlueBubbles stamps on every message
+ * (`SERVICE;TYPE;IDENTIFIER`, e.g. `iMessage;-;+15551234567`). TYPE is `-` for a
+ * 1:1 chat and `+` for a group. Returns null for anything that is not a
+ * well-formed 1:1 GUID (groups included) so callers treat it as "not a DM" and
+ * drop it (v1 is direct-message only).
+ */
+export function parseDmChatGuid(guid) {
+    if (typeof guid !== 'string')
+        return null;
+    const parts = guid.split(';');
+    if (parts.length !== 3)
+        return null;
+    const [rawService, rawType, rawIdentifier] = parts;
+    if (rawService === undefined || rawType === undefined || rawIdentifier === undefined)
+        return null;
+    const service = rawService.trim();
+    const type = rawType.trim();
+    const identifier = rawIdentifier.trim();
+    if (service.length === 0 || type !== '-' || identifier.length === 0)
+        return null;
+    const handle = normalizeHandle(identifier);
+    if (!isHandle(handle))
+        return null;
+    return { service, handle };
+}
+//# sourceMappingURL=keys.js.map

package/dist/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAC7D,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AACnE,qDAAqD;AACrD,MAAM,CAAC,MAAM,4BAA4B,GAAG,0BAA0B,CAAC;AACvE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,4BAA4B,GAAG,gCAAgC,CAAC;AAC7E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,0BAA0B,CAAC;AACvE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAEnE,0DAA0D;AAC1D,MAAM,CAAC,MAAM,OAAO,GAAG,mBAAmB,CAAC;AAE3C,iFAAiF;AACjF,MAAM,CAAC,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAErD,kEAAkE;AAClE,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAA8B;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,QAAQ,CAAC,MAAM,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA+B;IAE/B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC;IACnD,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAClG,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC"}

package/dist/message-gate.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The single inbound gate every session-reaching path goes through (AGENTS.md:
+ * gate EVERY session-reaching path behind pairing; A8: zod-validate inbound
+ * before it touches the session). Pure — the channel feeds it the raw
+ * BlueBubbles `new-message` payload plus its identity/allow-list state and
+ * branches on the verdict.
+ *
+ * Order of checks (each is load-bearing, mirroring the WhatsApp gate):
+ *  1. shape-validate + size-cap the consumed fields (zod).
+ *  2. drop own echoes: BlueBubbles emits `new-message` for the account's OWN
+ *     sends too (our replies come back `isFromMe`), so without the sent-id check
+ *     the bot would answer itself in a loop — and a self-chat reply would be
+ *     mistaken for a fresh owner prompt.
+ *  3. direct messages only (v1): a group chat GUID is dropped — group fan-in
+ *     needs its own trust story.
+ *  4. drop `isFromMe` messages outside the owner's self-chat: those are the
+ *     owner talking to OTHER people from an Apple device — never a prompt. Only
+ *     `isFromMe` in a 1:1 chat with one of the owner's own handles drives a turn.
+ *  5. allow-list by normalized handle for inbound (non-`isFromMe`) messages.
+ *     Unauthorized senders are dropped SILENTLY — replying would leak the bot's
+ *     existence.
+ */
+export type GateVerdict = {
+    readonly ok: false;
+    readonly reason: string;
+} | {
+    readonly ok: true;
+    readonly chatGuid: string;
+    readonly text: string;
+};
+export interface GateState {
+    /** The owner's own normalized handle(s) — the self-chat identities. */
+    readonly ownerHandles: ReadonlySet<string>;
+    /** Normalized handles of OTHER people allowed to drive the session. */
+    readonly allowedHandles: ReadonlySet<string>;
+    /** True for a guid/tempGuid of THIS channel's own recent send (echo/loop protection). */
+    readonly isOwnSend: (id: string) => boolean;
+}
+export declare function gateInboundMessage(state: GateState, raw: unknown): GateVerdict;
+//# sourceMappingURL=message-gate.d.ts.map

package/dist/message-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-gate.d.ts","sourceRoot":"","sources":["../src/message-gate.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3C,uEAAuE;IACvE,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7C,yFAAyF;IACzF,QAAQ,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC;CAC7C;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,GAAG,WAAW,CAmC9E"}

package/dist/message-gate.js

@@ -0,0 +1,54 @@
+import { normalizeHandle, parseDmChatGuid } from './keys.js';
+import { messageSchema } from './schema.js';
+export function gateInboundMessage(state, raw) {
+    const parsed = messageSchema.safeParse(raw);
+    if (!parsed.success)
+        return drop('invalid message shape');
+    const message = parsed.data;
+    const chats = message.chats;
+    const firstChat = chats && chats.length > 0 ? chats[0] : undefined;
+    if (!firstChat)
+        return drop('message without a chat');
+    const chatGuid = firstChat.guid;
+    // Own-echo drop FIRST — a reply we sent into a self-chat comes back isFromMe
+    // and would otherwise re-enter as an owner prompt (loop).
+    if (state.isOwnSend(message.guid))
+        return drop('own outbound echo (guid)');
+    const tempGuid = message.tempGuid;
+    if (tempGuid && state.isOwnSend(tempGuid))
+        return drop('own outbound echo (tempGuid)');
+    const dm = parseDmChatGuid(chatGuid);
+    if (!dm)
+        return drop('not a 1:1 direct message');
+    if (message.isFromMe === true) {
+        // Same-account messages: only the owner's own self-chat is a prompt surface.
+        if (!state.ownerHandles.has(dm.handle)) {
+            return drop('own message in a foreign chat');
+        }
+    }
+    else {
+        const senderHandle = resolveSender(message.handle, dm.handle);
+        if (!state.allowedHandles.has(senderHandle)) {
+            return drop('sender not allow-listed');
+        }
+    }
+    const text = typeof message.text === 'string' ? message.text.trim() : '';
+    if (text.length === 0)
+        return drop('no message text');
+    return { ok: true, chatGuid, text };
+}
+/**
+ * The sender's handle for an inbound message: the message's own `handle`
+ * address when present, else the 1:1 chat's counterpart (they are the same
+ * party in a DM). Narrowed once, then plain access — no optional-chain depth.
+ */
+function resolveSender(handle, chatHandle) {
+    if (handle && typeof handle.address === 'string' && handle.address.length > 0) {
+        return normalizeHandle(handle.address);
+    }
+    return chatHandle;
+}
+function drop(reason) {
+    return { ok: false, reason };
+}
+//# sourceMappingURL=message-gate.js.map

package/dist/message-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-gate.js","sourceRoot":"","sources":["../src/message-gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAsC5C,MAAM,UAAU,kBAAkB,CAAC,KAAgB,EAAE,GAAY;IAC/D,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;IAE5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,SAAS,GAAG,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC;IAEhC,6EAA6E;IAC7E,0DAA0D;IAC1D,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAEvF,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAEjD,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9B,6EAA6E;QAC7E,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAEtD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CACpB,MAA+D,EAC/D,UAAkB;IAElB,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9E,OAAO,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC"}

package/dist/permission.d.ts

@@ -0,0 +1,25 @@
+import type { PermissionResolver } from '@moxxy/sdk';
+export interface ImessagePermissionLogger {
+    info?(msg: string, meta?: Record<string, unknown>): void;
+}
+/**
+ * Build the iMessage channel's autonomous permission resolver.
+ *
+ * Like Signal and Slack (and unlike Telegram's inline-keyboard prompts), the
+ * iMessage channel runs hands-off: the operator declares trust upfront via
+ * `channels.imessage.allowedTools`, and any tool NOT in that list is denied.
+ * The trust check + `'*'` expansion + audit-on-auto-approve wiring is the shared
+ * {@link createAuditedAllowListResolver} from `@moxxy/channel-kit`; this wrapper
+ * binds it to the channel logger so every auto-approved call leaves a trail. An
+ * empty list denies everything (effectively read-only).
+ *
+ * Because this resolver decides synchronously (no deferred operator prompt), it
+ * has no pending-prompt state, so `stop()` has nothing to `abortAll` — aborting
+ * the in-flight turn is enough.
+ */
+export declare function buildImessagePermissionResolver(opts: {
+    allowedTools: ReadonlyArray<string>;
+    allToolNames: ReadonlyArray<string>;
+    logger?: ImessagePermissionLogger;
+}): PermissionResolver;
+//# sourceMappingURL=permission.d.ts.map

package/dist/permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE;IACpD,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,CAAC,EAAE,wBAAwB,CAAC;CACnC,GAAG,kBAAkB,CAarB"}

package/dist/permission.js

@@ -0,0 +1,31 @@
+import { createAuditedAllowListResolver } from '@moxxy/channel-kit';
+/**
+ * Build the iMessage channel's autonomous permission resolver.
+ *
+ * Like Signal and Slack (and unlike Telegram's inline-keyboard prompts), the
+ * iMessage channel runs hands-off: the operator declares trust upfront via
+ * `channels.imessage.allowedTools`, and any tool NOT in that list is denied.
+ * The trust check + `'*'` expansion + audit-on-auto-approve wiring is the shared
+ * {@link createAuditedAllowListResolver} from `@moxxy/channel-kit`; this wrapper
+ * binds it to the channel logger so every auto-approved call leaves a trail. An
+ * empty list denies everything (effectively read-only).
+ *
+ * Because this resolver decides synchronously (no deferred operator prompt), it
+ * has no pending-prompt state, so `stop()` has nothing to `abortAll` — aborting
+ * the in-flight turn is enough.
+ */
+export function buildImessagePermissionResolver(opts) {
+    return createAuditedAllowListResolver({
+        name: 'imessage-allow-list',
+        allowedTools: opts.allowedTools,
+        allToolNames: opts.allToolNames,
+        onAutoApprove: (call, { wildcard }) => {
+            opts.logger?.info?.('imessage: auto-approved tool call', {
+                tool: call.name,
+                callId: call.callId,
+                wildcard,
+            });
+        },
+    });
+}
+//# sourceMappingURL=permission.js.map

package/dist/permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.js","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAOpE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAI/C;IACC,OAAO,8BAA8B,CAAC;QACpC,IAAI,EAAE,qBAAqB;QAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YACpC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,mCAAmC,EAAE;gBACvD,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/schema.d.ts

@@ -0,0 +1,96 @@
+import { z } from 'zod';
+/**
+ * Zod validation for the BlueBubbles socket.io `new-message` payload — a
+ * serialized Message object. Every inbound message is validated + size-capped
+ * BEFORE any field reaches the session (channel invariant A8). Only the fields
+ * the channel consumes are typed; unknown extras pass through untouched so a
+ * newer BlueBubbles server doesn't fail validation, but nothing un-modeled is
+ * ever read.
+ */
+/** Cap on inbound prompt text we will forward to the model. */
+export declare const MAX_INBOUND_TEXT_CHARS = 16000;
+/** A single participant handle on a chat / message (`{ address, ... }`). */
+export declare const handleSchema: z.ZodObject<{
+    address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.ZodTypeAny, "passthrough">>;
+/** A chat the message belongs to. `guid` is `SERVICE;TYPE;IDENTIFIER`. */
+export declare const chatSchema: z.ZodObject<{
+    guid: z.ZodString;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    guid: z.ZodString;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    guid: z.ZodString;
+}, z.ZodTypeAny, "passthrough">>;
+/**
+ * The serialized Message. `guid` is the stable per-message id (used for the
+ * anti-echo drop); `tempGuid` echoes back the value the sender chose for an
+ * apple-script send, so our own replies can be recognised even before their
+ * permanent guid is known.
+ */
+export declare const messageSchema: z.ZodObject<{
+    guid: z.ZodString;
+    tempGuid: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    text: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    isFromMe: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    handle: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.ZodTypeAny, "passthrough">>>>;
+    chats: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        guid: z.ZodString;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        guid: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        guid: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+    dateCreated: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    guid: z.ZodString;
+    tempGuid: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    text: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    isFromMe: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    handle: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.ZodTypeAny, "passthrough">>>>;
+    chats: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        guid: z.ZodString;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        guid: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        guid: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+    dateCreated: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    guid: z.ZodString;
+    tempGuid: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    text: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    isFromMe: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
+    handle: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.ZodTypeAny, "passthrough">>>>;
+    chats: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        guid: z.ZodString;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        guid: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        guid: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+    dateCreated: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+}, z.ZodTypeAny, "passthrough">>;
+export type ImessageMessage = z.infer<typeof messageSchema>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AAEH,+DAA+D;AAC/D,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,4EAA4E;AAC5E,eAAO,MAAM,YAAY;;;;;;gCAIT,CAAC;AAEjB,0EAA0E;AAC1E,eAAO,MAAM,UAAU;;;;;;gCAIP,CAAC;AAEjB;;;;;GAKG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAUV,CAAC;AAEjB,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}

package/dist/schema.js

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+/**
+ * Zod validation for the BlueBubbles socket.io `new-message` payload — a
+ * serialized Message object. Every inbound message is validated + size-capped
+ * BEFORE any field reaches the session (channel invariant A8). Only the fields
+ * the channel consumes are typed; unknown extras pass through untouched so a
+ * newer BlueBubbles server doesn't fail validation, but nothing un-modeled is
+ * ever read.
+ */
+/** Cap on inbound prompt text we will forward to the model. */
+export const MAX_INBOUND_TEXT_CHARS = 16_000;
+/** A single participant handle on a chat / message (`{ address, ... }`). */
+export const handleSchema = z
+    .object({
+    address: z.string().min(1).max(256).nullable().optional(),
+})
+    .passthrough();
+/** A chat the message belongs to. `guid` is `SERVICE;TYPE;IDENTIFIER`. */
+export const chatSchema = z
+    .object({
+    guid: z.string().min(1).max(256),
+})
+    .passthrough();
+/**
+ * The serialized Message. `guid` is the stable per-message id (used for the
+ * anti-echo drop); `tempGuid` echoes back the value the sender chose for an
+ * apple-script send, so our own replies can be recognised even before their
+ * permanent guid is known.
+ */
+export const messageSchema = z
+    .object({
+    guid: z.string().min(1).max(256),
+    tempGuid: z.string().min(1).max(256).nullable().optional(),
+    text: z.string().max(MAX_INBOUND_TEXT_CHARS).nullable().optional(),
+    isFromMe: z.boolean().nullable().optional(),
+    handle: handleSchema.nullable().optional(),
+    chats: z.array(chatSchema).max(16).optional(),
+    dateCreated: z.number().nullable().optional(),
+})
+    .passthrough();
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;GAOG;AAEH,+DAA+D;AAC/D,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE7C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,0EAA0E;AAC1E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACjC,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC;KACD,WAAW,EAAE,CAAC"}

package/dist/setup-wizard.d.ts

@@ -0,0 +1,15 @@
+import type { ChannelSubcommandContext } from '@moxxy/sdk';
+/**
+ * Interactive iMessage (BlueBubbles) setup wizard (the channel's
+ * `interactiveCommand`).
+ *
+ * Walks the operator through:
+ *   1. the BlueBubbles server URL + password (stored in the vault),
+ *   2. a best-effort reachability check against that server,
+ *   3. the handle allow-list — who besides yourself may talk to the agent,
+ *   4. your own handle(s), so texting your own "self-chat" reaches moxxy,
+ *   5. the autonomous tool allow-list,
+ * then starts the channel.
+ */
+export declare function runImessageWizard(ctx: ChannelSubcommandContext): Promise<number>;
+//# sourceMappingURL=setup-wizard.d.ts.map

package/dist/setup-wizard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-wizard.d.ts","sourceRoot":"","sources":["../src/setup-wizard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAiB3D;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiHtF"}

package/dist/setup-wizard.js

@@ -0,0 +1,127 @@
+import { cancel, intro, isCancel, log, note, outro, password, text } from '@clack/prompts';
+import { IMESSAGE_ALLOWED_HANDLES_KEY, IMESSAGE_OWNER_HANDLES_KEY, IMESSAGE_SERVER_PASSWORD_KEY, IMESSAGE_SERVER_URL_KEY, isHandle, normalizeHandle, parseHandleList, } from './keys.js';
+import { BlueBubblesClient } from './bluebubbles-client.js';
+const ANSI = process.stdout.isTTY && !process.env.NO_COLOR;
+const bold = (s) => (ANSI ? `\x1b[1m${s}\x1b[22m` : s);
+const dim = (s) => (ANSI ? `\x1b[2m${s}\x1b[22m` : s);
+/**
+ * Interactive iMessage (BlueBubbles) setup wizard (the channel's
+ * `interactiveCommand`).
+ *
+ * Walks the operator through:
+ *   1. the BlueBubbles server URL + password (stored in the vault),
+ *   2. a best-effort reachability check against that server,
+ *   3. the handle allow-list — who besides yourself may talk to the agent,
+ *   4. your own handle(s), so texting your own "self-chat" reaches moxxy,
+ *   5. the autonomous tool allow-list,
+ * then starts the channel.
+ */
+export async function runImessageWizard(ctx) {
+    const vault = ctx.deps.vault;
+    intro(bold('moxxy imessage setup'));
+    note('moxxy talks to iMessage through a BlueBubbles server running on THIS Mac.\n' +
+        'Install it from https://bluebubbles.app, sign in to Messages, and set a\n' +
+        'server password. This channel uses the stock apple-script send method — no\n' +
+        'SIP changes or Private API needed. v1 handles 1:1 text chats only.', 'how the iMessage channel works');
+    const existingUrl = await vault.get(IMESSAGE_SERVER_URL_KEY);
+    const serverUrl = await text({
+        message: 'BlueBubbles server URL',
+        placeholder: 'http://localhost:1234',
+        initialValue: existingUrl ?? 'http://localhost:1234',
+        validate: (v) => {
+            if (!v || !v.trim())
+                return 'required';
+            try {
+                // eslint-disable-next-line no-new
+                new URL(v.trim());
+                return undefined;
+            }
+            catch {
+                return 'expected a URL, e.g. http://localhost:1234';
+            }
+        },
+    });
+    if (isCancel(serverUrl)) {
+        cancel('cancelled.');
+        return 0;
+    }
+    const url = String(serverUrl).trim();
+    const serverPassword = await password({
+        message: 'BlueBubbles server password',
+        validate: (v) => (v && v.length > 0 ? undefined : 'required'),
+    });
+    if (isCancel(serverPassword)) {
+        cancel('cancelled.');
+        return 0;
+    }
+    const pass = String(serverPassword);
+    await vault.set(IMESSAGE_SERVER_URL_KEY, url, ['imessage']);
+    await vault.set(IMESSAGE_SERVER_PASSWORD_KEY, pass, ['imessage']);
+    log.success('Stored the BlueBubbles server URL + password in the vault.');
+    // Best-effort reachability probe — the ping only uses fetch, no socket.
+    try {
+        await new BlueBubblesClient({ serverUrl: url, password: pass }).ping();
+        log.success('Reached the BlueBubbles server.');
+    }
+    catch (err) {
+        log.warn(`Could not reach the server yet: ${err instanceof Error ? err.message : String(err)}\n` +
+            'You can still finish setup — the channel will retry when it starts.');
+    }
+    const allowAnswer = await text({
+        message: 'Handles allowed to talk to moxxy (comma-separated E.164 numbers / Apple-ID emails)',
+        placeholder: '+15551234567, friend@icloud.com',
+        initialValue: parseHandleList(await vault.get(IMESSAGE_ALLOWED_HANDLES_KEY)).join(', '),
+    });
+    if (isCancel(allowAnswer)) {
+        cancel('cancelled.');
+        return 0;
+    }
+    const allowed = parseHandleInput(String(allowAnswer));
+    await vault.set(IMESSAGE_ALLOWED_HANDLES_KEY, JSON.stringify(allowed), ['imessage']);
+    log.success(allowed.length > 0
+        ? `Allow-list saved (${allowed.length} handle(s)).`
+        : 'Allow-list cleared (no external senders allowed).');
+    note('To talk to moxxy from your OWN Apple devices (texting your "self-chat"),\n' +
+        'add your own iMessage handle(s) below. Leave blank to keep self-chat off —\n' +
+        "your outbound messages to other people are never treated as prompts.", 'your own handles (self-chat)');
+    const ownerAnswer = await text({
+        message: 'Your own handle(s) (comma-separated; blank to skip)',
+        placeholder: '+15559876543, you@icloud.com',
+        initialValue: parseHandleList(await vault.get(IMESSAGE_OWNER_HANDLES_KEY)).join(', '),
+    });
+    if (isCancel(ownerAnswer)) {
+        cancel('cancelled.');
+        return 0;
+    }
+    const owner = parseHandleInput(String(ownerAnswer));
+    await vault.set(IMESSAGE_OWNER_HANDLES_KEY, JSON.stringify(owner), ['imessage']);
+    log.success(owner.length > 0 ? `Self-chat enabled for ${owner.length} handle(s).` : 'Self-chat left off.');
+    const allowToolsAnswer = await text({
+        message: 'Autonomous tool allow-list (comma-separated; "*" = all, blank = read-only)',
+        placeholder: 'Read, Grep, Glob',
+    });
+    if (isCancel(allowToolsAnswer)) {
+        cancel('cancelled.');
+        return 0;
+    }
+    const allowedTools = String(allowToolsAnswer)
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+    log.info('Starting the channel. Press Ctrl+C to stop.');
+    outro(dim('handing off to the channel…'));
+    return ctx.startChannel({ allowedTools });
+}
+/** Split comma/whitespace-separated handle input, normalize, drop non-handles. */
+function parseHandleInput(raw) {
+    const out = new Set();
+    for (const token of raw.split(/[,\s]+/)) {
+        if (!token)
+            continue;
+        const handle = normalizeHandle(token);
+        if (isHandle(handle))
+            out.add(handle);
+    }
+    return [...out];
+}
+//# sourceMappingURL=setup-wizard.js.map

package/dist/setup-wizard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-wizard.js","sourceRoot":"","sources":["../src/setup-wizard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAG3F,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,QAAQ,EACR,eAAe,EACf,eAAe,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC3D,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEtE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAA6B;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAmB,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAEpC,IAAI,CACF,6EAA6E;QAC3E,2EAA2E;QAC3E,8EAA8E;QAC9E,oEAAoE,EACtE,gCAAgC,CACjC,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC;QAC3B,OAAO,EAAE,wBAAwB;QACjC,WAAW,EAAE,uBAAuB;QACpC,YAAY,EAAE,WAAW,IAAI,uBAAuB;QACpD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;YACd,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;gBAAE,OAAO,UAAU,CAAC;YACvC,IAAI,CAAC;gBACH,kCAAkC;gBAClC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAClB,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,4CAA4C,CAAC;YACtD,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IAErC,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC;QACpC,OAAO,EAAE,6BAA6B;QACtC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;KAC9D,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;IAEpC,MAAM,KAAK,CAAC,GAAG,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5D,MAAM,KAAK,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAClE,GAAG,CAAC,OAAO,CAAC,4DAA4D,CAAC,CAAC;IAE1E,wEAAwE;IACxE,IAAI,CAAC;QACH,MAAM,IAAI,iBAAiB,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvE,GAAG,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,mCAAmC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI;YACrF,qEAAqE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC;QAC7B,OAAO,EAAE,oFAAoF;QAC7F,WAAW,EAAE,iCAAiC;QAC9C,YAAY,EAAE,eAAe,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KACxF,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACtD,MAAM,KAAK,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IACrF,GAAG,CAAC,OAAO,CACT,OAAO,CAAC,MAAM,GAAG,CAAC;QAChB,CAAC,CAAC,qBAAqB,OAAO,CAAC,MAAM,cAAc;QACnD,CAAC,CAAC,mDAAmD,CACxD,CAAC;IAEF,IAAI,CACF,4EAA4E;QAC1E,8EAA8E;QAC9E,sEAAsE,EACxE,8BAA8B,CAC/B,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC;QAC7B,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EAAE,8BAA8B;QAC3C,YAAY,EAAE,eAAe,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KACtF,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACpD,MAAM,KAAK,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IACjF,GAAG,CAAC,OAAO,CACT,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,yBAAyB,KAAK,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAC9F,CAAC;IAEF,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC;QAClC,OAAO,EAAE,4EAA4E;QACrF,WAAW,EAAE,kBAAkB;KAChC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,YAAY,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,gBAAgB,CAAC;SAC1C,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,GAAG,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IACxD,KAAK,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,kFAAkF;AAClF,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,QAAQ,CAAC,MAAM,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC"}