@zoulabo/line-hive 0.1.20 → 0.1.22

package/dist/line/messages.js.map

@@ -1 +1 @@
-{"version":3,"file":"messages.js","sourceRoot":"","sources":["../../src/line/messages.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,CAAC,EAAe,MAAM,YAAY,CAAC;AAiD5C,+EAA+E;AAE/E,MAAM,CAAC,MAAM,YAAY,GAA2B;IAClD,IAAI,EAAE,IAAI;IACV,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,GAAG;IAChB,KAAK,EAAE,GAAG;IACV,OAAO,EAAE,IAAI;CACd,CAAC;AAEF,MAAM,aAAa,GAAG;IACpB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IACjC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;CAC3B,CAAC;AAEF,+EAA+E;AAE/E,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,SAAiB,IAAI;IACpE,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACpB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5D,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACvC,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,GAAG,GAAG,EAAE;IACxC,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,mBAAmB,CAAC,KAAqD;IACvF,OAAO,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC;AAeD,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACnD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;YACnD,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACnD,IAAI,MAAM,KAAK,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACvD,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAC7D,IAAI,MAAM,KAAK,cAAc;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAC/D,IAAI,MAAM,KAAK,mBAAmB,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAmB,EAAE,SAAiB,IAAI;IACxE,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAEpB,uEAAuE;IACvE,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE;YACN,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;YACtB,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,GAAG;SACjB;KACF,CAAC,CAAC;IAEH,gBAAgB;IAChB,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE;YACN,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE;YACpB,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,GAAG;SACjB;KACF,CAAC,CAAC;IAEH,eAAe;IACf,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE;YACN,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE;YACpB,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,GAAG;SACjB;KACF,CAAC,CAAC;IAEH,0FAA0F;IAC1F,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GACR,KAAK,CAAC,OAAO,KAAK,KAAK;gBACrB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;YACxC,iEAAiE;YACjE,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC;YAC1E,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5E,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE;oBACN,IAAI,EAAE,UAAU;oBAChB,KAAK,EAAE,UAAU,CAAC,GAAG,KAAK,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;oBAC5C,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;oBAChH,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE;iBACvC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAA+B,EAC/B,SAAiB,IAAI;IAErB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACpB,MAAM,KAAK,GAAqB,EAAE,CAAC;IAEnC,iCAAiC;IACjC,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE;YACN,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;YACtB,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,GAAG;SACjB;KACF,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE;gBACN,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;gBACxG,WAAW,EAAE,KAAK;aACnB;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAAC,SAAiB,IAAI;IACrD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE;oBACN,IAAI,EAAE,UAAU;oBAChB,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;oBACtB,IAAI,EAAE,iBAAiB;oBACvB,WAAW,EAAE,GAAG;iBACjB;aACF;YACD;gBACE,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE;oBACN,IAAI,EAAE,UAAU;oBAChB,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE;oBACpB,IAAI,EAAE,eAAe;oBACrB,WAAW,EAAE,GAAG;iBACjB;aACF;YACD;gBACE,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE;oBACN,IAAI,EAAE,UAAU;oBAChB,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE;oBACpB,IAAI,EAAE,oBAAoB;oBAC1B,WAAW,EAAE,GAAG;iBACjB;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,MAAmB,EACnB,SAAiB,IAAI;IAErB,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI;QACJ,UAAU,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC;KACnG,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,MAAmB,EACnB,SAAiB,IAAI;IAErB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACpB,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAClG,0FAA0F;IAC1F,MAAM,UAAU,GAAmB;QACjC,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE;YACN,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE;YACpB,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,KAAK;SACnB;KACF,CAAC;IACF,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;IAClC,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI;QACJ,UAAU,EAAE,EAAE;KACf,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,MAAmB,EACnB,SAAiB,IAAI;IAErB,OAAO,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,kBAAkB,CAChC,SAAiB,EACjB,KAAa,EACb,UAAkB,EAClB,OAAe,EACf,SAAiB,IAAI;IAErB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC;QAC5C,UAAU,EAAE;YACV,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE;wBACN,IAAI,EAAE,UAAU;wBAChB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;wBAChB,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;wBACjG,WAAW,EAAE,IAAI;qBAClB;iBACF;gBACD;oBACE,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE;wBACN,IAAI,EAAE,UAAU;wBAChB,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE;wBACpB,IAAI,EAAE,eAAe;wBACrB,WAAW,EAAE,QAAQ;qBACtB;iBACF;gBACD;oBACE,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE;wBACN,IAAI,EAAE,UAAU;wBAChB,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE;wBACpB,IAAI,EAAE,oBAAoB;wBAC1B,WAAW,EAAE,IAAI;qBAClB;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"messages.js","sourceRoot":"","sources":["../../src/line/messages.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,CAAC,EAAe,MAAM,YAAY,CAAC;AAiD5C,+EAA+E;AAE/E,qFAAqF;AACrF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,iBAAiB;IACjB,oBAAoB;IACpB,yEAAyE;IACzE,0BAA0B;IAC1B,mEAAmE;IACnE,+BAA+B;IAC/B,2EAA2E;IAC3E,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;CACnB,CAAC,CAAC;AAEH,oEAAoE;AACpE,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,4CAA4C;AAC5C,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACtF,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,IAAI,QAAQ,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACnG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4CAA4C;AAC5C,SAAS,aAAa,CAAC,QAAgB;IACrC,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACnF,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,YAAY,CAAC;IAC9F,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9E,IAAI,QAAQ,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACxG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gDAAgD;AAChD,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,KAAK,GAAG,IAAI;QAAE,OAAO,GAAG,KAAK,IAAI,CAAC;IACtC,IAAI,KAAK,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAClE,OAAO,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAgB,EAChB,QAAgB,EAChB,OAAe,EACf,SAAiB,EACjB,QAAgB;IAEhB,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAEzC,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,MAAM,QAAQ,EAAE;QACzB,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE;gBACJ,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI;wBACV,IAAI,EAAE,KAAK;wBACX,IAAI,EAAE,CAAC;wBACP,OAAO,EAAE,QAAQ;qBAClB;oBACD;wBACE,IAAI,EAAE,KAAK;wBACX,MAAM,EAAE,UAAU;wBAClB,IAAI,EAAE,CAAC;wBACP,OAAO,EAAE,IAAI;wBACb,QAAQ,EAAE;4BACR;gCACE,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,QAAQ;gCACd,MAAM,EAAE,MAAM;gCACd,IAAI,EAAE,IAAI;gCACV,IAAI,EAAE,IAAI;gCACV,QAAQ,EAAE,CAAC;6BACZ;4BACD;gCACE,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,GAAG,SAAS,MAAM,OAAO,QAAQ,SAAS,EAAE;gCAClD,IAAI,EAAE,IAAI;gCACV,KAAK,EAAE,SAAS;6BACjB;yBACF;qBACF;iBACF;aACF;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,QAAQ;wBACd,MAAM,EAAE;4BACN,IAAI,EAAE,KAAK;4BACX,KAAK,EAAE,UAAU;4BACjB,GAAG,EAAE,OAAO;yBACb;wBACD,KAAK,EAAE,SAAS;wBAChB,MAAM,EAAE,IAAI;wBACZ,KAAK,EAAE,SAAS;qBACjB;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,YAAY,GAA2B;IAClD,IAAI,EAAE,IAAI;IACV,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,GAAG;IAChB,KAAK,EAAE,GAAG;IACV,OAAO,EAAE,IAAI;CACd,CAAC;AAEF,MAAM,aAAa,GAAG;IACpB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IACjC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;CAC3B,CAAC;AAEF,+EAA+E;AAE/E,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,SAAiB,IAAI;IACpE,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACpB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5D,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACvC,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,GAAG,GAAG,EAAE;IACxC,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,mBAAmB,CAAC,KAAqD;IACvF,OAAO,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC;AAeD,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACnD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;YACnD,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACnD,IAAI,MAAM,KAAK,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACvD,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAC7D,IAAI,MAAM,KAAK,cAAc;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAC/D,IAAI,MAAM,KAAK,mBAAmB,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAmB,EAAE,SAAiB,IAAI;IACxE,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAEpB,uEAAuE;IACvE,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE;YACN,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;YACtB,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,GAAG;SACjB;KACF,CAAC,CAAC;IAEH,gBAAgB;IAChB,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE;YACN,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE;YACpB,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,GAAG;SACjB;KACF,CAAC,CAAC;IAEH,eAAe;IACf,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE;YACN,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE;YACpB,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,GAAG;SACjB;KACF,CAAC,CAAC;IAEH,0FAA0F;IAC1F,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GACR,KAAK,CAAC,OAAO,KAAK,KAAK;gBACrB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;YACxC,iEAAiE;YACjE,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC;YAC1E,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5E,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE;oBACN,IAAI,EAAE,UAAU;oBAChB,KAAK,EAAE,UAAU,CAAC,GAAG,KAAK,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;oBAC5C,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;oBAChH,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE;iBACvC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAA+B,EAC/B,SAAiB,IAAI;IAErB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACpB,MAAM,KAAK,GAAqB,EAAE,CAAC;IAEnC,iCAAiC;IACjC,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE;YACN,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;YACtB,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,GAAG;SACjB;KACF,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE;gBACN,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;gBACxG,WAAW,EAAE,KAAK;aACnB;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAAC,SAAiB,IAAI;IACrD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE;oBACN,IAAI,EAAE,UAAU;oBAChB,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;oBACtB,IAAI,EAAE,iBAAiB;oBACvB,WAAW,EAAE,GAAG;iBACjB;aACF;YACD;gBACE,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE;oBACN,IAAI,EAAE,UAAU;oBAChB,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE;oBACpB,IAAI,EAAE,eAAe;oBACrB,WAAW,EAAE,GAAG;iBACjB;aACF;YACD;gBACE,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE;oBACN,IAAI,EAAE,UAAU;oBAChB,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE;oBACpB,IAAI,EAAE,oBAAoB;oBAC1B,WAAW,EAAE,GAAG;iBACjB;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,MAAmB,EACnB,SAAiB,IAAI,EACrB,OAAuC;IAEvC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAClG,mFAAmF;IACnF,IAAI,OAAO,EAAE,gBAAgB,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QACpB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE;YACpB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE;gBACN,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE;gBACrB,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;gBAClH,WAAW,EAAE,GAAG;aACjB;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI;QACJ,UAAU,EAAE,EAAE;KACf,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,MAAmB,EACnB,SAAiB,IAAI;IAErB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACpB,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAClG,0FAA0F;IAC1F,MAAM,UAAU,GAAmB;QACjC,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE;YACN,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE;YACpB,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,KAAK;SACnB;KACF,CAAC;IACF,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;IAClC,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI;QACJ,UAAU,EAAE,EAAE;KACf,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,MAAmB,EACnB,SAAiB,IAAI;IAErB,OAAO,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,kBAAkB,CAChC,SAAiB,EACjB,KAAa,EACb,UAAkB,EAClB,OAAe,EACf,SAAiB,IAAI;IAErB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC;QAC5C,UAAU,EAAE;YACV,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE;wBACN,IAAI,EAAE,UAAU;wBAChB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;wBAChB,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;wBACjG,WAAW,EAAE,IAAI;qBAClB;iBACF;gBACD;oBACE,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE;wBACN,IAAI,EAAE,UAAU;wBAChB,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE;wBACpB,IAAI,EAAE,eAAe;wBACrB,WAAW,EAAE,QAAQ;qBACtB;iBACF;gBACD;oBACE,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE;wBACN,IAAI,EAAE,UAAU;wBAChB,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE;wBACpB,IAAI,EAAE,oBAAoB;wBAC1B,WAAW,EAAE,IAAI;qBAClB;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/line/webhook.js

@@ -1,8 +1,11 @@
 import http from "http";
 import crypto from "crypto";
+import fs from "fs";
+import path from "path";
 import { buildDeleteQueueReply, errorMessage, parsePostbackData, textWithQuickReply, textWithQueueQuickReply, formatTimeAgo, STATUS_ICONS, getAgentDisplayName, } from "./messages.js";
 import { sendWithTokenPool } from "../util/sendWithTokenPool.js";
-import { CONFIG_TARGETED_AGENT } from "../constants.js";
+import { CONFIG_TARGETED_AGENT, INCOMING_MEDIA_DIR } from "../constants.js";
+import { getServeDir } from "../util/toolHelpers.js";
 import { t, resolveLocale } from "../i18n.js";
 export function verifySignature(secret, body, signature) {
     if (!secret || !signature) {
@@ -16,6 +19,73 @@ export function verifySignature(secret, body, signature) {
         return false;
     return crypto.timingSafeEqual(hashBuf, sigBuf);
 }
+// ─── SSRF Protection ────────────────────────────────────────────────────────
+/** Private/reserved CIDR ranges that should never be fetched externally */
+const PRIVATE_RANGES = [
+    { prefix: "10.", mask: 8 },
+    { prefix: "127.", mask: 8 },
+    { prefix: "169.254.", mask: 16 },
+    { prefix: "192.168.", mask: 16 },
+    { prefix: "0.", mask: 8 },
+    // 172.16.0.0/12
+];
+function isPrivateIp(ip) {
+    for (const range of PRIVATE_RANGES) {
+        if (ip.startsWith(range.prefix))
+            return true;
+    }
+    // 172.16.0.0 – 172.31.255.255
+    if (ip.startsWith("172.")) {
+        const second = parseInt(ip.split(".")[1], 10);
+        if (second >= 16 && second <= 31)
+            return true;
+    }
+    // IPv6 loopback
+    if (ip === "::1" || ip === "[::1]")
+        return true;
+    return false;
+}
+/**
+ * Check if a URL resolves to a private/reserved IP range (SSRF protection).
+ * Only checks the hostname — DNS rebinding is out of scope for this check.
+ */
+function isPrivateUrl(urlStr) {
+    try {
+        const parsed = new URL(urlStr);
+        return isPrivateIp(parsed.hostname);
+    }
+    catch {
+        return true; // invalid URL → reject
+    }
+}
+// ─── Size-limited response reader ───────────────────────────────────────────
+/**
+ * Read a fetch Response body with a hard byte limit.
+ * Prevents Content-Length TOCTOU: the actual bytes are counted during read.
+ * Returns null if the body exceeds the limit.
+ */
+async function readResponseWithLimit(res, maxBytes) {
+    const reader = res.body?.getReader();
+    if (!reader) {
+        // Fallback for environments without readable stream
+        const buf = Buffer.from(await res.arrayBuffer());
+        return buf.length <= maxBytes ? buf : null;
+    }
+    const chunks = [];
+    let totalBytes = 0;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        totalBytes += value.byteLength;
+        if (totalBytes > maxBytes) {
+            reader.cancel();
+            return null;
+        }
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks);
+}
 function getWebhookEventId(event) {
     return event.webhookEventId || event.message?.id || event.replyToken || `${event.timestamp}`;
 }
@@ -42,6 +112,18 @@ async function resolveUserLocale(deps, userId) {
     }
     return "en";
 }
+/**
+ * Register the user as default (if first user) and auto-enable restricted mode.
+ * When the first user interacts with the bot and no allowed_users list exists yet,
+ * this switches from open mode to restricted mode with the first user auto-allowed.
+ */
+function registerAndAutoAllow(deps, userId) {
+    const isFirst = deps.messageStore.registerDefaultUserIfMissing(userId);
+    if (isFirst && deps.messageStore.getAllowedUsers().length === 0) {
+        deps.messageStore.addAllowedUser(userId);
+        deps.logger?.info({ userId: userId.slice(0, 8) }, "First user auto-allowed, restricted mode enabled");
+    }
+}
 /** Format a single agent's status into a line of text */
 export function formatAgentStatus(agent, locale = "en") {
     const m = t(locale);
@@ -136,8 +218,8 @@ async function replyViaPool(deps, replyToken, message, eventTimestamp) {
     }
 }
 /**
- * Download an image preview from the LINE Content API and return as base64.
- * Uses the /preview endpoint (~240×240, ~30KB) to keep payloads small.
+ * Download an image from the LINE Content API at full resolution.
+ * Uses the full content endpoint (not preview) to get the original image.
  * For external images (forwarded), fetches from the original URL directly.
  */
 async function downloadImagePreview(deps, event) {
@@ -151,10 +233,16 @@ async function downloadImagePreview(deps, event) {
                 deps.logger?.warn({ url: provider.originalContentUrl }, "Rejected non-HTTPS external image URL");
                 return null;
             }
+            // Block private/reserved IP ranges (SSRF protection)
+            if (isPrivateUrl(provider.originalContentUrl)) {
+                deps.logger?.warn({ url: provider.originalContentUrl }, "Rejected external URL targeting private/reserved IP");
+                return null;
+            }
             url = provider.originalContentUrl;
         }
         else if (messageId) {
-            url = `https://api-data.line.me/v2/bot/message/${messageId}/content/preview`;
+            // Full-resolution content endpoint (not /preview)
+            url = `https://api-data.line.me/v2/bot/message/${messageId}/content`;
         }
         else {
             return null;
@@ -168,16 +256,20 @@ async function downloadImagePreview(deps, event) {
             deps.logger?.warn({ status: res.status, messageId }, "Image download failed");
             return null;
         }
-        // Limit download size to 5MB to prevent memory exhaustion
+        // Limit download size to 10MB to prevent memory exhaustion
+        const MAX_DOWNLOAD = 10 * 1024 * 1024;
         const contentLength = res.headers.get("content-length");
-        if (contentLength && parseInt(contentLength, 10) > 5 * 1024 * 1024) {
+        if (contentLength && parseInt(contentLength, 10) > MAX_DOWNLOAD) {
             deps.logger?.warn({ contentLength }, "Image too large, skipping download");
             return null;
         }
-        const buffer = Buffer.from(await res.arrayBuffer());
-        const base64 = buffer.toString("base64");
+        const buffer = await readResponseWithLimit(res, MAX_DOWNLOAD);
+        if (!buffer) {
+            deps.logger?.warn({ messageId }, "Image body exceeded size limit during read");
+            return null;
+        }
         const mimeType = res.headers.get("content-type") || "image/jpeg";
-        return { base64, mimeType };
+        return { buffer, mimeType };
     }
     catch (error) {
         deps.logger?.warn({ error }, "Image download error");
@@ -202,17 +294,21 @@ async function downloadFileContent(deps, event) {
             deps.logger?.warn({ status: res.status, messageId }, "File download failed");
             return null;
         }
-        // Limit download size to 10MB
+        // Limit download size (configurable) to prevent memory exhaustion.
+        const MAX_DOWNLOAD = deps.config.maxIncomingFileBytes;
         const contentLength = res.headers.get("content-length");
-        if (contentLength && parseInt(contentLength, 10) > 10 * 1024 * 1024) {
+        if (contentLength && parseInt(contentLength, 10) > MAX_DOWNLOAD) {
             deps.logger?.warn({ contentLength }, "File too large, skipping download");
             return null;
         }
-        const buffer = Buffer.from(await res.arrayBuffer());
-        const base64 = buffer.toString("base64");
+        const buffer = await readResponseWithLimit(res, MAX_DOWNLOAD);
+        if (!buffer) {
+            deps.logger?.warn({ messageId }, "File body exceeded size limit during read");
+            return null;
+        }
         const mimeType = res.headers.get("content-type") || "application/octet-stream";
         return {
-            base64,
+            buffer,
             mimeType,
             fileName: event.message?.fileName,
             fileSize: event.message?.fileSize,
@@ -223,6 +319,38 @@ async function downloadFileContent(deps, event) {
         return null;
     }
 }
+/**
+ * Write downloaded media to disk under `.line-hive-tmp/incoming/`.
+ * Returns the relative disk path (from project root) for storage in media_json.
+ *
+ * Naming: `{lineMessageId}-{sanitizedFilename}` or `{lineMessageId}.{ext}`
+ */
+function writeIncomingMedia(lineMessageId, buffer, mimeType, fileName) {
+    const dir = path.resolve(INCOMING_MEDIA_DIR);
+    fs.mkdirSync(dir, { recursive: true });
+    // Derive extension from filename or mime type
+    const mimeToExt = {
+        "image/jpeg": ".jpg", "image/png": ".png", "image/gif": ".gif",
+        "image/webp": ".webp", "audio/mpeg": ".mp3", "audio/m4a": ".m4a",
+        "audio/ogg": ".ogg", "video/mp4": ".mp4", "application/pdf": ".pdf",
+    };
+    // Sanitize message ID and filename to prevent path traversal
+    const safeId = lineMessageId.replace(/[^a-zA-Z0-9._-]/g, "_");
+    let safeName;
+    if (fileName) {
+        // Sanitize user-provided filename: keep alphanumeric, dots, hyphens, underscores
+        safeName = fileName.replace(/[^a-zA-Z0-9._-]/g, "_");
+    }
+    else {
+        const ext = mimeToExt[mimeType] || "";
+        safeName = `${safeId}${ext}`;
+    }
+    const diskName = `${safeId}-${safeName}`;
+    const diskPath = path.join(dir, diskName);
+    fs.writeFileSync(diskPath, buffer, { mode: 0o600 });
+    // Return path relative to project root (for storage in media_json)
+    return path.join(INCOMING_MEDIA_DIR, diskName);
+}
 async function handleFileEvent(deps, event, userId) {
     const replyToken = event.replyToken;
     const webhookEventId = getWebhookEventId(event);
@@ -230,7 +358,17 @@ async function handleFileEvent(deps, event, userId) {
     const fileSize = event.message?.fileSize;
     // Download file content immediately (LINE auto-deletes content after a period)
     const media = await downloadFileContent(deps, event);
-    const mediaJson = media ? JSON.stringify(media) : null;
+    let mediaJson = null;
+    if (media) {
+        const lineMessageId = event.message?.id ?? webhookEventId;
+        const diskPath = writeIncomingMedia(lineMessageId, media.buffer, media.mimeType, media.fileName);
+        mediaJson = JSON.stringify({
+            mimeType: media.mimeType,
+            diskPath,
+            fileName: media.fileName,
+            fileSize: media.fileSize,
+        });
+    }
     const locale = await resolveUserLocale(deps, userId);
     const chatTargetedAgentId = deps.messageStore.getConfig(CONFIG_TARGETED_AGENT);
     const sizeStr = fileSize ? ` (${Math.round(fileSize / 1024)}KB)` : "";
@@ -261,7 +399,12 @@ async function handleImageEvent(deps, event, userId) {
     const webhookEventId = getWebhookEventId(event);
     // Download image preview immediately (LINE auto-deletes content after a period)
     const media = await downloadImagePreview(deps, event);
-    const mediaJson = media ? JSON.stringify({ mimeType: media.mimeType, base64: media.base64 }) : null;
+    let mediaJson = null;
+    if (media) {
+        const lineMessageId = event.message?.id ?? webhookEventId;
+        const diskPath = writeIncomingMedia(lineMessageId, media.buffer, media.mimeType);
+        mediaJson = JSON.stringify({ mimeType: media.mimeType, diskPath });
+    }
     // Resolve user locale
     const locale = await resolveUserLocale(deps, userId);
     // For chat messages, use targeted routing if user has selected an agent
@@ -277,7 +420,7 @@ async function handleImageEvent(deps, event, userId) {
     }, { targetedAgentId: chatTargetedAgentId });
     if (messageResult.deduped)
         return;
-    // Auto-register userId
+    // Auto-register userId (no auto-allow for image events)
     deps.messageStore.registerDefaultUserIfMissing(userId);
     if (!replyToken)
         return;
@@ -331,8 +474,13 @@ async function handleTextEvent(deps, event, text, userId) {
     if (isControlCommand && messageResult.messageId) {
         deps.messageStore.markMessageConsumed(messageResult.messageId);
     }
-    // Auto-register userId from incoming webhook (DB-only, no env/file writes)
-    deps.messageStore.registerDefaultUserIfMissing(userId);
+    // Auto-register: only auto-allow on status command ("?"), not on chat/other
+    if (command.type === "status") {
+        registerAndAutoAllow(deps, userId);
+    }
+    else {
+        deps.messageStore.registerDefaultUserIfMissing(userId);
+    }
     if (!replyToken) {
         return;
     }
@@ -356,13 +504,21 @@ async function handlePostbackEvent(deps, event, data, userId) {
     const replyToken = event.replyToken;
     if (!replyToken)
         return;
-    // Auto-register userId if needed
+    // Auto-register userId (no auto-allow for postback events)
     deps.messageStore.registerDefaultUserIfMissing(userId);
     // Resolve user locale
     const locale = await resolveUserLocale(deps, userId);
     const command = parsePostbackData(data);
     await handleCommandReply(deps, command, replyToken, null, event.timestamp, locale);
 }
+/**
+ * Strip [Quoting: "..."] prefix from message text for queue previews.
+ * Quoted context is preserved in the full message delivered to agents,
+ * but showing it in the 50-char preview makes it look like a separate message.
+ */
+function stripQuotePrefix(text) {
+    return text.replace(/^\[Quoting: "[^"]*"\]\s*/, "");
+}
 /**
  * Shared command handler — routes status/select/chat commands
  * and replies with rich messages.
@@ -488,7 +644,8 @@ async function handleCommandReply(deps, command, replyToken, messageId, eventTim
                 : m.queuedHeader();
             const lines = queued.map((msg, i) => {
                 const ago = formatTimeAgo(msg.timestamp, locale);
-                const preview = msg.text.length > 50 ? msg.text.slice(0, 50) + "…" : msg.text;
+                const displayText = stripQuotePrefix(msg.text);
+                const preview = displayText.length > 50 ? displayText.slice(0, 50) + "…" : displayText;
                 // Only show per-line agent label when agents differ
                 const agentLabel = !allSameAgent && msg.targetAgentId
                     ? ` → ${msg.targetAgentId.includes(":") ? msg.targetAgentId.split(":").pop() : msg.targetAgentId}`
@@ -516,7 +673,8 @@ async function handleCommandReply(deps, command, replyToken, messageId, eventTim
         else {
             const lines = queued.map((msg, i) => {
                 const ago = formatTimeAgo(msg.timestamp, locale);
-                const preview = msg.text.length > 50 ? msg.text.slice(0, 50) + "…" : msg.text;
+                const displayText = stripQuotePrefix(msg.text);
+                const preview = displayText.length > 50 ? displayText.slice(0, 50) + "…" : displayText;
                 const emoji = ["1️⃣", "2️⃣", "3️⃣", "4️⃣", "5️⃣", "6️⃣", "7️⃣", "8️⃣", "9️⃣"][i] || `${i + 1}`;
                 return `${emoji} ${preview} (${ago})`;
             });
@@ -544,7 +702,8 @@ async function handleCommandReply(deps, command, replyToken, messageId, eventTim
                 const allSameAgent = queued.every(msg => msg.targetAgentId && msg.targetAgentId === queued[0].targetAgentId);
                 const lines = queued.map((msg, i) => {
                     const ago = formatTimeAgo(msg.timestamp, locale);
-                    const preview = msg.text.length > 50 ? msg.text.slice(0, 50) + "…" : msg.text;
+                    const displayText = stripQuotePrefix(msg.text);
+                    const preview = displayText.length > 50 ? displayText.slice(0, 50) + "…" : displayText;
                     const agentLabel = !allSameAgent && msg.targetAgentId
                         ? ` → ${msg.targetAgentId.includes(":") ? msg.targetAgentId.split(":").pop() : msg.targetAgentId}`
                         : "";
@@ -600,7 +759,8 @@ async function handleCommandReply(deps, command, replyToken, messageId, eventTim
         deps.logger?.info({ targetAgent: agentDisplayName }, "Chat routed to targeted agent");
         // If agent is actively waiting (has active session), save token silently —
         // agent will respond within seconds via line_ask polling.
-        if (deps.messageStore.hasWaitingSession()) {
+        // Scope to THIS agent to avoid stale sessions from dead agents suppressing acks.
+        if (deps.messageStore.getWaitingSessionForAgent(targetAgent.agentId)) {
             deps.messageStore.saveReplyToken(replyToken, eventTimestamp ?? Date.now());
             return;
         }
@@ -608,7 +768,7 @@ async function handleCommandReply(deps, command, replyToken, messageId, eventTim
         // send brief ack so user knows message was received and queued
         const queueCount = deps.messageStore.countUnclaimedMessages(undefined, targetAgent.agentId);
         const queueInfo = queueCount > 1 ? m.nQueued(queueCount) : "";
-        await replyViaPool(deps, replyToken, textWithQuickReply(m.ackQueued(agentDisplayName, queueInfo), recentStatuses, locale), eventTimestamp);
+        await replyViaPool(deps, replyToken, textWithQuickReply(m.ackQueued(agentDisplayName, queueInfo), recentStatuses, locale, { dismissMessageId: messageId ?? undefined }), eventTimestamp);
         return;
     }
     // No targeted agent — fall back to needs_input routing
@@ -645,6 +805,11 @@ export async function handleWebhook(deps, body, signature) {
         const userId = event.source?.userId;
         if (!userId)
             continue;
+        // Access control: reject messages from unauthorized users
+        if (!deps.messageStore.isUserAllowed(userId)) {
+            deps.logger?.info({ userId: userId.slice(0, 8) }, "Blocked message from unauthorized user");
+            continue;
+        }
         if (event.type === "message" && event.message?.type === "text") {
             const text = event.message?.text ?? "";
             await handleTextEvent(deps, event, text, userId);
@@ -667,6 +832,14 @@ export async function handleWebhook(deps, body, signature) {
             const removed = deps.messageStore.deleteByLineMessageId(event.unsend.messageId);
             deps.logger?.info({ lineMessageId: event.unsend.messageId, removed }, "Unsend: message deleted");
         }
+        else if (event.type === "follow") {
+            // New user added bot as friend — auto-register and auto-allow
+            registerAndAutoAllow(deps, userId);
+            // Save reply token if available
+            if (event.replyToken) {
+                deps.messageStore.saveReplyToken(event.replyToken, event.timestamp);
+            }
+        }
     }
     return { statusCode: 200, body: "OK" };
 }
@@ -675,43 +848,109 @@ export function startWebhookServer(deps) {
     const server = http.createServer((req, res) => {
         const { method, url } = req;
         // Serve outgoing files/images for LINE to fetch or user to download
-        // Supports both /files/ (new) and /images/ (legacy) paths
-        const isFilesRoute = method === "GET" && (url?.startsWith("/files/") || url?.startsWith("/images/"));
+        const isFilesRoute = (method === "GET" || method === "HEAD") && url?.startsWith("/files/");
         if (isFilesRoute) {
-            const prefix = url.startsWith("/files/") ? "/files/" : "/images/";
+            const prefix = "/files/";
             // Strip query string and decode percent-encoding for clean ID extraction
             const rawId = url.slice(prefix.length).split("?")[0];
-            // Strip file extension (e.g. "abc123.html" → "abc123") for store lookup
-            const imageId = decodeURIComponent(rawId).replace(/\.[^.]+$/, "");
-            if (!imageId || imageId.includes("/") || imageId.includes("..")) {
+            const decodedRawId = decodeURIComponent(rawId);
+            if (!decodedRawId || decodedRawId.includes("/") || decodedRawId.includes("..") || decodedRawId.includes("\\")) {
                 res.statusCode = 404;
                 res.end("Not found");
                 return;
             }
-            const image = deps.messageStore.getOutgoingImage(imageId);
-            if (!image) {
-                res.statusCode = 404;
-                res.end("Not found");
+            // Check TTL — all disk-served files MUST be tracked.
+            // Untracked files on disk return 404 (strict mode).
+            // Race: cleanup may delete between check and readFile → 404 (acceptable).
+            const fileExpiry = deps.messageStore.getServedFileExpiry(decodedRawId);
+            if (fileExpiry?.isExpired) {
+                res.statusCode = 410;
+                res.end("Gone — file expired");
                 return;
             }
-            // Add charset for text-based content types
-            const contentType = image.mimeType.startsWith("text/")
-                ? `${image.mimeType}; charset=utf-8`
-                : image.mimeType;
-            res.setHeader("Content-Type", contentType);
-            res.setHeader("Content-Length", image.data.length);
-            res.setHeader("Cache-Control", "public, max-age=3600");
-            // Prevent MIME sniffing (defense-in-depth)
-            res.setHeader("X-Content-Type-Options", "nosniff");
-            // Images and browser-viewable types display inline; others trigger download
-            if (image.mimeType.startsWith("image/") || image.mimeType === "text/html" || image.mimeType === "application/pdf") {
-                res.setHeader("Content-Disposition", "inline");
-            }
-            else {
-                res.setHeader("Content-Disposition", "attachment");
+            // Try disk (files MUST be tracked in served_files table)
+            const serveDir = getServeDir(deps.config);
+            const diskPath = path.resolve(serveDir, decodedRawId);
+            if (fileExpiry && diskPath.startsWith(serveDir + path.sep)) {
+                try {
+                    const stat = fs.statSync(diskPath);
+                    if (!stat.isFile()) {
+                        res.statusCode = 404;
+                        res.end("Not found");
+                        return;
+                    }
+                    const ext = path.extname(diskPath).toLowerCase();
+                    const mimeMap = {
+                        ".html": "text/html",
+                        ".css": "text/css",
+                        ".js": "application/javascript",
+                        ".json": "application/json",
+                        ".png": "image/png",
+                        ".jpg": "image/jpeg",
+                        ".jpeg": "image/jpeg",
+                        ".gif": "image/gif",
+                        ".webp": "image/webp",
+                        ".svg": "image/svg+xml",
+                        ".pdf": "application/pdf",
+                        ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+                        ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+                        ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+                        ".csv": "text/csv",
+                        ".txt": "text/plain",
+                    };
+                    const mimeType = mimeMap[ext] || "application/octet-stream";
+                    const contentType = mimeType.startsWith("text/") ? `${mimeType}; charset=utf-8` : mimeType;
+                    res.setHeader("Content-Type", contentType);
+                    res.setHeader("Content-Length", stat.size);
+                    res.setHeader("Cache-Control", "public, max-age=60");
+                    res.setHeader("X-Content-Type-Options", "nosniff");
+                    res.setHeader("Referrer-Policy", "no-referrer");
+                    res.setHeader("Accept-Ranges", "bytes");
+                    if (mimeType.startsWith("image/") || mimeType === "text/html" || mimeType === "application/pdf") {
+                        res.setHeader("Content-Disposition", "inline");
+                    }
+                    else {
+                        // Use the filename from the URL path as the download name
+                        const baseName = path.basename(diskPath);
+                        res.setHeader("Content-Disposition", `attachment; filename="${baseName}"`);
+                    }
+                    res.statusCode = 200;
+                    if (method === "HEAD") {
+                        res.end();
+                        return;
+                    }
+                    const stream = fs.createReadStream(diskPath);
+                    stream.on("error", (err) => {
+                        if (err?.code === "ENOENT") {
+                            res.statusCode = 404;
+                            res.end("Not found");
+                        }
+                        else {
+                            deps.logger?.warn({ error: err instanceof Error ? err.message : err, file: decodedRawId }, "Failed to stream file");
+                            // If headers already sent, just destroy.
+                            try {
+                                res.destroy();
+                            }
+                            catch { }
+                        }
+                    });
+                    stream.pipe(res);
+                }
+                catch (err) {
+                    if (err?.code === "ENOENT") {
+                        res.statusCode = 404;
+                        res.end("Not found");
+                    }
+                    else {
+                        deps.logger?.warn({ error: err instanceof Error ? err.message : err, file: decodedRawId }, "Failed to serve file");
+                        res.statusCode = 500;
+                        res.end("Internal error");
+                    }
+                }
+                return;
             }
-            res.statusCode = 200;
-            res.end(image.data);
+            res.statusCode = 404;
+            res.end("Not found");
             return;
         }
         if (method !== "POST" || url !== deps.config.webhookPath) {
@@ -753,10 +992,11 @@ export function startWebhookServer(deps) {
         deps.logger?.error({ error }, "Webhook server error");
         throw error;
     });
-    server.listen(deps.config.webhookPort, () => {
+    server.listen(deps.config.webhookPort, "127.0.0.1", () => {
         deps.logger?.info({
             port: deps.config.webhookPort,
-            path: deps.config.webhookPath
+            path: deps.config.webhookPath,
+            host: "127.0.0.1"
         }, "Webhook server listening");
     });
     return server;