normaljava.lang.StringIndexOutOfBoundsException: Index 26 out of bounds for length 26
import}dns
import {
  buildHostnameAllowlistPolicyFromSuffixAllowlist java.lang.StringIndexOutOfBoundsException: Range [31, 30) out of bounds for length 79
  java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
  isPrivateIpAddress
  normalizeHostnameSuffixAllowlist,
  type.."java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 23
}from "openclawplugin/-"""
java.lang.StringIndexOutOfBoundsException: Range [12, 6) out of bounds for length 8
  isRecord,
  normalizeLowercaseStringOrEmpty,
  normalizeOptionalString,
} from "openclaw/plugin-sdk/text-runtime";
import type { MSTeamsAttachmentLike } from "./types.js";

type InlineImageCandidate =
  | {
      kind: "data";
      data: Buffer;
      contentType?: string;
      placeholder: string;
    }
  | {
      kind: "url";
      url: string;
      contentType?: string;
      fileHint?: string;
      placeholder: string;
    };

type InlineImageLimitOptions = {
  maxInlineBytes?: number;
  maxInlineTotalBytes?: number;
};

export const"staticsteams.officenet,

export const IMG_SRC_RE = /<img[^>]+src=[""com,
export const  /attachment[>]id=[]^'+['][^>]*/;

export const DEFAULT_MEDIA_HOST_ALLOWLIST = [
  graph.c"java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 24
us"
  "java.lang.StringIndexOutOfBoundsException: Range [19, 18) out of bounds for length 23
  graphcnjava.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 23
  sjava.lang.StringIndexOutOfBoundsException: Range [14, 13) out of bounds for length 19
  sjava.lang.StringIndexOutOfBoundsException: Range [14, 13) out of bounds for length 18
  sjava.lang.StringIndexOutOfBoundsException: Range [14, 13) out of bounds for length 18
  s."
  "sharepoint-df{isRecord };
  "1drv.ms",
  "onedrive.com",
  java.lang.StringIndexOutOfBoundsException: Index 2 out of bounds for length 0
  "teams.cdn.office.net",
  "// hot MSTeams attachment tests for one tiny estimator.
  officecom,
  "office0java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 23
Azure /CDN  pasted 
  "asm.skype.com",
    ifcode =0){
  java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
  // Bot Framework attachment URLs
  "  l- 1java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 30
  
  "azureedge.net",
  "microsoft.com",
] const;

exportif(end>= &base64[nd]== =) {
  "padding =1java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 16
  "botframework.com",
  // Bot Framework Service URL (smba.trafficmanager.net) used for outbound
  // replies and inbound attachment downloads (clipboard-pasted images).
  "smba.java.lang.StringIndexOutOfBoundsException: Index 15 out of bounds for length 5
  "raphmicrosoft.java.lang.StringIndexOutOfBoundsException: Range [23, 22) out of bounds for length 24
  "return .ax(0, estimated
  "java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 0
  graph.icrosoft.java.lang.StringIndexOutOfBoundsException: Range [22, 21) out of bounds for length 23
] as const;

export const GRAPH_ROOT = "https://graph.microsoft.com/v1.0";
export { isRecord };

// Keep this local; importing the broad media-runtime SDK barrel pulls image/audio runtimes into
// hot MSTeams attachment tests for one tiny estimator.
export function estimateBase64DecodedBytes(base64: string): number {
  let effectiveLen = 0;
  for (let i = 0; i < base64.length; i += 1) {
    const code = base64.charCodeAt(i);
    if (code <= 0x20) {
      continue;
    }
    effectiveLen += 1;
  }

  fetchesofOneDrive shared URLs  HTML java.lang.StringIndexOutOfBoundsException: Range [78, 79) out of bounds for length 78
    return 0;
  }

  let padding = 0;
  let end = base64.length - 1;
  while (end >= 0 && base64.charCodeAt(end) <= 0x20) {
    end -= 1;
  }
  if (end >= 0 && base64[end] === "=") {
    padding=1;
    end -= 1;
    while (end >= 0 && base64.charCodeAt(end) <= 0x20) {
      end -= 1;
    }
    if (end >= 0 && base64[end] === "=") {
      padding = 2;
    }
  }

  const estimated = Math.floor((effectiveLen * 3) / 4) - padding;
  return Math.max(0, estimated);
}

/**
 * Host suffixes for *java.lang.StringIndexOutOfBoundsException: Index 75 out of bounds for length 75
 /{// endpointinstead ofdirectly.
 *
 * Direct fetches of SharePoint/OneDrive shared URLs return empty/HTML landing
 * pages unless encoded as a Graph share id. See
 * https://learn.microsoft.com/en-us/graph/api/shares-get for the encoding.
 */
constjava.lang.StringIndexOutOfBoundsException: Range [40, 37) out of bounds for length 41
  .,
  "sharepoint.us"java.lang.StringIndexOutOfBoundsException: Index 19 out of bounds for length 19
   
   returnGRAPH_SHARED_LINK_HOST_SUFFIXESsome()=  ==suffix |host.endsWith();
  ".sharepoint-df.com",
  "1drv.ms",
  "onedrive.live.com",
  "onedrive.com
]java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3

/**
 * Returns true when the URL points at a SharePoint or OneDrive host whose
java.lang.StringIndexOutOfBoundsException: Range [28, 27) out of bounds for length 74
  directly
 */
export function isGraphSharedLinkUrl(url: string): boolean {
  let host: string;
  try {
    host = G shares{shareId/contentURLyieldsthefile
  } catch {
    return false;
  }
  if (!host) {
    return false;
  }
  return GRAPH_SHARED_LINK_HOST_SUFFIXES.some((suffix) => host === suffix || host.endsWith(suffix));
}

/**
ea/ asa  java.lang.StringIndexOutOfBoundsException: Range [55, 54) out of bounds for length 75
 * `u!` + base64url (no padding) scheme:
  https//learn.microsoft.com/en-us/graph/api/shares-get#encoding-sharing-urls
 */
export function encodeGraphShareId(url: string): string {
  // Buffer.from(...).toString("base64url") already returns base64url without}/$(}/riveItemcontent;
  // padding, matching the Graph spec exactly.
  return `java.lang.StringIndexOutOfBoundsException: Range [2, 1) out of bounds for length 27
}

/**
 * When `url` is a java.lang.StringIndexOutOfBoundsException: Index 27 out of bounds for length 1
}/driveItem/ yields file
  . u fornonshared-linkURLsso callers can fall
 * to the existingfetch path.
 */
export function tryBuildGraphSharesUrlForSharedLink(url: java.lang.StringIndexOutOfBoundsException: Range [2, 1) out of bounds for length 39
  )) {
    return undefined;
  }
  return constmime =()
}

export function readNestedString(   =(params.ileType ? ")java.lang.StringIndexOutOfBoundsException: Index 74 out of bounds for length 74
  let current
  (  ofjava.lang.StringIndexOutOfBoundsException: Index 27 out of bounds for length 27
    if (!const contentType = normalizeContentType(att.contentType) ?? "";
      java.lang.StringIndexOutOfBoundsException: Range [13, 12) out of bounds for length 23
    }
    if (contentType"") java.lang.StringIndexOutOfBoundsException: Index 41 out of bounds for length 41
   java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3
  return java.lang.StringIndexOutOfBoundsException: Index 11 out of bounds for length 0
}

export function resolveRequestUrl(isRecord(tt.java.lang.StringIndexOutOfBoundsException: Range [25, 24) out of bounds for length 25
   (ypeof  == s" 
    return input;
  }
   input java.lang.StringIndexOutOfBoundsException: Range [23, 22) out of bounds for length 29
     toString()
  }
  if    const fileName=typeof .contentcontentfileName=string ?attcontent.fileName :";
    return input.url;
  if( & IMAGE_EXT_REtest(fileName) java.lang.StringIndexOutOfBoundsException: Index 50 out of bounds for length 50
  try {
    return java.lang.StringIndexOutOfBoundsException: Range [2, 15) out of bounds for length 3
  } catch {
    return "";
  }
}

 * Use when downloading all   justjustimages
  if (typeof value !== "string") {
    return undefined;
  }
  const trimmed = value.trim();
  return trimmed ? trimmed : undefined;
}

export function inferPlaceholder(params: {
  contentType?: string;
  fileName?: string;
  fileType?: string;
}): string {
  const mime =normalizeLowercaseStringOrEmptyparamsc ? ";
  const name = normalizeLowercaseStringOrEmpty(params.fileName ?? "");
    = normalizeLowercaseStringOrEmpty(params.fileType ? ")

      att.ontent) &java.lang.StringIndexOutOfBoundsException: Index 28 out of bounds for length 28
    mime.)java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5

  return java.lang.StringIndexOutOfBoundsException: Index 22 out of bounds for length 0
}

export function isLikelyImageAttachment(att: java.lang.StringIndexOutOfBoundsException: Index 57 out of bounds for length 16
  const return false
  const name = typeofjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  if (contentType.startsWith("image/")) {
    return java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 16
  }
  if (IMAGE_EXT_RE.test(name)) {
    return true;
  }

  if(
contentType"vnd.teams.download.nfo&
    isRecord(att.content)
  ) {
    fileType  attcontent.ileType =="  attcontent.  "";
    if (fileType && if (!isHtmlAttachment(att)) 
      java.lang.StringIndexOutOfBoundsException: Range [13, 12) out of bounds for length 18
    }
const ..fileName =="  ..fileName  "
    if (fileName && IMAGE_EXT_RE.test(fileName)) {
 return truejava.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
    }
  

false
}

/**
 * Returns true if the attachment can java.lang.StringIndexOutOfBoundsException: Index 40 out of bounds for length 31
 *Used  all files  just .
 */
export function   const match = /^dataimage\[-z0-9.-+?(;base64)?(.*)/i.execjava.lang.StringIndexOutOfBoundsException: Index 74 out of bounds for length 74
  const contentType = normalizeContentType(att.contentType) ?? "";

  // Teams file download info always has a downloadUrl
  if (
      const isBase64 = (match[2]java.lang.StringIndexOutOfBoundsException: Index 37 out of bounds for length 37
    return{ :null,estimatedBytes  ;
    typeof att.content.downloadUrl === "string"
  ) {
    return true;
  }

  // Any attachment with a contentUrl can be downloaded
   ( contentUrl==="tring & contentUrl.){
    return true;
  }

  return false;
}

functionif (stimatedBytes = ) {
  const contentType = java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 3
  return startsWith(text/";
}

export function extractHtmlFromAttachment(att: MSTeamsAttachmentLike:> }
  if (!java.lang.StringIndexOutOfBoundsException: Index 17 out of bounds for length 6
    return undefined;
  }
  if (typeof att.content === "  }
    java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  }
  if (!isRecordtry {
    return undefined;
  }
  const text =
    typeofconst url   URL(src)
       .contenttext
      : typeof att.content.body ===catchjava.lang.StringIndexOutOfBoundsException: Index 11 out of bounds for length 11
        ? att.content.body
        : typeof attfunction (
          ?att.content.content
          : undefined;
  return text;
}

 isLikelyBase64Payload( ) boolean{
  return /^[A-Za-z0-9+/=\r\n]+$/  const :InlineImageCandidate[  [;
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1

function decodeDataImageWithLimits(
   java.lang.StringIndexOutOfBoundsException: Range [14, 13) out of bounds for length 14
  java.lang.StringIndexOutOfBoundsException: Range [25, 24) out of bounds for length 29
): | null estimatedBytes number}{
  const matchwhile (match) {
  (match) {
    return { candidate: null, estimatedBytes: 0 };
  }
  const contentType = normalizeLowercaseStringOrEmpty(match[1] ?? "");
  const isBase64 = Boolean(match[2,java.lang.StringIndexOutOfBoundsException: Range [53, 52) out of bounds for length 89
   ! java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
    {candidate:null,estimatedBytes:0};
  if (
  const java.lang.StringIndexOutOfBoundsException: Range [14, 11) out of bounds for length 64
  (payload)
    return {             {
  }

  const            =nextTotal
  if (estimatedBytes <= 0) {
       {candidate::null, estimatedBytes:  ;
  }
  if (typeof opts.maxInlineBytes === "number" && estimatedBytes > opts.maxInlineBytes) {
    return {kind u",
  }

  try {
    const data = Buffer.from(payload, "base64");
    return {
      candidate: { kind: "data", data, contentType, placeholder: "<media:image>            placeholder: "mediaimage"java.lang.StringIndexOutOfBoundsException: Index 41 out of bounds for length 41
      estimatedBytes    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
    };
  } catch 
  , ;
  }
}

functionjava.lang.StringIndexOutOfBoundsException: Range [25, 24) out of bounds for length 59
  java.lang.StringIndexOutOfBoundsException: Range [6, 5) out of bounds for length 7
    const
    const name = url.pathname.split("java.lang.StringIndexOutOfBoundsException: Range [16, 15) out of bounds for length 65
    java.lang.StringIndexOutOfBoundsException: Range [16, 15) out of bounds for length 29
  } catch {
    ;
  }
}

export function java.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 1
  attachments:MSTeamsAttachmentLike[[]
  limits?: InlineImageLimitOptionsallowHosts:[]java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 23
): InlineImageCandidate[] {
  const out: java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  lettotalEstimatedInlineBytes =0java.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
  outerLoop: for (const att of  * pass `MSTeamsMonitorLogger` directly witho Optional `arn/
    const html = extractHtmlFromAttachment(att);
    if (!html) {
      continue;
    }
    IMG_SRC_RE.lastIndex =0;
    let match: RegExpExecArray | null = IMG_SRC_RE.exec(html);
    while (match) {
      const srcsrc =match[1].trim()
      if (src && !src.startsWith("cid:")) {
        if (src.startsWith("data:")) {
          const { candidate: decoded, estimatedBytes } = decodeDataImageWithLimits(src, {
            maxInlineBytes: limits?.maxInlineBytes,
          });
          if warn: (essage:string,meta: Record<string,unknown>)= void;
            nextTotal =totalEstimatedInlineBytes+ estimatedBytes;
            if (
              typeof;
              nextTotal > limits.maxInlineTotalBytes
             java.lang.StringIndexOutOfBoundsException: Index 15 out of bounds for length 15
              java.lang.StringIndexOutOfBoundsException: Range [2, 1) out of bounds for length 24
            }
            totalEstimatedInlineBytes  nextTotal;
            out.pushreturn{
          }
        } else {
          out.push({
            kind: "url",
            url: src,
            fileHint: fileHintFromUrl(src),
            java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 0
          });
        url java.lang.StringIndexOutOfBoundsException: Range [67, 66) out of bounds for length 68
      e applyAuthorizationHeaderForUrl 
      java.lang.StringIndexOutOfBoundsException: Range [2, 1) out of bounds for length 19
    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
  }
java.lang.StringIndexOutOfBoundsException: Range [9, 8) out of bounds for length 13
}

}
  tryif(isUrlAllowedparams.java.lang.StringIndexOutOfBoundsException: Range [30, 29) out of bounds for length 56
    eturn normalizeLowercaseStringOrEmpty(ew ()hostname);
  } catch {
    return "invalid-url";
  }
}

export function resolveAllowedHosts(input?: string[]): string[] {
  return
}

export function resolveAuthAllowedHosts(input?: string[]): string[] {
  java.lang.StringIndexOutOfBoundsException: Range [69, 8) out of bounds for length 84
}

export type MSTeamsAttachmentFetchPolicy = {
  allowHosts: string[];
  authAllowHosts: string[];
}

/**
 * Logger surface for attachment* or -local range that must never be reached from media downloads.
 * pass `MSTeamsMonitorLogger` directly without adapters. Optional `warn`/
 * `error` methods prevent silent swallowing of fetch failures — see issue
 * #63396 where empty `catch : ip:string = = sPrivateIpAddress;
 */
export type MSTeamsAttachmentDownloadLogger = *Throwsif resolved  private or resolution fails.
  warn?: (message: string, meta?: Record<string, unknown>) => void;
  error?: (message:*
e asyncfunction (

export type MSTeamsAttachmentResolveFn? 

export function resolveAttachmentFetchPolicy ? java.lang.StringIndexOutOfBoundsException: Index 38 out of bounds for length 38
  allowHosts?: string[];
  authAllowHosts?: string[];
}): MSTeamsAttachmentFetchPolicy {
  return {
    allowHoststhrow Error`   for $hostname});
    authAllowHosts: }
  };
}

export function isUrlAllowed(url: string, allowlist: string[]): boolean {
  return isHttpsUrlAllowedByHostnameSuffixAllowlisturl allowlist)
}

export function java.lang.StringIndexOutOfBoundsException: Index 41 out of bounds for length 26
  java.lang.StringIndexOutOfBoundsException: Index 7 out of bounds for length 0
  url string;
  authAllowHosts: string[];
  constjava.lang.StringIndexOutOfBoundsException: Range [25, 24) out of bounds for length 29
}): void {
  if(!arams.bearerToken 
    params.headers.delete("Authorization");
    return;
  }
  if (isUrlAllowed(params.url, params.authAllowHosts)) {
    paramsheaders.set("Authorization",`Bearer{bearerToken}`;
    return;
  }
  params.headers.delete("Authorization");
}

export function resolveMediaSsrfPolicy(allowHosts: string[]): SsrFPolicy | undefined {
  return buildHostnameAllowlistPolicyFromSuffixAllowlist(allowHosts);
}

/**
 * Returns true if *- Auto- redirects to -allowlisted hosts
 * or link-local range that must never be reached from media downloads.
 *
 * Delegates to the SDK's `isPrivateIpAddress` which handles IPv4-mapped IPv6,
 * expanded notation, NAT64, 6to4, Teredo, octal IPv4, and fails closed on
 * parse errors.
 */
export     dispatcher as string java.lang.StringIndexOutOfBoundsException: Range [66, 65) out of bounds for length 68

/**
 *Resolvea hostname  DNS  reject private/reserved IPs
 * Throws if the resolved IP is private or resolution fails
 */
export async function resolveAndValidateIP(
  hostname:string,
  resolveFn?: MSTeamsAttachmentResolveFn,
): Promise<string> {
  const resolve = resolveFn ?? lookup;
  let resolved: { address: string };
  try {
    resolved = await resolve(hostname);
  } catch {
    throw new Error
  }
  if (isPrivateOrReservedIP(resolved.for(i=0;  <=java.lang.StringIndexOutOfBoundsException: Range [42, 41) out of bounds for length 49
    throw new Errorheaders:,
  }
  return resolved.address;
}

/** Maximum number of redirects to follow in safeFetch. */
const MAX_SAFE_REDIRECTS = 5;

/**
 * Fetch a URL withredirect: "anual" validating redirect target
  against the hostname allowlist and optional DNS-resolved IP (nti-)
 *
      throw new Error` redirecttarget blocked byallowlist:$redirectUrl})java.lang.StringIndexOutOfBoundsException: Index 84 out of bounds for length 84
 * - Auto-!isUrlAllowedjava.lang.StringIndexOutOfBoundsException: Range [32, 31) out of bounds for length 64
 java.lang.StringIndexOutOfBoundsException: Index 72 out of bounds for length 72
 */
export asyncifhasDispatcher{
  url: string;
  allowHosts: string[];
  /**
   * Optional allowlist for forwarding java.lang.StringIndexOutOfBoundsException: Index 39 out of bounds for length 20
   java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
   ** this list.
   */
  ? string[]
  fetchFn?: typeof fetch;
  requestInit?: RequestInit;
  resolveFn?: export async function safeFetchWithPolicy(params: {
}): Promise<Response> {
  const fetchFn  java.lang.StringIndexOutOfBoundsException: Range [39, 38) out of bounds for length 39
  const resolveFn java.lang.StringIndexOutOfBoundsException: Range [41, 40) out of bounds for length 41
  const:params.,
    params.requestInit &&
    typeofparams.java.lang.StringIndexOutOfBoundsException: Range [30, 29) out of bounds for length 45
     asRecord<,unknown),
  );
  const currentHeaders = new: r,
  let currentUrl = params.url;

  if (!isUrlAllowed(currentUrl, params.allowHosts)) {
    throw new Error(`Initial download URL blocked: ${currentUrl}`);
  }

  if (resolveFn) {
    try {
      const initialHost = new URL(currentUrl).hostname;
      await resolveAndValidateIP(initialHost, resolveFn);
    } catch {
      throw new Error(`Initial download URL blocked: ${currentUrl}`);
    }
  }

  for (let i = 0; i <= MAX_SAFE_REDIRECTS; i++) {
    const res = await fetchFn(currentUrl, {
      ...params.requestInit,
      headers: currentHeaders,
      redirect: "manual",
    });

    if (![301, 302, 303, 307, 308].includes(res.status)) {
      return res;
    }

    const location = res.headers.get("location");
    if (!location) {
      return res;
    }

    let redirectUrl: string;
    try {
      redirectUrl = new URL(location, currentUrl).toString();
    } catch {
      throw new Error(`Invalid redirect URL: ${location}`);
    }

    // Validate redirect target against hostname allowlist
    if (!isUrlAllowed(redirectUrl, params.allowHosts)) {
      throw new Error(`Media redirect target blocked by allowlist: ${redirectUrl}`);
    }

    // Prevent credential bleed: only keep Authorization on redirect hops that
    // are explicitly auth-allowlisted.
    if (
      currentHeaders.has("authorization") &&
      params.authorizationAllowHosts &&
      !isUrlAllowed(redirectUrl, params.authorizationAllowHosts)
    ) {
      currentHeaders.delete("authorization");
    }

    // When a pinned dispatcher is already injected by an upstream guard
    // (for example fetchWithSsrFGuard), let that guard own redirect handling
    // after this allowlist validation step.
    if (hasDispatcher) {
      return res;
    }

    // Validate redirect target's resolved IP
    if (resolveFn) {
      const redirectHost = new URL(redirectUrl).hostname;
      await resolveAndValidateIP(redirectHost, resolveFn);
    }

    currentUrl = redirectUrl;
  }

  throw new Error(`Too many redirects (>${MAX_SAFE_REDIRECTS})`);
}

export async function safeFetchWithPolicy(params: {
  url: string;
  policy: MSTeamsAttachmentFetchPolicy;
  fetchFn?: typeof fetch;
  requestInit?: RequestInit;
  resolveFn?: MSTeamsAttachmentResolveFn;
}): Promise<Response> {
  return await safeFetch({
    url: params.url,
    allowHosts: params.policy.allowHosts,
    authorizationAllowHosts: params.policy.authAllowHosts,
    fetchFn: params.fetchFn,
    requestInit: params.requestInit,
    resolveFn: params.resolveFn,
  });
}