@mulmoclaude/core 0.5.0 → 0.6.0

package/dist/feeds/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../src/feeds/server/host.ts","../../../src/feeds/server/registry.ts","../../../src/feeds/server/retrievers/index.ts","../../../src/feeds/server/fetch/httpClient.ts","../../../src/feeds/server/fetch/rssParser.ts","../../../src/feeds/server/pathResolver.ts","../../../src/feeds/server/projectItem.ts","../../../src/feeds/server/retrievers/rss.ts","../../../src/feeds/server/retrievers/httpJson.ts","../../../src/feeds/server/state.ts","../../../src/feeds/server/agentIngest.ts","../../../src/feeds/server/engine.ts","../../../src/feeds/server/scheduledRefresh.ts"],"sourcesContent":["// Host injection seam for the Feeds engine — mirrors `configureCollectionHost`\n// / `configureScheduler`. The engine is host-agnostic: the workspace root, the\n// logger, an atomic file writer, and the hidden/visible agent-ingest worker\n// launcher are injected once at boot via `configureFeedsHost`. Everything else\n// the engine needs (collection IO, the notifier) is a sibling `@mulmoclaude/core`\n// subpath, imported directly. Both MulmoClaude and MulmoTerminal supply their\n// own host shim.\n\n/** Outcome of launching one hidden/visible agent-ingest worker. `chatId` lets\n *  the caller register a completion hook so a failed refresh doesn't die\n *  silently. */\nexport type AgentWorkerResult = { ok: true; chatId: string } | { ok: false; error: string };\n\n/** Launches a worker chat. Injected at boot to keep the feeds engine from\n *  importing a host's routes/session layer. `hidden` chooses an invisible\n *  system worker (scheduled refresh) vs a visible session the user can watch\n *  (manual Refresh — debuggable). `onComplete` is a one-shot completion hook\n *  (only honoured for hidden workers) so the dispatcher learns success/failure.\n *  Returns `ok:false` on the concurrency-cap miss or a launch error — the caller\n *  leaves state untouched and retries next tick. */\nexport type AgentWorkerRunner = (args: {\n  message: string;\n  roleId: string;\n  hidden: boolean;\n  onComplete?: (outcome: { didError: boolean }) => void | Promise<void>;\n}) => Promise<AgentWorkerResult>;\n\n/** Structured logger, `(prefix, msg, data?)` — same shape as `CollectionLogger`. */\nexport interface FeedsLogger {\n  error: (prefix: string, message: string, data?: Record<string, unknown>) => void;\n  warn: (prefix: string, message: string, data?: Record<string, unknown>) => void;\n  info: (prefix: string, message: string, data?: Record<string, unknown>) => void;\n  debug: (prefix: string, message: string, data?: Record<string, unknown>) => void;\n}\n\nexport interface FeedsHost {\n  /** Absolute workspace root — the default for `refreshDue()` and state paths. */\n  workspaceRoot: string;\n  /** Host logger. */\n  log: FeedsLogger;\n  /** Host atomic file writer (state files). */\n  writeFileAtomic: (filePath: string, content: string) => Promise<void>;\n  /** Launches the agent-ingest worker (was `setAgentWorkerRunner`). */\n  spawnWorker: AgentWorkerRunner;\n}\n\nlet current: FeedsHost | null = null;\n\n/** Wire the feeds engine to a host. Call once at startup, before any refresh. */\nexport function configureFeedsHost(host: FeedsHost): void {\n  if (current && current !== host) {\n    throw new Error(\"@mulmoclaude/core/feeds: configureFeedsHost() was already called with a different host\");\n  }\n  current = host;\n}\n\n/** The configured host, or throw if `configureFeedsHost` was never called. */\nexport function requireFeedsHost(): FeedsHost {\n  if (!current) throw new Error(\"@mulmoclaude/core/feeds: configureFeedsHost() was not called by the host\");\n  return current;\n}\n\n/** Test-only: clear the configured host. */\nexport function resetFeedsHostForTesting(): void {\n  current = null;\n}\n\n/** Forwarding logger so engine modules can `import { log }` without each\n *  reaching for `requireFeedsHost().log`. */\nexport const log: FeedsLogger = {\n  error: (prefix, msg, data) => requireFeedsHost().log.error(prefix, msg, data),\n  warn: (prefix, msg, data) => requireFeedsHost().log.warn(prefix, msg, data),\n  info: (prefix, msg, data) => requireFeedsHost().log.info(prefix, msg, data),\n  debug: (prefix, msg, data) => requireFeedsHost().log.debug(prefix, msg, data),\n};\n","// List the registered data-source feeds. Feeds are CREATED / REMOVED by\n// the agent writing / deleting `feeds/<slug>/schema.json` directly (see\n// config/helps/feeds.md) — the host only discovers + retrieves them.\n// icon / dataPath defaults for agent-authored feed schemas are applied in\n// `collection/server/discovery.ts` (source === \"feed\").\n\nimport { rm } from \"node:fs/promises\";\nimport { discoverCollections, resolveDataDir, safeSlugName, type LoadedCollection } from \"../../collection/server/index.js\";\nimport { log, requireFeedsHost } from \"./host.js\";\nimport { feedDir } from \"../paths.js\";\n\n/** Every registered feed, as a discovered collection (carrying its\n *  validated schema, `ingest`, and resolved `dataDir`). */\nexport async function listFeeds(workspaceRoot: string = requireFeedsHost().workspaceRoot): Promise<LoadedCollection[]> {\n  const all = await discoverCollections({ workspaceRoot });\n  return all.filter((collection) => collection.source === \"feed\");\n}\n\n/** Delete a feed entirely: its records AND its `feeds/<slug>/` directory\n *  (schema + state). Idempotent. Host-side only (backs the UI delete\n *  button); the agent removes a feed by deleting both directories itself.\n *\n *  The records dir is derived from the SLUG (`data/feeds/<slug>`), never\n *  from the schema's `dataPath` — feeds are forced into that namespace at\n *  discovery, so a malformed/hostile `dataPath` can't redirect this delete\n *  at another app's data (e.g. `data/wiki`). `resolveDataDir` also rejects\n *  any path that escapes the workspace. */\nexport async function removeFeed(workspaceRoot: string, slug: string): Promise<boolean> {\n  const safe = safeSlugName(slug);\n  if (safe === null) return false;\n  const recordsDir = resolveDataDir(`data/feeds/${safe}`, workspaceRoot);\n  try {\n    if (recordsDir) await rm(recordsDir, { recursive: true, force: true });\n    await rm(feedDir(safe, workspaceRoot), { recursive: true, force: true });\n    log.info(\"feeds\", \"feed + records removed\", { slug: safe });\n    return true;\n  } catch (error) {\n    log.warn(\"feeds\", \"feed remove failed\", { slug: safe, error: String(error) });\n    return false;\n  }\n}\n","// Pluggable retriever registry. Each declarative `ingest.kind` maps to one\n// RetrieveFn that fetches the endpoint and returns projected records.\n// Side-effect registration keeps the engine decoupled from the kinds.\n// The `agent` kind is NOT a retriever (it dispatches a hidden worker before\n// the engine consults this registry); a future `code` kind would register here.\n\nimport type { CollectionItem, CollectionSchema } from \"../../../collection/index.js\";\nimport type { DeclarativeIngestSpec } from \"../../ingestTypes.js\";\nimport type { FeedState } from \"../state.js\";\n\nexport interface RetrieveResult {\n  /** Projected records, keyed by primaryKey (the engine upserts them). */\n  items: CollectionItem[];\n  /** Updated retriever cursor to persist (incremental fetches). */\n  cursor: Record<string, string>;\n}\n\n// Declarative-only: the engine branches `agent` ingest off BEFORE looking up a\n// retriever, so a RetrieveFn never sees a non-fetch spec (and rss/http-json can\n// read `ingest.url`/`map` without union narrowing).\nexport type RetrieveFn = (ingest: DeclarativeIngestSpec, schema: CollectionSchema, state: FeedState) => Promise<RetrieveResult>;\n\nconst registry = new Map<string, RetrieveFn>();\n\nexport function registerRetriever(kind: string, retriever: RetrieveFn): void {\n  registry.set(kind, retriever);\n}\n\nexport function getRetriever(kind: string): RetrieveFn | undefined {\n  return registry.get(kind);\n}\n","// Minimal HTTP client for feed retrievers. Feed URLs are model-authored /\n// user-supplied, so beyond a User-Agent + timeout this guards against SSRF:\n// every URL (and every redirect hop) is DNS-resolved and rejected if it\n// points at a loopback / private / link-local / cloud-metadata address.\n// Redirects are followed MANUALLY so a public URL can't 302 to an internal\n// one and bypass the guard. It does NOT do robots.txt / rate limiting (the\n// engine fetches feeds sequentially to stay gentle).\n\nimport { lookup } from \"node:dns/promises\";\nimport { isIP } from \"node:net\";\n\n// Inlined — the client needs only this one time constant and must stay free of\n// host-side time-constant modules.\nconst ONE_SECOND_MS = 1_000;\n\n/** Identifies the bot to site operators. */\nexport const FEED_USER_AGENT = \"MulmoClaude-FeedBot/1.0 (+https://github.com/receptron/mulmoclaude)\";\n\n/** Per-request wall-clock cap so a hung server can't wedge a refresh. */\nexport const DEFAULT_FEED_TIMEOUT_MS = 30 * ONE_SECOND_MS;\n\n/** Cap on redirect hops followed (each re-checked for SSRF). */\nconst MAX_REDIRECTS = 5;\n\n// CIDR blocks we refuse to fetch: unspecified, loopback, RFC1918, CGNAT,\n// and link-local (which also covers the 169.254.169.254 metadata IP).\n/* eslint-disable sonarjs/no-hardcoded-ip -- intentional SSRF deny-list of loopback / private / link-local / CGNAT CIDRs */\nconst BLOCKED_V4_CIDRS: readonly (readonly [string, number])[] = [\n  [\"0.0.0.0\", 8],\n  [\"10.0.0.0\", 8],\n  [\"100.64.0.0\", 10],\n  [\"127.0.0.0\", 8],\n  [\"169.254.0.0\", 16],\n  [\"172.16.0.0\", 12],\n  [\"192.168.0.0\", 16],\n];\n/* eslint-enable sonarjs/no-hardcoded-ip */\n\nfunction ipv4ToInt(address: string): number | null {\n  const octets = address.split(\".\").map(Number);\n  if (octets.length !== 4 || octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return null;\n  return ((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>> 0;\n}\n\nfunction isBlockedIpv4(address: string): boolean {\n  const value = ipv4ToInt(address);\n  if (value === null) return true; // malformed → block\n  return BLOCKED_V4_CIDRS.some(([base, bits]) => {\n    const baseInt = ipv4ToInt(base) ?? 0;\n    const mask = bits === 0 ? 0 : (0xffffffff << (32 - bits)) >>> 0;\n    return (value & mask) === (baseInt & mask);\n  });\n}\n\nfunction isBlockedIpv6(address: string): boolean {\n  const lower = address.toLowerCase();\n  if (lower === \"::1\" || lower === \"::\") return true; // loopback, unspecified\n  if (lower.startsWith(\"fe80\")) return true; // link-local fe80::/10\n  if (lower.startsWith(\"fc\") || lower.startsWith(\"fd\")) return true; // ULA fc00::/7\n  const mapped = /^::ffff:(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})$/.exec(lower); // IPv4-mapped\n  return mapped ? isBlockedIpv4(mapped[1]) : false;\n}\n\n/** True for any address we must not fetch (also blocks non-IP input). */\nfunction isBlockedIp(address: string): boolean {\n  const kind = isIP(address);\n  if (kind === 4) return isBlockedIpv4(address);\n  if (kind === 6) return isBlockedIpv6(address);\n  return true;\n}\n\n/** Reject non-http(s) URLs and URLs that resolve to a private/loopback\n *  address (SSRF guard). Throws with a clear reason; returns void on pass. */\nasync function assertFetchableUrl(rawUrl: string): Promise<void> {\n  if (!/^https?:\\/\\//i.test(rawUrl)) throw new Error(`refusing non-http(s) URL: ${rawUrl}`);\n  const { hostname } = new URL(rawUrl);\n  // URL.hostname keeps the brackets for IPv6 literals (`[::1]`); strip them\n  // so isIP / the block check see the bare address.\n  const host = hostname.startsWith(\"[\") && hostname.endsWith(\"]\") ? hostname.slice(1, -1) : hostname;\n  if (isIP(host)) {\n    if (isBlockedIp(host)) throw new Error(`refusing to fetch a private/loopback address: ${host}`);\n    return;\n  }\n  let addresses: { address: string }[];\n  try {\n    addresses = await lookup(host, { all: true });\n  } catch (err) {\n    throw new Error(`could not resolve host '${host}': ${String(err)}`);\n  }\n  const blocked = addresses.find((entry) => isBlockedIp(entry.address));\n  if (blocked) throw new Error(`refusing to fetch '${host}' — resolves to a private/loopback address (${blocked.address})`);\n}\n\nasync function fetchOnce(url: string, timeoutMs: number): Promise<Response> {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(new DOMException(`feed fetch timed out after ${timeoutMs}ms`, \"TimeoutError\")), timeoutMs);\n  try {\n    return await fetch(url, { headers: { \"User-Agent\": FEED_USER_AGENT }, signal: controller.signal, redirect: \"manual\" });\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\n// Follow redirects manually, re-running the SSRF guard on every hop so a\n// public URL cannot bounce to an internal target.\nasync function fetchGuarded(rawUrl: string, timeoutMs: number): Promise<Response> {\n  let current = rawUrl;\n  for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {\n    await assertFetchableUrl(current);\n    const response = await fetchOnce(current, timeoutMs);\n    const redirect = response.status >= 300 && response.status < 400 && response.status !== 304 ? response.headers.get(\"location\") : null;\n    if (!redirect) return response;\n    current = new URL(redirect, current).toString();\n  }\n  throw new Error(`too many redirects (>${MAX_REDIRECTS}) starting from ${rawUrl}`);\n}\n\n/** Fetch a URL as text, throwing on guard rejection, network error, or non-2xx. */\nexport async function fetchText(url: string, timeoutMs: number = DEFAULT_FEED_TIMEOUT_MS): Promise<string> {\n  const response = await fetchGuarded(url, timeoutMs);\n  if (!response.ok) throw new Error(`HTTP ${response.status} ${response.statusText} fetching ${url}`);\n  return response.text();\n}\n\n/** Fetch a URL as parsed JSON, throwing on guard rejection, network error, or non-2xx. */\nexport async function fetchJson(url: string, timeoutMs: number = DEFAULT_FEED_TIMEOUT_MS): Promise<unknown> {\n  const response = await fetchGuarded(url, timeoutMs);\n  if (!response.ok) throw new Error(`HTTP ${response.status} ${response.statusText} fetching ${url}`);\n  return response.json();\n}\n","// RSS 2.0 + Atom 1.0 + RSS 1.0 (RDF) parser for the Feeds engine.\n//\n// Deliberately NON-normalizing: it locates the feed's items and hands\n// each one back as its RAW parsed XML element. The host hard-codes no\n// per-feed field list — `ingest.map` resolves source paths against the\n// raw item (tags are keys; attributes are prefixed `@_`; namespaced tags\n// keep their prefix), and the caller inspects the feed to decide what to\n// map. Generic value handling (text-node unwrapping, date parsing by the\n// target field's declared type) lives in `projectItem.ts`, not here.\n//\n// Own copy of the XML plumbing — the Feeds tree does not import the\n// legacy `sources` tree. Pure; unit-testable with fixture strings.\n\nimport { XMLParser } from \"fast-xml-parser\";\n\n// Tiny inline type guards (the host's shared `utils/types` is not available in\n// this shared package — these are the only two we need here).\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\nfunction isNonEmptyString(value: unknown): value is string {\n  return typeof value === \"string\" && value.trim().length > 0;\n}\n\nexport interface ParsedFeedItem {\n  /** The raw parsed XML <item>/<entry> object, verbatim. */\n  raw: Record<string, unknown>;\n}\n\nexport interface ParsedFeed {\n  kind: \"rss\" | \"atom\";\n  title: string | null;\n  items: ParsedFeedItem[];\n}\n\nconst xml = new XMLParser({\n  ignoreAttributes: false,\n  attributeNamePrefix: \"@_\",\n  cdataPropName: \"#cdata\",\n  parseTagValue: false,\n  parseAttributeValue: false,\n  trimValues: true,\n  // Only the item containers are forced to arrays (single vs. many).\n  // Everything else stays in its natural parsed shape so `ingest.map`\n  // resolves paths the way the caller sees them in the feed.\n  isArray: (name) => name === \"item\" || name === \"entry\",\n});\n\n/** Parse an RSS/Atom/RDF feed body. Returns null when the input doesn't\n *  look like a feed we understand. */\nexport function parseFeed(body: string): ParsedFeed | null {\n  const text = stripBom(body);\n  if (!text.trim()) return null;\n  let parsed: unknown;\n  try {\n    parsed = xml.parse(text);\n  } catch {\n    return null;\n  }\n  if (!isRecord(parsed)) return null;\n  if (isRecord(parsed.rss)) return parseRss(parsed.rss);\n  if (isRecord(parsed.feed)) return parseAtom(parsed.feed);\n  const rdf = parsed[\"rdf:RDF\"] ?? parsed.RDF;\n  if (isRecord(rdf)) return parseRss10(rdf);\n  return null;\n}\n\n// Collect the raw item objects, skipping anything that isn't a record or\n// carries no <title> (drops feed-level noise / empty entries).\nfunction collectItems(value: unknown): ParsedFeedItem[] {\n  const rawItems = Array.isArray(value) ? value : [];\n  const items: ParsedFeedItem[] = [];\n  for (const raw of rawItems) {\n    if (isRecord(raw) && readString(raw.title) !== null) items.push({ raw });\n  }\n  return items;\n}\n\nfunction parseRss(rss: Record<string, unknown>): ParsedFeed | null {\n  const { channel } = rss;\n  if (!isRecord(channel)) return null;\n  return { kind: \"rss\", title: readString(channel.title), items: collectItems(channel.item) };\n}\n\nfunction parseRss10(rdf: Record<string, unknown>): ParsedFeed | null {\n  const channel = isRecord(rdf.channel) ? rdf.channel : null;\n  return { kind: \"rss\", title: channel ? readString(channel.title) : null, items: collectItems(rdf.item) };\n}\n\nfunction parseAtom(feed: Record<string, unknown>): ParsedFeed | null {\n  return { kind: \"atom\", title: readString(feed.title), items: collectItems(feed.entry) };\n}\n\n// --- helpers ------------------------------------------------------------\n\n// Extract a string from a plain string, a `{ \"#text\" }` / `{ \"#cdata\" }`\n// node, or an array (first non-empty). Used only to read the feed/item\n// title for the channel name + the empty-item filter.\nfunction readString(value: unknown): string | null {\n  if (isNonEmptyString(value)) return value;\n  if (typeof value === \"string\") return null;\n  if (isRecord(value)) return readStringFromRecord(value);\n  if (Array.isArray(value)) return readStringFromArray(value);\n  return null;\n}\n\nfunction readStringFromRecord(record: Record<string, unknown>): string | null {\n  const text = record[\"#text\"];\n  if (isNonEmptyString(text)) return text;\n  const cdata = record[\"#cdata\"];\n  if (isNonEmptyString(cdata)) return cdata;\n  return null;\n}\n\nfunction readStringFromArray(array: readonly unknown[]): string | null {\n  for (const entry of array) {\n    const resolved = readString(entry);\n    if (resolved !== null) return resolved;\n  }\n  return null;\n}\n\nfunction stripBom(text: string): string {\n  return text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;\n}\n","// Tiny dot/bracket path resolver used by the declarative `ingest.map`\n// and `ingest.itemsAt`. Pure, no I/O, exhaustively unit-testable.\n//\n// Supported syntax:\n//   \"title\"                → root.title\n//   \"data.name\"            → root.data.name\n//   \"results[0].id\"        → root.results[0].id\n//   \"hourly[]\"             → root.hourly        (trailing [] = \"the array\n//                            here\"; the marker is a no-op for value reads)\n//   \"data.results[]\"       → root.data.results\n//\n// Any miss (wrong type, out-of-range index, absent key) yields\n// `undefined` rather than throwing — declarative configs fail soft.\n\ninterface KeyToken {\n  kind: \"key\";\n  key: string;\n}\ninterface IndexToken {\n  kind: \"index\";\n  index: number;\n}\ntype PathToken = KeyToken | IndexToken;\n\nconst BRACKET_RE = /\\[(\\d*)\\]/g;\n\n/** Split one dot-segment (`results[0]`, `hourly[]`, `name`) into tokens.\n *  An empty `[]` is an array-identity marker and emits no token — the\n *  array value is read by the preceding key. */\nfunction parseSegment(segment: string, tokens: PathToken[]): void {\n  const bracketStart = segment.indexOf(\"[\");\n  const name = bracketStart === -1 ? segment : segment.slice(0, bracketStart);\n  if (name.length > 0) tokens.push({ kind: \"key\", key: name });\n  if (bracketStart === -1) return;\n  for (const match of segment.slice(bracketStart).matchAll(BRACKET_RE)) {\n    const [, inner] = match;\n    if (inner.length > 0) tokens.push({ kind: \"index\", index: Number(inner) });\n  }\n}\n\nfunction tokenize(path: string): PathToken[] {\n  const tokens: PathToken[] = [];\n  for (const segment of path.split(\".\")) {\n    if (segment.length > 0) parseSegment(segment, tokens);\n  }\n  return tokens;\n}\n\nfunction step(current: unknown, token: PathToken): unknown {\n  if (current === null || current === undefined) return undefined;\n  if (token.kind === \"key\") {\n    if (typeof current !== \"object\" || Array.isArray(current)) return undefined;\n    return (current as Record<string, unknown>)[token.key];\n  }\n  return Array.isArray(current) ? current[token.index] : undefined;\n}\n\n/** Resolve a dot/bracket path against `root`, or `undefined` on any miss. */\nexport function getByPath(root: unknown, path: string): unknown {\n  let current: unknown = root;\n  for (const token of tokenize(path)) {\n    current = step(current, token);\n  }\n  return current;\n}\n\n/** Locate the array of raw items for a fetch. With `itemsAt` set, walk\n *  to it; without it, the response itself must be the array. Non-arrays\n *  yield `[]` so a malformed response is a no-op, not a crash. */\nexport function getItemsArray(root: unknown, itemsAt: string | undefined): unknown[] {\n  if (!itemsAt) return Array.isArray(root) ? root : [];\n  const value = getByPath(root, itemsAt);\n  return Array.isArray(value) ? value : [];\n}\n","// Project one raw retrieved item (a parsed RSS entry, or a JSON object)\n// into a CollectionItem whose keys match the schema's fields, using the\n// declarative `ingest.map`. Also derives the record's id.\n//\n// Id rule: a collection record's filename IS its primaryKey value, and\n// that value must be a safe slug. Feed-native keys (RSS guids/URLs,\n// ISO datetimes) usually are NOT slug-safe, so we slugify the natural\n// key into a deterministic, stable id — same natural key → same id, so\n// re-fetches upsert in place. The natural key comes from the mapped\n// primaryKey value, then `ingest.idFrom`, then a content hash.\n\nimport { createHash } from \"node:crypto\";\nimport { getByPath } from \"./pathResolver.js\";\nimport type { CollectionItem, CollectionSchema } from \"../../collection/index.js\";\nimport type { DeclarativeIngestSpec } from \"../ingestTypes.js\";\n\nfunction asKeyString(value: unknown): string | null {\n  if (typeof value === \"string\" && value.trim().length > 0) return value.trim();\n  if (typeof value === \"number\" && Number.isFinite(value)) return String(value);\n  return null;\n}\n\n/** Collapse an XML element object that carries body text alongside\n *  attributes (`{ \"#text\": \"v\", \"@_x\": \"...\" }`) or CDATA to its text.\n *  Generic — the host knows no field names, only this fast-xml-parser\n *  shape — so a tag like `<guid isPermaLink=\"false\">id</guid>` maps to\n *  its text without the caller needing to write `.#text`. */\nfunction unwrapTextNode(value: unknown): unknown {\n  if (value && typeof value === \"object\" && !Array.isArray(value)) {\n    const obj = value as Record<string, unknown>;\n    if (typeof obj[\"#text\"] === \"string\") return obj[\"#text\"];\n    if (typeof obj[\"#cdata\"] === \"string\") return obj[\"#cdata\"];\n  }\n  return value;\n}\n\n/** Normalize a mapped value generically — driven by the SCHEMA's declared\n *  field type, never by the source field name. Today: unwrap XML text\n *  nodes, and coerce anything mapped into a `date` field to a `YYYY-MM-DD`\n *  civil date (the collection `date` type + calendar are day-granularity\n *  and parse strictly — a full RFC-3339 timestamp would be rejected). */\nfunction normalizeValue(value: unknown, fieldType: string | undefined): unknown {\n  const unwrapped = unwrapTextNode(value);\n  if (fieldType === \"date\" && typeof unwrapped === \"string\") {\n    const millis = Date.parse(unwrapped);\n    if (Number.isFinite(millis)) return new Date(millis).toISOString().slice(0, 10);\n  }\n  return unwrapped;\n}\n\n/** Slugify a natural key into a stable, filename-safe id. Short, safe\n *  keys pass through (lowercased); long or unsafe keys collapse to a\n *  hash so the filename stays bounded and valid. */\nfunction toSafeId(natural: string): string {\n  const collapsed = natural\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\");\n  // eslint-disable-next-line sonarjs/super-linear-regex -- anchored hyphen trim, linear, no catastrophic backtracking\n  const slug = collapsed.replace(/^-+|-+$/g, \"\");\n  if (slug.length > 0 && slug.length <= 80) return slug;\n  const hash = createHash(\"sha256\")\n    .update(natural || \"item\", \"utf-8\")\n    .digest(\"hex\")\n    .slice(0, 16);\n  return slug.length > 80 ? `${slug.slice(0, 60)}-${hash}` : `feed-${hash}`;\n}\n\nfunction naturalKey(record: CollectionItem, rawItem: unknown, ingest: DeclarativeIngestSpec, schema: CollectionSchema): string {\n  const fromMapped = asKeyString(record[schema.primaryKey]);\n  if (fromMapped) return fromMapped;\n  if (ingest.idFrom) {\n    const fromId = asKeyString(unwrapTextNode(getByPath(rawItem, ingest.idFrom)));\n    if (fromId) return fromId;\n  }\n  return JSON.stringify(record);\n}\n\n/** Build a record from a raw fetched item (a parsed RSS/Atom element or a\n *  JSON object) using `ingest.map`. Each source path is resolved against\n *  the raw item and normalized per the target field's declared type. The\n *  returned record's primaryKey is set to the derived safe id (so it\n *  doubles as the filename). */\nexport function projectRecord(rawItem: unknown, ingest: DeclarativeIngestSpec, schema: CollectionSchema): CollectionItem {\n  const record: CollectionItem = {};\n  for (const [targetField, sourcePath] of Object.entries(ingest.map)) {\n    const value = normalizeValue(getByPath(rawItem, sourcePath), schema.fields?.[targetField]?.type);\n    if (value !== undefined) record[targetField] = value;\n  }\n  record[schema.primaryKey] = toSafeId(naturalKey(record, rawItem, ingest, schema));\n  return record;\n}\n","// RSS / Atom retriever. Fetches the feed, parses it, and projects each\n// item's RAW parsed XML element through `ingest.map`. The map's source\n// paths are the item's own tags/attributes (e.g. `title`, `pubDate`,\n// `enclosure.@_url`, `itunes:duration`) — the host hard-codes no field\n// list; the caller inspects the feed and maps what it carries.\n\nimport { fetchText } from \"../fetch/httpClient.js\";\nimport { parseFeed } from \"../fetch/rssParser.js\";\nimport { projectRecord } from \"../projectItem.js\";\nimport { registerRetriever, type RetrieveFn } from \"./index.js\";\n\nconst retrieveRss: RetrieveFn = async (ingest, schema) => {\n  const body = await fetchText(ingest.url);\n  const feed = parseFeed(body);\n  if (!feed) return { items: [], cursor: {} };\n  const items = feed.items.map((item) => projectRecord(item.raw, ingest, schema));\n  return { items, cursor: {} };\n};\n\n// Atom shares the same parser + projection path.\nregisterRetriever(\"rss\", retrieveRss);\nregisterRetriever(\"atom\", retrieveRss);\n\nexport { retrieveRss };\n","// Generic JSON-API retriever. Fetches JSON, walks `ingest.itemsAt` to\n// the array of raw items, and projects each through `ingest.map` (whose\n// source paths are dot/bracket paths into each raw item).\n\nimport { fetchJson } from \"../fetch/httpClient.js\";\nimport { getItemsArray } from \"../pathResolver.js\";\nimport { projectRecord } from \"../projectItem.js\";\nimport { registerRetriever, type RetrieveFn } from \"./index.js\";\n\nconst retrieveHttpJson: RetrieveFn = async (ingest, schema) => {\n  const json = await fetchJson(ingest.url);\n  const rawItems = getItemsArray(json, ingest.itemsAt);\n  const items = rawItems.map((raw) => projectRecord(raw, ingest, schema));\n  return { items, cursor: {} };\n};\n\nregisterRetriever(\"http-json\", retrieveHttpJson);\n\nexport { retrieveHttpJson };\n","// Per-collection retrieval state — when we last fetched/dispatched, the\n// retriever's cursor (for incremental fetches), and a consecutive-failure\n// counter. NOT committed to git. Location depends on the collection's source:\n// feeds keep it alongside the schema at `<workspace>/feeds/<slug>/_state.json`;\n// skill-backed collections with `ingest.kind: \"agent\"` store it at\n// `<workspace>/data/ingest-state/<slug>.json` (a schema-less `feeds/<slug>/`\n// dir would confuse feed discovery, and `_state.json` must never live in a\n// collection's dataDir where `listItems` would read it as a record).\n// Deliberately minimal: the legacy `sources` tree carries richer backoff\n// state, but the engine starts simple and grows on real need.\n\nimport { mkdir, readFile } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport type { CollectionSource } from \"../../collection/index.js\";\nimport { log, requireFeedsHost } from \"./host.js\";\nimport { feedStatePath, ingestStatePath } from \"../paths.js\";\n\n/** Minimal shape needed to locate a collection's state file. `LoadedCollection`\n *  satisfies it. */\nexport interface StateTarget {\n  slug: string;\n  source: CollectionSource;\n}\n\n/** Resolve the on-disk state file for a collection, branching on source. */\nfunction stateFilePath(target: StateTarget, workspaceRoot: string): string {\n  return target.source === \"feed\" ? feedStatePath(target.slug, workspaceRoot) : ingestStatePath(target.slug, workspaceRoot);\n}\n\nexport interface FeedState {\n  slug: string;\n  /** ISO timestamp of the last successful fetch (declarative) or dispatch\n   *  (agent ingest), or null if never. */\n  lastFetchedAt: string | null;\n  /** Free-form retriever cursor (e.g. last-seen id / etag). */\n  cursor: Record<string, string>;\n  /** Consecutive failed fetches/runs; reset to 0 on success. */\n  consecutiveFailures: number;\n  /** Agent ingest only: the notifier entry id of the active \"refresh failed\"\n   *  bell, so a later success can clear exactly that entry. Absent when no\n   *  failure bell is showing. */\n  failureBellId?: string;\n}\n\nexport function defaultFeedState(slug: string): FeedState {\n  return { slug, lastFetchedAt: null, cursor: {}, consecutiveFailures: 0 };\n}\n\nfunction normalizeState(slug: string, parsed: Partial<FeedState>): FeedState {\n  const base = defaultFeedState(slug);\n  const cursor = parsed.cursor && typeof parsed.cursor === \"object\" ? (parsed.cursor as Record<string, string>) : base.cursor;\n  return {\n    slug,\n    lastFetchedAt: typeof parsed.lastFetchedAt === \"string\" ? parsed.lastFetchedAt : base.lastFetchedAt,\n    cursor,\n    consecutiveFailures: typeof parsed.consecutiveFailures === \"number\" ? parsed.consecutiveFailures : base.consecutiveFailures,\n    ...(typeof parsed.failureBellId === \"string\" ? { failureBellId: parsed.failureBellId } : {}),\n  };\n}\n\n/** Read a collection's retrieval state, tolerating a missing file (first run →\n *  default). The state path branches on `target.source`. */\nexport async function readFeedState(workspaceRoot: string, target: StateTarget): Promise<FeedState> {\n  const { slug } = target;\n  try {\n    const raw = await readFile(stateFilePath(target, workspaceRoot), \"utf-8\");\n    return normalizeState(slug, JSON.parse(raw) as Partial<FeedState>);\n  } catch (err) {\n    const error = err as { code?: string };\n    if (error.code !== \"ENOENT\") {\n      log.warn(\"feeds\", \"failed to read feed state, using default\", { slug, error: String(err) });\n    }\n    return defaultFeedState(slug);\n  }\n}\n\n/** Persist a collection's retrieval state atomically (creating the parent dir\n *  if needed). The state path branches on `target.source`. */\nexport async function writeFeedState(workspaceRoot: string, target: StateTarget, state: FeedState): Promise<void> {\n  const file = stateFilePath(target, workspaceRoot);\n  await mkdir(path.dirname(file), { recursive: true });\n  await requireFeedsHost().writeFileAtomic(file, `${JSON.stringify(state, null, 2)}\\n`);\n}\n","// Agent-performed ingest (`ingest.kind: \"agent\"`). On schedule (or a manual\n// Refresh), the host seeds a hidden background worker — origin `system`, so\n// it never appears in the user's session list — in the collection's declared\n// role with its template + a summary of every record, and the worker edits the\n// records itself via the collections io layer. The host stays domain-free:\n// everything stock-specific (or whatever the collection does) is prose in the\n// template.\n//\n// DI seam: the worker is launched through `FeedsHost.spawnWorker`, injected at\n// boot via `configureFeedsHost`, not imported directly — this module ships in a\n// shared package and must not reach into any host's session/routes layer.\n\nimport { listItems, readSkillTemplate, buildCollectionActionSeedPrompt, type LoadedCollection } from \"../../collection/server/index.js\";\nimport { publish as publishNotifier, clear as clearNotifier } from \"../../notifier/index.js\";\nimport { log, requireFeedsHost, type AgentWorkerResult, type AgentWorkerRunner } from \"./host.js\";\nimport { readFeedState, writeFeedState, type FeedState } from \"./state.js\";\nimport type { AgentIngestSpec } from \"../ingestTypes.js\";\nimport type { RefreshResult } from \"./refreshResult.js\";\n\nexport type { AgentWorkerResult, AgentWorkerRunner } from \"./host.js\";\n\n/** The injected worker launcher, or null if the host was never configured.\n *  Read non-throwingly so the failure-isolated contract holds (an unconfigured\n *  host becomes an `errors` entry, not a thrown exception). */\nfunction workerRunnerOrNull(): AgentWorkerRunner | null {\n  try {\n    return requireFeedsHost().spawnWorker;\n  } catch {\n    return null;\n  }\n}\n\nfunction result(slug: string, patch: Partial<RefreshResult>): RefreshResult {\n  return { slug, written: 0, removed: 0, errors: [], ...patch };\n}\n\n/** Dispatch one agent-ingest refresh: build the seed, launch a worker, and (on a\n *  successful launch) stamp `lastFetchedAt` with the DISPATCH time — not\n *  completion. That's what gates the due-loop, so a slow worker can't cause a\n *  double-dispatch. `opts.hidden` (default true) runs an invisible system worker\n *  for SCHEDULED refreshes; a MANUAL Refresh passes `hidden:false` for a visible,\n *  debuggable session. Failure-isolated: never throws; cap-miss / template-miss /\n *  launch error leave state untouched and report via `errors`. */\nexport async function refreshViaAgent(workspaceRoot: string, collection: LoadedCollection, opts?: { hidden?: boolean }): Promise<RefreshResult> {\n  const hidden = opts?.hidden ?? true;\n  const { slug } = collection;\n  const ingest = collection.schema.ingest as AgentIngestSpec | undefined;\n  if (!ingest || ingest.kind !== \"agent\") return result(slug, { errors: [\"collection has no agent ingest config\"] });\n  const workerRunner = workerRunnerOrNull();\n  if (!workerRunner) return result(slug, { errors: [\"agent ingest worker runner not configured\"] });\n\n  const template = await readSkillTemplate(collection.skillDir, ingest.template);\n  if (template === null) return result(slug, { errors: [`ingest template '${ingest.template}' could not be read`] });\n\n  const items = await listItems(collection.dataDir, { workspaceRoot });\n  const message = buildCollectionActionSeedPrompt(items, collection.schema, template);\n\n  // The runner is injected, so guard its promise here to honour the\n  // failure-isolated contract (a rejection must become an `errors` entry, not\n  // escape into the scheduler loop / route handler).\n  let launch: AgentWorkerResult;\n  try {\n    launch = await workerRunner({\n      message,\n      roleId: ingest.role,\n      hidden,\n      // A visible manual run is watched directly — only hidden runs get the\n      // completion hook (failure bell + consecutiveFailures); `finalizeRun` only\n      // fires it for system-origin sessions anyway.\n      onComplete: hidden ? (outcome) => recordOutcome(workspaceRoot, collection, outcome.didError) : undefined,\n    });\n  } catch (err) {\n    log.warn(\"feeds\", \"agent ingest worker launch threw\", { slug, error: String(err) });\n    return result(slug, { errors: [String(err)], dispatched: false });\n  }\n  if (!launch.ok) {\n    // Cap-miss or launch error: do NOT touch lastFetchedAt — the next due tick\n    // (or manual Refresh) redials. Surface it so a manual refresh reads honest.\n    log.info(\"feeds\", \"agent ingest dispatch skipped\", { slug, error: launch.error });\n    return result(slug, { errors: [launch.error], dispatched: false });\n  }\n\n  const state = await readFeedState(workspaceRoot, collection);\n  await writeFeedState(workspaceRoot, collection, { ...state, lastFetchedAt: new Date().toISOString() });\n  log.info(\"feeds\", \"agent ingest dispatched\", { slug, role: ingest.role, chatId: launch.chatId, hidden, items: items.length });\n  // Surface the chatId only for a visible run so the client can open it; a hidden\n  // session is excluded from every listing and can't be navigated to anyway.\n  return result(slug, { dispatched: true, ...(hidden ? {} : { chatId: launch.chatId }) });\n}\n\n/** Completion hook: reconcile failure tracking when a dispatched worker\n *  finishes. On error, bump `consecutiveFailures` and raise a single failure\n *  bell (deduped via the persisted `failureBellId`). On success, reset the\n *  counter and clear any standing bell. Best-effort + failure-isolated — it\n *  runs inside the agent run's teardown, so it must never throw. */\nasync function recordOutcome(workspaceRoot: string, collection: LoadedCollection, didError: boolean): Promise<void> {\n  const state = await readFeedState(workspaceRoot, collection);\n  const next: FeedState = didError ? await onWorkerError(state, collection) : await onWorkerSuccess(state, collection);\n  await writeFeedState(workspaceRoot, collection, next);\n}\n\nasync function onWorkerError(state: FeedState, collection: LoadedCollection): Promise<FeedState> {\n  const next: FeedState = { ...state, consecutiveFailures: state.consecutiveFailures + 1 };\n  log.warn(\"feeds\", \"agent ingest worker failed\", { slug: collection.slug, consecutiveFailures: next.consecutiveFailures });\n  // Raise a single bell on the first failure; a standing one isn't piled onto.\n  if (!state.failureBellId) {\n    try {\n      const { id } = await publishNotifier({\n        pluginPkg: \"host\",\n        severity: \"nudge\",\n        lifecycle: \"fyi\",\n        title: \"Collection refresh failed\",\n        body: `“${collection.schema.title}” (${collection.slug}) couldn't refresh. Open it to retry.`,\n        navigateTarget: `/collections/${collection.slug}`,\n      });\n      next.failureBellId = id;\n    } catch (err) {\n      log.warn(\"feeds\", \"failed to publish ingest failure bell\", { slug: collection.slug, error: String(err) });\n    }\n  }\n  return next;\n}\n\nasync function onWorkerSuccess(state: FeedState, collection: LoadedCollection): Promise<FeedState> {\n  log.info(\"feeds\", \"agent ingest worker completed\", { slug: collection.slug });\n  if (state.failureBellId) {\n    await clearNotifier(state.failureBellId).catch((err) =>\n      log.warn(\"feeds\", \"failed to clear ingest failure bell\", { slug: collection.slug, error: String(err) }),\n    );\n  }\n  const next: FeedState = { ...state, consecutiveFailures: 0 };\n  delete next.failureBellId;\n  return next;\n}\n","// Retrieval engine: fetch a feed, upsert its records into the\n// collection's data dir (keyed by primaryKey, so re-fetches replace in\n// place / accumulate by id), and persist per-feed state. Per-feed\n// failures are isolated — `refreshOne` never throws; `refreshDue`\n// processes feeds sequentially to stay gentle on remote hosts (the\n// fetch client does no rate-limiting yet).\n\nimport { deleteItem, discoverCollections, listItems, writeItem, type LoadedCollection } from \"../../collection/server/index.js\";\nimport type { CollectionItem, CollectionSchema } from \"../../collection/index.js\";\nimport { log, requireFeedsHost } from \"./host.js\";\nimport { getRetriever } from \"./retrievers/index.js\";\nimport \"./retrievers/registerAll.js\";\nimport { readFeedState, writeFeedState, type FeedState } from \"./state.js\";\nimport { DEFAULT_FEED_MAX_ITEMS, AGENT_INGEST_KIND, type FeedSchedule, type IngestSpec } from \"../ingestTypes.js\";\nimport { refreshViaAgent } from \"./agentIngest.js\";\nimport type { RefreshResult } from \"./refreshResult.js\";\n\nexport type { RefreshResult } from \"./refreshResult.js\";\n\n// Refresh cadence anchors (ms). Inlined — the engine needs only these two and\n// must stay free of host-side time-constant modules.\nconst ONE_HOUR_MS = 3_600_000;\nconst ONE_DAY_MS = 86_400_000;\n\n/** Feed schemas carry the rich `IngestSpec` (validated at discovery —\n *  `source === \"feed\"` requires `ingest`), but the canonical\n *  `CollectionSchema.ingest` only promises the minimal `CollectionIngest`.\n *  Narrow here so the engine can read the retrieval fields type-safely. */\nfunction feedIngest(schema: CollectionSchema): IngestSpec | undefined {\n  return schema.ingest as IngestSpec | undefined;\n}\n\nasync function upsertItems(workspaceRoot: string, feed: LoadedCollection, items: CollectionItem[]): Promise<number> {\n  let written = 0;\n  for (const item of items) {\n    const itemId = item[feed.schema.primaryKey];\n    if (typeof itemId !== \"string\" || itemId.length === 0) continue;\n    const result = await writeItem(feed.dataDir, itemId, item, { refuseOverwrite: false, workspaceRoot, slug: feed.slug });\n    if (result.kind === \"ok\") written += 1;\n    else log.warn(\"feeds\", \"feed item write skipped\", { slug: feed.slug, itemId, kind: result.kind });\n  }\n  return written;\n}\n\n/** The schema's first `date` field, used to order records for the\n *  maxItems cap. Null when the schema declares none. */\nfunction firstDateField(schema: CollectionSchema): string | null {\n  for (const [key, spec] of Object.entries(schema.fields)) {\n    if (spec.type === \"date\") return key;\n  }\n  return null;\n}\n\n// Epoch ms for a record's date value; missing / unparseable sorts oldest.\nfunction recordTime(item: CollectionItem, field: string): number {\n  const value = item[field];\n  const millis = typeof value === \"string\" ? Date.parse(value) : NaN;\n  return Number.isFinite(millis) ? millis : Number.NEGATIVE_INFINITY;\n}\n\n/** Enforce `ingest.maxItems` (default 100): keep the newest N records by\n *  the schema's date field, delete the rest. No-op when the cap is 0/absent\n *  of a date field, or when under the cap. Returns the number deleted. */\nasync function pruneFeed(workspaceRoot: string, feed: LoadedCollection): Promise<number> {\n  const ingest = feedIngest(feed.schema);\n  // maxItems is a declarative-feed concept; agent ingest manages its own record\n  // set, so it's never pruned here (and `refreshOne` never calls pruneFeed for it).\n  const cap = (ingest && ingest.kind !== AGENT_INGEST_KIND ? ingest.maxItems : undefined) ?? DEFAULT_FEED_MAX_ITEMS;\n  if (cap <= 0) return 0;\n  const dateField = firstDateField(feed.schema);\n  if (!dateField) {\n    log.warn(\"feeds\", \"maxItems prune skipped: schema has no date field to order by\", { slug: feed.slug });\n    return 0;\n  }\n  const items = await listItems(feed.dataDir, { workspaceRoot });\n  if (items.length <= cap) return 0;\n  const stale = [...items].sort((left, right) => recordTime(right, dateField) - recordTime(left, dateField)).slice(cap);\n  let removed = 0;\n  for (const item of stale) {\n    const itemId = item[feed.schema.primaryKey];\n    if (typeof itemId !== \"string\" || itemId.length === 0) continue;\n    if ((await deleteItem(feed.dataDir, itemId, { workspaceRoot, slug: feed.slug })).kind === \"ok\") removed += 1;\n  }\n  if (removed > 0) log.info(\"feeds\", \"pruned old feed records\", { slug: feed.slug, removed, cap });\n  return removed;\n}\n\n/** Fetch one feed now, upsert its records, then enforce the maxItems cap.\n *  Failure-isolated: returns an errors array rather than throwing. */\nexport async function refreshOne(workspaceRoot: string, feed: LoadedCollection, opts?: { hidden?: boolean }): Promise<RefreshResult> {\n  const { slug } = feed;\n  const ingest = feedIngest(feed.schema);\n  if (!ingest) return { slug, written: 0, removed: 0, errors: [\"collection has no ingest config\"] };\n  // `agent` ingest dispatches a worker instead of fetching: branch off BEFORE\n  // the retriever registry (which only knows declarative kinds). `opts.hidden`\n  // (manual Refresh passes false) only affects the agent path; declarative\n  // feeds ignore it.\n  if (ingest.kind === AGENT_INGEST_KIND) return refreshViaAgent(workspaceRoot, feed, opts);\n  const retriever = getRetriever(ingest.kind);\n  if (!retriever) return { slug, written: 0, removed: 0, errors: [`no retriever registered for kind '${ingest.kind}'`] };\n  const state = await readFeedState(workspaceRoot, feed);\n  try {\n    const result = await retriever(ingest, feed.schema, state);\n    const written = await upsertItems(workspaceRoot, feed, result.items);\n    await writeFeedState(workspaceRoot, feed, { ...state, lastFetchedAt: new Date().toISOString(), cursor: result.cursor, consecutiveFailures: 0 });\n    const removed = await pruneFeed(workspaceRoot, feed);\n    log.info(\"feeds\", \"feed refreshed\", { slug, written, removed, fetched: result.items.length });\n    return { slug, written, removed, errors: [] };\n  } catch (error) {\n    await writeFeedState(workspaceRoot, feed, { ...state, consecutiveFailures: state.consecutiveFailures + 1 });\n    const message = String(error);\n    log.warn(\"feeds\", \"feed refresh failed\", { slug, error: message });\n    return { slug, written: 0, removed: 0, errors: [message] };\n  }\n}\n\nfunction dueIntervalMs(schedule: FeedSchedule): number {\n  switch (schedule) {\n    case \"daily\":\n      return ONE_DAY_MS;\n    case \"weekly\":\n      return 7 * ONE_DAY_MS;\n    default:\n      return ONE_HOUR_MS;\n  }\n}\n\n/** True iff a `daily` schedule with a UTC `atHour` anchor is due. The system\n *  task ticks hourly, so \"due\" means: we're in the anchor hour AND we haven't\n *  already run in roughly the last day. The 23 h floor (not 24 h) tolerates the\n *  tick landing a few minutes earlier than the previous run, while staying well\n *  above 1 h so a second tick in the same anchor hour can't double-fire. */\nfunction isDailyAtHourDue(now: Date, atHour: number, lastFetchedAt: string | null): boolean {\n  if (now.getUTCHours() !== atHour) return false;\n  if (!lastFetchedAt) return true;\n  const elapsed = now.getTime() - Date.parse(lastFetchedAt);\n  if (!Number.isFinite(elapsed)) return true;\n  return elapsed >= 23 * ONE_HOUR_MS;\n}\n\n/** True iff a collection is due to refresh given its schedule + last run.\n *  `on-demand` is never auto-due; a `daily` schedule with `atHour` anchors to\n *  that UTC hour, otherwise cadence is elapsed-based. */\nfunction isFeedDue(feed: LoadedCollection, state: FeedState): boolean {\n  const ingest = feedIngest(feed.schema);\n  const schedule = ingest?.schedule;\n  if (!schedule || schedule === \"on-demand\") return false;\n  if (schedule === \"daily\" && typeof ingest?.atHour === \"number\") {\n    return isDailyAtHourDue(new Date(), ingest.atHour, state.lastFetchedAt);\n  }\n  if (!state.lastFetchedAt) return true;\n  const elapsed = Date.now() - Date.parse(state.lastFetchedAt);\n  if (!Number.isFinite(elapsed)) return true;\n  return elapsed >= dueIntervalMs(schedule);\n}\n\n/** Refresh every collection whose ingest schedule says it's due — declarative\n *  feeds AND skill-backed collections with `ingest.kind: \"agent\"`. Called by the\n *  hourly system task. Sequential + failure-isolated. */\nexport async function refreshDue(workspaceRoot: string = requireFeedsHost().workspaceRoot): Promise<RefreshResult[]> {\n  const all = await discoverCollections({ workspaceRoot });\n  const withIngest = all.filter((collection) => collection.schema.ingest);\n  const results: RefreshResult[] = [];\n  for (const collection of withIngest) {\n    // Isolate per-collection failures: `readFeedState`/`refreshOne` (esp. the\n    // agent path) can throw, and one bad collection must not abort the whole\n    // due-loop. Capture it as an errors result and move on.\n    try {\n      const state = await readFeedState(workspaceRoot, collection);\n      if (!isFeedDue(collection, state)) continue;\n      results.push(await refreshOne(workspaceRoot, collection));\n    } catch (error) {\n      log.warn(\"feeds\", \"scheduled refresh failed for collection\", { slug: collection.slug, error: String(error) });\n      results.push({ slug: collection.slug, written: 0, removed: 0, errors: [String(error)] });\n    }\n  }\n  return results;\n}\n","// Shareable registration for the hourly \"refresh due collections\" task.\n// Both MulmoClaude (via `initScheduler`, with persistence + catch-up) and a\n// standalone MulmoTerminal/MulmoBooks (via a bare task-manager `registerTask`)\n// register the SAME definition through this factory, so the id/schedule/run\n// can't drift between hosts. See plans/done/feat-shareable-feed-refresh-registration.md.\nimport { SCHEDULE_TYPES, MISSED_RUN_POLICIES } from \"@receptron/task-scheduler\";\nimport type { SystemTaskDef } from \"../../scheduler/adapter.js\";\nimport { refreshDue } from \"./engine.js\";\n\n// Id kept stable so the scheduler-state row isn't orphaned across hosts/renames.\nexport const FEED_REFRESH_TASK_ID = \"system:feed-refresh\";\n// Single source of truth for the default refresh cadence (one hour). Core has no\n// shared time module — `server/utils/time.ts` is host-only — so the named export\n// IS the constant; hosts override via `feedRefreshTaskDef({ intervalMs })`.\nexport const DEFAULT_FEED_REFRESH_INTERVAL_MS = 60 * 60 * 1000;\n\n/**\n * The hourly \"refresh due collections\" task, shared by every host.\n *\n * Drives ALL scheduled ingest: declarative feeds (RSS / JSON) fetch directly,\n * and skill-backed `ingest.kind: \"agent\"` collections dispatch a hidden worker.\n *\n * Returns the rich `SystemTaskDef` rather than registering it — each host keeps\n * its own registration mechanism and applies its own schedule overrides first.\n * A host driving a bare task-manager can still `registerTask(...)` it; the extra\n * `missedRunPolicy` field is simply ignored there.\n *\n * @param opts.intervalMs   per-host interval override (defaults to one hour)\n * @param opts.workspaceRoot defaults to the configured FeedsHost workspace\n */\nexport function feedRefreshTaskDef(opts?: { workspaceRoot?: string; intervalMs?: number }): SystemTaskDef {\n  return {\n    id: FEED_REFRESH_TASK_ID,\n    name: \"Scheduled collection refresh\",\n    description: \"Refresh due collections — fetch declarative feeds + dispatch agent-ingest workers\",\n    schedule: { type: SCHEDULE_TYPES.interval, intervalMs: opts?.intervalMs ?? DEFAULT_FEED_REFRESH_INTERVAL_MS },\n    missedRunPolicy: MISSED_RUN_POLICIES.runOnce,\n    run: () => refreshDue(opts?.workspaceRoot).then(() => {}),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AA8CA,IAAI,UAA4B;;AAGhC,SAAgB,mBAAmB,MAAuB;CACxD,IAAI,WAAW,YAAY,MACzB,MAAM,IAAI,MAAM,wFAAwF;CAE1G,UAAU;AACZ;;AAGA,SAAgB,mBAA8B;CAC5C,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,0EAA0E;CACxG,OAAO;AACT;;AAGA,SAAgB,2BAAiC;CAC/C,UAAU;AACZ;;;AAIA,IAAa,MAAmB;CAC9B,QAAQ,QAAQ,KAAK,SAAS,iBAAiB,CAAC,CAAC,IAAI,MAAM,QAAQ,KAAK,IAAI;CAC5E,OAAO,QAAQ,KAAK,SAAS,iBAAiB,CAAC,CAAC,IAAI,KAAK,QAAQ,KAAK,IAAI;CAC1E,OAAO,QAAQ,KAAK,SAAS,iBAAiB,CAAC,CAAC,IAAI,KAAK,QAAQ,KAAK,IAAI;CAC1E,QAAQ,QAAQ,KAAK,SAAS,iBAAiB,CAAC,CAAC,IAAI,MAAM,QAAQ,KAAK,IAAI;AAC9E;;;;;AC7DA,eAAsB,UAAU,gBAAwB,iBAAiB,CAAC,CAAC,eAA4C;CAErH,QAAO,MADW,oBAAoB,EAAE,cAAc,CAAC,EAAA,CAC5C,QAAQ,eAAe,WAAW,WAAW,MAAM;AAChE;;;;;;;;;;AAWA,eAAsB,WAAW,eAAuB,MAAgC;CACtF,MAAM,OAAO,aAAa,IAAI;CAC9B,IAAI,SAAS,MAAM,OAAO;CAC1B,MAAM,aAAa,eAAe,cAAc,QAAQ,aAAa;CACrE,IAAI;EACF,IAAI,YAAY,MAAM,GAAG,YAAY;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EACrE,MAAM,GAAG,QAAQ,MAAM,aAAa,GAAG;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EACvE,IAAI,KAAK,SAAS,0BAA0B,EAAE,MAAM,KAAK,CAAC;EAC1D,OAAO;CACT,SAAS,OAAO;EACd,IAAI,KAAK,SAAS,sBAAsB;GAAE,MAAM;GAAM,OAAO,OAAO,KAAK;EAAE,CAAC;EAC5E,OAAO;CACT;AACF;;;AClBA,IAAM,2BAAW,IAAI,IAAwB;AAE7C,SAAgB,kBAAkB,MAAc,WAA6B;CAC3E,SAAS,IAAI,MAAM,SAAS;AAC9B;AAEA,SAAgB,aAAa,MAAsC;CACjE,OAAO,SAAS,IAAI,IAAI;AAC1B;;;ACjBA,IAAM,gBAAgB;;AAGtB,IAAa,kBAAkB;;AAG/B,IAAa,0BAA0B,KAAK;;AAG5C,IAAM,gBAAgB;AAKtB,IAAM,mBAA2D;CAC/D,CAAC,WAAW,CAAC;CACb,CAAC,YAAY,CAAC;CACd,CAAC,cAAc,EAAE;CACjB,CAAC,aAAa,CAAC;CACf,CAAC,eAAe,EAAE;CAClB,CAAC,cAAc,EAAE;CACjB,CAAC,eAAe,EAAE;AACpB;AAGA,SAAS,UAAU,SAAgC;CACjD,MAAM,SAAS,QAAQ,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;CAC5C,IAAI,OAAO,WAAW,KAAK,OAAO,MAAM,SAAS,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,GAAG,GAAG,OAAO;CAC5G,QAAS,OAAO,MAAM,KAAO,OAAO,MAAM,KAAO,OAAO,MAAM,IAAK,OAAO,QAAQ;AACpF;AAEA,SAAS,cAAc,SAA0B;CAC/C,MAAM,QAAQ,UAAU,OAAO;CAC/B,IAAI,UAAU,MAAM,OAAO;CAC3B,OAAO,iBAAiB,MAAM,CAAC,MAAM,UAAU;EAC7C,MAAM,UAAU,UAAU,IAAI,KAAK;EACnC,MAAM,OAAO,SAAS,IAAI,IAAK,cAAe,KAAK,SAAW;EAC9D,QAAQ,QAAQ,WAAW,UAAU;CACvC,CAAC;AACH;AAEA,SAAS,cAAc,SAA0B;CAC/C,MAAM,QAAQ,QAAQ,YAAY;CAClC,IAAI,UAAU,SAAS,UAAU,MAAM,OAAO;CAC9C,IAAI,MAAM,WAAW,MAAM,GAAG,OAAO;CACrC,IAAI,MAAM,WAAW,IAAI,KAAK,MAAM,WAAW,IAAI,GAAG,OAAO;CAC7D,MAAM,SAAS,gDAAgD,KAAK,KAAK;CACzE,OAAO,SAAS,cAAc,OAAO,EAAE,IAAI;AAC7C;;AAGA,SAAS,YAAY,SAA0B;CAC7C,MAAM,OAAO,KAAK,OAAO;CACzB,IAAI,SAAS,GAAG,OAAO,cAAc,OAAO;CAC5C,IAAI,SAAS,GAAG,OAAO,cAAc,OAAO;CAC5C,OAAO;AACT;;;AAIA,eAAe,mBAAmB,QAA+B;CAC/D,IAAI,CAAC,gBAAgB,KAAK,MAAM,GAAG,MAAM,IAAI,MAAM,6BAA6B,QAAQ;CACxF,MAAM,EAAE,aAAa,IAAI,IAAI,MAAM;CAGnC,MAAM,OAAO,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;CAC1F,IAAI,KAAK,IAAI,GAAG;EACd,IAAI,YAAY,IAAI,GAAG,MAAM,IAAI,MAAM,iDAAiD,MAAM;EAC9F;CACF;CACA,IAAI;CACJ,IAAI;EACF,YAAY,MAAM,OAAO,MAAM,EAAE,KAAK,KAAK,CAAC;CAC9C,SAAS,KAAK;EACZ,MAAM,IAAI,MAAM,2BAA2B,KAAK,KAAK,OAAO,GAAG,GAAG;CACpE;CACA,MAAM,UAAU,UAAU,MAAM,UAAU,YAAY,MAAM,OAAO,CAAC;CACpE,IAAI,SAAS,MAAM,IAAI,MAAM,sBAAsB,KAAK,8CAA8C,QAAQ,QAAQ,EAAE;AAC1H;AAEA,eAAe,UAAU,KAAa,WAAsC;CAC1E,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,QAAQ,iBAAiB,WAAW,MAAM,IAAI,aAAa,8BAA8B,UAAU,KAAK,cAAc,CAAC,GAAG,SAAS;CACzI,IAAI;EACF,OAAO,MAAM,MAAM,KAAK;GAAE,SAAS,EAAE,cAAc,gBAAgB;GAAG,QAAQ,WAAW;GAAQ,UAAU;EAAS,CAAC;CACvH,UAAU;EACR,aAAa,KAAK;CACpB;AACF;AAIA,eAAe,aAAa,QAAgB,WAAsC;CAChF,IAAI,UAAU;CACd,KAAK,IAAI,MAAM,GAAG,OAAO,eAAe,OAAO;EAC7C,MAAM,mBAAmB,OAAO;EAChC,MAAM,WAAW,MAAM,UAAU,SAAS,SAAS;EACnD,MAAM,WAAW,SAAS,UAAU,OAAO,SAAS,SAAS,OAAO,SAAS,WAAW,MAAM,SAAS,QAAQ,IAAI,UAAU,IAAI;EACjI,IAAI,CAAC,UAAU,OAAO;EACtB,UAAU,IAAI,IAAI,UAAU,OAAO,CAAC,CAAC,SAAS;CAChD;CACA,MAAM,IAAI,MAAM,wBAAwB,cAAc,kBAAkB,QAAQ;AAClF;;AAGA,eAAsB,UAAU,KAAa,YAAoB,yBAA0C;CACzG,MAAM,WAAW,MAAM,aAAa,KAAK,SAAS;CAClD,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,QAAQ,SAAS,OAAO,GAAG,SAAS,WAAW,YAAY,KAAK;CAClG,OAAO,SAAS,KAAK;AACvB;;AAGA,eAAsB,UAAU,KAAa,YAAoB,yBAA2C;CAC1G,MAAM,WAAW,MAAM,aAAa,KAAK,SAAS;CAClD,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,QAAQ,SAAS,OAAO,GAAG,SAAS,WAAW,YAAY,KAAK;CAClG,OAAO,SAAS,KAAK;AACvB;;;AChHA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AACA,SAAS,iBAAiB,OAAiC;CACzD,OAAO,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,SAAS;AAC5D;AAaA,IAAM,MAAM,IAAI,UAAU;CACxB,kBAAkB;CAClB,qBAAqB;CACrB,eAAe;CACf,eAAe;CACf,qBAAqB;CACrB,YAAY;CAIZ,UAAU,SAAS,SAAS,UAAU,SAAS;AACjD,CAAC;;;AAID,SAAgB,UAAU,MAAiC;CACzD,MAAM,OAAO,SAAS,IAAI;CAC1B,IAAI,CAAC,KAAK,KAAK,GAAG,OAAO;CACzB,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,MAAM,IAAI;CACzB,QAAQ;EACN,OAAO;CACT;CACA,IAAI,CAAC,SAAS,MAAM,GAAG,OAAO;CAC9B,IAAI,SAAS,OAAO,GAAG,GAAG,OAAO,SAAS,OAAO,GAAG;CACpD,IAAI,SAAS,OAAO,IAAI,GAAG,OAAO,UAAU,OAAO,IAAI;CACvD,MAAM,MAAM,OAAO,cAAc,OAAO;CACxC,IAAI,SAAS,GAAG,GAAG,OAAO,WAAW,GAAG;CACxC,OAAO;AACT;AAIA,SAAS,aAAa,OAAkC;CACtD,MAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;CACjD,MAAM,QAA0B,CAAC;CACjC,KAAK,MAAM,OAAO,UAChB,IAAI,SAAS,GAAG,KAAK,WAAW,IAAI,KAAK,MAAM,MAAM,MAAM,KAAK,EAAE,IAAI,CAAC;CAEzE,OAAO;AACT;AAEA,SAAS,SAAS,KAAiD;CACjE,MAAM,EAAE,YAAY;CACpB,IAAI,CAAC,SAAS,OAAO,GAAG,OAAO;CAC/B,OAAO;EAAE,MAAM;EAAO,OAAO,WAAW,QAAQ,KAAK;EAAG,OAAO,aAAa,QAAQ,IAAI;CAAE;AAC5F;AAEA,SAAS,WAAW,KAAiD;CACnE,MAAM,UAAU,SAAS,IAAI,OAAO,IAAI,IAAI,UAAU;CACtD,OAAO;EAAE,MAAM;EAAO,OAAO,UAAU,WAAW,QAAQ,KAAK,IAAI;EAAM,OAAO,aAAa,IAAI,IAAI;CAAE;AACzG;AAEA,SAAS,UAAU,MAAkD;CACnE,OAAO;EAAE,MAAM;EAAQ,OAAO,WAAW,KAAK,KAAK;EAAG,OAAO,aAAa,KAAK,KAAK;CAAE;AACxF;AAOA,SAAS,WAAW,OAA+B;CACjD,IAAI,iBAAiB,KAAK,GAAG,OAAO;CACpC,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,IAAI,SAAS,KAAK,GAAG,OAAO,qBAAqB,KAAK;CACtD,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,oBAAoB,KAAK;CAC1D,OAAO;AACT;AAEA,SAAS,qBAAqB,QAAgD;CAC5E,MAAM,OAAO,OAAO;CACpB,IAAI,iBAAiB,IAAI,GAAG,OAAO;CACnC,MAAM,QAAQ,OAAO;CACrB,IAAI,iBAAiB,KAAK,GAAG,OAAO;CACpC,OAAO;AACT;AAEA,SAAS,oBAAoB,OAA0C;CACrE,KAAK,MAAM,SAAS,OAAO;EACzB,MAAM,WAAW,WAAW,KAAK;EACjC,IAAI,aAAa,MAAM,OAAO;CAChC;CACA,OAAO;AACT;AAEA,SAAS,SAAS,MAAsB;CACtC,OAAO,KAAK,WAAW,CAAC,MAAM,QAAS,KAAK,MAAM,CAAC,IAAI;AACzD;;;ACpGA,IAAM,aAAa;;;;AAKnB,SAAS,aAAa,SAAiB,QAA2B;CAChE,MAAM,eAAe,QAAQ,QAAQ,GAAG;CACxC,MAAM,OAAO,iBAAiB,KAAK,UAAU,QAAQ,MAAM,GAAG,YAAY;CAC1E,IAAI,KAAK,SAAS,GAAG,OAAO,KAAK;EAAE,MAAM;EAAO,KAAK;CAAK,CAAC;CAC3D,IAAI,iBAAiB,IAAI;CACzB,KAAK,MAAM,SAAS,QAAQ,MAAM,YAAY,CAAC,CAAC,SAAS,UAAU,GAAG;EACpE,MAAM,GAAG,SAAS;EAClB,IAAI,MAAM,SAAS,GAAG,OAAO,KAAK;GAAE,MAAM;GAAS,OAAO,OAAO,KAAK;EAAE,CAAC;CAC3E;AACF;AAEA,SAAS,SAAS,MAA2B;CAC3C,MAAM,SAAsB,CAAC;CAC7B,KAAK,MAAM,WAAW,KAAK,MAAM,GAAG,GAClC,IAAI,QAAQ,SAAS,GAAG,aAAa,SAAS,MAAM;CAEtD,OAAO;AACT;AAEA,SAAS,KAAK,SAAkB,OAA2B;CACzD,IAAI,YAAY,QAAQ,YAAY,KAAA,GAAW,OAAO,KAAA;CACtD,IAAI,MAAM,SAAS,OAAO;EACxB,IAAI,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG,OAAO,KAAA;EAClE,OAAQ,QAAoC,MAAM;CACpD;CACA,OAAO,MAAM,QAAQ,OAAO,IAAI,QAAQ,MAAM,SAAS,KAAA;AACzD;;AAGA,SAAgB,UAAU,MAAe,MAAuB;CAC9D,IAAI,UAAmB;CACvB,KAAK,MAAM,SAAS,SAAS,IAAI,GAC/B,UAAU,KAAK,SAAS,KAAK;CAE/B,OAAO;AACT;;;;AAKA,SAAgB,cAAc,MAAe,SAAwC;CACnF,IAAI,CAAC,SAAS,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;CACnD,MAAM,QAAQ,UAAU,MAAM,OAAO;CACrC,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACzC;;;ACzDA,SAAS,YAAY,OAA+B;CAClD,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,SAAS,GAAG,OAAO,MAAM,KAAK;CAC5E,IAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG,OAAO,OAAO,KAAK;CAC5E,OAAO;AACT;;;;;;AAOA,SAAS,eAAe,OAAyB;CAC/C,IAAI,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAG;EAC/D,MAAM,MAAM;EACZ,IAAI,OAAO,IAAI,aAAa,UAAU,OAAO,IAAI;EACjD,IAAI,OAAO,IAAI,cAAc,UAAU,OAAO,IAAI;CACpD;CACA,OAAO;AACT;;;;;;AAOA,SAAS,eAAe,OAAgB,WAAwC;CAC9E,MAAM,YAAY,eAAe,KAAK;CACtC,IAAI,cAAc,UAAU,OAAO,cAAc,UAAU;EACzD,MAAM,SAAS,KAAK,MAAM,SAAS;EACnC,IAAI,OAAO,SAAS,MAAM,GAAG,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,EAAE;CAChF;CACA,OAAO;AACT;;;;AAKA,SAAS,SAAS,SAAyB;CAMzC,MAAM,OALY,QACf,KAAK,CAAC,CACN,YAAY,CAAC,CACb,QAAQ,eAAe,GAEb,CAAA,CAAU,QAAQ,YAAY,EAAE;CAC7C,IAAI,KAAK,SAAS,KAAK,KAAK,UAAU,IAAI,OAAO;CACjD,MAAM,OAAO,WAAW,QAAQ,CAAC,CAC9B,OAAO,WAAW,QAAQ,OAAO,CAAC,CAClC,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,KAAK,SAAS,KAAK,GAAG,KAAK,MAAM,GAAG,EAAE,EAAE,GAAG,SAAS,QAAQ;AACrE;AAEA,SAAS,WAAW,QAAwB,SAAkB,QAA+B,QAAkC;CAC7H,MAAM,aAAa,YAAY,OAAO,OAAO,WAAW;CACxD,IAAI,YAAY,OAAO;CACvB,IAAI,OAAO,QAAQ;EACjB,MAAM,SAAS,YAAY,eAAe,UAAU,SAAS,OAAO,MAAM,CAAC,CAAC;EAC5E,IAAI,QAAQ,OAAO;CACrB;CACA,OAAO,KAAK,UAAU,MAAM;AAC9B;;;;;;AAOA,SAAgB,cAAc,SAAkB,QAA+B,QAA0C;CACvH,MAAM,SAAyB,CAAC;CAChC,KAAK,MAAM,CAAC,aAAa,eAAe,OAAO,QAAQ,OAAO,GAAG,GAAG;EAClE,MAAM,QAAQ,eAAe,UAAU,SAAS,UAAU,GAAG,OAAO,SAAS,YAAY,EAAE,IAAI;EAC/F,IAAI,UAAU,KAAA,GAAW,OAAO,eAAe;CACjD;CACA,OAAO,OAAO,cAAc,SAAS,WAAW,QAAQ,SAAS,QAAQ,MAAM,CAAC;CAChF,OAAO;AACT;;;AChFA,IAAM,cAA0B,OAAO,QAAQ,WAAW;CAExD,MAAM,OAAO,UAAU,MADJ,UAAU,OAAO,GAAG,CACZ;CAC3B,IAAI,CAAC,MAAM,OAAO;EAAE,OAAO,CAAC;EAAG,QAAQ,CAAC;CAAE;CAE1C,OAAO;EAAE,OADK,KAAK,MAAM,KAAK,SAAS,cAAc,KAAK,KAAK,QAAQ,MAAM,CACpE;EAAO,QAAQ,CAAC;CAAE;AAC7B;AAGA,kBAAkB,OAAO,WAAW;AACpC,kBAAkB,QAAQ,WAAW;;;ACZrC,IAAM,mBAA+B,OAAO,QAAQ,WAAW;CAI7D,OAAO;EAAE,OAFQ,cAAc,MADZ,UAAU,OAAO,GAAG,GACF,OAAO,OAC9B,CAAA,CAAS,KAAK,QAAQ,cAAc,KAAK,QAAQ,MAAM,CAC5D;EAAO,QAAQ,CAAC;CAAE;AAC7B;AAEA,kBAAkB,aAAa,gBAAgB;;;;ACS/C,SAAS,cAAc,QAAqB,eAA+B;CACzE,OAAO,OAAO,WAAW,SAAS,cAAc,OAAO,MAAM,aAAa,IAAI,gBAAgB,OAAO,MAAM,aAAa;AAC1H;AAiBA,SAAgB,iBAAiB,MAAyB;CACxD,OAAO;EAAE;EAAM,eAAe;EAAM,QAAQ,CAAC;EAAG,qBAAqB;CAAE;AACzE;AAEA,SAAS,eAAe,MAAc,QAAuC;CAC3E,MAAM,OAAO,iBAAiB,IAAI;CAClC,MAAM,SAAS,OAAO,UAAU,OAAO,OAAO,WAAW,WAAY,OAAO,SAAoC,KAAK;CACrH,OAAO;EACL;EACA,eAAe,OAAO,OAAO,kBAAkB,WAAW,OAAO,gBAAgB,KAAK;EACtF;EACA,qBAAqB,OAAO,OAAO,wBAAwB,WAAW,OAAO,sBAAsB,KAAK;EACxG,GAAI,OAAO,OAAO,kBAAkB,WAAW,EAAE,eAAe,OAAO,cAAc,IAAI,CAAC;CAC5F;AACF;;;AAIA,eAAsB,cAAc,eAAuB,QAAyC;CAClG,MAAM,EAAE,SAAS;CACjB,IAAI;EACF,MAAM,MAAM,MAAM,SAAS,cAAc,QAAQ,aAAa,GAAG,OAAO;EACxE,OAAO,eAAe,MAAM,KAAK,MAAM,GAAG,CAAuB;CACnE,SAAS,KAAK;EAEZ,IAAI,IAAM,SAAS,UACjB,IAAI,KAAK,SAAS,4CAA4C;GAAE;GAAM,OAAO,OAAO,GAAG;EAAE,CAAC;EAE5F,OAAO,iBAAiB,IAAI;CAC9B;AACF;;;AAIA,eAAsB,eAAe,eAAuB,QAAqB,OAAiC;CAChH,MAAM,OAAO,cAAc,QAAQ,aAAa;CAChD,MAAM,MAAM,KAAK,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CACnD,MAAM,iBAAiB,CAAC,CAAC,gBAAgB,MAAM,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,GAAG;AACtF;;;;;;AC1DA,SAAS,qBAA+C;CACtD,IAAI;EACF,OAAO,iBAAiB,CAAC,CAAC;CAC5B,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,OAAO,MAAc,OAA8C;CAC1E,OAAO;EAAE;EAAM,SAAS;EAAG,SAAS;EAAG,QAAQ,CAAC;EAAG,GAAG;CAAM;AAC9D;;;;;;;;AASA,eAAsB,gBAAgB,eAAuB,YAA8B,MAAqD;CAC9I,MAAM,SAAS,MAAM,UAAU;CAC/B,MAAM,EAAE,SAAS;CACjB,MAAM,SAAS,WAAW,OAAO;CACjC,IAAI,CAAC,UAAU,OAAO,SAAS,SAAS,OAAO,OAAO,MAAM,EAAE,QAAQ,CAAC,uCAAuC,EAAE,CAAC;CACjH,MAAM,eAAe,mBAAmB;CACxC,IAAI,CAAC,cAAc,OAAO,OAAO,MAAM,EAAE,QAAQ,CAAC,2CAA2C,EAAE,CAAC;CAEhG,MAAM,WAAW,MAAM,kBAAkB,WAAW,UAAU,OAAO,QAAQ;CAC7E,IAAI,aAAa,MAAM,OAAO,OAAO,MAAM,EAAE,QAAQ,CAAC,oBAAoB,OAAO,SAAS,oBAAoB,EAAE,CAAC;CAEjH,MAAM,QAAQ,MAAM,UAAU,WAAW,SAAS,EAAE,cAAc,CAAC;CACnE,MAAM,UAAU,gCAAgC,OAAO,WAAW,QAAQ,QAAQ;CAKlF,IAAI;CACJ,IAAI;EACF,SAAS,MAAM,aAAa;GAC1B;GACA,QAAQ,OAAO;GACf;GAIA,YAAY,UAAU,YAAY,cAAc,eAAe,YAAY,QAAQ,QAAQ,IAAI,KAAA;EACjG,CAAC;CACH,SAAS,KAAK;EACZ,IAAI,KAAK,SAAS,oCAAoC;GAAE;GAAM,OAAO,OAAO,GAAG;EAAE,CAAC;EAClF,OAAO,OAAO,MAAM;GAAE,QAAQ,CAAC,OAAO,GAAG,CAAC;GAAG,YAAY;EAAM,CAAC;CAClE;CACA,IAAI,CAAC,OAAO,IAAI;EAGd,IAAI,KAAK,SAAS,iCAAiC;GAAE;GAAM,OAAO,OAAO;EAAM,CAAC;EAChF,OAAO,OAAO,MAAM;GAAE,QAAQ,CAAC,OAAO,KAAK;GAAG,YAAY;EAAM,CAAC;CACnE;CAGA,MAAM,eAAe,eAAe,YAAY;EAAE,GAAG,MADjC,cAAc,eAAe,UAAU;EACC,gCAAe,IAAI,KAAK,EAAA,CAAE,YAAY;CAAE,CAAC;CACrG,IAAI,KAAK,SAAS,2BAA2B;EAAE;EAAM,MAAM,OAAO;EAAM,QAAQ,OAAO;EAAQ;EAAQ,OAAO,MAAM;CAAO,CAAC;CAG5H,OAAO,OAAO,MAAM;EAAE,YAAY;EAAM,GAAI,SAAS,CAAC,IAAI,EAAE,QAAQ,OAAO,OAAO;CAAG,CAAC;AACxF;;;;;;AAOA,eAAe,cAAc,eAAuB,YAA8B,UAAkC;CAClH,MAAM,QAAQ,MAAM,cAAc,eAAe,UAAU;CAE3D,MAAM,eAAe,eAAe,YADZ,WAAW,MAAM,cAAc,OAAO,UAAU,IAAI,MAAM,gBAAgB,OAAO,UAAU,CAC/D;AACtD;AAEA,eAAe,cAAc,OAAkB,YAAkD;CAC/F,MAAM,OAAkB;EAAE,GAAG;EAAO,qBAAqB,MAAM,sBAAsB;CAAE;CACvF,IAAI,KAAK,SAAS,8BAA8B;EAAE,MAAM,WAAW;EAAM,qBAAqB,KAAK;CAAoB,CAAC;CAExH,IAAI,CAAC,MAAM,eACT,IAAI;EACF,MAAM,EAAE,OAAO,MAAM,QAAgB;GACnC,WAAW;GACX,UAAU;GACV,WAAW;GACX,OAAO;GACP,MAAM,IAAI,WAAW,OAAO,MAAM,KAAK,WAAW,KAAK;GACvD,gBAAgB,gBAAgB,WAAW;EAC7C,CAAC;EACD,KAAK,gBAAgB;CACvB,SAAS,KAAK;EACZ,IAAI,KAAK,SAAS,yCAAyC;GAAE,MAAM,WAAW;GAAM,OAAO,OAAO,GAAG;EAAE,CAAC;CAC1G;CAEF,OAAO;AACT;AAEA,eAAe,gBAAgB,OAAkB,YAAkD;CACjG,IAAI,KAAK,SAAS,iCAAiC,EAAE,MAAM,WAAW,KAAK,CAAC;CAC5E,IAAI,MAAM,eACR,MAAM,MAAc,MAAM,aAAa,CAAC,CAAC,OAAO,QAC9C,IAAI,KAAK,SAAS,uCAAuC;EAAE,MAAM,WAAW;EAAM,OAAO,OAAO,GAAG;CAAE,CAAC,CACxG;CAEF,MAAM,OAAkB;EAAE,GAAG;EAAO,qBAAqB;CAAE;CAC3D,OAAO,KAAK;CACZ,OAAO;AACT;;;AChHA,IAAM,cAAc;AACpB,IAAM,aAAa;;;;;AAMnB,SAAS,WAAW,QAAkD;CACpE,OAAO,OAAO;AAChB;AAEA,eAAe,YAAY,eAAuB,MAAwB,OAA0C;CAClH,IAAI,UAAU;CACd,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,SAAS,KAAK,KAAK,OAAO;EAChC,IAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;EACvD,MAAM,SAAS,MAAM,UAAU,KAAK,SAAS,QAAQ,MAAM;GAAE,iBAAiB;GAAO;GAAe,MAAM,KAAK;EAAK,CAAC;EACrH,IAAI,OAAO,SAAS,MAAM,WAAW;OAChC,IAAI,KAAK,SAAS,2BAA2B;GAAE,MAAM,KAAK;GAAM;GAAQ,MAAM,OAAO;EAAK,CAAC;CAClG;CACA,OAAO;AACT;;;AAIA,SAAS,eAAe,QAAyC;CAC/D,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,OAAO,MAAM,GACpD,IAAI,KAAK,SAAS,QAAQ,OAAO;CAEnC,OAAO;AACT;AAGA,SAAS,WAAW,MAAsB,OAAuB;CAC/D,MAAM,QAAQ,KAAK;CACnB,MAAM,SAAS,OAAO,UAAU,WAAW,KAAK,MAAM,KAAK,IAAI;CAC/D,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO;AACnD;;;;AAKA,eAAe,UAAU,eAAuB,MAAyC;CACvF,MAAM,SAAS,WAAW,KAAK,MAAM;CAGrC,MAAM,OAAO,UAAU,OAAO,SAAA,UAA6B,OAAO,WAAW,KAAA,MAAA;CAC7E,IAAI,OAAO,GAAG,OAAO;CACrB,MAAM,YAAY,eAAe,KAAK,MAAM;CAC5C,IAAI,CAAC,WAAW;EACd,IAAI,KAAK,SAAS,gEAAgE,EAAE,MAAM,KAAK,KAAK,CAAC;EACrG,OAAO;CACT;CACA,MAAM,QAAQ,MAAM,UAAU,KAAK,SAAS,EAAE,cAAc,CAAC;CAC7D,IAAI,MAAM,UAAU,KAAK,OAAO;CAChC,MAAM,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,MAAM,UAAU,WAAW,OAAO,SAAS,IAAI,WAAW,MAAM,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG;CACpH,IAAI,UAAU;CACd,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,SAAS,KAAK,KAAK,OAAO;EAChC,IAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;EACvD,KAAK,MAAM,WAAW,KAAK,SAAS,QAAQ;GAAE;GAAe,MAAM,KAAK;EAAK,CAAC,EAAA,CAAG,SAAS,MAAM,WAAW;CAC7G;CACA,IAAI,UAAU,GAAG,IAAI,KAAK,SAAS,2BAA2B;EAAE,MAAM,KAAK;EAAM;EAAS;CAAI,CAAC;CAC/F,OAAO;AACT;;;AAIA,eAAsB,WAAW,eAAuB,MAAwB,MAAqD;CACnI,MAAM,EAAE,SAAS;CACjB,MAAM,SAAS,WAAW,KAAK,MAAM;CACrC,IAAI,CAAC,QAAQ,OAAO;EAAE;EAAM,SAAS;EAAG,SAAS;EAAG,QAAQ,CAAC,iCAAiC;CAAE;CAKhG,IAAI,OAAO,SAAA,SAA4B,OAAO,gBAAgB,eAAe,MAAM,IAAI;CACvF,MAAM,YAAY,aAAa,OAAO,IAAI;CAC1C,IAAI,CAAC,WAAW,OAAO;EAAE;EAAM,SAAS;EAAG,SAAS;EAAG,QAAQ,CAAC,qCAAqC,OAAO,KAAK,EAAE;CAAE;CACrH,MAAM,QAAQ,MAAM,cAAc,eAAe,IAAI;CACrD,IAAI;EACF,MAAM,SAAS,MAAM,UAAU,QAAQ,KAAK,QAAQ,KAAK;EACzD,MAAM,UAAU,MAAM,YAAY,eAAe,MAAM,OAAO,KAAK;EACnE,MAAM,eAAe,eAAe,MAAM;GAAE,GAAG;GAAO,gCAAe,IAAI,KAAK,EAAA,CAAE,YAAY;GAAG,QAAQ,OAAO;GAAQ,qBAAqB;EAAE,CAAC;EAC9I,MAAM,UAAU,MAAM,UAAU,eAAe,IAAI;EACnD,IAAI,KAAK,SAAS,kBAAkB;GAAE;GAAM;GAAS;GAAS,SAAS,OAAO,MAAM;EAAO,CAAC;EAC5F,OAAO;GAAE;GAAM;GAAS;GAAS,QAAQ,CAAC;EAAE;CAC9C,SAAS,OAAO;EACd,MAAM,eAAe,eAAe,MAAM;GAAE,GAAG;GAAO,qBAAqB,MAAM,sBAAsB;EAAE,CAAC;EAC1G,MAAM,UAAU,OAAO,KAAK;EAC5B,IAAI,KAAK,SAAS,uBAAuB;GAAE;GAAM,OAAO;EAAQ,CAAC;EACjE,OAAO;GAAE;GAAM,SAAS;GAAG,SAAS;GAAG,QAAQ,CAAC,OAAO;EAAE;CAC3D;AACF;AAEA,SAAS,cAAc,UAAgC;CACrD,QAAQ,UAAR;EACE,KAAK,SACH,OAAO;EACT,KAAK,UACH,OAAO,IAAI;EACb,SACE,OAAO;CACX;AACF;;;;;;AAOA,SAAS,iBAAiB,KAAW,QAAgB,eAAuC;CAC1F,IAAI,IAAI,YAAY,MAAM,QAAQ,OAAO;CACzC,IAAI,CAAC,eAAe,OAAO;CAC3B,MAAM,UAAU,IAAI,QAAQ,IAAI,KAAK,MAAM,aAAa;CACxD,IAAI,CAAC,OAAO,SAAS,OAAO,GAAG,OAAO;CACtC,OAAO,WAAW,KAAK;AACzB;;;;AAKA,SAAS,UAAU,MAAwB,OAA2B;CACpE,MAAM,SAAS,WAAW,KAAK,MAAM;CACrC,MAAM,WAAW,QAAQ;CACzB,IAAI,CAAC,YAAY,aAAa,aAAa,OAAO;CAClD,IAAI,aAAa,WAAW,OAAO,QAAQ,WAAW,UACpD,OAAO,iCAAiB,IAAI,KAAK,GAAG,OAAO,QAAQ,MAAM,aAAa;CAExE,IAAI,CAAC,MAAM,eAAe,OAAO;CACjC,MAAM,UAAU,KAAK,IAAI,IAAI,KAAK,MAAM,MAAM,aAAa;CAC3D,IAAI,CAAC,OAAO,SAAS,OAAO,GAAG,OAAO;CACtC,OAAO,WAAW,cAAc,QAAQ;AAC1C;;;;AAKA,eAAsB,WAAW,gBAAwB,iBAAiB,CAAC,CAAC,eAAyC;CAEnH,MAAM,cAAa,MADD,oBAAoB,EAAE,cAAc,CAAC,EAAA,CAChC,QAAQ,eAAe,WAAW,OAAO,MAAM;CACtE,MAAM,UAA2B,CAAC;CAClC,KAAK,MAAM,cAAc,YAIvB,IAAI;EAEF,IAAI,CAAC,UAAU,YAAY,MADP,cAAc,eAAe,UAAU,CAC3B,GAAG;EACnC,QAAQ,KAAK,MAAM,WAAW,eAAe,UAAU,CAAC;CAC1D,SAAS,OAAO;EACd,IAAI,KAAK,SAAS,2CAA2C;GAAE,MAAM,WAAW;GAAM,OAAO,OAAO,KAAK;EAAE,CAAC;EAC5G,QAAQ,KAAK;GAAE,MAAM,WAAW;GAAM,SAAS;GAAG,SAAS;GAAG,QAAQ,CAAC,OAAO,KAAK,CAAC;EAAE,CAAC;CACzF;CAEF,OAAO;AACT;;;ACvKA,IAAa,uBAAuB;AAIpC,IAAa,mCAAmC,OAAU;;;;;;;;;;;;;;;AAgB1D,SAAgB,mBAAmB,MAAuE;CACxG,OAAO;EACL,IAAI;EACJ,MAAM;EACN,aAAa;EACb,UAAU;GAAE,MAAM,eAAe;GAAU,YAAY,MAAM,cAAA;EAA+C;EAC5G,iBAAiB,oBAAoB;EACrC,WAAW,WAAW,MAAM,aAAa,CAAC,CAAC,WAAW,CAAC,CAAC;CAC1D;AACF"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/feeds/server/host.ts","../../../src/feeds/server/registry.ts","../../../src/feeds/server/retrievers/index.ts","../../../src/feeds/server/fetch/httpClient.ts","../../../src/feeds/server/fetch/rssParser.ts","../../../src/feeds/server/pathResolver.ts","../../../src/feeds/server/projectItem.ts","../../../src/feeds/server/retrievers/rss.ts","../../../src/feeds/server/retrievers/httpJson.ts","../../../src/feeds/server/state.ts","../../../src/feeds/server/agentIngest.ts","../../../src/feeds/server/engine.ts","../../../src/feeds/server/scheduledRefresh.ts"],"sourcesContent":["// Host injection seam for the Feeds engine — mirrors `configureCollectionHost`\n// / `configureScheduler`. The engine is host-agnostic: the workspace root, the\n// logger, an atomic file writer, and the hidden/visible agent-ingest worker\n// launcher are injected once at boot via `configureFeedsHost`. Everything else\n// the engine needs (collection IO, the notifier) is a sibling `@mulmoclaude/core`\n// subpath, imported directly. Both MulmoClaude and MulmoTerminal supply their\n// own host shim.\n\n/** Outcome of launching one hidden/visible agent-ingest worker. `chatId` lets\n *  the caller register a completion hook so a failed refresh doesn't die\n *  silently. */\nexport type AgentWorkerResult = { ok: true; chatId: string } | { ok: false; error: string };\n\n/** Launches a worker chat. Injected at boot to keep the feeds engine from\n *  importing a host's routes/session layer. `hidden` chooses an invisible\n *  system worker (scheduled refresh) vs a visible session the user can watch\n *  (manual Refresh — debuggable). `onComplete` is a one-shot completion hook\n *  (only honoured for hidden workers) so the dispatcher learns success/failure.\n *  Returns `ok:false` on the concurrency-cap miss or a launch error — the caller\n *  leaves state untouched and retries next tick. */\nexport type AgentWorkerRunner = (args: {\n  message: string;\n  roleId: string;\n  hidden: boolean;\n  onComplete?: (outcome: { didError: boolean }) => void | Promise<void>;\n}) => Promise<AgentWorkerResult>;\n\n/** Structured logger, `(prefix, msg, data?)` — same shape as `CollectionLogger`. */\nexport interface FeedsLogger {\n  error: (prefix: string, message: string, data?: Record<string, unknown>) => void;\n  warn: (prefix: string, message: string, data?: Record<string, unknown>) => void;\n  info: (prefix: string, message: string, data?: Record<string, unknown>) => void;\n  debug: (prefix: string, message: string, data?: Record<string, unknown>) => void;\n}\n\nexport interface FeedsHost {\n  /** Absolute workspace root — the default for `refreshDue()` and state paths. */\n  workspaceRoot: string;\n  /** Host logger. */\n  log: FeedsLogger;\n  /** Host atomic file writer (state files). */\n  writeFileAtomic: (filePath: string, content: string) => Promise<void>;\n  /** Launches the agent-ingest worker (was `setAgentWorkerRunner`). */\n  spawnWorker: AgentWorkerRunner;\n}\n\nlet current: FeedsHost | null = null;\n\n/** Wire the feeds engine to a host. Call once at startup, before any refresh. */\nexport function configureFeedsHost(host: FeedsHost): void {\n  if (current && current !== host) {\n    throw new Error(\"@mulmoclaude/core/feeds: configureFeedsHost() was already called with a different host\");\n  }\n  current = host;\n}\n\n/** The configured host, or throw if `configureFeedsHost` was never called. */\nexport function requireFeedsHost(): FeedsHost {\n  if (!current) throw new Error(\"@mulmoclaude/core/feeds: configureFeedsHost() was not called by the host\");\n  return current;\n}\n\n/** Test-only: clear the configured host. */\nexport function resetFeedsHostForTesting(): void {\n  current = null;\n}\n\n/** Forwarding logger so engine modules can `import { log }` without each\n *  reaching for `requireFeedsHost().log`. */\nexport const log: FeedsLogger = {\n  error: (prefix, msg, data) => requireFeedsHost().log.error(prefix, msg, data),\n  warn: (prefix, msg, data) => requireFeedsHost().log.warn(prefix, msg, data),\n  info: (prefix, msg, data) => requireFeedsHost().log.info(prefix, msg, data),\n  debug: (prefix, msg, data) => requireFeedsHost().log.debug(prefix, msg, data),\n};\n","// List the registered data-source feeds. Feeds are CREATED / REMOVED by\n// the agent writing / deleting `feeds/<slug>/schema.json` directly (see\n// config/helps/feeds.md) — the host only discovers + retrieves them.\n// icon / dataPath defaults for agent-authored feed schemas are applied in\n// `collection/server/discovery.ts` (source === \"feed\").\n\nimport { rm } from \"node:fs/promises\";\nimport { discoverCollections, resolveDataDir, safeSlugName, type LoadedCollection } from \"../../collection/server/index.js\";\nimport { log, requireFeedsHost } from \"./host.js\";\nimport { feedDir } from \"../paths.js\";\n\n/** Every registered feed, as a discovered collection (carrying its\n *  validated schema, `ingest`, and resolved `dataDir`). */\nexport async function listFeeds(workspaceRoot: string = requireFeedsHost().workspaceRoot): Promise<LoadedCollection[]> {\n  const all = await discoverCollections({ workspaceRoot });\n  return all.filter((collection) => collection.source === \"feed\");\n}\n\n/** Delete a feed entirely: its records AND its `feeds/<slug>/` directory\n *  (schema + state). Idempotent. Host-side only (backs the UI delete\n *  button); the agent removes a feed by deleting both directories itself.\n *\n *  The records dir is derived from the SLUG (`data/feeds/<slug>`), never\n *  from the schema's `dataPath` — feeds are forced into that namespace at\n *  discovery, so a malformed/hostile `dataPath` can't redirect this delete\n *  at another app's data (e.g. `data/wiki`). `resolveDataDir` also rejects\n *  any path that escapes the workspace. */\nexport async function removeFeed(workspaceRoot: string, slug: string): Promise<boolean> {\n  const safe = safeSlugName(slug);\n  if (safe === null) return false;\n  const recordsDir = resolveDataDir(`data/feeds/${safe}`, workspaceRoot);\n  try {\n    if (recordsDir) await rm(recordsDir, { recursive: true, force: true });\n    await rm(feedDir(safe, workspaceRoot), { recursive: true, force: true });\n    log.info(\"feeds\", \"feed + records removed\", { slug: safe });\n    return true;\n  } catch (error) {\n    log.warn(\"feeds\", \"feed remove failed\", { slug: safe, error: String(error) });\n    return false;\n  }\n}\n","// Pluggable retriever registry. Each declarative `ingest.kind` maps to one\n// RetrieveFn that fetches the endpoint and returns projected records.\n// Side-effect registration keeps the engine decoupled from the kinds.\n// The `agent` kind is NOT a retriever (it dispatches a hidden worker before\n// the engine consults this registry); a future `code` kind would register here.\n\nimport type { CollectionItem, CollectionSchema } from \"../../../collection/index.js\";\nimport type { DeclarativeIngestSpec } from \"../../ingestTypes.js\";\nimport type { FeedState } from \"../state.js\";\n\nexport interface RetrieveResult {\n  /** Projected records, keyed by primaryKey (the engine upserts them). */\n  items: CollectionItem[];\n  /** Updated retriever cursor to persist (incremental fetches). */\n  cursor: Record<string, string>;\n}\n\n// Declarative-only: the engine branches `agent` ingest off BEFORE looking up a\n// retriever, so a RetrieveFn never sees a non-fetch spec (and rss/http-json can\n// read `ingest.url`/`map` without union narrowing).\nexport type RetrieveFn = (ingest: DeclarativeIngestSpec, schema: CollectionSchema, state: FeedState) => Promise<RetrieveResult>;\n\nconst registry = new Map<string, RetrieveFn>();\n\nexport function registerRetriever(kind: string, retriever: RetrieveFn): void {\n  registry.set(kind, retriever);\n}\n\nexport function getRetriever(kind: string): RetrieveFn | undefined {\n  return registry.get(kind);\n}\n","// Minimal HTTP client for feed retrievers. Feed URLs are model-authored /\n// user-supplied, so beyond a User-Agent + timeout this guards against SSRF:\n// every URL (and every redirect hop) is DNS-resolved and rejected if it\n// points at a loopback / private / link-local / cloud-metadata address.\n// Redirects are followed MANUALLY so a public URL can't 302 to an internal\n// one and bypass the guard. It does NOT do robots.txt / rate limiting (the\n// engine fetches feeds sequentially to stay gentle).\n\nimport { lookup } from \"node:dns/promises\";\nimport { isIP } from \"node:net\";\n\n// Inlined — the client needs only this one time constant and must stay free of\n// host-side time-constant modules.\nconst ONE_SECOND_MS = 1_000;\n\n/** Identifies the bot to site operators. */\nexport const FEED_USER_AGENT = \"MulmoClaude-FeedBot/1.0 (+https://github.com/receptron/mulmoclaude)\";\n\n/** Per-request wall-clock cap so a hung server can't wedge a refresh. */\nexport const DEFAULT_FEED_TIMEOUT_MS = 30 * ONE_SECOND_MS;\n\n/** Cap on redirect hops followed (each re-checked for SSRF). */\nconst MAX_REDIRECTS = 5;\n\n// CIDR blocks we refuse to fetch: unspecified, loopback, RFC1918, CGNAT,\n// and link-local (which also covers the 169.254.169.254 metadata IP).\n/* eslint-disable sonarjs/no-hardcoded-ip -- intentional SSRF deny-list of loopback / private / link-local / CGNAT CIDRs */\nconst BLOCKED_V4_CIDRS: readonly (readonly [string, number])[] = [\n  [\"0.0.0.0\", 8],\n  [\"10.0.0.0\", 8],\n  [\"100.64.0.0\", 10],\n  [\"127.0.0.0\", 8],\n  [\"169.254.0.0\", 16],\n  [\"172.16.0.0\", 12],\n  [\"192.168.0.0\", 16],\n];\n/* eslint-enable sonarjs/no-hardcoded-ip */\n\nfunction ipv4ToInt(address: string): number | null {\n  const octets = address.split(\".\").map(Number);\n  if (octets.length !== 4 || octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return null;\n  return ((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>> 0;\n}\n\nfunction isBlockedIpv4(address: string): boolean {\n  const value = ipv4ToInt(address);\n  if (value === null) return true; // malformed → block\n  return BLOCKED_V4_CIDRS.some(([base, bits]) => {\n    const baseInt = ipv4ToInt(base) ?? 0;\n    const mask = bits === 0 ? 0 : (0xffffffff << (32 - bits)) >>> 0;\n    return (value & mask) === (baseInt & mask);\n  });\n}\n\nfunction isBlockedIpv6(address: string): boolean {\n  const lower = address.toLowerCase();\n  if (lower === \"::1\" || lower === \"::\") return true; // loopback, unspecified\n  if (lower.startsWith(\"fe80\")) return true; // link-local fe80::/10\n  if (lower.startsWith(\"fc\") || lower.startsWith(\"fd\")) return true; // ULA fc00::/7\n  const mapped = /^::ffff:(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})$/.exec(lower); // IPv4-mapped\n  return mapped ? isBlockedIpv4(mapped[1]) : false;\n}\n\n/** True for any address we must not fetch (also blocks non-IP input). */\nfunction isBlockedIp(address: string): boolean {\n  const kind = isIP(address);\n  if (kind === 4) return isBlockedIpv4(address);\n  if (kind === 6) return isBlockedIpv6(address);\n  return true;\n}\n\n/** Reject non-http(s) URLs and URLs that resolve to a private/loopback\n *  address (SSRF guard). Throws with a clear reason; returns void on pass. */\nasync function assertFetchableUrl(rawUrl: string): Promise<void> {\n  if (!/^https?:\\/\\//i.test(rawUrl)) throw new Error(`refusing non-http(s) URL: ${rawUrl}`);\n  const { hostname } = new URL(rawUrl);\n  // URL.hostname keeps the brackets for IPv6 literals (`[::1]`); strip them\n  // so isIP / the block check see the bare address.\n  const host = hostname.startsWith(\"[\") && hostname.endsWith(\"]\") ? hostname.slice(1, -1) : hostname;\n  if (isIP(host)) {\n    if (isBlockedIp(host)) throw new Error(`refusing to fetch a private/loopback address: ${host}`);\n    return;\n  }\n  let addresses: { address: string }[];\n  try {\n    addresses = await lookup(host, { all: true });\n  } catch (err) {\n    throw new Error(`could not resolve host '${host}': ${String(err)}`);\n  }\n  const blocked = addresses.find((entry) => isBlockedIp(entry.address));\n  if (blocked) throw new Error(`refusing to fetch '${host}' — resolves to a private/loopback address (${blocked.address})`);\n}\n\nasync function fetchOnce(url: string, timeoutMs: number): Promise<Response> {\n  const controller = new AbortController();\n  const timer = setTimeout(() => controller.abort(new DOMException(`feed fetch timed out after ${timeoutMs}ms`, \"TimeoutError\")), timeoutMs);\n  try {\n    return await fetch(url, { headers: { \"User-Agent\": FEED_USER_AGENT }, signal: controller.signal, redirect: \"manual\" });\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\n// Follow redirects manually, re-running the SSRF guard on every hop so a\n// public URL cannot bounce to an internal target.\nasync function fetchGuarded(rawUrl: string, timeoutMs: number): Promise<Response> {\n  let current = rawUrl;\n  for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {\n    await assertFetchableUrl(current);\n    const response = await fetchOnce(current, timeoutMs);\n    const redirect = response.status >= 300 && response.status < 400 && response.status !== 304 ? response.headers.get(\"location\") : null;\n    if (!redirect) return response;\n    current = new URL(redirect, current).toString();\n  }\n  throw new Error(`too many redirects (>${MAX_REDIRECTS}) starting from ${rawUrl}`);\n}\n\n/** Fetch a URL as text, throwing on guard rejection, network error, or non-2xx. */\nexport async function fetchText(url: string, timeoutMs: number = DEFAULT_FEED_TIMEOUT_MS): Promise<string> {\n  const response = await fetchGuarded(url, timeoutMs);\n  if (!response.ok) throw new Error(`HTTP ${response.status} ${response.statusText} fetching ${url}`);\n  return response.text();\n}\n\n/** Fetch a URL as parsed JSON, throwing on guard rejection, network error, or non-2xx. */\nexport async function fetchJson(url: string, timeoutMs: number = DEFAULT_FEED_TIMEOUT_MS): Promise<unknown> {\n  const response = await fetchGuarded(url, timeoutMs);\n  if (!response.ok) throw new Error(`HTTP ${response.status} ${response.statusText} fetching ${url}`);\n  return response.json();\n}\n","// RSS 2.0 + Atom 1.0 + RSS 1.0 (RDF) parser for the Feeds engine.\n//\n// Deliberately NON-normalizing: it locates the feed's items and hands\n// each one back as its RAW parsed XML element. The host hard-codes no\n// per-feed field list — `ingest.map` resolves source paths against the\n// raw item (tags are keys; attributes are prefixed `@_`; namespaced tags\n// keep their prefix), and the caller inspects the feed to decide what to\n// map. Generic value handling (text-node unwrapping, date parsing by the\n// target field's declared type) lives in `projectItem.ts`, not here.\n//\n// Own copy of the XML plumbing — the Feeds tree does not import the\n// legacy `sources` tree. Pure; unit-testable with fixture strings.\n\nimport { XMLParser } from \"fast-xml-parser\";\n\n// Tiny inline type guards (the host's shared `utils/types` is not available in\n// this shared package — these are the only two we need here).\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\nfunction isNonEmptyString(value: unknown): value is string {\n  return typeof value === \"string\" && value.trim().length > 0;\n}\n\nexport interface ParsedFeedItem {\n  /** The raw parsed XML <item>/<entry> object, verbatim. */\n  raw: Record<string, unknown>;\n}\n\nexport interface ParsedFeed {\n  kind: \"rss\" | \"atom\";\n  title: string | null;\n  items: ParsedFeedItem[];\n}\n\nconst xml = new XMLParser({\n  ignoreAttributes: false,\n  attributeNamePrefix: \"@_\",\n  cdataPropName: \"#cdata\",\n  parseTagValue: false,\n  parseAttributeValue: false,\n  trimValues: true,\n  // Only the item containers are forced to arrays (single vs. many).\n  // Everything else stays in its natural parsed shape so `ingest.map`\n  // resolves paths the way the caller sees them in the feed.\n  isArray: (name) => name === \"item\" || name === \"entry\",\n});\n\n/** Parse an RSS/Atom/RDF feed body. Returns null when the input doesn't\n *  look like a feed we understand. */\nexport function parseFeed(body: string): ParsedFeed | null {\n  const text = stripBom(body);\n  if (!text.trim()) return null;\n  let parsed: unknown;\n  try {\n    parsed = xml.parse(text);\n  } catch {\n    return null;\n  }\n  if (!isRecord(parsed)) return null;\n  if (isRecord(parsed.rss)) return parseRss(parsed.rss);\n  if (isRecord(parsed.feed)) return parseAtom(parsed.feed);\n  const rdf = parsed[\"rdf:RDF\"] ?? parsed.RDF;\n  if (isRecord(rdf)) return parseRss10(rdf);\n  return null;\n}\n\n// Collect the raw item objects, skipping anything that isn't a record or\n// carries no <title> (drops feed-level noise / empty entries).\nfunction collectItems(value: unknown): ParsedFeedItem[] {\n  const rawItems = Array.isArray(value) ? value : [];\n  const items: ParsedFeedItem[] = [];\n  for (const raw of rawItems) {\n    if (isRecord(raw) && readString(raw.title) !== null) items.push({ raw });\n  }\n  return items;\n}\n\nfunction parseRss(rss: Record<string, unknown>): ParsedFeed | null {\n  const { channel } = rss;\n  if (!isRecord(channel)) return null;\n  return { kind: \"rss\", title: readString(channel.title), items: collectItems(channel.item) };\n}\n\nfunction parseRss10(rdf: Record<string, unknown>): ParsedFeed | null {\n  const channel = isRecord(rdf.channel) ? rdf.channel : null;\n  return { kind: \"rss\", title: channel ? readString(channel.title) : null, items: collectItems(rdf.item) };\n}\n\nfunction parseAtom(feed: Record<string, unknown>): ParsedFeed | null {\n  return { kind: \"atom\", title: readString(feed.title), items: collectItems(feed.entry) };\n}\n\n// --- helpers ------------------------------------------------------------\n\n// Extract a string from a plain string, a `{ \"#text\" }` / `{ \"#cdata\" }`\n// node, or an array (first non-empty). Used only to read the feed/item\n// title for the channel name + the empty-item filter.\nfunction readString(value: unknown): string | null {\n  if (isNonEmptyString(value)) return value;\n  if (typeof value === \"string\") return null;\n  if (isRecord(value)) return readStringFromRecord(value);\n  if (Array.isArray(value)) return readStringFromArray(value);\n  return null;\n}\n\nfunction readStringFromRecord(record: Record<string, unknown>): string | null {\n  const text = record[\"#text\"];\n  if (isNonEmptyString(text)) return text;\n  const cdata = record[\"#cdata\"];\n  if (isNonEmptyString(cdata)) return cdata;\n  return null;\n}\n\nfunction readStringFromArray(array: readonly unknown[]): string | null {\n  for (const entry of array) {\n    const resolved = readString(entry);\n    if (resolved !== null) return resolved;\n  }\n  return null;\n}\n\nfunction stripBom(text: string): string {\n  return text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;\n}\n","// Tiny dot/bracket path resolver used by the declarative `ingest.map`\n// and `ingest.itemsAt`. Pure, no I/O, exhaustively unit-testable.\n//\n// Supported syntax:\n//   \"title\"                → root.title\n//   \"data.name\"            → root.data.name\n//   \"results[0].id\"        → root.results[0].id\n//   \"hourly[]\"             → root.hourly        (trailing [] = \"the array\n//                            here\"; the marker is a no-op for value reads)\n//   \"data.results[]\"       → root.data.results\n//\n// Any miss (wrong type, out-of-range index, absent key) yields\n// `undefined` rather than throwing — declarative configs fail soft.\n\ninterface KeyToken {\n  kind: \"key\";\n  key: string;\n}\ninterface IndexToken {\n  kind: \"index\";\n  index: number;\n}\ntype PathToken = KeyToken | IndexToken;\n\nconst BRACKET_RE = /\\[(\\d*)\\]/g;\n\n/** Split one dot-segment (`results[0]`, `hourly[]`, `name`) into tokens.\n *  An empty `[]` is an array-identity marker and emits no token — the\n *  array value is read by the preceding key. */\nfunction parseSegment(segment: string, tokens: PathToken[]): void {\n  const bracketStart = segment.indexOf(\"[\");\n  const name = bracketStart === -1 ? segment : segment.slice(0, bracketStart);\n  if (name.length > 0) tokens.push({ kind: \"key\", key: name });\n  if (bracketStart === -1) return;\n  for (const match of segment.slice(bracketStart).matchAll(BRACKET_RE)) {\n    const [, inner] = match;\n    if (inner.length > 0) tokens.push({ kind: \"index\", index: Number(inner) });\n  }\n}\n\nfunction tokenize(path: string): PathToken[] {\n  const tokens: PathToken[] = [];\n  for (const segment of path.split(\".\")) {\n    if (segment.length > 0) parseSegment(segment, tokens);\n  }\n  return tokens;\n}\n\nfunction step(current: unknown, token: PathToken): unknown {\n  if (current === null || current === undefined) return undefined;\n  if (token.kind === \"key\") {\n    if (typeof current !== \"object\" || Array.isArray(current)) return undefined;\n    return (current as Record<string, unknown>)[token.key];\n  }\n  return Array.isArray(current) ? current[token.index] : undefined;\n}\n\n/** Resolve a dot/bracket path against `root`, or `undefined` on any miss. */\nexport function getByPath(root: unknown, path: string): unknown {\n  let current: unknown = root;\n  for (const token of tokenize(path)) {\n    current = step(current, token);\n  }\n  return current;\n}\n\n/** Locate the array of raw items for a fetch. With `itemsAt` set, walk\n *  to it; without it, the response itself must be the array. Non-arrays\n *  yield `[]` so a malformed response is a no-op, not a crash. */\nexport function getItemsArray(root: unknown, itemsAt: string | undefined): unknown[] {\n  if (!itemsAt) return Array.isArray(root) ? root : [];\n  const value = getByPath(root, itemsAt);\n  return Array.isArray(value) ? value : [];\n}\n","// Project one raw retrieved item (a parsed RSS entry, or a JSON object)\n// into a CollectionItem whose keys match the schema's fields, using the\n// declarative `ingest.map`. Also derives the record's id.\n//\n// Id rule: a collection record's filename IS its primaryKey value, and\n// that value must be a safe slug. Feed-native keys (RSS guids/URLs,\n// ISO datetimes) usually are NOT slug-safe, so we slugify the natural\n// key into a deterministic, stable id — same natural key → same id, so\n// re-fetches upsert in place. The natural key comes from the mapped\n// primaryKey value, then `ingest.idFrom`, then a content hash.\n\nimport { createHash } from \"node:crypto\";\nimport { getByPath } from \"./pathResolver.js\";\nimport type { CollectionItem, CollectionSchema } from \"../../collection/index.js\";\nimport type { DeclarativeIngestSpec } from \"../ingestTypes.js\";\n\nfunction asKeyString(value: unknown): string | null {\n  if (typeof value === \"string\" && value.trim().length > 0) return value.trim();\n  if (typeof value === \"number\" && Number.isFinite(value)) return String(value);\n  return null;\n}\n\n/** Collapse an XML element object that carries body text alongside\n *  attributes (`{ \"#text\": \"v\", \"@_x\": \"...\" }`) or CDATA to its text.\n *  Generic — the host knows no field names, only this fast-xml-parser\n *  shape — so a tag like `<guid isPermaLink=\"false\">id</guid>` maps to\n *  its text without the caller needing to write `.#text`. */\nfunction unwrapTextNode(value: unknown): unknown {\n  if (value && typeof value === \"object\" && !Array.isArray(value)) {\n    const obj = value as Record<string, unknown>;\n    if (typeof obj[\"#text\"] === \"string\") return obj[\"#text\"];\n    if (typeof obj[\"#cdata\"] === \"string\") return obj[\"#cdata\"];\n  }\n  return value;\n}\n\n/** Normalize a mapped value generically — driven by the SCHEMA's declared\n *  field type, never by the source field name. Today: unwrap XML text\n *  nodes, and coerce anything mapped into a `date` field to a `YYYY-MM-DD`\n *  civil date (the collection `date` type + calendar are day-granularity\n *  and parse strictly — a full RFC-3339 timestamp would be rejected). */\nfunction normalizeValue(value: unknown, fieldType: string | undefined): unknown {\n  const unwrapped = unwrapTextNode(value);\n  if (fieldType === \"date\" && typeof unwrapped === \"string\") {\n    const millis = Date.parse(unwrapped);\n    if (Number.isFinite(millis)) return new Date(millis).toISOString().slice(0, 10);\n  }\n  return unwrapped;\n}\n\n/** Slugify a natural key into a stable, filename-safe id. Short, safe\n *  keys pass through (lowercased); long or unsafe keys collapse to a\n *  hash so the filename stays bounded and valid. */\nfunction toSafeId(natural: string): string {\n  const collapsed = natural\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\");\n  // eslint-disable-next-line sonarjs/super-linear-regex -- anchored hyphen trim, linear, no catastrophic backtracking\n  const slug = collapsed.replace(/^-+|-+$/g, \"\");\n  if (slug.length > 0 && slug.length <= 80) return slug;\n  const hash = createHash(\"sha256\")\n    .update(natural || \"item\", \"utf-8\")\n    .digest(\"hex\")\n    .slice(0, 16);\n  return slug.length > 80 ? `${slug.slice(0, 60)}-${hash}` : `feed-${hash}`;\n}\n\nfunction naturalKey(record: CollectionItem, rawItem: unknown, ingest: DeclarativeIngestSpec, schema: CollectionSchema): string {\n  const fromMapped = asKeyString(record[schema.primaryKey]);\n  if (fromMapped) return fromMapped;\n  if (ingest.idFrom) {\n    const fromId = asKeyString(unwrapTextNode(getByPath(rawItem, ingest.idFrom)));\n    if (fromId) return fromId;\n  }\n  return JSON.stringify(record);\n}\n\n/** Build a record from a raw fetched item (a parsed RSS/Atom element or a\n *  JSON object) using `ingest.map`. Each source path is resolved against\n *  the raw item and normalized per the target field's declared type. The\n *  returned record's primaryKey is set to the derived safe id (so it\n *  doubles as the filename). */\nexport function projectRecord(rawItem: unknown, ingest: DeclarativeIngestSpec, schema: CollectionSchema): CollectionItem {\n  const record: CollectionItem = {};\n  for (const [targetField, sourcePath] of Object.entries(ingest.map)) {\n    const value = normalizeValue(getByPath(rawItem, sourcePath), schema.fields?.[targetField]?.type);\n    if (value !== undefined) record[targetField] = value;\n  }\n  record[schema.primaryKey] = toSafeId(naturalKey(record, rawItem, ingest, schema));\n  return record;\n}\n","// RSS / Atom retriever. Fetches the feed, parses it, and projects each\n// item's RAW parsed XML element through `ingest.map`. The map's source\n// paths are the item's own tags/attributes (e.g. `title`, `pubDate`,\n// `enclosure.@_url`, `itunes:duration`) — the host hard-codes no field\n// list; the caller inspects the feed and maps what it carries.\n\nimport { fetchText } from \"../fetch/httpClient.js\";\nimport { parseFeed } from \"../fetch/rssParser.js\";\nimport { projectRecord } from \"../projectItem.js\";\nimport { registerRetriever, type RetrieveFn } from \"./index.js\";\n\nconst retrieveRss: RetrieveFn = async (ingest, schema) => {\n  const body = await fetchText(ingest.url);\n  const feed = parseFeed(body);\n  if (!feed) return { items: [], cursor: {} };\n  const items = feed.items.map((item) => projectRecord(item.raw, ingest, schema));\n  return { items, cursor: {} };\n};\n\n// Atom shares the same parser + projection path.\nregisterRetriever(\"rss\", retrieveRss);\nregisterRetriever(\"atom\", retrieveRss);\n\nexport { retrieveRss };\n","// Generic JSON-API retriever. Fetches JSON, walks `ingest.itemsAt` to\n// the array of raw items, and projects each through `ingest.map` (whose\n// source paths are dot/bracket paths into each raw item).\n\nimport { fetchJson } from \"../fetch/httpClient.js\";\nimport { getItemsArray } from \"../pathResolver.js\";\nimport { projectRecord } from \"../projectItem.js\";\nimport { registerRetriever, type RetrieveFn } from \"./index.js\";\n\nconst retrieveHttpJson: RetrieveFn = async (ingest, schema) => {\n  const json = await fetchJson(ingest.url);\n  const rawItems = getItemsArray(json, ingest.itemsAt);\n  const items = rawItems.map((raw) => projectRecord(raw, ingest, schema));\n  return { items, cursor: {} };\n};\n\nregisterRetriever(\"http-json\", retrieveHttpJson);\n\nexport { retrieveHttpJson };\n","// Per-collection retrieval state — when we last fetched/dispatched, the\n// retriever's cursor (for incremental fetches), and a consecutive-failure\n// counter. NOT committed to git. Location depends on the collection's source:\n// feeds keep it alongside the schema at `<workspace>/feeds/<slug>/_state.json`;\n// skill-backed collections with `ingest.kind: \"agent\"` store it at\n// `<workspace>/data/ingest-state/<slug>.json` (a schema-less `feeds/<slug>/`\n// dir would confuse feed discovery, and `_state.json` must never live in a\n// collection's dataDir where `listItems` would read it as a record).\n// Deliberately minimal: the legacy `sources` tree carries richer backoff\n// state, but the engine starts simple and grows on real need.\n\nimport { mkdir, readFile } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport type { CollectionSource } from \"../../collection/index.js\";\nimport { log, requireFeedsHost } from \"./host.js\";\nimport { feedStatePath, ingestStatePath } from \"../paths.js\";\n\n/** Minimal shape needed to locate a collection's state file. `LoadedCollection`\n *  satisfies it. */\nexport interface StateTarget {\n  slug: string;\n  source: CollectionSource;\n}\n\n/** Resolve the on-disk state file for a collection, branching on source. */\nfunction stateFilePath(target: StateTarget, workspaceRoot: string): string {\n  return target.source === \"feed\" ? feedStatePath(target.slug, workspaceRoot) : ingestStatePath(target.slug, workspaceRoot);\n}\n\nexport interface FeedState {\n  slug: string;\n  /** ISO timestamp of the last successful fetch (declarative) or dispatch\n   *  (agent ingest), or null if never. */\n  lastFetchedAt: string | null;\n  /** Free-form retriever cursor (e.g. last-seen id / etag). */\n  cursor: Record<string, string>;\n  /** Consecutive failed fetches/runs; reset to 0 on success. */\n  consecutiveFailures: number;\n  /** Agent ingest only: the notifier entry id of the active \"refresh failed\"\n   *  bell, so a later success can clear exactly that entry. Absent when no\n   *  failure bell is showing. */\n  failureBellId?: string;\n}\n\nexport function defaultFeedState(slug: string): FeedState {\n  return { slug, lastFetchedAt: null, cursor: {}, consecutiveFailures: 0 };\n}\n\nfunction normalizeState(slug: string, parsed: Partial<FeedState>): FeedState {\n  const base = defaultFeedState(slug);\n  const cursor = parsed.cursor && typeof parsed.cursor === \"object\" ? (parsed.cursor as Record<string, string>) : base.cursor;\n  return {\n    slug,\n    lastFetchedAt: typeof parsed.lastFetchedAt === \"string\" ? parsed.lastFetchedAt : base.lastFetchedAt,\n    cursor,\n    consecutiveFailures: typeof parsed.consecutiveFailures === \"number\" ? parsed.consecutiveFailures : base.consecutiveFailures,\n    ...(typeof parsed.failureBellId === \"string\" ? { failureBellId: parsed.failureBellId } : {}),\n  };\n}\n\n/** Read a collection's retrieval state, tolerating a missing file (first run →\n *  default). The state path branches on `target.source`. */\nexport async function readFeedState(workspaceRoot: string, target: StateTarget): Promise<FeedState> {\n  const { slug } = target;\n  try {\n    const raw = await readFile(stateFilePath(target, workspaceRoot), \"utf-8\");\n    return normalizeState(slug, JSON.parse(raw) as Partial<FeedState>);\n  } catch (err) {\n    const error = err as { code?: string };\n    if (error.code !== \"ENOENT\") {\n      log.warn(\"feeds\", \"failed to read feed state, using default\", { slug, error: String(err) });\n    }\n    return defaultFeedState(slug);\n  }\n}\n\n/** Persist a collection's retrieval state atomically (creating the parent dir\n *  if needed). The state path branches on `target.source`. */\nexport async function writeFeedState(workspaceRoot: string, target: StateTarget, state: FeedState): Promise<void> {\n  const file = stateFilePath(target, workspaceRoot);\n  await mkdir(path.dirname(file), { recursive: true });\n  await requireFeedsHost().writeFileAtomic(file, `${JSON.stringify(state, null, 2)}\\n`);\n}\n","// Agent-performed ingest (`ingest.kind: \"agent\"`). On schedule (or a manual\n// Refresh), the host seeds a hidden background worker — origin `system`, so\n// it never appears in the user's session list — in the collection's declared\n// role with its template + a summary of every record, and the worker edits the\n// records itself via the collections io layer. The host stays domain-free:\n// everything stock-specific (or whatever the collection does) is prose in the\n// template.\n//\n// DI seam: the worker is launched through `FeedsHost.spawnWorker`, injected at\n// boot via `configureFeedsHost`, not imported directly — this module ships in a\n// shared package and must not reach into any host's session/routes layer.\n\nimport { listItems, promptPathsFor, readSkillTemplate, buildCollectionActionSeedPrompt, type LoadedCollection } from \"../../collection/server/index.js\";\nimport { publish as publishNotifier, clear as clearNotifier } from \"../../notifier/index.js\";\nimport { log, requireFeedsHost, type AgentWorkerResult, type AgentWorkerRunner } from \"./host.js\";\nimport { readFeedState, writeFeedState, type FeedState } from \"./state.js\";\nimport type { AgentIngestSpec } from \"../ingestTypes.js\";\nimport type { RefreshResult } from \"./refreshResult.js\";\n\nexport type { AgentWorkerResult, AgentWorkerRunner } from \"./host.js\";\n\n/** The injected worker launcher, or null if the host was never configured.\n *  Read non-throwingly so the failure-isolated contract holds (an unconfigured\n *  host becomes an `errors` entry, not a thrown exception). */\nfunction workerRunnerOrNull(): AgentWorkerRunner | null {\n  try {\n    return requireFeedsHost().spawnWorker;\n  } catch {\n    return null;\n  }\n}\n\nfunction result(slug: string, patch: Partial<RefreshResult>): RefreshResult {\n  return { slug, written: 0, removed: 0, errors: [], ...patch };\n}\n\n/** Dispatch one agent-ingest refresh: build the seed, launch a worker, and (on a\n *  successful launch) stamp `lastFetchedAt` with the DISPATCH time — not\n *  completion. That's what gates the due-loop, so a slow worker can't cause a\n *  double-dispatch. `opts.hidden` (default true) runs an invisible system worker\n *  for SCHEDULED refreshes; a MANUAL Refresh passes `hidden:false` for a visible,\n *  debuggable session. Failure-isolated: never throws; cap-miss / template-miss /\n *  launch error leave state untouched and report via `errors`. */\nexport async function refreshViaAgent(workspaceRoot: string, collection: LoadedCollection, opts?: { hidden?: boolean }): Promise<RefreshResult> {\n  const hidden = opts?.hidden ?? true;\n  const { slug } = collection;\n  const ingest = collection.schema.ingest as AgentIngestSpec | undefined;\n  if (!ingest || ingest.kind !== \"agent\") return result(slug, { errors: [\"collection has no agent ingest config\"] });\n  const workerRunner = workerRunnerOrNull();\n  if (!workerRunner) return result(slug, { errors: [\"agent ingest worker runner not configured\"] });\n\n  const template = await readSkillTemplate(collection.skillDir, ingest.template);\n  if (template === null) return result(slug, { errors: [`ingest template '${ingest.template}' could not be read`] });\n\n  const items = await listItems(collection.dataDir, { workspaceRoot });\n  // Thread the canonical, host-normalized paths through the seed so the\n  // template can pass `--out-dir data/collections/<slug>/items` (etc.) into\n  // any bundled script instead of relying on the script's `argparse` default —\n  // which was written for the author's pre-import layout, NOT the R3-\n  // normalized location the host actually reads records from. Fixes #1891.\n  const message = buildCollectionActionSeedPrompt(items, collection.schema, template, promptPathsFor(collection, workspaceRoot));\n\n  // The runner is injected, so guard its promise here to honour the\n  // failure-isolated contract (a rejection must become an `errors` entry, not\n  // escape into the scheduler loop / route handler).\n  let launch: AgentWorkerResult;\n  try {\n    launch = await workerRunner({\n      message,\n      roleId: ingest.role,\n      hidden,\n      // A visible manual run is watched directly — only hidden runs get the\n      // completion hook (failure bell + consecutiveFailures); `finalizeRun` only\n      // fires it for system-origin sessions anyway.\n      onComplete: hidden ? (outcome) => recordOutcome(workspaceRoot, collection, outcome.didError) : undefined,\n    });\n  } catch (err) {\n    log.warn(\"feeds\", \"agent ingest worker launch threw\", { slug, error: String(err) });\n    return result(slug, { errors: [String(err)], dispatched: false });\n  }\n  if (!launch.ok) {\n    // Cap-miss or launch error: do NOT touch lastFetchedAt — the next due tick\n    // (or manual Refresh) redials. Surface it so a manual refresh reads honest.\n    log.info(\"feeds\", \"agent ingest dispatch skipped\", { slug, error: launch.error });\n    return result(slug, { errors: [launch.error], dispatched: false });\n  }\n\n  const state = await readFeedState(workspaceRoot, collection);\n  await writeFeedState(workspaceRoot, collection, { ...state, lastFetchedAt: new Date().toISOString() });\n  log.info(\"feeds\", \"agent ingest dispatched\", { slug, role: ingest.role, chatId: launch.chatId, hidden, items: items.length });\n  // Surface the chatId only for a visible run so the client can open it; a hidden\n  // session is excluded from every listing and can't be navigated to anyway.\n  return result(slug, { dispatched: true, ...(hidden ? {} : { chatId: launch.chatId }) });\n}\n\n/** Completion hook: reconcile failure tracking when a dispatched worker\n *  finishes. On error, bump `consecutiveFailures` and raise a single failure\n *  bell (deduped via the persisted `failureBellId`). On success, reset the\n *  counter and clear any standing bell. Best-effort + failure-isolated — it\n *  runs inside the agent run's teardown, so it must never throw. */\nasync function recordOutcome(workspaceRoot: string, collection: LoadedCollection, didError: boolean): Promise<void> {\n  const state = await readFeedState(workspaceRoot, collection);\n  const next: FeedState = didError ? await onWorkerError(state, collection) : await onWorkerSuccess(state, collection);\n  await writeFeedState(workspaceRoot, collection, next);\n}\n\nasync function onWorkerError(state: FeedState, collection: LoadedCollection): Promise<FeedState> {\n  const next: FeedState = { ...state, consecutiveFailures: state.consecutiveFailures + 1 };\n  log.warn(\"feeds\", \"agent ingest worker failed\", { slug: collection.slug, consecutiveFailures: next.consecutiveFailures });\n  // Raise a single bell on the first failure; a standing one isn't piled onto.\n  if (!state.failureBellId) {\n    try {\n      const { id } = await publishNotifier({\n        pluginPkg: \"host\",\n        severity: \"nudge\",\n        lifecycle: \"fyi\",\n        title: \"Collection refresh failed\",\n        body: `“${collection.schema.title}” (${collection.slug}) couldn't refresh. Open it to retry.`,\n        navigateTarget: `/collections/${collection.slug}`,\n      });\n      next.failureBellId = id;\n    } catch (err) {\n      log.warn(\"feeds\", \"failed to publish ingest failure bell\", { slug: collection.slug, error: String(err) });\n    }\n  }\n  return next;\n}\n\nasync function onWorkerSuccess(state: FeedState, collection: LoadedCollection): Promise<FeedState> {\n  log.info(\"feeds\", \"agent ingest worker completed\", { slug: collection.slug });\n  if (state.failureBellId) {\n    await clearNotifier(state.failureBellId).catch((err) =>\n      log.warn(\"feeds\", \"failed to clear ingest failure bell\", { slug: collection.slug, error: String(err) }),\n    );\n  }\n  const next: FeedState = { ...state, consecutiveFailures: 0 };\n  delete next.failureBellId;\n  return next;\n}\n","// Retrieval engine: fetch a feed, upsert its records into the\n// collection's data dir (keyed by primaryKey, so re-fetches replace in\n// place / accumulate by id), and persist per-feed state. Per-feed\n// failures are isolated — `refreshOne` never throws; `refreshDue`\n// processes feeds sequentially to stay gentle on remote hosts (the\n// fetch client does no rate-limiting yet).\n\nimport { deleteItem, discoverCollections, listItems, writeItem, type LoadedCollection } from \"../../collection/server/index.js\";\nimport type { CollectionItem, CollectionSchema } from \"../../collection/index.js\";\nimport { log, requireFeedsHost } from \"./host.js\";\nimport { getRetriever } from \"./retrievers/index.js\";\nimport \"./retrievers/registerAll.js\";\nimport { readFeedState, writeFeedState, type FeedState } from \"./state.js\";\nimport { DEFAULT_FEED_MAX_ITEMS, AGENT_INGEST_KIND, type FeedSchedule, type IngestSpec } from \"../ingestTypes.js\";\nimport { refreshViaAgent } from \"./agentIngest.js\";\nimport type { RefreshResult } from \"./refreshResult.js\";\n\nexport type { RefreshResult } from \"./refreshResult.js\";\n\n// Refresh cadence anchors (ms). Inlined — the engine needs only these two and\n// must stay free of host-side time-constant modules.\nconst ONE_HOUR_MS = 3_600_000;\nconst ONE_DAY_MS = 86_400_000;\n\n/** Feed schemas carry the rich `IngestSpec` (validated at discovery —\n *  `source === \"feed\"` requires `ingest`), but the canonical\n *  `CollectionSchema.ingest` only promises the minimal `CollectionIngest`.\n *  Narrow here so the engine can read the retrieval fields type-safely. */\nfunction feedIngest(schema: CollectionSchema): IngestSpec | undefined {\n  return schema.ingest as IngestSpec | undefined;\n}\n\nasync function upsertItems(workspaceRoot: string, feed: LoadedCollection, items: CollectionItem[]): Promise<number> {\n  let written = 0;\n  for (const item of items) {\n    const itemId = item[feed.schema.primaryKey];\n    if (typeof itemId !== \"string\" || itemId.length === 0) continue;\n    const result = await writeItem(feed.dataDir, itemId, item, { refuseOverwrite: false, workspaceRoot, slug: feed.slug });\n    if (result.kind === \"ok\") written += 1;\n    else log.warn(\"feeds\", \"feed item write skipped\", { slug: feed.slug, itemId, kind: result.kind });\n  }\n  return written;\n}\n\n/** The schema's first `date` field, used to order records for the\n *  maxItems cap. Null when the schema declares none. */\nfunction firstDateField(schema: CollectionSchema): string | null {\n  for (const [key, spec] of Object.entries(schema.fields)) {\n    if (spec.type === \"date\") return key;\n  }\n  return null;\n}\n\n// Epoch ms for a record's date value; missing / unparseable sorts oldest.\nfunction recordTime(item: CollectionItem, field: string): number {\n  const value = item[field];\n  const millis = typeof value === \"string\" ? Date.parse(value) : NaN;\n  return Number.isFinite(millis) ? millis : Number.NEGATIVE_INFINITY;\n}\n\n/** Enforce `ingest.maxItems` (default 100): keep the newest N records by\n *  the schema's date field, delete the rest. No-op when the cap is 0/absent\n *  of a date field, or when under the cap. Returns the number deleted. */\nasync function pruneFeed(workspaceRoot: string, feed: LoadedCollection): Promise<number> {\n  const ingest = feedIngest(feed.schema);\n  // maxItems is a declarative-feed concept; agent ingest manages its own record\n  // set, so it's never pruned here (and `refreshOne` never calls pruneFeed for it).\n  const cap = (ingest && ingest.kind !== AGENT_INGEST_KIND ? ingest.maxItems : undefined) ?? DEFAULT_FEED_MAX_ITEMS;\n  if (cap <= 0) return 0;\n  const dateField = firstDateField(feed.schema);\n  if (!dateField) {\n    log.warn(\"feeds\", \"maxItems prune skipped: schema has no date field to order by\", { slug: feed.slug });\n    return 0;\n  }\n  const items = await listItems(feed.dataDir, { workspaceRoot });\n  if (items.length <= cap) return 0;\n  const stale = [...items].sort((left, right) => recordTime(right, dateField) - recordTime(left, dateField)).slice(cap);\n  let removed = 0;\n  for (const item of stale) {\n    const itemId = item[feed.schema.primaryKey];\n    if (typeof itemId !== \"string\" || itemId.length === 0) continue;\n    if ((await deleteItem(feed.dataDir, itemId, { workspaceRoot, slug: feed.slug })).kind === \"ok\") removed += 1;\n  }\n  if (removed > 0) log.info(\"feeds\", \"pruned old feed records\", { slug: feed.slug, removed, cap });\n  return removed;\n}\n\n/** Fetch one feed now, upsert its records, then enforce the maxItems cap.\n *  Failure-isolated: returns an errors array rather than throwing. */\nexport async function refreshOne(workspaceRoot: string, feed: LoadedCollection, opts?: { hidden?: boolean }): Promise<RefreshResult> {\n  const { slug } = feed;\n  const ingest = feedIngest(feed.schema);\n  if (!ingest) return { slug, written: 0, removed: 0, errors: [\"collection has no ingest config\"] };\n  // `agent` ingest dispatches a worker instead of fetching: branch off BEFORE\n  // the retriever registry (which only knows declarative kinds). `opts.hidden`\n  // (manual Refresh passes false) only affects the agent path; declarative\n  // feeds ignore it.\n  if (ingest.kind === AGENT_INGEST_KIND) return refreshViaAgent(workspaceRoot, feed, opts);\n  const retriever = getRetriever(ingest.kind);\n  if (!retriever) return { slug, written: 0, removed: 0, errors: [`no retriever registered for kind '${ingest.kind}'`] };\n  const state = await readFeedState(workspaceRoot, feed);\n  try {\n    const result = await retriever(ingest, feed.schema, state);\n    const written = await upsertItems(workspaceRoot, feed, result.items);\n    await writeFeedState(workspaceRoot, feed, { ...state, lastFetchedAt: new Date().toISOString(), cursor: result.cursor, consecutiveFailures: 0 });\n    const removed = await pruneFeed(workspaceRoot, feed);\n    log.info(\"feeds\", \"feed refreshed\", { slug, written, removed, fetched: result.items.length });\n    return { slug, written, removed, errors: [] };\n  } catch (error) {\n    await writeFeedState(workspaceRoot, feed, { ...state, consecutiveFailures: state.consecutiveFailures + 1 });\n    const message = String(error);\n    log.warn(\"feeds\", \"feed refresh failed\", { slug, error: message });\n    return { slug, written: 0, removed: 0, errors: [message] };\n  }\n}\n\nfunction dueIntervalMs(schedule: FeedSchedule): number {\n  switch (schedule) {\n    case \"daily\":\n      return ONE_DAY_MS;\n    case \"weekly\":\n      return 7 * ONE_DAY_MS;\n    default:\n      return ONE_HOUR_MS;\n  }\n}\n\n/** True iff a `daily` schedule with a UTC `atHour` anchor is due. The system\n *  task ticks hourly, so \"due\" means: we're in the anchor hour AND we haven't\n *  already run in roughly the last day. The 23 h floor (not 24 h) tolerates the\n *  tick landing a few minutes earlier than the previous run, while staying well\n *  above 1 h so a second tick in the same anchor hour can't double-fire. */\nfunction isDailyAtHourDue(now: Date, atHour: number, lastFetchedAt: string | null): boolean {\n  if (now.getUTCHours() !== atHour) return false;\n  if (!lastFetchedAt) return true;\n  const elapsed = now.getTime() - Date.parse(lastFetchedAt);\n  if (!Number.isFinite(elapsed)) return true;\n  return elapsed >= 23 * ONE_HOUR_MS;\n}\n\n/** True iff a collection is due to refresh given its schedule + last run.\n *  `on-demand` is never auto-due; a `daily` schedule with `atHour` anchors to\n *  that UTC hour, otherwise cadence is elapsed-based. */\nfunction isFeedDue(feed: LoadedCollection, state: FeedState): boolean {\n  const ingest = feedIngest(feed.schema);\n  const schedule = ingest?.schedule;\n  if (!schedule || schedule === \"on-demand\") return false;\n  if (schedule === \"daily\" && typeof ingest?.atHour === \"number\") {\n    return isDailyAtHourDue(new Date(), ingest.atHour, state.lastFetchedAt);\n  }\n  if (!state.lastFetchedAt) return true;\n  const elapsed = Date.now() - Date.parse(state.lastFetchedAt);\n  if (!Number.isFinite(elapsed)) return true;\n  return elapsed >= dueIntervalMs(schedule);\n}\n\n/** Refresh every collection whose ingest schedule says it's due — declarative\n *  feeds AND skill-backed collections with `ingest.kind: \"agent\"`. Called by the\n *  hourly system task. Sequential + failure-isolated. */\nexport async function refreshDue(workspaceRoot: string = requireFeedsHost().workspaceRoot): Promise<RefreshResult[]> {\n  const all = await discoverCollections({ workspaceRoot });\n  const withIngest = all.filter((collection) => collection.schema.ingest);\n  const results: RefreshResult[] = [];\n  for (const collection of withIngest) {\n    // Isolate per-collection failures: `readFeedState`/`refreshOne` (esp. the\n    // agent path) can throw, and one bad collection must not abort the whole\n    // due-loop. Capture it as an errors result and move on.\n    try {\n      const state = await readFeedState(workspaceRoot, collection);\n      if (!isFeedDue(collection, state)) continue;\n      results.push(await refreshOne(workspaceRoot, collection));\n    } catch (error) {\n      log.warn(\"feeds\", \"scheduled refresh failed for collection\", { slug: collection.slug, error: String(error) });\n      results.push({ slug: collection.slug, written: 0, removed: 0, errors: [String(error)] });\n    }\n  }\n  return results;\n}\n","// Shareable registration for the hourly \"refresh due collections\" task.\n// Both MulmoClaude (via `initScheduler`, with persistence + catch-up) and a\n// standalone MulmoTerminal/MulmoBooks (via a bare task-manager `registerTask`)\n// register the SAME definition through this factory, so the id/schedule/run\n// can't drift between hosts. See plans/done/feat-shareable-feed-refresh-registration.md.\nimport { SCHEDULE_TYPES, MISSED_RUN_POLICIES } from \"@receptron/task-scheduler\";\nimport type { SystemTaskDef } from \"../../scheduler/adapter.js\";\nimport { refreshDue } from \"./engine.js\";\n\n// Id kept stable so the scheduler-state row isn't orphaned across hosts/renames.\nexport const FEED_REFRESH_TASK_ID = \"system:feed-refresh\";\n// Single source of truth for the default refresh cadence (one hour). Core has no\n// shared time module — `server/utils/time.ts` is host-only — so the named export\n// IS the constant; hosts override via `feedRefreshTaskDef({ intervalMs })`.\nexport const DEFAULT_FEED_REFRESH_INTERVAL_MS = 60 * 60 * 1000;\n\n/**\n * The hourly \"refresh due collections\" task, shared by every host.\n *\n * Drives ALL scheduled ingest: declarative feeds (RSS / JSON) fetch directly,\n * and skill-backed `ingest.kind: \"agent\"` collections dispatch a hidden worker.\n *\n * Returns the rich `SystemTaskDef` rather than registering it — each host keeps\n * its own registration mechanism and applies its own schedule overrides first.\n * A host driving a bare task-manager can still `registerTask(...)` it; the extra\n * `missedRunPolicy` field is simply ignored there.\n *\n * @param opts.intervalMs   per-host interval override (defaults to one hour)\n * @param opts.workspaceRoot defaults to the configured FeedsHost workspace\n */\nexport function feedRefreshTaskDef(opts?: { workspaceRoot?: string; intervalMs?: number }): SystemTaskDef {\n  return {\n    id: FEED_REFRESH_TASK_ID,\n    name: \"Scheduled collection refresh\",\n    description: \"Refresh due collections — fetch declarative feeds + dispatch agent-ingest workers\",\n    schedule: { type: SCHEDULE_TYPES.interval, intervalMs: opts?.intervalMs ?? DEFAULT_FEED_REFRESH_INTERVAL_MS },\n    missedRunPolicy: MISSED_RUN_POLICIES.runOnce,\n    run: () => refreshDue(opts?.workspaceRoot).then(() => {}),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AA8CA,IAAI,UAA4B;;AAGhC,SAAgB,mBAAmB,MAAuB;CACxD,IAAI,WAAW,YAAY,MACzB,MAAM,IAAI,MAAM,wFAAwF;CAE1G,UAAU;AACZ;;AAGA,SAAgB,mBAA8B;CAC5C,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,0EAA0E;CACxG,OAAO;AACT;;AAGA,SAAgB,2BAAiC;CAC/C,UAAU;AACZ;;;AAIA,IAAa,MAAmB;CAC9B,QAAQ,QAAQ,KAAK,SAAS,iBAAiB,CAAC,CAAC,IAAI,MAAM,QAAQ,KAAK,IAAI;CAC5E,OAAO,QAAQ,KAAK,SAAS,iBAAiB,CAAC,CAAC,IAAI,KAAK,QAAQ,KAAK,IAAI;CAC1E,OAAO,QAAQ,KAAK,SAAS,iBAAiB,CAAC,CAAC,IAAI,KAAK,QAAQ,KAAK,IAAI;CAC1E,QAAQ,QAAQ,KAAK,SAAS,iBAAiB,CAAC,CAAC,IAAI,MAAM,QAAQ,KAAK,IAAI;AAC9E;;;;;AC7DA,eAAsB,UAAU,gBAAwB,iBAAiB,CAAC,CAAC,eAA4C;CAErH,QAAO,MADW,oBAAoB,EAAE,cAAc,CAAC,EAAA,CAC5C,QAAQ,eAAe,WAAW,WAAW,MAAM;AAChE;;;;;;;;;;AAWA,eAAsB,WAAW,eAAuB,MAAgC;CACtF,MAAM,OAAO,aAAa,IAAI;CAC9B,IAAI,SAAS,MAAM,OAAO;CAC1B,MAAM,aAAa,eAAe,cAAc,QAAQ,aAAa;CACrE,IAAI;EACF,IAAI,YAAY,MAAM,GAAG,YAAY;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EACrE,MAAM,GAAG,QAAQ,MAAM,aAAa,GAAG;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EACvE,IAAI,KAAK,SAAS,0BAA0B,EAAE,MAAM,KAAK,CAAC;EAC1D,OAAO;CACT,SAAS,OAAO;EACd,IAAI,KAAK,SAAS,sBAAsB;GAAE,MAAM;GAAM,OAAO,OAAO,KAAK;EAAE,CAAC;EAC5E,OAAO;CACT;AACF;;;AClBA,IAAM,2BAAW,IAAI,IAAwB;AAE7C,SAAgB,kBAAkB,MAAc,WAA6B;CAC3E,SAAS,IAAI,MAAM,SAAS;AAC9B;AAEA,SAAgB,aAAa,MAAsC;CACjE,OAAO,SAAS,IAAI,IAAI;AAC1B;;;ACjBA,IAAM,gBAAgB;;AAGtB,IAAa,kBAAkB;;AAG/B,IAAa,0BAA0B,KAAK;;AAG5C,IAAM,gBAAgB;AAKtB,IAAM,mBAA2D;CAC/D,CAAC,WAAW,CAAC;CACb,CAAC,YAAY,CAAC;CACd,CAAC,cAAc,EAAE;CACjB,CAAC,aAAa,CAAC;CACf,CAAC,eAAe,EAAE;CAClB,CAAC,cAAc,EAAE;CACjB,CAAC,eAAe,EAAE;AACpB;AAGA,SAAS,UAAU,SAAgC;CACjD,MAAM,SAAS,QAAQ,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;CAC5C,IAAI,OAAO,WAAW,KAAK,OAAO,MAAM,SAAS,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,GAAG,GAAG,OAAO;CAC5G,QAAS,OAAO,MAAM,KAAO,OAAO,MAAM,KAAO,OAAO,MAAM,IAAK,OAAO,QAAQ;AACpF;AAEA,SAAS,cAAc,SAA0B;CAC/C,MAAM,QAAQ,UAAU,OAAO;CAC/B,IAAI,UAAU,MAAM,OAAO;CAC3B,OAAO,iBAAiB,MAAM,CAAC,MAAM,UAAU;EAC7C,MAAM,UAAU,UAAU,IAAI,KAAK;EACnC,MAAM,OAAO,SAAS,IAAI,IAAK,cAAe,KAAK,SAAW;EAC9D,QAAQ,QAAQ,WAAW,UAAU;CACvC,CAAC;AACH;AAEA,SAAS,cAAc,SAA0B;CAC/C,MAAM,QAAQ,QAAQ,YAAY;CAClC,IAAI,UAAU,SAAS,UAAU,MAAM,OAAO;CAC9C,IAAI,MAAM,WAAW,MAAM,GAAG,OAAO;CACrC,IAAI,MAAM,WAAW,IAAI,KAAK,MAAM,WAAW,IAAI,GAAG,OAAO;CAC7D,MAAM,SAAS,gDAAgD,KAAK,KAAK;CACzE,OAAO,SAAS,cAAc,OAAO,EAAE,IAAI;AAC7C;;AAGA,SAAS,YAAY,SAA0B;CAC7C,MAAM,OAAO,KAAK,OAAO;CACzB,IAAI,SAAS,GAAG,OAAO,cAAc,OAAO;CAC5C,IAAI,SAAS,GAAG,OAAO,cAAc,OAAO;CAC5C,OAAO;AACT;;;AAIA,eAAe,mBAAmB,QAA+B;CAC/D,IAAI,CAAC,gBAAgB,KAAK,MAAM,GAAG,MAAM,IAAI,MAAM,6BAA6B,QAAQ;CACxF,MAAM,EAAE,aAAa,IAAI,IAAI,MAAM;CAGnC,MAAM,OAAO,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;CAC1F,IAAI,KAAK,IAAI,GAAG;EACd,IAAI,YAAY,IAAI,GAAG,MAAM,IAAI,MAAM,iDAAiD,MAAM;EAC9F;CACF;CACA,IAAI;CACJ,IAAI;EACF,YAAY,MAAM,OAAO,MAAM,EAAE,KAAK,KAAK,CAAC;CAC9C,SAAS,KAAK;EACZ,MAAM,IAAI,MAAM,2BAA2B,KAAK,KAAK,OAAO,GAAG,GAAG;CACpE;CACA,MAAM,UAAU,UAAU,MAAM,UAAU,YAAY,MAAM,OAAO,CAAC;CACpE,IAAI,SAAS,MAAM,IAAI,MAAM,sBAAsB,KAAK,8CAA8C,QAAQ,QAAQ,EAAE;AAC1H;AAEA,eAAe,UAAU,KAAa,WAAsC;CAC1E,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,QAAQ,iBAAiB,WAAW,MAAM,IAAI,aAAa,8BAA8B,UAAU,KAAK,cAAc,CAAC,GAAG,SAAS;CACzI,IAAI;EACF,OAAO,MAAM,MAAM,KAAK;GAAE,SAAS,EAAE,cAAc,gBAAgB;GAAG,QAAQ,WAAW;GAAQ,UAAU;EAAS,CAAC;CACvH,UAAU;EACR,aAAa,KAAK;CACpB;AACF;AAIA,eAAe,aAAa,QAAgB,WAAsC;CAChF,IAAI,UAAU;CACd,KAAK,IAAI,MAAM,GAAG,OAAO,eAAe,OAAO;EAC7C,MAAM,mBAAmB,OAAO;EAChC,MAAM,WAAW,MAAM,UAAU,SAAS,SAAS;EACnD,MAAM,WAAW,SAAS,UAAU,OAAO,SAAS,SAAS,OAAO,SAAS,WAAW,MAAM,SAAS,QAAQ,IAAI,UAAU,IAAI;EACjI,IAAI,CAAC,UAAU,OAAO;EACtB,UAAU,IAAI,IAAI,UAAU,OAAO,CAAC,CAAC,SAAS;CAChD;CACA,MAAM,IAAI,MAAM,wBAAwB,cAAc,kBAAkB,QAAQ;AAClF;;AAGA,eAAsB,UAAU,KAAa,YAAoB,yBAA0C;CACzG,MAAM,WAAW,MAAM,aAAa,KAAK,SAAS;CAClD,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,QAAQ,SAAS,OAAO,GAAG,SAAS,WAAW,YAAY,KAAK;CAClG,OAAO,SAAS,KAAK;AACvB;;AAGA,eAAsB,UAAU,KAAa,YAAoB,yBAA2C;CAC1G,MAAM,WAAW,MAAM,aAAa,KAAK,SAAS;CAClD,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,QAAQ,SAAS,OAAO,GAAG,SAAS,WAAW,YAAY,KAAK;CAClG,OAAO,SAAS,KAAK;AACvB;;;AChHA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AACA,SAAS,iBAAiB,OAAiC;CACzD,OAAO,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,SAAS;AAC5D;AAaA,IAAM,MAAM,IAAI,UAAU;CACxB,kBAAkB;CAClB,qBAAqB;CACrB,eAAe;CACf,eAAe;CACf,qBAAqB;CACrB,YAAY;CAIZ,UAAU,SAAS,SAAS,UAAU,SAAS;AACjD,CAAC;;;AAID,SAAgB,UAAU,MAAiC;CACzD,MAAM,OAAO,SAAS,IAAI;CAC1B,IAAI,CAAC,KAAK,KAAK,GAAG,OAAO;CACzB,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,MAAM,IAAI;CACzB,QAAQ;EACN,OAAO;CACT;CACA,IAAI,CAAC,SAAS,MAAM,GAAG,OAAO;CAC9B,IAAI,SAAS,OAAO,GAAG,GAAG,OAAO,SAAS,OAAO,GAAG;CACpD,IAAI,SAAS,OAAO,IAAI,GAAG,OAAO,UAAU,OAAO,IAAI;CACvD,MAAM,MAAM,OAAO,cAAc,OAAO;CACxC,IAAI,SAAS,GAAG,GAAG,OAAO,WAAW,GAAG;CACxC,OAAO;AACT;AAIA,SAAS,aAAa,OAAkC;CACtD,MAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;CACjD,MAAM,QAA0B,CAAC;CACjC,KAAK,MAAM,OAAO,UAChB,IAAI,SAAS,GAAG,KAAK,WAAW,IAAI,KAAK,MAAM,MAAM,MAAM,KAAK,EAAE,IAAI,CAAC;CAEzE,OAAO;AACT;AAEA,SAAS,SAAS,KAAiD;CACjE,MAAM,EAAE,YAAY;CACpB,IAAI,CAAC,SAAS,OAAO,GAAG,OAAO;CAC/B,OAAO;EAAE,MAAM;EAAO,OAAO,WAAW,QAAQ,KAAK;EAAG,OAAO,aAAa,QAAQ,IAAI;CAAE;AAC5F;AAEA,SAAS,WAAW,KAAiD;CACnE,MAAM,UAAU,SAAS,IAAI,OAAO,IAAI,IAAI,UAAU;CACtD,OAAO;EAAE,MAAM;EAAO,OAAO,UAAU,WAAW,QAAQ,KAAK,IAAI;EAAM,OAAO,aAAa,IAAI,IAAI;CAAE;AACzG;AAEA,SAAS,UAAU,MAAkD;CACnE,OAAO;EAAE,MAAM;EAAQ,OAAO,WAAW,KAAK,KAAK;EAAG,OAAO,aAAa,KAAK,KAAK;CAAE;AACxF;AAOA,SAAS,WAAW,OAA+B;CACjD,IAAI,iBAAiB,KAAK,GAAG,OAAO;CACpC,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,IAAI,SAAS,KAAK,GAAG,OAAO,qBAAqB,KAAK;CACtD,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,oBAAoB,KAAK;CAC1D,OAAO;AACT;AAEA,SAAS,qBAAqB,QAAgD;CAC5E,MAAM,OAAO,OAAO;CACpB,IAAI,iBAAiB,IAAI,GAAG,OAAO;CACnC,MAAM,QAAQ,OAAO;CACrB,IAAI,iBAAiB,KAAK,GAAG,OAAO;CACpC,OAAO;AACT;AAEA,SAAS,oBAAoB,OAA0C;CACrE,KAAK,MAAM,SAAS,OAAO;EACzB,MAAM,WAAW,WAAW,KAAK;EACjC,IAAI,aAAa,MAAM,OAAO;CAChC;CACA,OAAO;AACT;AAEA,SAAS,SAAS,MAAsB;CACtC,OAAO,KAAK,WAAW,CAAC,MAAM,QAAS,KAAK,MAAM,CAAC,IAAI;AACzD;;;ACpGA,IAAM,aAAa;;;;AAKnB,SAAS,aAAa,SAAiB,QAA2B;CAChE,MAAM,eAAe,QAAQ,QAAQ,GAAG;CACxC,MAAM,OAAO,iBAAiB,KAAK,UAAU,QAAQ,MAAM,GAAG,YAAY;CAC1E,IAAI,KAAK,SAAS,GAAG,OAAO,KAAK;EAAE,MAAM;EAAO,KAAK;CAAK,CAAC;CAC3D,IAAI,iBAAiB,IAAI;CACzB,KAAK,MAAM,SAAS,QAAQ,MAAM,YAAY,CAAC,CAAC,SAAS,UAAU,GAAG;EACpE,MAAM,GAAG,SAAS;EAClB,IAAI,MAAM,SAAS,GAAG,OAAO,KAAK;GAAE,MAAM;GAAS,OAAO,OAAO,KAAK;EAAE,CAAC;CAC3E;AACF;AAEA,SAAS,SAAS,MAA2B;CAC3C,MAAM,SAAsB,CAAC;CAC7B,KAAK,MAAM,WAAW,KAAK,MAAM,GAAG,GAClC,IAAI,QAAQ,SAAS,GAAG,aAAa,SAAS,MAAM;CAEtD,OAAO;AACT;AAEA,SAAS,KAAK,SAAkB,OAA2B;CACzD,IAAI,YAAY,QAAQ,YAAY,KAAA,GAAW,OAAO,KAAA;CACtD,IAAI,MAAM,SAAS,OAAO;EACxB,IAAI,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,GAAG,OAAO,KAAA;EAClE,OAAQ,QAAoC,MAAM;CACpD;CACA,OAAO,MAAM,QAAQ,OAAO,IAAI,QAAQ,MAAM,SAAS,KAAA;AACzD;;AAGA,SAAgB,UAAU,MAAe,MAAuB;CAC9D,IAAI,UAAmB;CACvB,KAAK,MAAM,SAAS,SAAS,IAAI,GAC/B,UAAU,KAAK,SAAS,KAAK;CAE/B,OAAO;AACT;;;;AAKA,SAAgB,cAAc,MAAe,SAAwC;CACnF,IAAI,CAAC,SAAS,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;CACnD,MAAM,QAAQ,UAAU,MAAM,OAAO;CACrC,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AACzC;;;ACzDA,SAAS,YAAY,OAA+B;CAClD,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,SAAS,GAAG,OAAO,MAAM,KAAK;CAC5E,IAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG,OAAO,OAAO,KAAK;CAC5E,OAAO;AACT;;;;;;AAOA,SAAS,eAAe,OAAyB;CAC/C,IAAI,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAG;EAC/D,MAAM,MAAM;EACZ,IAAI,OAAO,IAAI,aAAa,UAAU,OAAO,IAAI;EACjD,IAAI,OAAO,IAAI,cAAc,UAAU,OAAO,IAAI;CACpD;CACA,OAAO;AACT;;;;;;AAOA,SAAS,eAAe,OAAgB,WAAwC;CAC9E,MAAM,YAAY,eAAe,KAAK;CACtC,IAAI,cAAc,UAAU,OAAO,cAAc,UAAU;EACzD,MAAM,SAAS,KAAK,MAAM,SAAS;EACnC,IAAI,OAAO,SAAS,MAAM,GAAG,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,EAAE;CAChF;CACA,OAAO;AACT;;;;AAKA,SAAS,SAAS,SAAyB;CAMzC,MAAM,OALY,QACf,KAAK,CAAC,CACN,YAAY,CAAC,CACb,QAAQ,eAAe,GAEb,CAAA,CAAU,QAAQ,YAAY,EAAE;CAC7C,IAAI,KAAK,SAAS,KAAK,KAAK,UAAU,IAAI,OAAO;CACjD,MAAM,OAAO,WAAW,QAAQ,CAAC,CAC9B,OAAO,WAAW,QAAQ,OAAO,CAAC,CAClC,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,KAAK,SAAS,KAAK,GAAG,KAAK,MAAM,GAAG,EAAE,EAAE,GAAG,SAAS,QAAQ;AACrE;AAEA,SAAS,WAAW,QAAwB,SAAkB,QAA+B,QAAkC;CAC7H,MAAM,aAAa,YAAY,OAAO,OAAO,WAAW;CACxD,IAAI,YAAY,OAAO;CACvB,IAAI,OAAO,QAAQ;EACjB,MAAM,SAAS,YAAY,eAAe,UAAU,SAAS,OAAO,MAAM,CAAC,CAAC;EAC5E,IAAI,QAAQ,OAAO;CACrB;CACA,OAAO,KAAK,UAAU,MAAM;AAC9B;;;;;;AAOA,SAAgB,cAAc,SAAkB,QAA+B,QAA0C;CACvH,MAAM,SAAyB,CAAC;CAChC,KAAK,MAAM,CAAC,aAAa,eAAe,OAAO,QAAQ,OAAO,GAAG,GAAG;EAClE,MAAM,QAAQ,eAAe,UAAU,SAAS,UAAU,GAAG,OAAO,SAAS,YAAY,EAAE,IAAI;EAC/F,IAAI,UAAU,KAAA,GAAW,OAAO,eAAe;CACjD;CACA,OAAO,OAAO,cAAc,SAAS,WAAW,QAAQ,SAAS,QAAQ,MAAM,CAAC;CAChF,OAAO;AACT;;;AChFA,IAAM,cAA0B,OAAO,QAAQ,WAAW;CAExD,MAAM,OAAO,UAAU,MADJ,UAAU,OAAO,GAAG,CACZ;CAC3B,IAAI,CAAC,MAAM,OAAO;EAAE,OAAO,CAAC;EAAG,QAAQ,CAAC;CAAE;CAE1C,OAAO;EAAE,OADK,KAAK,MAAM,KAAK,SAAS,cAAc,KAAK,KAAK,QAAQ,MAAM,CACpE;EAAO,QAAQ,CAAC;CAAE;AAC7B;AAGA,kBAAkB,OAAO,WAAW;AACpC,kBAAkB,QAAQ,WAAW;;;ACZrC,IAAM,mBAA+B,OAAO,QAAQ,WAAW;CAI7D,OAAO;EAAE,OAFQ,cAAc,MADZ,UAAU,OAAO,GAAG,GACF,OAAO,OAC9B,CAAA,CAAS,KAAK,QAAQ,cAAc,KAAK,QAAQ,MAAM,CAC5D;EAAO,QAAQ,CAAC;CAAE;AAC7B;AAEA,kBAAkB,aAAa,gBAAgB;;;;ACS/C,SAAS,cAAc,QAAqB,eAA+B;CACzE,OAAO,OAAO,WAAW,SAAS,cAAc,OAAO,MAAM,aAAa,IAAI,gBAAgB,OAAO,MAAM,aAAa;AAC1H;AAiBA,SAAgB,iBAAiB,MAAyB;CACxD,OAAO;EAAE;EAAM,eAAe;EAAM,QAAQ,CAAC;EAAG,qBAAqB;CAAE;AACzE;AAEA,SAAS,eAAe,MAAc,QAAuC;CAC3E,MAAM,OAAO,iBAAiB,IAAI;CAClC,MAAM,SAAS,OAAO,UAAU,OAAO,OAAO,WAAW,WAAY,OAAO,SAAoC,KAAK;CACrH,OAAO;EACL;EACA,eAAe,OAAO,OAAO,kBAAkB,WAAW,OAAO,gBAAgB,KAAK;EACtF;EACA,qBAAqB,OAAO,OAAO,wBAAwB,WAAW,OAAO,sBAAsB,KAAK;EACxG,GAAI,OAAO,OAAO,kBAAkB,WAAW,EAAE,eAAe,OAAO,cAAc,IAAI,CAAC;CAC5F;AACF;;;AAIA,eAAsB,cAAc,eAAuB,QAAyC;CAClG,MAAM,EAAE,SAAS;CACjB,IAAI;EACF,MAAM,MAAM,MAAM,SAAS,cAAc,QAAQ,aAAa,GAAG,OAAO;EACxE,OAAO,eAAe,MAAM,KAAK,MAAM,GAAG,CAAuB;CACnE,SAAS,KAAK;EAEZ,IAAI,IAAM,SAAS,UACjB,IAAI,KAAK,SAAS,4CAA4C;GAAE;GAAM,OAAO,OAAO,GAAG;EAAE,CAAC;EAE5F,OAAO,iBAAiB,IAAI;CAC9B;AACF;;;AAIA,eAAsB,eAAe,eAAuB,QAAqB,OAAiC;CAChH,MAAM,OAAO,cAAc,QAAQ,aAAa;CAChD,MAAM,MAAM,KAAK,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CACnD,MAAM,iBAAiB,CAAC,CAAC,gBAAgB,MAAM,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,GAAG;AACtF;;;;;;AC1DA,SAAS,qBAA+C;CACtD,IAAI;EACF,OAAO,iBAAiB,CAAC,CAAC;CAC5B,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,OAAO,MAAc,OAA8C;CAC1E,OAAO;EAAE;EAAM,SAAS;EAAG,SAAS;EAAG,QAAQ,CAAC;EAAG,GAAG;CAAM;AAC9D;;;;;;;;AASA,eAAsB,gBAAgB,eAAuB,YAA8B,MAAqD;CAC9I,MAAM,SAAS,MAAM,UAAU;CAC/B,MAAM,EAAE,SAAS;CACjB,MAAM,SAAS,WAAW,OAAO;CACjC,IAAI,CAAC,UAAU,OAAO,SAAS,SAAS,OAAO,OAAO,MAAM,EAAE,QAAQ,CAAC,uCAAuC,EAAE,CAAC;CACjH,MAAM,eAAe,mBAAmB;CACxC,IAAI,CAAC,cAAc,OAAO,OAAO,MAAM,EAAE,QAAQ,CAAC,2CAA2C,EAAE,CAAC;CAEhG,MAAM,WAAW,MAAM,kBAAkB,WAAW,UAAU,OAAO,QAAQ;CAC7E,IAAI,aAAa,MAAM,OAAO,OAAO,MAAM,EAAE,QAAQ,CAAC,oBAAoB,OAAO,SAAS,oBAAoB,EAAE,CAAC;CAEjH,MAAM,QAAQ,MAAM,UAAU,WAAW,SAAS,EAAE,cAAc,CAAC;CAMnE,MAAM,UAAU,gCAAgC,OAAO,WAAW,QAAQ,UAAU,eAAe,YAAY,aAAa,CAAC;CAK7H,IAAI;CACJ,IAAI;EACF,SAAS,MAAM,aAAa;GAC1B;GACA,QAAQ,OAAO;GACf;GAIA,YAAY,UAAU,YAAY,cAAc,eAAe,YAAY,QAAQ,QAAQ,IAAI,KAAA;EACjG,CAAC;CACH,SAAS,KAAK;EACZ,IAAI,KAAK,SAAS,oCAAoC;GAAE;GAAM,OAAO,OAAO,GAAG;EAAE,CAAC;EAClF,OAAO,OAAO,MAAM;GAAE,QAAQ,CAAC,OAAO,GAAG,CAAC;GAAG,YAAY;EAAM,CAAC;CAClE;CACA,IAAI,CAAC,OAAO,IAAI;EAGd,IAAI,KAAK,SAAS,iCAAiC;GAAE;GAAM,OAAO,OAAO;EAAM,CAAC;EAChF,OAAO,OAAO,MAAM;GAAE,QAAQ,CAAC,OAAO,KAAK;GAAG,YAAY;EAAM,CAAC;CACnE;CAGA,MAAM,eAAe,eAAe,YAAY;EAAE,GAAG,MADjC,cAAc,eAAe,UAAU;EACC,gCAAe,IAAI,KAAK,EAAA,CAAE,YAAY;CAAE,CAAC;CACrG,IAAI,KAAK,SAAS,2BAA2B;EAAE;EAAM,MAAM,OAAO;EAAM,QAAQ,OAAO;EAAQ;EAAQ,OAAO,MAAM;CAAO,CAAC;CAG5H,OAAO,OAAO,MAAM;EAAE,YAAY;EAAM,GAAI,SAAS,CAAC,IAAI,EAAE,QAAQ,OAAO,OAAO;CAAG,CAAC;AACxF;;;;;;AAOA,eAAe,cAAc,eAAuB,YAA8B,UAAkC;CAClH,MAAM,QAAQ,MAAM,cAAc,eAAe,UAAU;CAE3D,MAAM,eAAe,eAAe,YADZ,WAAW,MAAM,cAAc,OAAO,UAAU,IAAI,MAAM,gBAAgB,OAAO,UAAU,CAC/D;AACtD;AAEA,eAAe,cAAc,OAAkB,YAAkD;CAC/F,MAAM,OAAkB;EAAE,GAAG;EAAO,qBAAqB,MAAM,sBAAsB;CAAE;CACvF,IAAI,KAAK,SAAS,8BAA8B;EAAE,MAAM,WAAW;EAAM,qBAAqB,KAAK;CAAoB,CAAC;CAExH,IAAI,CAAC,MAAM,eACT,IAAI;EACF,MAAM,EAAE,OAAO,MAAM,QAAgB;GACnC,WAAW;GACX,UAAU;GACV,WAAW;GACX,OAAO;GACP,MAAM,IAAI,WAAW,OAAO,MAAM,KAAK,WAAW,KAAK;GACvD,gBAAgB,gBAAgB,WAAW;EAC7C,CAAC;EACD,KAAK,gBAAgB;CACvB,SAAS,KAAK;EACZ,IAAI,KAAK,SAAS,yCAAyC;GAAE,MAAM,WAAW;GAAM,OAAO,OAAO,GAAG;EAAE,CAAC;CAC1G;CAEF,OAAO;AACT;AAEA,eAAe,gBAAgB,OAAkB,YAAkD;CACjG,IAAI,KAAK,SAAS,iCAAiC,EAAE,MAAM,WAAW,KAAK,CAAC;CAC5E,IAAI,MAAM,eACR,MAAM,MAAc,MAAM,aAAa,CAAC,CAAC,OAAO,QAC9C,IAAI,KAAK,SAAS,uCAAuC;EAAE,MAAM,WAAW;EAAM,OAAO,OAAO,GAAG;CAAE,CAAC,CACxG;CAEF,MAAM,OAAkB;EAAE,GAAG;EAAO,qBAAqB;CAAE;CAC3D,OAAO,KAAK;CACZ,OAAO;AACT;;;ACrHA,IAAM,cAAc;AACpB,IAAM,aAAa;;;;;AAMnB,SAAS,WAAW,QAAkD;CACpE,OAAO,OAAO;AAChB;AAEA,eAAe,YAAY,eAAuB,MAAwB,OAA0C;CAClH,IAAI,UAAU;CACd,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,SAAS,KAAK,KAAK,OAAO;EAChC,IAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;EACvD,MAAM,SAAS,MAAM,UAAU,KAAK,SAAS,QAAQ,MAAM;GAAE,iBAAiB;GAAO;GAAe,MAAM,KAAK;EAAK,CAAC;EACrH,IAAI,OAAO,SAAS,MAAM,WAAW;OAChC,IAAI,KAAK,SAAS,2BAA2B;GAAE,MAAM,KAAK;GAAM;GAAQ,MAAM,OAAO;EAAK,CAAC;CAClG;CACA,OAAO;AACT;;;AAIA,SAAS,eAAe,QAAyC;CAC/D,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,OAAO,MAAM,GACpD,IAAI,KAAK,SAAS,QAAQ,OAAO;CAEnC,OAAO;AACT;AAGA,SAAS,WAAW,MAAsB,OAAuB;CAC/D,MAAM,QAAQ,KAAK;CACnB,MAAM,SAAS,OAAO,UAAU,WAAW,KAAK,MAAM,KAAK,IAAI;CAC/D,OAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO;AACnD;;;;AAKA,eAAe,UAAU,eAAuB,MAAyC;CACvF,MAAM,SAAS,WAAW,KAAK,MAAM;CAGrC,MAAM,OAAO,UAAU,OAAO,SAAA,UAA6B,OAAO,WAAW,KAAA,MAAA;CAC7E,IAAI,OAAO,GAAG,OAAO;CACrB,MAAM,YAAY,eAAe,KAAK,MAAM;CAC5C,IAAI,CAAC,WAAW;EACd,IAAI,KAAK,SAAS,gEAAgE,EAAE,MAAM,KAAK,KAAK,CAAC;EACrG,OAAO;CACT;CACA,MAAM,QAAQ,MAAM,UAAU,KAAK,SAAS,EAAE,cAAc,CAAC;CAC7D,IAAI,MAAM,UAAU,KAAK,OAAO;CAChC,MAAM,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,MAAM,UAAU,WAAW,OAAO,SAAS,IAAI,WAAW,MAAM,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG;CACpH,IAAI,UAAU;CACd,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,SAAS,KAAK,KAAK,OAAO;EAChC,IAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;EACvD,KAAK,MAAM,WAAW,KAAK,SAAS,QAAQ;GAAE;GAAe,MAAM,KAAK;EAAK,CAAC,EAAA,CAAG,SAAS,MAAM,WAAW;CAC7G;CACA,IAAI,UAAU,GAAG,IAAI,KAAK,SAAS,2BAA2B;EAAE,MAAM,KAAK;EAAM;EAAS;CAAI,CAAC;CAC/F,OAAO;AACT;;;AAIA,eAAsB,WAAW,eAAuB,MAAwB,MAAqD;CACnI,MAAM,EAAE,SAAS;CACjB,MAAM,SAAS,WAAW,KAAK,MAAM;CACrC,IAAI,CAAC,QAAQ,OAAO;EAAE;EAAM,SAAS;EAAG,SAAS;EAAG,QAAQ,CAAC,iCAAiC;CAAE;CAKhG,IAAI,OAAO,SAAA,SAA4B,OAAO,gBAAgB,eAAe,MAAM,IAAI;CACvF,MAAM,YAAY,aAAa,OAAO,IAAI;CAC1C,IAAI,CAAC,WAAW,OAAO;EAAE;EAAM,SAAS;EAAG,SAAS;EAAG,QAAQ,CAAC,qCAAqC,OAAO,KAAK,EAAE;CAAE;CACrH,MAAM,QAAQ,MAAM,cAAc,eAAe,IAAI;CACrD,IAAI;EACF,MAAM,SAAS,MAAM,UAAU,QAAQ,KAAK,QAAQ,KAAK;EACzD,MAAM,UAAU,MAAM,YAAY,eAAe,MAAM,OAAO,KAAK;EACnE,MAAM,eAAe,eAAe,MAAM;GAAE,GAAG;GAAO,gCAAe,IAAI,KAAK,EAAA,CAAE,YAAY;GAAG,QAAQ,OAAO;GAAQ,qBAAqB;EAAE,CAAC;EAC9I,MAAM,UAAU,MAAM,UAAU,eAAe,IAAI;EACnD,IAAI,KAAK,SAAS,kBAAkB;GAAE;GAAM;GAAS;GAAS,SAAS,OAAO,MAAM;EAAO,CAAC;EAC5F,OAAO;GAAE;GAAM;GAAS;GAAS,QAAQ,CAAC;EAAE;CAC9C,SAAS,OAAO;EACd,MAAM,eAAe,eAAe,MAAM;GAAE,GAAG;GAAO,qBAAqB,MAAM,sBAAsB;EAAE,CAAC;EAC1G,MAAM,UAAU,OAAO,KAAK;EAC5B,IAAI,KAAK,SAAS,uBAAuB;GAAE;GAAM,OAAO;EAAQ,CAAC;EACjE,OAAO;GAAE;GAAM,SAAS;GAAG,SAAS;GAAG,QAAQ,CAAC,OAAO;EAAE;CAC3D;AACF;AAEA,SAAS,cAAc,UAAgC;CACrD,QAAQ,UAAR;EACE,KAAK,SACH,OAAO;EACT,KAAK,UACH,OAAO,IAAI;EACb,SACE,OAAO;CACX;AACF;;;;;;AAOA,SAAS,iBAAiB,KAAW,QAAgB,eAAuC;CAC1F,IAAI,IAAI,YAAY,MAAM,QAAQ,OAAO;CACzC,IAAI,CAAC,eAAe,OAAO;CAC3B,MAAM,UAAU,IAAI,QAAQ,IAAI,KAAK,MAAM,aAAa;CACxD,IAAI,CAAC,OAAO,SAAS,OAAO,GAAG,OAAO;CACtC,OAAO,WAAW,KAAK;AACzB;;;;AAKA,SAAS,UAAU,MAAwB,OAA2B;CACpE,MAAM,SAAS,WAAW,KAAK,MAAM;CACrC,MAAM,WAAW,QAAQ;CACzB,IAAI,CAAC,YAAY,aAAa,aAAa,OAAO;CAClD,IAAI,aAAa,WAAW,OAAO,QAAQ,WAAW,UACpD,OAAO,iCAAiB,IAAI,KAAK,GAAG,OAAO,QAAQ,MAAM,aAAa;CAExE,IAAI,CAAC,MAAM,eAAe,OAAO;CACjC,MAAM,UAAU,KAAK,IAAI,IAAI,KAAK,MAAM,MAAM,aAAa;CAC3D,IAAI,CAAC,OAAO,SAAS,OAAO,GAAG,OAAO;CACtC,OAAO,WAAW,cAAc,QAAQ;AAC1C;;;;AAKA,eAAsB,WAAW,gBAAwB,iBAAiB,CAAC,CAAC,eAAyC;CAEnH,MAAM,cAAa,MADD,oBAAoB,EAAE,cAAc,CAAC,EAAA,CAChC,QAAQ,eAAe,WAAW,OAAO,MAAM;CACtE,MAAM,UAA2B,CAAC;CAClC,KAAK,MAAM,cAAc,YAIvB,IAAI;EAEF,IAAI,CAAC,UAAU,YAAY,MADP,cAAc,eAAe,UAAU,CAC3B,GAAG;EACnC,QAAQ,KAAK,MAAM,WAAW,eAAe,UAAU,CAAC;CAC1D,SAAS,OAAO;EACd,IAAI,KAAK,SAAS,2CAA2C;GAAE,MAAM,WAAW;GAAM,OAAO,OAAO,KAAK;EAAE,CAAC;EAC5G,QAAQ,KAAK;GAAE,MAAM,WAAW;GAAM,SAAS;GAAG,SAAS;GAAG,QAAQ,CAAC,OAAO,KAAK,CAAC;EAAE,CAAC;CACzF;CAEF,OAAO;AACT;;;ACvKA,IAAa,uBAAuB;AAIpC,IAAa,mCAAmC,OAAU;;;;;;;;;;;;;;;AAgB1D,SAAgB,mBAAmB,MAAuE;CACxG,OAAO;EACL,IAAI;EACJ,MAAM;EACN,aAAa;EACb,UAAU;GAAE,MAAM,eAAe;GAAU,YAAY,MAAM,cAAA;EAA+C;EAC5G,iBAAiB,oBAAoB;EACrC,WAAW,WAAW,MAAM,aAAa,CAAC,CAAC,WAAW,CAAC,CAAC;CAC1D;AACF"}

package/dist/remote-view/index.cjs

@@ -0,0 +1,192 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/remote-view/index.ts
+/** Bump when the bootstrap/message contract changes shape; the bootstrap
+*  exposes it as `__MC_VIEW.protocol` so a parent can refuse a stale view. */
+var REMOTE_VIEW_PROTOCOL = 1;
+/** postMessage types between the sandboxed view and its parent page.
+*  `startChat` reuses the desktop custom-view message type on purpose — the
+*  desktop parent already understands it. */
+var REMOTE_VIEW_MESSAGES = {
+	/** view → parent: request one page of records ({ requestId, offset, limit, fields }). */
+	getItems: "mc-remote-get-items",
+	/** parent → view: the reply ({ requestId, ok, page | error }). */
+	items: "mc-remote-items",
+	/** view → parent: open a new chat with a prefilled, NOT auto-sent draft. */
+	startChat: "mc-start-chat"
+};
+/** Pagination defaults — mirrored by the phase-2 record handlers
+*  (`server/remoteHost/handlers/collectionPage.ts` imports these) so a view
+*  page can never outgrow what the command channel itself serves. */
+var DEFAULT_PAGE_LIMIT = 50;
+var MAX_PAGE_LIMIT = 200;
+/** Hard cap on the wrapped srcdoc: it travels to the phone INSIDE a Firestore
+*  command document (1 MiB total), so leave envelope headroom. */
+var REMOTE_VIEW_MAX_BYTES = 9e5;
+/** In-iframe `getItems` timeout — matches the remote client's `callHost`
+*  response timeout so the two layers give up together. */
+var GET_ITEMS_TIMEOUT_MS = 3e4;
+var SANDBOXED_VIEW_CDN_ALLOWLIST = [
+	"https://cdn.jsdelivr.net",
+	"https://unpkg.com",
+	"https://cdnjs.cloudflare.com",
+	"https://fonts.googleapis.com",
+	"https://fonts.gstatic.com",
+	"https://cdn.plot.ly"
+];
+var toInt = (value) => {
+	const num = typeof value === "number" ? value : typeof value === "string" ? Number(value) : NaN;
+	return Number.isFinite(num) ? Math.floor(num) : null;
+};
+/** Coerce a channel/postMessage offset (arrives as untyped JSON) to a non-negative int. */
+var clampOffset = (value) => Math.max(0, toInt(value) ?? 0);
+/** Coerce a channel/postMessage limit to [1, MAX_PAGE_LIMIT] (default 50). */
+var clampLimit = (value) => {
+	const num = toInt(value);
+	if (num === null || num <= 0) return 50;
+	return Math.min(num, 200);
+};
+/** Coerce a `fields` projection list from untyped message JSON. */
+var normalizeFields = (value) => {
+	if (!Array.isArray(value)) return void 0;
+	const cleaned = value.filter((entry) => typeof entry === "string").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+	return cleaned.length > 0 ? cleaned : void 0;
+};
+/** Keep only `fields` (+ always the primary key) on each record. Parents apply
+*  this uniformly — the desktop preview via `pageFromItems`, the phone parent
+*  over the page it fetched through the channel — so a view sees the same
+*  projection everywhere. No-op without `fields`. */
+function projectItems(items, fields, primaryKey) {
+	if (!fields || fields.length === 0) return items;
+	const keep = /* @__PURE__ */ new Set([primaryKey, ...fields]);
+	return items.map((item) => Object.fromEntries(Object.entries(item).filter(([key]) => keep.has(key))));
+}
+/** Answer a page request from an already-loaded record array (the desktop
+*  preview's data source): slice + project. Observable behavior matches the
+*  phone paging over the command channel. */
+function pageFromItems(items, request, primaryKey) {
+	return {
+		items: projectItems(items.slice(request.offset, request.offset + request.limit), request.fields, primaryKey),
+		total: items.length,
+		offset: request.offset,
+		limit: request.limit
+	};
+}
+/**
+* CSP for a remote (mobile) custom view. Stricter than the desktop custom-view
+* policy: the view's data arrives over postMessage, so `connect-src` is
+* `'none'` — no fetch / XHR / WebSocket / sendBeacon to ANY origin, which
+* closes the bidirectional-exfiltration channel completely (there is no token
+* to steal either). Script/style/font keep the curated CDN allowlist (the
+* phone can reach the internet; only the host is unreachable), and
+* `img-src`/`media-src` allow any `https:` host so record image/media URLs
+* render — the same knowingly-accepted one-way GET-exfil tradeoff as the
+* desktop policy (see buildCustomViewCsp in src/utils/html/previewCsp.ts).
+*/
+function buildRemoteViewCsp(cdns = SANDBOXED_VIEW_CDN_ALLOWLIST) {
+	const cdnList = cdns.join(" ");
+	return [
+		"default-src 'none'",
+		`script-src 'unsafe-inline' ${cdnList}`,
+		`style-src 'unsafe-inline' ${cdnList}`,
+		`font-src ${cdnList}`,
+		`img-src ${cdnList} data: blob: https:`,
+		"media-src https: data: blob:",
+		"connect-src 'none'"
+	].join("; ");
+}
+/** The in-iframe bootstrap installed before any of the view's own scripts.
+*  Owns the fiddly part of the contract — request/response correlation — so an
+*  LLM-authored view only ever awaits `__MC_VIEW.getItems(...)`:
+*
+*  - `getItems({ offset, limit, fields })`: posts an `mc-remote-get-items`
+*    with a fresh `requestId`, resolves on the matching `mc-remote-items`
+*    reply (validated to come from `window.parent`), rejects on `ok: false`
+*    or after 30 s. targetOrigin `'*'` is safe: the request carries no secret
+*    and the parent is by construction the party supplying the data.
+*  - `startChat(prompt, role)`: same message type + semantics as the desktop
+*    bridge — the parent opens a new chat with `prompt` prefilled as an
+*    editable draft, never auto-sent.
+*  - `t(key, named)`: the same vue-i18n-compatible dict helper as the desktop
+*    bootstrap (named interpolation only), over the host-picked `dict`.
+*
+*  Self-contained one-line string (no `<`, no `<\/script>`, `${}` only for the
+*  interpolated constants). */
+function remoteViewBootstrap() {
+	return `(function(){var v=window.__MC_VIEW,seq=0,pend={};window.addEventListener('message',function(e){if(e.source!==window.parent)return;var d=e.data;if(!d||d.type!=='${REMOTE_VIEW_MESSAGES.items}')return;var p=pend[d.requestId];if(!p)return;delete pend[d.requestId];clearTimeout(p.timer);if(d.ok)p.resolve(d.page);else p.reject(new Error(typeof d.error==='string'?d.error:'load failed'));});v.getItems=function(opts){opts=opts&&typeof opts==='object'?opts:{};return new Promise(function(resolve,reject){var id='q'+(++seq);var timer=setTimeout(function(){delete pend[id];reject(new Error('getItems timed out'));},${GET_ITEMS_TIMEOUT_MS});pend[id]={resolve:resolve,reject:reject,timer:timer};window.parent.postMessage({type:'${REMOTE_VIEW_MESSAGES.getItems}',slug:v.slug,requestId:id,offset:opts.offset,limit:opts.limit,fields:opts.fields},'*');});};v.startChat=function(prompt,role){window.parent.postMessage({type:'${REMOTE_VIEW_MESSAGES.startChat}',slug:v.slug,prompt:String(prompt),role:typeof role==='string'?role:undefined},'*');};v.dict=v.dict||{};v.t=function(key,named){var s=v.dict[key];if(typeof s!=='string')return typeof key==='string'?key:String(key);if(!named||typeof named!=='object')return s;return s.replace(/\\{(\\w+)\\}/g,function(m,n){var x=named[n];return x==null?m:String(x);});};})();`;
+}
+/** Wrap a view's HTML into the sandboxed srcdoc: CSP meta + `__MC_VIEW` boot +
+*  bridge bootstrap injected at the start of `<head>` (before any view
+*  script). Runs HOST-side (`getRemoteView`) so the phone and the desktop
+*  preview receive the identical finished artifact. */
+function buildRemoteViewSrcdoc(html, boot) {
+	const injection = `${`<meta http-equiv="Content-Security-Policy" content="${buildRemoteViewCsp()}">`}<script>window.__MC_VIEW=${JSON.stringify({
+		slug: boot.slug,
+		locale: boot.locale ?? "",
+		dict: boot.dict ?? {},
+		target: "mobile",
+		protocol: 1
+	}).replace(/</g, "\\u003c")};${remoteViewBootstrap()}<\/script>`;
+	if (/<head\b[^>]*>/i.test(html)) return html.replace(/(<head\b[^>]*>)/i, `$1${injection}`);
+	return `<!DOCTYPE html><html><head>${injection}</head><body>${html}</body></html>`;
+}
+async function answerGetItems(requestId, request, handlers, reply) {
+	try {
+		const page = await handlers.getPage(request);
+		reply({
+			type: REMOTE_VIEW_MESSAGES.items,
+			requestId,
+			ok: true,
+			page
+		});
+	} catch (err) {
+		reply({
+			type: REMOTE_VIEW_MESSAGES.items,
+			requestId,
+			ok: false,
+			error: err instanceof Error ? err.message : String(err)
+		});
+	}
+}
+/**
+* Handle one message-event payload from a sandboxed remote view. DOM- and
+* framework-free: the caller owns the `message` listener (and MUST verify
+* `event.source === iframe.contentWindow` before calling), `reply` posts the
+* response back into the iframe (targetOrigin `"*"` — the sandboxed document's
+* origin is opaque, so nothing else can match). Returns true when the payload
+* was a remote-view request for this slug (callers ignore everything else).
+*/
+async function handleRemoteViewMessage(data, handlers, reply) {
+	if (typeof data !== "object" || data === null) return false;
+	const msg = data;
+	if (msg.slug !== handlers.slug) return false;
+	if (msg.type === REMOTE_VIEW_MESSAGES.startChat) {
+		const prompt = typeof msg.prompt === "string" ? msg.prompt.trim() : "";
+		if (prompt) handlers.onStartChat?.(prompt, typeof msg.role === "string" ? msg.role : void 0);
+		return true;
+	}
+	if (msg.type !== REMOTE_VIEW_MESSAGES.getItems || typeof msg.requestId !== "string") return false;
+	const request = {
+		offset: clampOffset(msg.offset),
+		limit: clampLimit(msg.limit),
+		fields: normalizeFields(msg.fields)
+	};
+	await answerGetItems(msg.requestId, request, handlers, reply);
+	return true;
+}
+//#endregion
+exports.DEFAULT_PAGE_LIMIT = DEFAULT_PAGE_LIMIT;
+exports.MAX_PAGE_LIMIT = MAX_PAGE_LIMIT;
+exports.REMOTE_VIEW_MAX_BYTES = REMOTE_VIEW_MAX_BYTES;
+exports.REMOTE_VIEW_MESSAGES = REMOTE_VIEW_MESSAGES;
+exports.REMOTE_VIEW_PROTOCOL = REMOTE_VIEW_PROTOCOL;
+exports.SANDBOXED_VIEW_CDN_ALLOWLIST = SANDBOXED_VIEW_CDN_ALLOWLIST;
+exports.buildRemoteViewCsp = buildRemoteViewCsp;
+exports.buildRemoteViewSrcdoc = buildRemoteViewSrcdoc;
+exports.clampLimit = clampLimit;
+exports.clampOffset = clampOffset;
+exports.handleRemoteViewMessage = handleRemoteViewMessage;
+exports.normalizeFields = normalizeFields;
+exports.pageFromItems = pageFromItems;
+exports.projectItems = projectItems;
+
+//# sourceMappingURL=index.cjs.map

package/dist/remote-view/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../../src/remote-view/index.ts"],"sourcesContent":["// The remote custom-view contract (phase 3 — plans/feat-remote-custom-view.md).\n//\n// Browser-safe single source of truth shared by the host server (which wraps\n// the view HTML into a sandboxed srcdoc), the desktop phone-frame preview, and\n// the mulmoserver mobile client (post-publish). A remote view runs on a phone\n// that can reach the internet but NOT the host's localhost, so — unlike the\n// desktop custom view (token + fetch to the view-data route) — its records\n// arrive over an async postMessage bridge owned by the parent page, and its\n// CSP locks `connect-src` to 'none' entirely.\n\n/** Bump when the bootstrap/message contract changes shape; the bootstrap\n *  exposes it as `__MC_VIEW.protocol` so a parent can refuse a stale view. */\nexport const REMOTE_VIEW_PROTOCOL = 1;\n\n/** postMessage types between the sandboxed view and its parent page.\n *  `startChat` reuses the desktop custom-view message type on purpose — the\n *  desktop parent already understands it. */\nexport const REMOTE_VIEW_MESSAGES = {\n  /** view → parent: request one page of records ({ requestId, offset, limit, fields }). */\n  getItems: \"mc-remote-get-items\",\n  /** parent → view: the reply ({ requestId, ok, page | error }). */\n  items: \"mc-remote-items\",\n  /** view → parent: open a new chat with a prefilled, NOT auto-sent draft. */\n  startChat: \"mc-start-chat\",\n} as const;\n\n/** Pagination defaults — mirrored by the phase-2 record handlers\n *  (`server/remoteHost/handlers/collectionPage.ts` imports these) so a view\n *  page can never outgrow what the command channel itself serves. */\nexport const DEFAULT_PAGE_LIMIT = 50;\nexport const MAX_PAGE_LIMIT = 200;\n\n/** Hard cap on the wrapped srcdoc: it travels to the phone INSIDE a Firestore\n *  command document (1 MiB total), so leave envelope headroom. */\nexport const REMOTE_VIEW_MAX_BYTES = 900_000;\n\n/** In-iframe `getItems` timeout — matches the remote client's `callHost`\n *  response timeout so the two layers give up together. */\nconst GET_ITEMS_TIMEOUT_MS = 30_000;\n\n// CDN allowlist for sandboxed LLM-authored HTML (script/style/font loads).\n// Shared with the desktop preview + custom-view CSPs\n// (src/utils/html/previewCsp.ts re-exports it as its default) so the two\n// policies can't drift. Keep the list audited — every entry is a potential\n// supply-chain surface; the hosts here are reputable infrastructure that does\n// not expose per-request logs to third parties.\nexport const SANDBOXED_VIEW_CDN_ALLOWLIST: readonly string[] = [\n  \"https://cdn.jsdelivr.net\",\n  \"https://unpkg.com\",\n  \"https://cdnjs.cloudflare.com\",\n  \"https://fonts.googleapis.com\",\n  \"https://fonts.gstatic.com\",\n  // Plotly's first-party CDN — the LLM defaults to it for Plotly charts.\n  \"https://cdn.plot.ly\",\n];\n\nconst toInt = (value: unknown): number | null => {\n  const num = typeof value === \"number\" ? value : typeof value === \"string\" ? Number(value) : NaN;\n  return Number.isFinite(num) ? Math.floor(num) : null;\n};\n\n/** Coerce a channel/postMessage offset (arrives as untyped JSON) to a non-negative int. */\nexport const clampOffset = (value: unknown): number => Math.max(0, toInt(value) ?? 0);\n\n/** Coerce a channel/postMessage limit to [1, MAX_PAGE_LIMIT] (default 50). */\nexport const clampLimit = (value: unknown): number => {\n  const num = toInt(value);\n  if (num === null || num <= 0) return DEFAULT_PAGE_LIMIT;\n  return Math.min(num, MAX_PAGE_LIMIT);\n};\n\n/** Coerce a `fields` projection list from untyped message JSON. */\nexport const normalizeFields = (value: unknown): string[] | undefined => {\n  if (!Array.isArray(value)) return undefined;\n  const cleaned = value\n    .filter((entry): entry is string => typeof entry === \"string\")\n    .map((entry) => entry.trim())\n    .filter((entry) => entry.length > 0);\n  return cleaned.length > 0 ? cleaned : undefined;\n};\n\nexport type RemoteViewItem = Record<string, unknown>;\n\n/** One page of records, the resolved value of the view's `getItems()`. Same\n *  shape as the phase-2 `getCollection` page so a parent can pass a channel\n *  page straight through. */\nexport interface RemoteViewPage {\n  items: RemoteViewItem[];\n  total: number;\n  offset: number;\n  limit: number;\n}\n\n/** A normalized (clamped, fields-cleaned) page request handed to a parent's\n *  `getPage` — `handleRemoteViewMessage` does the coercion so every parent\n *  answers identical values. */\nexport interface RemoteViewPageRequest {\n  offset: number;\n  limit: number;\n  fields?: string[];\n}\n\n/** Keep only `fields` (+ always the primary key) on each record. Parents apply\n *  this uniformly — the desktop preview via `pageFromItems`, the phone parent\n *  over the page it fetched through the channel — so a view sees the same\n *  projection everywhere. No-op without `fields`. */\nexport function projectItems(items: RemoteViewItem[], fields: string[] | undefined, primaryKey: string): RemoteViewItem[] {\n  if (!fields || fields.length === 0) return items;\n  const keep = new Set([primaryKey, ...fields]);\n  return items.map((item) => Object.fromEntries(Object.entries(item).filter(([key]) => keep.has(key))));\n}\n\n/** Answer a page request from an already-loaded record array (the desktop\n *  preview's data source): slice + project. Observable behavior matches the\n *  phone paging over the command channel. */\nexport function pageFromItems(items: RemoteViewItem[], request: RemoteViewPageRequest, primaryKey: string): RemoteViewPage {\n  const pageItems = items.slice(request.offset, request.offset + request.limit);\n  return { items: projectItems(pageItems, request.fields, primaryKey), total: items.length, offset: request.offset, limit: request.limit };\n}\n\n/**\n * CSP for a remote (mobile) custom view. Stricter than the desktop custom-view\n * policy: the view's data arrives over postMessage, so `connect-src` is\n * `'none'` — no fetch / XHR / WebSocket / sendBeacon to ANY origin, which\n * closes the bidirectional-exfiltration channel completely (there is no token\n * to steal either). Script/style/font keep the curated CDN allowlist (the\n * phone can reach the internet; only the host is unreachable), and\n * `img-src`/`media-src` allow any `https:` host so record image/media URLs\n * render — the same knowingly-accepted one-way GET-exfil tradeoff as the\n * desktop policy (see buildCustomViewCsp in src/utils/html/previewCsp.ts).\n */\nexport function buildRemoteViewCsp(cdns: readonly string[] = SANDBOXED_VIEW_CDN_ALLOWLIST): string {\n  const cdnList = cdns.join(\" \");\n  return [\n    \"default-src 'none'\",\n    `script-src 'unsafe-inline' ${cdnList}`,\n    `style-src 'unsafe-inline' ${cdnList}`,\n    `font-src ${cdnList}`,\n    `img-src ${cdnList} data: blob: https:`,\n    \"media-src https: data: blob:\",\n    \"connect-src 'none'\",\n  ].join(\"; \");\n}\n\n/** The in-iframe bootstrap installed before any of the view's own scripts.\n *  Owns the fiddly part of the contract — request/response correlation — so an\n *  LLM-authored view only ever awaits `__MC_VIEW.getItems(...)`:\n *\n *  - `getItems({ offset, limit, fields })`: posts an `mc-remote-get-items`\n *    with a fresh `requestId`, resolves on the matching `mc-remote-items`\n *    reply (validated to come from `window.parent`), rejects on `ok: false`\n *    or after 30 s. targetOrigin `'*'` is safe: the request carries no secret\n *    and the parent is by construction the party supplying the data.\n *  - `startChat(prompt, role)`: same message type + semantics as the desktop\n *    bridge — the parent opens a new chat with `prompt` prefilled as an\n *    editable draft, never auto-sent.\n *  - `t(key, named)`: the same vue-i18n-compatible dict helper as the desktop\n *    bootstrap (named interpolation only), over the host-picked `dict`.\n *\n *  Self-contained one-line string (no `<`, no `</script>`, `${}` only for the\n *  interpolated constants). */\nfunction remoteViewBootstrap(): string {\n  return `(function(){var v=window.__MC_VIEW,seq=0,pend={};window.addEventListener('message',function(e){if(e.source!==window.parent)return;var d=e.data;if(!d||d.type!=='${REMOTE_VIEW_MESSAGES.items}')return;var p=pend[d.requestId];if(!p)return;delete pend[d.requestId];clearTimeout(p.timer);if(d.ok)p.resolve(d.page);else p.reject(new Error(typeof d.error==='string'?d.error:'load failed'));});v.getItems=function(opts){opts=opts&&typeof opts==='object'?opts:{};return new Promise(function(resolve,reject){var id='q'+(++seq);var timer=setTimeout(function(){delete pend[id];reject(new Error('getItems timed out'));},${GET_ITEMS_TIMEOUT_MS});pend[id]={resolve:resolve,reject:reject,timer:timer};window.parent.postMessage({type:'${REMOTE_VIEW_MESSAGES.getItems}',slug:v.slug,requestId:id,offset:opts.offset,limit:opts.limit,fields:opts.fields},'*');});};v.startChat=function(prompt,role){window.parent.postMessage({type:'${REMOTE_VIEW_MESSAGES.startChat}',slug:v.slug,prompt:String(prompt),role:typeof role==='string'?role:undefined},'*');};v.dict=v.dict||{};v.t=function(key,named){var s=v.dict[key];if(typeof s!=='string')return typeof key==='string'?key:String(key);if(!named||typeof named!=='object')return s;return s.replace(/\\\\{(\\\\w+)\\\\}/g,function(m,n){var x=named[n];return x==null?m:String(x);});};})();`;\n}\n\n/** What the host injects into `window.__MC_VIEW` — note what is ABSENT\n *  compared to the desktop boot: no token, no dataUrl, no origin. */\nexport interface RemoteViewBoot {\n  slug: string;\n  /** Locale the dict was picked for; empty string when no translations. */\n  locale?: string;\n  /** Host-picked, locale-filtered flat string map (same contract as the\n   *  desktop custom-view dict). */\n  dict?: Record<string, string>;\n}\n\n/** Wrap a view's HTML into the sandboxed srcdoc: CSP meta + `__MC_VIEW` boot +\n *  bridge bootstrap injected at the start of `<head>` (before any view\n *  script). Runs HOST-side (`getRemoteView`) so the phone and the desktop\n *  preview receive the identical finished artifact. */\nexport function buildRemoteViewSrcdoc(html: string, boot: RemoteViewBoot): string {\n  const cspMeta = `<meta http-equiv=\"Content-Security-Policy\" content=\"${buildRemoteViewCsp()}\">`;\n  // `<`-escape the JSON so a hostile slug/dict string can't break out of the\n  // <script> element (same escape as the desktop srcdoc builder).\n  const json = JSON.stringify({\n    slug: boot.slug,\n    locale: boot.locale ?? \"\",\n    dict: boot.dict ?? {},\n    target: \"mobile\",\n    protocol: REMOTE_VIEW_PROTOCOL,\n  }).replace(/</g, \"\\\\u003c\");\n  const injection = `${cspMeta}<script>window.__MC_VIEW=${json};${remoteViewBootstrap()}</script>`;\n  if (/<head\\b[^>]*>/i.test(html)) {\n    return html.replace(/(<head\\b[^>]*>)/i, `$1${injection}`);\n  }\n  return `<!DOCTYPE html><html><head>${injection}</head><body>${html}</body></html>`;\n}\n\n/** What a parent page provides to answer the sandboxed view. Deliberately\n *  minimal — exactly the phone runtime's capabilities, nothing more, so the\n *  desktop preview can never exceed what works on the phone. */\nexport interface RemoteViewBridgeHandlers {\n  slug: string;\n  /** Answer one normalized page request (already clamped + fields-cleaned). */\n  getPage: (request: RemoteViewPageRequest) => Promise<RemoteViewPage> | RemoteViewPage;\n  /** Relay a `startChat` draft; omit on a parent without a chat surface. */\n  onStartChat?: (prompt: string, role?: string) => void;\n}\n\nasync function answerGetItems(requestId: string, request: RemoteViewPageRequest, handlers: RemoteViewBridgeHandlers, reply: RemoteViewReply): Promise<void> {\n  try {\n    const page = await handlers.getPage(request);\n    reply({ type: REMOTE_VIEW_MESSAGES.items, requestId, ok: true, page });\n  } catch (err) {\n    reply({ type: REMOTE_VIEW_MESSAGES.items, requestId, ok: false, error: err instanceof Error ? err.message : String(err) });\n  }\n}\n\ntype RemoteViewReply = (message: Record<string, unknown>) => void;\n\n/**\n * Handle one message-event payload from a sandboxed remote view. DOM- and\n * framework-free: the caller owns the `message` listener (and MUST verify\n * `event.source === iframe.contentWindow` before calling), `reply` posts the\n * response back into the iframe (targetOrigin `\"*\"` — the sandboxed document's\n * origin is opaque, so nothing else can match). Returns true when the payload\n * was a remote-view request for this slug (callers ignore everything else).\n */\nexport async function handleRemoteViewMessage(data: unknown, handlers: RemoteViewBridgeHandlers, reply: RemoteViewReply): Promise<boolean> {\n  if (typeof data !== \"object\" || data === null) return false;\n  const msg = data as {\n    type?: unknown;\n    slug?: unknown;\n    requestId?: unknown;\n    offset?: unknown;\n    limit?: unknown;\n    fields?: unknown;\n    prompt?: unknown;\n    role?: unknown;\n  };\n  if (msg.slug !== handlers.slug) return false;\n  if (msg.type === REMOTE_VIEW_MESSAGES.startChat) {\n    const prompt = typeof msg.prompt === \"string\" ? msg.prompt.trim() : \"\";\n    if (prompt) handlers.onStartChat?.(prompt, typeof msg.role === \"string\" ? msg.role : undefined);\n    return true;\n  }\n  if (msg.type !== REMOTE_VIEW_MESSAGES.getItems || typeof msg.requestId !== \"string\") return false;\n  const request: RemoteViewPageRequest = { offset: clampOffset(msg.offset), limit: clampLimit(msg.limit), fields: normalizeFields(msg.fields) };\n  await answerGetItems(msg.requestId, request, handlers, reply);\n  return true;\n}\n"],"mappings":";;;;AAYA,IAAa,uBAAuB;;;;AAKpC,IAAa,uBAAuB;;CAElC,UAAU;;CAEV,OAAO;;CAEP,WAAW;AACb;;;;AAKA,IAAa,qBAAqB;AAClC,IAAa,iBAAiB;;;AAI9B,IAAa,wBAAwB;;;AAIrC,IAAM,uBAAuB;AAQ7B,IAAa,+BAAkD;CAC7D;CACA;CACA;CACA;CACA;CAEA;AACF;AAEA,IAAM,SAAS,UAAkC;CAC/C,MAAM,MAAM,OAAO,UAAU,WAAW,QAAQ,OAAO,UAAU,WAAW,OAAO,KAAK,IAAI;CAC5F,OAAO,OAAO,SAAS,GAAG,IAAI,KAAK,MAAM,GAAG,IAAI;AAClD;;AAGA,IAAa,eAAe,UAA2B,KAAK,IAAI,GAAG,MAAM,KAAK,KAAK,CAAC;;AAGpF,IAAa,cAAc,UAA2B;CACpD,MAAM,MAAM,MAAM,KAAK;CACvB,IAAI,QAAQ,QAAQ,OAAO,GAAG,OAAA;CAC9B,OAAO,KAAK,IAAI,KAAA,GAAmB;AACrC;;AAGA,IAAa,mBAAmB,UAAyC;CACvE,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,OAAO,KAAA;CAClC,MAAM,UAAU,MACb,QAAQ,UAA2B,OAAO,UAAU,QAAQ,CAAC,CAC7D,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,CAC5B,QAAQ,UAAU,MAAM,SAAS,CAAC;CACrC,OAAO,QAAQ,SAAS,IAAI,UAAU,KAAA;AACxC;;;;;AA2BA,SAAgB,aAAa,OAAyB,QAA8B,YAAsC;CACxH,IAAI,CAAC,UAAU,OAAO,WAAW,GAAG,OAAO;CAC3C,MAAM,uBAAO,IAAI,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;CAC5C,OAAO,MAAM,KAAK,SAAS,OAAO,YAAY,OAAO,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC;AACtG;;;;AAKA,SAAgB,cAAc,OAAyB,SAAgC,YAAoC;CAEzH,OAAO;EAAE,OAAO,aADE,MAAM,MAAM,QAAQ,QAAQ,QAAQ,SAAS,QAAQ,KAC1C,GAAW,QAAQ,QAAQ,UAAU;EAAG,OAAO,MAAM;EAAQ,QAAQ,QAAQ;EAAQ,OAAO,QAAQ;CAAM;AACzI;;;;;;;;;;;;AAaA,SAAgB,mBAAmB,OAA0B,8BAAsC;CACjG,MAAM,UAAU,KAAK,KAAK,GAAG;CAC7B,OAAO;EACL;EACA,8BAA8B;EAC9B,6BAA6B;EAC7B,YAAY;EACZ,WAAW,QAAQ;EACnB;EACA;CACF,CAAC,CAAC,KAAK,IAAI;AACb;;;;;;;;;;;;;;;;;;AAmBA,SAAS,sBAA8B;CACrC,OAAO,mKAAmK,qBAAqB,MAAM,maAAma,qBAAqB,0FAA0F,qBAAqB,SAAS,kKAAkK,qBAAqB,UAAU;AACx7B;;;;;AAiBA,SAAgB,sBAAsB,MAAc,MAA8B;CAWhF,MAAM,YAAY,GAAG,uDAVkD,mBAAmB,EAAE,IAU/D,2BAPhB,KAAK,UAAU;EAC1B,MAAM,KAAK;EACX,QAAQ,KAAK,UAAU;EACvB,MAAM,KAAK,QAAQ,CAAC;EACpB,QAAQ;EACR,UAAA;CACF,CAAC,CAAC,CAAC,QAAQ,MAAM,SACuC,EAAK,GAAG,oBAAoB,EAAE;CACtF,IAAI,iBAAiB,KAAK,IAAI,GAC5B,OAAO,KAAK,QAAQ,oBAAoB,KAAK,WAAW;CAE1D,OAAO,8BAA8B,UAAU,eAAe,KAAK;AACrE;AAaA,eAAe,eAAe,WAAmB,SAAgC,UAAoC,OAAuC;CAC1J,IAAI;EACF,MAAM,OAAO,MAAM,SAAS,QAAQ,OAAO;EAC3C,MAAM;GAAE,MAAM,qBAAqB;GAAO;GAAW,IAAI;GAAM;EAAK,CAAC;CACvE,SAAS,KAAK;EACZ,MAAM;GAAE,MAAM,qBAAqB;GAAO;GAAW,IAAI;GAAO,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;EAAE,CAAC;CAC3H;AACF;;;;;;;;;AAYA,eAAsB,wBAAwB,MAAe,UAAoC,OAA0C;CACzI,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM,OAAO;CACtD,MAAM,MAAM;CAUZ,IAAI,IAAI,SAAS,SAAS,MAAM,OAAO;CACvC,IAAI,IAAI,SAAS,qBAAqB,WAAW;EAC/C,MAAM,SAAS,OAAO,IAAI,WAAW,WAAW,IAAI,OAAO,KAAK,IAAI;EACpE,IAAI,QAAQ,SAAS,cAAc,QAAQ,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,KAAA,CAAS;EAC9F,OAAO;CACT;CACA,IAAI,IAAI,SAAS,qBAAqB,YAAY,OAAO,IAAI,cAAc,UAAU,OAAO;CAC5F,MAAM,UAAiC;EAAE,QAAQ,YAAY,IAAI,MAAM;EAAG,OAAO,WAAW,IAAI,KAAK;EAAG,QAAQ,gBAAgB,IAAI,MAAM;CAAE;CAC5I,MAAM,eAAe,IAAI,WAAW,SAAS,UAAU,KAAK;CAC5D,OAAO;AACT"}