agim-cli 1.0.1

package/dist/plugins/messengers/wechat/ilink-types.js

@@ -0,0 +1,22 @@
+// WeChat iLink Bot API Types
+// Based on: https://github.com/epiral/weixin-bot/blob/main/docs/protocol-spec.md
+// ============================================
+// Media Item Type Constants
+// ============================================
+export const ITEM_TYPE = {
+    TEXT: 1,
+    IMAGE: 2,
+    VOICE: 3,
+    FILE: 4,
+    VIDEO: 5,
+};
+// ============================================
+// Error Codes
+// ============================================
+export const ILINK_ERRORS = {
+    SESSION_EXPIRED: -14, // Need to re-login
+    NETWORK_ERROR: -1,
+    INVALID_PARAMS: -2,
+    RATE_LIMITED: -3,
+};
+//# sourceMappingURL=ilink-types.js.map

package/dist/plugins/messengers/wechat/ilink-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ilink-types.js","sourceRoot":"","sources":["../../../../src/plugins/messengers/wechat/ilink-types.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,iFAAiF;AAiMjF,+CAA+C;AAC/C,4BAA4B;AAC5B,+CAA+C;AAE/C,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;CACA,CAAA;AAEV,+CAA+C;AAC/C,cAAc;AACd,+CAA+C;AAE/C,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,eAAe,EAAE,CAAC,EAAE,EAAE,mBAAmB;IACzC,aAAa,EAAE,CAAC,CAAC;IACjB,cAAc,EAAE,CAAC,CAAC;IAClB,YAAY,EAAE,CAAC,CAAC;CACR,CAAA"}

package/dist/plugins/messengers/wechat/media-download.d.ts

@@ -0,0 +1,32 @@
+import type { CDNMedia, ImageItem, VoiceItem, FileItem, VideoItem } from './ilink-types.js';
+import type { ILinkClient } from './ilink-client.js';
+export declare const MEDIA_ROOT: string;
+export declare const MAX_BYTES: number;
+export interface WechatDownloadResult {
+    path: string;
+    bytes: number;
+}
+/**
+ * Download a CDN media blob via the iLink client and write it to
+ * `MEDIA_ROOT/wechat/<subdir>/<filename>`. Returns the absolute path.
+ * The AES key is read from `cdnMedia.aes_key` (base64 of an ASCII hex string).
+ */
+export declare function downloadWechatMedia(client: ILinkClient, cdnMedia: CDNMedia, subdir: string, filename: string): Promise<WechatDownloadResult>;
+/**
+ * Pick a file extension based on the media item contents. Falls back to a
+ * generic extension when nothing more specific can be inferred.
+ */
+export declare function pickExtensionForImage(item: ImageItem): string;
+export declare function pickExtensionForVoice(item: VoiceItem): string;
+export declare function pickExtensionForFile(item: FileItem): string;
+export declare function pickExtensionForVideo(_item: VideoItem): string;
+/**
+ * Resolve the CDNMedia reference from a media item. Returns null when the
+ * item lacks the signed CDN URL or its AES key. The bot fetches
+ * `media.full_url` directly and decrypts with `media.aes_key` (no iLink-side
+ * download endpoint exists).
+ */
+export declare function extractCdnMedia(item: {
+    media?: CDNMedia;
+}): CDNMedia | null;
+//# sourceMappingURL=media-download.d.ts.map

package/dist/plugins/messengers/wechat/media-download.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-download.d.ts","sourceRoot":"","sources":["../../../../src/plugins/messengers/wechat/media-download.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC3F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAIpD,eAAO,MAAM,UAAU,EAAE,MAExB,CAAA;AAED,eAAO,MAAM,SAAS,QAAmB,CAAA;AAEzC,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC,CAqB/B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAM7D;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAG7D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAM3D;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,QAAQ,CAAA;CAAE,GACzB,QAAQ,GAAG,IAAI,CAGjB"}

package/dist/plugins/messengers/wechat/media-download.js

@@ -0,0 +1,78 @@
+// WeChat media download helper.
+//
+// Downloads image / voice / file / video attachments received via iLink to
+// ~/.im-hub/media/wechat/<userId>/<msgId>.<ext> so downstream agents can
+// read them by path (same convention as the Telegram adapter).
+//
+// Cleanup: shares MEDIA_ROOT and the same TTL-based sweep as
+// telegram/media-download.ts (both write into the same root dir).
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { logger as rootLogger } from '../../../core/logger.js';
+import { AGIM_HOME } from '../../../core/agim-paths.js';
+const log = rootLogger.child({ component: 'wechat.media' });
+export const MEDIA_ROOT = resolve(process.env.IMHUB_MEDIA_ROOT ?? join(AGIM_HOME, 'media'));
+export const MAX_BYTES = 20 * 1024 * 1024;
+/**
+ * Download a CDN media blob via the iLink client and write it to
+ * `MEDIA_ROOT/wechat/<subdir>/<filename>`. Returns the absolute path.
+ * The AES key is read from `cdnMedia.aes_key` (base64 of an ASCII hex string).
+ */
+export async function downloadWechatMedia(client, cdnMedia, subdir, filename) {
+    if (filename.includes('/') || filename.includes('\\') || filename.includes('..')) {
+        throw new Error(`unsafe filename: ${filename}`);
+    }
+    const dir = resolve(MEDIA_ROOT, 'wechat', subdir);
+    const filePath = resolve(dir, filename);
+    if (!filePath.startsWith(`${MEDIA_ROOT}/`)) {
+        throw new Error(`destination escapes MEDIA_ROOT: ${filePath}`);
+    }
+    const buf = await client.downloadMedia(cdnMedia);
+    if (buf.length > MAX_BYTES) {
+        throw new Error(`payload exceeds ${MAX_BYTES} bytes (got ${buf.length})`);
+    }
+    await mkdir(dir, { recursive: true });
+    await writeFile(filePath, buf);
+    log.info({ event: 'wechat.media.downloaded', path: filePath, bytes: buf.length });
+    return { path: filePath, bytes: buf.length };
+}
+/**
+ * Pick a file extension based on the media item contents. Falls back to a
+ * generic extension when nothing more specific can be inferred.
+ */
+export function pickExtensionForImage(item) {
+    if (item.url) {
+        const m = /\.([a-z0-9]+)$/i.exec(item.url.split('?')[0]);
+        if (m)
+            return m[1].toLowerCase();
+    }
+    return 'jpg';
+}
+export function pickExtensionForVoice(item) {
+    if (item.encode_type === 6)
+        return 'silk';
+    return 'amr';
+}
+export function pickExtensionForFile(item) {
+    if (item.file_name) {
+        const m = /\.([a-z0-9]+)$/i.exec(item.file_name);
+        if (m)
+            return m[1].toLowerCase();
+    }
+    return 'bin';
+}
+export function pickExtensionForVideo(_item) {
+    return 'mp4';
+}
+/**
+ * Resolve the CDNMedia reference from a media item. Returns null when the
+ * item lacks the signed CDN URL or its AES key. The bot fetches
+ * `media.full_url` directly and decrypts with `media.aes_key` (no iLink-side
+ * download endpoint exists).
+ */
+export function extractCdnMedia(item) {
+    if (!item.media?.full_url || !item.media?.aes_key)
+        return null;
+    return item.media;
+}
+//# sourceMappingURL=media-download.js.map

package/dist/plugins/messengers/wechat/media-download.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-download.js","sourceRoot":"","sources":["../../../../src/plugins/messengers/wechat/media-download.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,+DAA+D;AAC/D,EAAE;AACF,6DAA6D;AAC7D,kEAAkE;AAElE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAA;AAIvD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAA;AAE3D,MAAM,CAAC,MAAM,UAAU,GAAW,OAAO,CACvC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CACzD,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAOzC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAmB,EACnB,QAAkB,EAClB,MAAc,EACd,QAAgB;IAEhB,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,EAAE,CAAC,CAAA;IACjD,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACvC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;IAChD,IAAI,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,eAAe,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACrC,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAE9B,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IACjF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAe;IACnD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACxD,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAClC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAe;IACnD,IAAI,IAAI,CAAC,WAAW,KAAK,CAAC;QAAE,OAAO,MAAM,CAAA;IACzC,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAc;IACjD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAChD,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAClC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAgB;IACpD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA0B;IAE1B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO;QAAE,OAAO,IAAI,CAAA;IAC9D,OAAO,IAAI,CAAC,KAAK,CAAA;AACnB,CAAC"}

package/dist/scripts/migrate-gcj02-to-wgs84.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=migrate-gcj02-to-wgs84.d.ts.map

package/dist/scripts/migrate-gcj02-to-wgs84.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-gcj02-to-wgs84.d.ts","sourceRoot":"","sources":["../../src/scripts/migrate-gcj02-to-wgs84.ts"],"names":[],"mappings":""}

package/dist/scripts/migrate-gcj02-to-wgs84.js

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+// One-shot migration: rewrite memo rows whose stored coords are actually
+// GCJ-02 (because they came from a Telegram pin or H5 navigator.geolocation
+// on an Apple/Google device in China — Apple/Google apply the offset before
+// the JS API returns).
+//
+// AFTER 2026-05-11 the ingestion paths now reverse the offset at write
+// time. This script is for the rows created BEFORE that fix lands.
+//
+// Usage:
+//   node dist/scripts/migrate-gcj02-to-wgs84.js [--dry-run]
+//
+// Safety:
+//   - Only rows with where_lat IS NOT NULL are touched.
+//   - Rows outside the China bbox are skipped (gcj02ToWgs84 no-ops there).
+//   - Run with --dry-run first to preview.
+import Database from 'better-sqlite3';
+import { join } from 'node:path';
+import { gcj02ToWgs84 } from '../core/memos.js';
+import { AGIM_HOME } from '../core/agim-paths.js';
+const DRY = process.argv.includes('--dry-run');
+const DB_FILE = process.env.IMHUB_MEMOS_DB || join(AGIM_HOME, 'memos.db');
+const db = new Database(DB_FILE);
+const rows = db.prepare('SELECT id, what, where_lat, where_lng FROM memos WHERE where_lat IS NOT NULL').all();
+console.log(`Loaded ${rows.length} memo rows with coords from ${DB_FILE}`);
+console.log(`Mode: ${DRY ? 'DRY-RUN' : 'WRITE'}`);
+console.log();
+const update = db.prepare('UPDATE memos SET where_lat = ?, where_lng = ?, updated_at = ? WHERE id = ?');
+const now = new Date(Date.now() + 8 * 3600_000).toISOString().slice(0, 19).replace('T', ' ');
+let touched = 0;
+let skipped = 0;
+for (const row of rows) {
+    const wgs = gcj02ToWgs84(row.where_lat, row.where_lng);
+    const latDiff = Math.abs(wgs.lat - row.where_lat);
+    const lngDiff = Math.abs(wgs.lng - row.where_lng);
+    if (latDiff < 1e-7 && lngDiff < 1e-7) {
+        console.log(`  #${row.id} [${row.what}]: no shift (out of China) — skipped`);
+        skipped++;
+        continue;
+    }
+    console.log(`  #${row.id} [${row.what}]: ${row.where_lat.toFixed(6)},${row.where_lng.toFixed(6)} → ${wgs.lat.toFixed(6)},${wgs.lng.toFixed(6)}`);
+    if (!DRY) {
+        update.run(wgs.lat, wgs.lng, now, row.id);
+    }
+    touched++;
+}
+console.log();
+console.log(`Touched: ${touched} | Skipped (out of China): ${skipped} | Total: ${rows.length}`);
+if (DRY)
+    console.log('Re-run without --dry-run to apply.');
+db.close();
+//# sourceMappingURL=migrate-gcj02-to-wgs84.js.map

package/dist/scripts/migrate-gcj02-to-wgs84.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-gcj02-to-wgs84.js","sourceRoot":"","sources":["../../src/scripts/migrate-gcj02-to-wgs84.ts"],"names":[],"mappings":";AACA,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,uBAAuB;AACvB,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,EAAE;AACF,SAAS;AACT,4DAA4D;AAC5D,EAAE;AACF,UAAU;AACV,wDAAwD;AACxD,2EAA2E;AAC3E,2CAA2C;AAE3C,OAAO,QAAQ,MAAM,gBAAgB,CAAA;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEjD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;AAEzE,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAA;AAChC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB,8EAA8E,CAC/E,CAAC,GAAG,EAA+E,CAAA;AAEpF,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,MAAM,+BAA+B,OAAO,EAAE,CAAC,CAAA;AAC1E,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;AACjD,OAAO,CAAC,GAAG,EAAE,CAAA;AAEb,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,4EAA4E,CAAC,CAAA;AACvG,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AAE5F,IAAI,OAAO,GAAG,CAAC,CAAA;AACf,IAAI,OAAO,GAAG,CAAC,CAAA;AACf,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,CAAA;IACjD,IAAI,OAAO,GAAG,IAAI,IAAI,OAAO,GAAG,IAAI,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,sCAAsC,CAAC,CAAA;QAC5E,OAAO,EAAE,CAAA;QACT,SAAQ;IACV,CAAC;IACD,OAAO,CAAC,GAAG,CACT,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CACpI,CAAA;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED,OAAO,CAAC,GAAG,EAAE,CAAA;AACb,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,8BAA8B,OAAO,aAAa,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;AAC/F,IAAI,GAAG;IAAE,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAA;AAC1D,EAAE,CAAC,KAAK,EAAE,CAAA"}

package/dist/utils/backoff.d.ts

@@ -0,0 +1,35 @@
+export interface BackoffOptions {
+    /** Initial delay in ms. Doubles each attempt up to capMs. Default 1000. */
+    baseMs?: number;
+    /** Maximum delay in ms before jitter. Default 60_000. */
+    capMs?: number;
+    /** Multiplicative jitter range in [0, 1]. The actual delay is sampled
+     *  uniformly from `[exp * (1 - jitter), exp * (1 + jitter)]`. Set to 0
+     *  for deterministic delays (testing). Default 0.5. */
+    jitter?: number;
+    /** Pluggable RNG for deterministic tests. Defaults to Math.random. */
+    random?: () => number;
+}
+export declare class Backoff {
+    private attempt;
+    private readonly baseMs;
+    private readonly capMs;
+    private readonly jitter;
+    private readonly random;
+    constructor(opts?: BackoffOptions);
+    /**
+     * Compute the next delay in ms and increment the attempt counter.
+     *
+     *   - First call:  ~baseMs (jittered)
+     *   - Each call doubles the unjittered exponent until it hits capMs
+     *   - Then every subsequent call returns ~capMs (jittered)
+     *
+     * Returns a non-negative integer.
+     */
+    nextDelayMs(): number;
+    /** Reset attempt counter — call after a successful operation. */
+    reset(): void;
+    /** Diagnostic: current attempt count without bumping. */
+    currentAttempt(): number;
+}
+//# sourceMappingURL=backoff.d.ts.map

package/dist/utils/backoff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backoff.d.ts","sourceRoot":"","sources":["../../src/utils/backoff.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;2DAEuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,MAAM,CAAA;CACtB;AAMD,qBAAa,OAAO;IAClB,OAAO,CAAC,OAAO,CAAI;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;gBAEzB,IAAI,GAAE,cAAmB;IAOrC;;;;;;;;OAQG;IACH,WAAW,IAAI,MAAM;IASrB,iEAAiE;IACjE,KAAK,IAAI,IAAI;IAIb,yDAAyD;IACzD,cAAc,IAAI,MAAM;CAGzB"}

package/dist/utils/backoff.js

@@ -0,0 +1,59 @@
+// Exponential backoff with jitter — used by IM adapter reconnect loops.
+//
+// Why: when an IM platform throws (auth revoked, network blip, server
+// outage) the adapter retries. With fixed delays we have three problems:
+//
+//   1. Auth revoked → infinite fast hammering of the IM API at the same
+//      cadence; with backoff the cadence relaxes to capMs.
+//   2. Multi-instance fleet recovering from a network event reconnects
+//      in lock-step at the same fixed delay — thundering herd hits the
+//      IM platform's load balancer; jitter spreads the storm.
+//   3. Flaky network → CPU spent in tight reconnect loop; longer waits
+//      between attempts dampen this.
+//
+// Used by:
+//   - telegram-adapter runPollingLoop (was fixed 2s/5s delays)
+//   - wechat ilink-adapter polling loop (had exp backoff but no jitter)
+const DEFAULT_BASE_MS = 1_000;
+const DEFAULT_CAP_MS = 60_000;
+const DEFAULT_JITTER = 0.5;
+export class Backoff {
+    attempt = 0;
+    baseMs;
+    capMs;
+    jitter;
+    random;
+    constructor(opts = {}) {
+        this.baseMs = Math.max(0, opts.baseMs ?? DEFAULT_BASE_MS);
+        this.capMs = Math.max(this.baseMs, opts.capMs ?? DEFAULT_CAP_MS);
+        this.jitter = Math.max(0, Math.min(1, opts.jitter ?? DEFAULT_JITTER));
+        this.random = opts.random ?? Math.random;
+    }
+    /**
+     * Compute the next delay in ms and increment the attempt counter.
+     *
+     *   - First call:  ~baseMs (jittered)
+     *   - Each call doubles the unjittered exponent until it hits capMs
+     *   - Then every subsequent call returns ~capMs (jittered)
+     *
+     * Returns a non-negative integer.
+     */
+    nextDelayMs() {
+        const exp = Math.min(this.capMs, this.baseMs * 2 ** this.attempt);
+        this.attempt += 1;
+        if (this.jitter === 0)
+            return Math.floor(exp);
+        // Multiplicative jitter: factor ∈ [1 - jitter, 1 + jitter]
+        const factor = 1 + (this.random() * 2 - 1) * this.jitter;
+        return Math.max(0, Math.floor(exp * factor));
+    }
+    /** Reset attempt counter — call after a successful operation. */
+    reset() {
+        this.attempt = 0;
+    }
+    /** Diagnostic: current attempt count without bumping. */
+    currentAttempt() {
+        return this.attempt;
+    }
+}
+//# sourceMappingURL=backoff.js.map

package/dist/utils/backoff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backoff.js","sourceRoot":"","sources":["../../src/utils/backoff.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,sEAAsE;AACtE,yEAAyE;AACzE,EAAE;AACF,wEAAwE;AACxE,2DAA2D;AAC3D,uEAAuE;AACvE,uEAAuE;AACvE,8DAA8D;AAC9D,uEAAuE;AACvE,qCAAqC;AACrC,EAAE;AACF,WAAW;AACX,+DAA+D;AAC/D,wEAAwE;AAexE,MAAM,eAAe,GAAG,KAAK,CAAA;AAC7B,MAAM,cAAc,GAAG,MAAM,CAAA;AAC7B,MAAM,cAAc,GAAG,GAAG,CAAA;AAE1B,MAAM,OAAO,OAAO;IACV,OAAO,GAAG,CAAC,CAAA;IACF,MAAM,CAAQ;IACd,KAAK,CAAQ;IACb,MAAM,CAAQ;IACd,MAAM,CAAc;IAErC,YAAY,OAAuB,EAAE;QACnC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,CAAA;QACzD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC,CAAA;QAChE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,CAAA;QACrE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAA;IAC1C,CAAC;IAED;;;;;;;;OAQG;IACH,WAAW;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAA;QACjE,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA;QACjB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC7C,2DAA2D;QAC3D,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAA;QACxD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAA;IAC9C,CAAC;IAED,iEAAiE;IACjE,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,CAAC,CAAA;IAClB,CAAC;IAED,yDAAyD;IACzD,cAAc;QACZ,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;CACF"}

package/dist/utils/cross-platform.d.ts

@@ -0,0 +1,26 @@
+import { type SpawnOptions, type ChildProcess } from 'node:child_process';
+export declare const isWindows: boolean;
+export declare const isMac: boolean;
+export declare const isLinux: boolean;
+/**
+ * Cross-platform spawn wrapper that automatically handles Windows compatibility.
+ * On Windows, it sets shell: true to enable command execution.
+ *
+ * Note: When using stdio: ['ignore', 'pipe', 'pipe'], stdout and stderr are guaranteed to be non-null.
+ */
+export declare function crossSpawn(command: string, args?: string[], options?: SpawnOptions): ChildProcess;
+/**
+ * Get Copilot CLI binary path based on the current platform.
+ * Copilot CLI is installed by VS Code extension in different locations per OS.
+ */
+export declare function getCopilotBinPath(): string;
+/**
+ * Check if a command exists in PATH.
+ * Uses 'where' on Windows, 'which' on Unix.
+ */
+export declare function commandExists(command: string): Promise<boolean>;
+/**
+ * Get the correct newline character for the current platform.
+ */
+export declare const EOL: string;
+//# sourceMappingURL=cross-platform.d.ts.map

package/dist/utils/cross-platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-platform.d.ts","sourceRoot":"","sources":["../../src/utils/cross-platform.ts"],"names":[],"mappings":"AAEA,OAAO,EAAS,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAIhF,eAAO,MAAM,SAAS,SAAyB,CAAA;AAC/C,eAAO,MAAM,KAAK,SAA0B,CAAA;AAC5C,eAAO,MAAM,OAAO,SAAyB,CAAA;AAE7C;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,MAAM,EAAO,EACnB,OAAO,GAAE,YAAiB,GACzB,YAAY,CAQd;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAuB1C;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO/D;AAED;;GAEG;AACH,eAAO,MAAM,GAAG,QAA4B,CAAA"}

package/dist/utils/cross-platform.js

@@ -0,0 +1,58 @@
+// Cross-platform utilities for Windows compatibility
+import { spawn } from 'node:child_process';
+import { platform, homedir } from 'node:os';
+import { join } from 'node:path';
+export const isWindows = platform() === 'win32';
+export const isMac = platform() === 'darwin';
+export const isLinux = platform() === 'linux';
+/**
+ * Cross-platform spawn wrapper that automatically handles Windows compatibility.
+ * On Windows, it sets shell: true to enable command execution.
+ *
+ * Note: When using stdio: ['ignore', 'pipe', 'pipe'], stdout and stderr are guaranteed to be non-null.
+ */
+export function crossSpawn(command, args = [], options = {}) {
+    const spawnOptions = {
+        ...options,
+        // On Windows, we need shell: true for commands like 'claude', 'opencode', etc.
+        // to be found in PATH and executed properly.
+        shell: isWindows ? (options.shell ?? true) : options.shell,
+    };
+    return spawn(command, args, spawnOptions);
+}
+/**
+ * Get Copilot CLI binary path based on the current platform.
+ * Copilot CLI is installed by VS Code extension in different locations per OS.
+ */
+export function getCopilotBinPath() {
+    if (isWindows) {
+        // Windows: VS Code extensions are in %USERPROFILE%\.vscode\extensions
+        // The copilot CLI should be in the global storage
+        return join(homedir(), '.vscode', 'extensions', 'github.copilot-chat-*/copilotCli/copilot.exe');
+    }
+    else if (isMac) {
+        // macOS
+        return join(homedir(), 'Library/Application Support/Code/User/globalStorage/github.copilot-chat/copilotCli/copilot');
+    }
+    else {
+        // Linux
+        return join(homedir(), '.vscode/extensions/github.copilot-chat/copilotCli/copilot');
+    }
+}
+/**
+ * Check if a command exists in PATH.
+ * Uses 'where' on Windows, 'which' on Unix.
+ */
+export function commandExists(command) {
+    return new Promise((resolve) => {
+        const checkCmd = isWindows ? 'where' : 'which';
+        const proc = crossSpawn(checkCmd, [command], { stdio: 'ignore' });
+        proc.on('close', (code) => resolve(code === 0));
+        proc.on('error', () => resolve(false));
+    });
+}
+/**
+ * Get the correct newline character for the current platform.
+ */
+export const EOL = isWindows ? '\r\n' : '\n';
+//# sourceMappingURL=cross-platform.js.map

package/dist/utils/cross-platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-platform.js","sourceRoot":"","sources":["../../src/utils/cross-platform.ts"],"names":[],"mappings":"AAAA,qDAAqD;AAErD,OAAO,EAAE,KAAK,EAAwC,MAAM,oBAAoB,CAAA;AAChF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,MAAM,CAAC,MAAM,SAAS,GAAG,QAAQ,EAAE,KAAK,OAAO,CAAA;AAC/C,MAAM,CAAC,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,QAAQ,CAAA;AAC5C,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,EAAE,KAAK,OAAO,CAAA;AAE7C;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,OAAe,EACf,OAAiB,EAAE,EACnB,UAAwB,EAAE;IAE1B,MAAM,YAAY,GAAiB;QACjC,GAAG,OAAO;QACV,+EAA+E;QAC/E,6CAA6C;QAC7C,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK;KAC3D,CAAA;IACD,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,CAAA;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,SAAS,EAAE,CAAC;QACd,sEAAsE;QACtE,kDAAkD;QAClD,OAAO,IAAI,CACT,OAAO,EAAE,EACT,SAAS,EACT,YAAY,EACZ,8CAA8C,CAC/C,CAAA;IACH,CAAC;SAAM,IAAI,KAAK,EAAE,CAAC;QACjB,QAAQ;QACR,OAAO,IAAI,CACT,OAAO,EAAE,EACT,4FAA4F,CAC7F,CAAA;IACH,CAAC;SAAM,CAAC;QACN,QAAQ;QACR,OAAO,IAAI,CACT,OAAO,EAAE,EACT,2DAA2D,CAC5D,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;QAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAA;QAC/C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA"}

package/dist/utils/message-split.d.ts

@@ -0,0 +1,14 @@
+export interface SplitOptions {
+    /** Maximum characters per chunk */
+    maxLength?: number;
+    /** Add continuation marker to split messages */
+    addContinuationMarker?: boolean;
+    /** Continuation marker text */
+    continuationMarker?: string;
+}
+/**
+ * Split a long message into chunks that fit within messenger limits.
+ * Tries to split at natural boundaries (code blocks, paragraphs, lines).
+ */
+export declare function splitMessage(text: string, options?: SplitOptions): string[];
+//# sourceMappingURL=message-split.d.ts.map

package/dist/utils/message-split.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-split.d.ts","sourceRoot":"","sources":["../../src/utils/message-split.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,YAAY;IAC3B,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,gDAAgD;IAChD,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,+BAA+B;IAC/B,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAmBD;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,YAAiB,GACzB,MAAM,EAAE,CAkDV"}

package/dist/utils/message-split.js

@@ -0,0 +1,65 @@
+// Shared message splitting utility
+// Used by WeChat, Telegram, and other messengers with character limits
+/**
+ * If `idx` falls between a UTF-16 surrogate pair, step back by 1 so the
+ * pair stays whole. JavaScript strings are UTF-16; characters in plane 1+
+ * (most emoji, e.g. 😀 U+1F600) are encoded as a high-surrogate +
+ * low-surrogate pair (2 code units). Slicing through the boundary yields
+ * an orphan surrogate that renders as `□` (or worse, breaks Telegram's
+ * HTML parser when the orphan happens to be inside a tag value).
+ *
+ * Returns the safe split point. Idempotent on already-safe boundaries.
+ */
+function safeSplitPoint(s, idx) {
+    if (idx <= 0 || idx >= s.length)
+        return idx;
+    const code = s.charCodeAt(idx - 1);
+    if (code >= 0xD800 && code <= 0xDBFF)
+        return idx - 1;
+    return idx;
+}
+/**
+ * Split a long message into chunks that fit within messenger limits.
+ * Tries to split at natural boundaries (code blocks, paragraphs, lines).
+ */
+export function splitMessage(text, options = {}) {
+    const { maxLength = 2000, addContinuationMarker = true, continuationMarker = '\n\n[continued...]', } = options;
+    if (text.length <= maxLength) {
+        return [text];
+    }
+    const chunks = [];
+    let remaining = text;
+    while (remaining.length > maxLength) {
+        // Try to split at code block boundary first
+        let splitPoint = remaining.lastIndexOf('\n```\n', maxLength);
+        if (splitPoint < maxLength / 2) {
+            // Try paragraph break
+            splitPoint = remaining.lastIndexOf('\n\n', maxLength);
+        }
+        if (splitPoint < maxLength / 2) {
+            // Try line break
+            splitPoint = remaining.lastIndexOf('\n', maxLength);
+        }
+        if (splitPoint < maxLength / 2) {
+            // Force split at maxLength
+            splitPoint = maxLength;
+        }
+        // M10: surrogate-pair safety. The natural-boundary searches land on
+        // ASCII bytes (newline, backtick) so they're already safe; the forced
+        // split at maxLength is the only path that could land mid-pair.
+        splitPoint = safeSplitPoint(remaining, splitPoint);
+        chunks.push(remaining.slice(0, splitPoint).trim());
+        remaining = remaining.slice(splitPoint).trim();
+    }
+    if (remaining) {
+        chunks.push(remaining);
+    }
+    // Add continuation markers
+    if (addContinuationMarker && chunks.length > 1) {
+        for (let i = 0; i < chunks.length - 1; i++) {
+            chunks[i] += continuationMarker;
+        }
+    }
+    return chunks;
+}
+//# sourceMappingURL=message-split.js.map

package/dist/utils/message-split.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-split.js","sourceRoot":"","sources":["../../src/utils/message-split.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,uEAAuE;AAWvE;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,CAAS,EAAE,GAAW;IAC5C,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,MAAM;QAAE,OAAO,GAAG,CAAA;IAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IAClC,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM;QAAE,OAAO,GAAG,GAAG,CAAC,CAAA;IACpD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,UAAwB,EAAE;IAE1B,MAAM,EACJ,SAAS,GAAG,IAAI,EAChB,qBAAqB,GAAG,IAAI,EAC5B,kBAAkB,GAAG,oBAAoB,GAC1C,GAAG,OAAO,CAAA;IAEX,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,CAAA;IACf,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,SAAS,GAAG,IAAI,CAAA;IAEpB,OAAO,SAAS,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QACpC,4CAA4C;QAC5C,IAAI,UAAU,GAAG,SAAS,CAAC,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QAC5D,IAAI,UAAU,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;YAC/B,sBAAsB;YACtB,UAAU,GAAG,SAAS,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QACvD,CAAC;QACD,IAAI,UAAU,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;YAC/B,iBAAiB;YACjB,UAAU,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QACrD,CAAC;QACD,IAAI,UAAU,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;YAC/B,2BAA2B;YAC3B,UAAU,GAAG,SAAS,CAAA;QACxB,CAAC;QACD,oEAAoE;QACpE,sEAAsE;QACtE,gEAAgE;QAChE,UAAU,GAAG,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;QAElD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAClD,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAA;IAChD,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACxB,CAAC;IAED,2BAA2B;IAC3B,IAAI,qBAAqB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAA;QACjC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/utils/safe-equal.d.ts

@@ -0,0 +1,2 @@
+export declare function safeEqual(a: string, b: string): boolean;
+//# sourceMappingURL=safe-equal.d.ts.map

package/dist/utils/safe-equal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-equal.d.ts","sourceRoot":"","sources":["../../src/utils/safe-equal.ts"],"names":[],"mappings":"AAKA,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAKvD"}

package/dist/utils/safe-equal.js

@@ -0,0 +1,11 @@
+// Constant-time string compare for auth-token comparison.
+// Returns false when lengths differ, otherwise defers to crypto.timingSafeEqual.
+import { timingSafeEqual } from 'node:crypto';
+export function safeEqual(a, b) {
+    const bufA = Buffer.from(a);
+    const bufB = Buffer.from(b);
+    if (bufA.length !== bufB.length)
+        return false;
+    return timingSafeEqual(bufA, bufB);
+}
+//# sourceMappingURL=safe-equal.js.map

package/dist/utils/safe-equal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-equal.js","sourceRoot":"","sources":["../../src/utils/safe-equal.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,iFAAiF;AAEjF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C,MAAM,UAAU,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAC7C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AACpC,CAAC"}