@agent-team-foundation/first-tree-hub 0.6.1 → 0.6.3

package/dist/feishu-BoMJHlOv.mjs

@@ -0,0 +1,832 @@
+import { t as __exportAll } from "./rolldown-runtime-twds-ZHy.mjs";
+import { z } from "zod";
+//#region ../shared/dist/index.mjs
+const adapterPlatformSchema = z.enum([
+	"feishu",
+	"slack",
+	"kael"
+]);
+const adapterStatusSchema = z.enum(["active", "inactive"]);
+const createAdapterConfigSchema = z.object({
+	platform: adapterPlatformSchema,
+	agentId: z.string().min(1),
+	credentials: z.record(z.string(), z.unknown()),
+	status: adapterStatusSchema.default("active")
+});
+const updateAdapterConfigSchema = z.object({
+	agentId: z.string().min(1).optional(),
+	credentials: z.record(z.string(), z.unknown()).optional(),
+	status: adapterStatusSchema.optional()
+});
+z.object({
+	id: z.number(),
+	platform: z.string(),
+	agentId: z.string(),
+	hasCredentials: z.boolean(),
+	status: z.string(),
+	createdAt: z.string(),
+	updatedAt: z.string()
+});
+const adapterBindMethodSchema = z.enum([
+	"code",
+	"reverse_token",
+	"oauth",
+	"manual"
+]);
+const selfServiceFeishuBotSchema = z.object({
+	appId: z.string().min(1),
+	appSecret: z.string().min(1)
+});
+const createAdapterMappingSchema = z.object({
+	platform: adapterPlatformSchema,
+	externalUserId: z.string().min(1),
+	agentId: z.string().min(1),
+	boundVia: adapterBindMethodSchema.default("manual"),
+	displayName: z.string().max(200).optional()
+});
+z.object({
+	id: z.number(),
+	platform: z.string(),
+	externalUserId: z.string(),
+	agentId: z.string(),
+	boundVia: z.string().nullable(),
+	displayName: z.string().nullable(),
+	createdAt: z.string()
+});
+const delegateFeishuUserSchema = z.object({
+	feishuUserId: z.string().min(1),
+	displayName: z.string().max(200).optional()
+});
+z.object({
+	configId: z.number(),
+	platform: z.string(),
+	agentId: z.string(),
+	appId: z.string(),
+	connected: z.boolean(),
+	lastActiveAt: z.string().nullable()
+});
+const presenceStatusSchema = z.enum(["online", "offline"]);
+const runtimeStateSchema = z.enum([
+	"idle",
+	"working",
+	"blocked",
+	"error"
+]);
+const sessionStateSchema = z.enum([
+	"active",
+	"suspended",
+	"evicted"
+]);
+const sessionStateMessageSchema = z.object({
+	chatId: z.string().min(1),
+	state: sessionStateSchema
+});
+/** Client-reported runtime state override (client → server, per-agent). */
+const runtimeStateMessageSchema = z.object({ runtimeState: runtimeStateSchema });
+const agentBindRequestSchema = z.object({
+	agentId: z.string().min(1),
+	runtimeType: z.string().max(50),
+	runtimeVersion: z.string().max(50).optional()
+});
+const AGENT_BIND_REJECT_REASONS = {
+	WRONG_CLIENT: "wrong_client",
+	NOT_OWNED: "not_owned",
+	AGENT_SUSPENDED: "agent_suspended",
+	WRONG_ORG: "wrong_org",
+	UNKNOWN_AGENT: "unknown_agent"
+};
+z.enum([
+	"wrong_client",
+	"not_owned",
+	"agent_suspended",
+	"wrong_org",
+	"unknown_agent"
+]);
+/** Header used on agent-scoped HTTP calls to select which managed agent the JWT acts as. */
+const AGENT_SELECTOR_HEADER = "x-agent-id";
+z.object({
+	agentId: z.string(),
+	status: presenceStatusSchema,
+	connectedAt: z.string().nullable(),
+	lastSeenAt: z.string(),
+	clientId: z.string().nullable().optional(),
+	runtimeType: z.string().nullable().optional(),
+	runtimeVersion: z.string().nullable().optional(),
+	runtimeState: runtimeStateSchema.nullable().optional(),
+	activeSessions: z.number().int().nullable().optional(),
+	totalSessions: z.number().int().nullable().optional(),
+	runtimeUpdatedAt: z.string().nullable().optional()
+});
+z.object({
+	total: z.number().int(),
+	running: z.number().int(),
+	byState: z.object({
+		idle: z.number().int(),
+		working: z.number().int(),
+		blocked: z.number().int(),
+		error: z.number().int()
+	}),
+	clients: z.number().int()
+});
+const AGENT_TYPES = {
+	HUMAN: "human",
+	PERSONAL_ASSISTANT: "personal_assistant",
+	AUTONOMOUS_AGENT: "autonomous_agent"
+};
+const agentTypeSchema = z.enum([
+	"human",
+	"personal_assistant",
+	"autonomous_agent"
+]);
+const AGENT_VISIBILITY = {
+	PRIVATE: "private",
+	ORGANIZATION: "organization"
+};
+const agentVisibilitySchema = z.enum(["private", "organization"]);
+const AGENT_STATUSES = {
+	ACTIVE: "active",
+	SUSPENDED: "suspended",
+	DELETED: "deleted"
+};
+const AGENT_SOURCES = {
+	ADMIN_API: "admin-api",
+	PORTAL: "portal"
+};
+const agentSourceSchema = z.enum(["admin-api", "portal"]);
+z.enum(["active", "suspended"]);
+const createAgentSchema = z.object({
+	name: z.string().min(1).max(100).regex(/^[a-z0-9_-]+$/, "Only lowercase alphanumeric, hyphens, and underscores").optional(),
+	type: agentTypeSchema,
+	displayName: z.string().max(200).optional(),
+	delegateMention: z.string().max(100).optional(),
+	organizationId: z.string().max(100).optional(),
+	source: agentSourceSchema.optional(),
+	visibility: agentVisibilitySchema.optional(),
+	metadata: z.record(z.string(), z.unknown()).optional(),
+	managerId: z.string().optional(),
+	clientId: z.string().min(1).max(100).optional()
+});
+const updateAgentSchema = z.object({
+	type: agentTypeSchema.optional(),
+	displayName: z.string().max(200).nullable().optional(),
+	delegateMention: z.string().max(100).nullable().optional(),
+	visibility: agentVisibilitySchema.optional(),
+	metadata: z.record(z.string(), z.unknown()).optional(),
+	managerId: z.string().nullable().optional(),
+	clientId: z.string().min(1).max(100).nullable().optional()
+});
+z.object({
+	uuid: z.string(),
+	name: z.string().nullable(),
+	organizationId: z.string(),
+	type: agentTypeSchema,
+	displayName: z.string().nullable(),
+	delegateMention: z.string().nullable(),
+	inboxId: z.string(),
+	status: z.string(),
+	source: z.string().nullable().optional(),
+	cloudUserId: z.string().nullable().optional(),
+	visibility: agentVisibilitySchema,
+	metadata: z.record(z.string(), z.unknown()),
+	managerId: z.string().nullable(),
+	clientId: z.string().nullable(),
+	presenceStatus: presenceStatusSchema.optional(),
+	createdAt: z.string(),
+	updatedAt: z.string()
+});
+z.object({
+	repo: z.string().nullable(),
+	branch: z.string().nullable()
+});
+/**
+* Agent runtime configuration — M1 (Claude Code only).
+*
+* Defines the 5 user-tunable field groups that the Hub centrally manages
+* and pushes down to the client runtime: prompt append, model, MCP servers,
+* env vars, and Git repos.
+*
+* NOTE: do not co-locate with `packages/shared/src/config/` — that namespace
+* is reserved for the local YAML config (`agent.yaml` / server / client) and
+* is unrelated to the Hub-managed runtime config defined here.
+*/
+const PROMPT_APPEND_MAX_LENGTH = 32e3;
+const MCP_NAME_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
+const ENV_KEY_PATTERN = /^[A-Z][A-Z0-9_]*$/;
+const promptConfigSchema = z.object({ append: z.string().max(PROMPT_APPEND_MAX_LENGTH).default("") });
+const mcpStdioServerSchema = z.object({
+	name: z.string().regex(MCP_NAME_PATTERN, "MCP name must match /^[a-z0-9][a-z0-9_-]{0,63}$/i"),
+	transport: z.literal("stdio"),
+	command: z.string().min(1),
+	args: z.array(z.string()).optional()
+});
+const mcpHttpServerSchema = z.object({
+	name: z.string().regex(MCP_NAME_PATTERN, "MCP name must match /^[a-z0-9][a-z0-9_-]{0,63}$/i"),
+	transport: z.literal("http"),
+	url: z.string().url(),
+	headers: z.record(z.string(), z.string()).optional()
+});
+const mcpSseServerSchema = z.object({
+	name: z.string().regex(MCP_NAME_PATTERN, "MCP name must match /^[a-z0-9][a-z0-9_-]{0,63}$/i"),
+	transport: z.literal("sse"),
+	url: z.string().url(),
+	headers: z.record(z.string(), z.string()).optional()
+});
+const mcpServerSchema = z.discriminatedUnion("transport", [
+	mcpStdioServerSchema,
+	mcpHttpServerSchema,
+	mcpSseServerSchema
+]);
+const envEntrySchema = z.object({
+	key: z.string().regex(ENV_KEY_PATTERN, "Env key must match /^[A-Z][A-Z0-9_]*$/"),
+	value: z.string(),
+	sensitive: z.boolean().default(false)
+});
+const gitRepoSchema = z.object({
+	url: z.string().min(1),
+	ref: z.string().min(1).optional(),
+	localPath: z.string().min(1).optional()
+});
+/**
+* Base shape (no refinements) — used for `.partial()` derivations such as the
+* PATCH payload schema. Zod 4 forbids `.partial()` on a refined object, so we
+* keep refinements on a separate full schema below.
+*/
+const agentRuntimeConfigPayloadShape = z.object({
+	prompt: promptConfigSchema.default({ append: "" }),
+	model: z.string().default(""),
+	mcpServers: z.array(mcpServerSchema).default([]),
+	env: z.array(envEntrySchema).default([]),
+	gitRepos: z.array(gitRepoSchema).default([])
+});
+const payloadDuplicatesRefinement = (payload, ctx) => {
+	const seenMcp = /* @__PURE__ */ new Set();
+	payload.mcpServers.forEach((server, idx) => {
+		const lower = server.name.toLowerCase();
+		if (seenMcp.has(lower)) ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			path: [
+				"mcpServers",
+				idx,
+				"name"
+			],
+			message: `Duplicate MCP server name "${server.name}"`
+		});
+		seenMcp.add(lower);
+	});
+	const seenEnv = /* @__PURE__ */ new Set();
+	payload.env.forEach((entry, idx) => {
+		if (seenEnv.has(entry.key)) ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			path: [
+				"env",
+				idx,
+				"key"
+			],
+			message: `Duplicate env key "${entry.key}"`
+		});
+		seenEnv.add(entry.key);
+	});
+	const seenPaths = /* @__PURE__ */ new Set();
+	payload.gitRepos.forEach((repo, idx) => {
+		const path = repo.localPath ?? deriveRepoLocalPath(repo.url);
+		if (!path) return;
+		if (seenPaths.has(path)) ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			path: [
+				"gitRepos",
+				idx,
+				"localPath"
+			],
+			message: `Duplicate git repo local path "${path}"`
+		});
+		seenPaths.add(path);
+	});
+};
+const agentRuntimeConfigPayloadSchema = agentRuntimeConfigPayloadShape.superRefine(payloadDuplicatesRefinement);
+/** Default payload used when creating a fresh agent. */
+const DEFAULT_AGENT_RUNTIME_CONFIG_PAYLOAD = {
+	prompt: { append: "" },
+	model: "",
+	mcpServers: [],
+	env: [],
+	gitRepos: []
+};
+const agentRuntimeConfigSchema = z.object({
+	agentId: z.string(),
+	version: z.number().int().positive(),
+	payload: agentRuntimeConfigPayloadSchema,
+	updatedAt: z.string(),
+	updatedBy: z.string()
+});
+/**
+* Patch payload for PATCH /api/v1/admin/agents/:uuid/config.
+*
+* - `expectedVersion` enforces optimistic locking; mismatch → 409.
+* - All payload fields are optional; omitted fields are left untouched.
+*/
+const updateAgentRuntimeConfigSchema = z.object({
+	expectedVersion: z.number().int().positive(),
+	payload: agentRuntimeConfigPayloadShape.partial()
+});
+const dryRunAgentRuntimeConfigSchema = z.object({ payload: agentRuntimeConfigPayloadShape.partial() });
+z.object({
+	current: agentRuntimeConfigSchema,
+	next: agentRuntimeConfigPayloadSchema,
+	diff: z.array(z.object({
+		path: z.string(),
+		op: z.enum([
+			"add",
+			"remove",
+			"replace"
+		]),
+		before: z.unknown().optional(),
+		after: z.unknown().optional()
+	}))
+});
+/** Mask of a previously-stored sensitive value when echoing back to admin. */
+function isRedactedEnvValue(value) {
+	return value === "***";
+}
+/**
+* Derive a default local path from a repo URL.
+* Used both for validation (duplicate detection) and at runtime when the user
+* leaves `localPath` empty.
+*/
+function deriveRepoLocalPath(url) {
+	const trimmed = url.trim();
+	if (!trimmed) return "";
+	return ((trimmed.split(/[?#]/)[0] ?? "").split(/[/:]/).filter(Boolean).pop() ?? "").replace(/\.git$/i, "");
+}
+const loginSchema = z.object({
+	username: z.string().min(1),
+	password: z.string().min(1)
+});
+z.object({
+	accessToken: z.string(),
+	refreshToken: z.string()
+});
+const refreshTokenSchema = z.object({ refreshToken: z.string().min(1) });
+const connectTokenExchangeSchema = z.object({ token: z.string().min(1) });
+z.object({
+	token: z.string(),
+	expiresIn: z.number(),
+	command: z.string()
+});
+const chatTypeSchema = z.enum([
+	"direct",
+	"group",
+	"thread"
+]);
+const createChatSchema = z.object({
+	type: chatTypeSchema,
+	topic: z.string().max(500).optional(),
+	participantIds: z.array(z.string()).min(1),
+	metadata: z.record(z.string(), z.unknown()).optional()
+});
+const chatParticipantSchema = z.object({
+	agentId: z.string(),
+	role: z.string(),
+	mode: z.string(),
+	joinedAt: z.string()
+});
+z.object({
+	id: z.string(),
+	organizationId: z.string(),
+	type: z.string(),
+	topic: z.string().nullable(),
+	lifecyclePolicy: z.string().nullable().optional(),
+	metadata: z.record(z.string(), z.unknown()),
+	createdAt: z.string(),
+	updatedAt: z.string()
+}).extend({ participants: z.array(chatParticipantSchema) });
+const addParticipantSchema = z.object({
+	agentId: z.string().min(1),
+	mode: z.enum(["full", "mention_only"]).default("full")
+});
+z.object({ agentId: z.string().min(1) });
+const clientStatusSchema = z.enum(["connected", "disconnected"]);
+z.object({
+	id: z.string(),
+	userId: z.string().nullable(),
+	status: clientStatusSchema,
+	sdkVersion: z.string().max(50).nullable(),
+	hostname: z.string().max(100).nullable(),
+	os: z.string().max(50).nullable(),
+	agentCount: z.number().int().min(0),
+	connectedAt: z.string().nullable(),
+	lastSeenAt: z.string(),
+	metadata: z.record(z.string(), z.unknown()).nullable()
+});
+const clientRegisterSchema = z.object({
+	clientId: z.string().min(1).max(100),
+	hostname: z.string().max(100).optional(),
+	os: z.string().max(50).optional(),
+	sdkVersion: z.string().max(50).optional()
+});
+const paginationQuerySchema = z.object({
+	limit: z.coerce.number().int().min(1).max(100).default(20),
+	cursor: z.string().optional()
+});
+const messageSourceSchema = z.enum([
+	"hub_ui",
+	"cli",
+	"feishu",
+	"github",
+	"api"
+]);
+const messageFormatSchema = z.enum([
+	"text",
+	"markdown",
+	"card",
+	"reference",
+	"file",
+	"task"
+]);
+const sendMessageSchema = z.object({
+	format: messageFormatSchema.default("text"),
+	content: z.unknown(),
+	metadata: z.record(z.string(), z.unknown()).optional(),
+	inReplyTo: z.string().optional(),
+	replyToInbox: z.string().optional(),
+	replyToChat: z.string().optional(),
+	source: messageSourceSchema.optional()
+});
+const sendToAgentSchema = z.object({
+	format: messageFormatSchema.default("text"),
+	content: z.unknown(),
+	metadata: z.record(z.string(), z.unknown()).optional(),
+	replyToInbox: z.string().optional(),
+	replyToChat: z.string().optional(),
+	source: messageSourceSchema.optional()
+});
+/**
+* Wire format for messages routed FROM the Hub TO a client runtime.
+*
+* Adds `configVersion` so the client can compare against its locally cached
+* agent runtime config and refresh before delivering the message to the SDK.
+*
+* Step 3: this is the single shape used by `buildClientMessagePayload` —
+* never serialise a raw `messageSchema` row to a client; always go through
+* the dispatcher.
+*/
+const clientMessageSchema = z.object({
+	id: z.string(),
+	chatId: z.string(),
+	senderId: z.string(),
+	format: z.string(),
+	content: z.unknown(),
+	metadata: z.record(z.string(), z.unknown()),
+	replyToInbox: z.string().nullable(),
+	replyToChat: z.string().nullable(),
+	inReplyTo: z.string().nullable(),
+	source: messageSourceSchema.nullable(),
+	createdAt: z.string()
+}).extend({ configVersion: z.number().int().positive() });
+z.enum([
+	"pending",
+	"delivered",
+	"acked",
+	"failed"
+]);
+z.object({
+	id: z.number(),
+	inboxId: z.string(),
+	messageId: z.string(),
+	chatId: z.string().nullable(),
+	status: z.string(),
+	retryCount: z.number(),
+	createdAt: z.string(),
+	deliveredAt: z.string().nullable(),
+	ackedAt: z.string().nullable()
+}).extend({ message: clientMessageSchema });
+const inboxPollQuerySchema = z.object({ limit: z.coerce.number().int().min(1).max(50).default(10) });
+const memberRoleSchema = z.enum(["admin", "member"]);
+const memberSchema = z.object({
+	id: z.string(),
+	userId: z.string(),
+	organizationId: z.string(),
+	agentId: z.string(),
+	role: memberRoleSchema,
+	createdAt: z.string()
+});
+/** Admin creates a member — password is auto-generated, returned once. */
+const createMemberSchema = z.object({
+	username: z.string().min(1).max(100),
+	displayName: z.string().min(1).max(200),
+	role: memberRoleSchema.default("member")
+});
+const updateMemberSchema = z.object({ role: memberRoleSchema.optional() });
+memberSchema.extend({
+	username: z.string(),
+	displayName: z.string(),
+	password: z.string()
+});
+const notificationTypeSchema = z.enum([
+	"agent_error",
+	"session_error",
+	"agent_needs_decision",
+	"agent_blocked",
+	"agent_stale",
+	"agent_disconnected",
+	"agent_connected",
+	"session_completed"
+]);
+const notificationSeveritySchema = z.enum([
+	"high",
+	"medium",
+	"low"
+]);
+z.object({
+	id: z.string(),
+	organizationId: z.string(),
+	type: notificationTypeSchema,
+	severity: notificationSeveritySchema,
+	agentId: z.string().nullable(),
+	chatId: z.string().nullable(),
+	message: z.string(),
+	read: z.boolean(),
+	createdAt: z.string()
+});
+const notificationQuerySchema = z.object({
+	limit: z.coerce.number().int().min(1).max(100).default(20),
+	cursor: z.string().optional(),
+	severity: notificationSeveritySchema.optional(),
+	read: z.enum(["true", "false"]).transform((v) => v === "true").optional(),
+	agentId: z.string().optional()
+});
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const createOrganizationSchema = z.object({
+	name: z.string().min(2).max(50).regex(/^[a-z0-9][a-z0-9-]*$/, "Must start with a letter or digit and contain only lowercase alphanumeric and hyphens").refine((v) => !UUID_PATTERN.test(v), "Name must not be a UUID format"),
+	displayName: z.string().min(1).max(200),
+	maxAgents: z.number().int().min(0).default(0),
+	maxMessagesPerMinute: z.number().int().min(0).default(0),
+	features: z.record(z.string(), z.unknown()).default({})
+});
+const updateOrganizationSchema = z.object({
+	name: z.string().min(2).max(50).regex(/^[a-z0-9][a-z0-9-]*$/, "Must start with a letter or digit and contain only lowercase alphanumeric and hyphens").refine((v) => !UUID_PATTERN.test(v), "Name must not be a UUID format").optional(),
+	displayName: z.string().min(1).max(200).optional(),
+	maxAgents: z.number().int().min(0).optional(),
+	maxMessagesPerMinute: z.number().int().min(0).optional(),
+	features: z.record(z.string(), z.unknown()).optional()
+});
+z.object({
+	id: z.string(),
+	name: z.string(),
+	displayName: z.string(),
+	maxAgents: z.number(),
+	maxMessagesPerMinute: z.number(),
+	features: z.record(z.string(), z.unknown()),
+	createdAt: z.string(),
+	updatedAt: z.string()
+});
+z.object({
+	id: z.string(),
+	agentId: z.string(),
+	chatId: z.string(),
+	content: z.string(),
+	updatedAt: z.string()
+});
+/** WS message: client reports session output text to server. */
+const sessionOutputMessageSchema = z.object({
+	agentId: z.string(),
+	chatId: z.string(),
+	content: z.string().max(5e4)
+});
+const orgStatsSchema = z.object({
+	organizationId: z.string(),
+	agentCount: z.number(),
+	chatCount: z.number(),
+	messageCount: z.number()
+});
+z.object({
+	totalAgents: z.number(),
+	totalChats: z.number(),
+	totalMessages: z.number(),
+	byOrganization: z.array(orgStatsSchema)
+});
+z.object({
+	key: z.string(),
+	value: z.unknown(),
+	updatedAt: z.string()
+});
+const updateSystemConfigSchema = z.record(z.string(), z.unknown());
+const SYSTEM_CONFIG_KEYS = {
+	INBOX_TIMEOUT_SECONDS: "inbox_timeout_seconds",
+	MAX_RETRY_COUNT: "max_retry_count",
+	POLLING_INTERVAL_SECONDS: "polling_interval_seconds",
+	PRESENCE_CLEANUP_SECONDS: "presence_cleanup_seconds"
+};
+const SYSTEM_CONFIG_DEFAULTS = {
+	[SYSTEM_CONFIG_KEYS.INBOX_TIMEOUT_SECONDS]: 300,
+	[SYSTEM_CONFIG_KEYS.MAX_RETRY_COUNT]: 3,
+	[SYSTEM_CONFIG_KEYS.POLLING_INTERVAL_SECONDS]: 5,
+	[SYSTEM_CONFIG_KEYS.PRESENCE_CLEANUP_SECONDS]: 60
+};
+/** Fixed 5-state machine. No custom statuses. */
+const TASK_STATUSES = {
+	PENDING: "pending",
+	ASSIGNED: "assigned",
+	WORKING: "working",
+	COMPLETED: "completed",
+	FAILED: "failed",
+	CANCELLED: "cancelled"
+};
+const taskStatusSchema = z.enum([
+	"pending",
+	"assigned",
+	"working",
+	"completed",
+	"failed",
+	"cancelled"
+]);
+/** Terminal statuses — once reached, no further transitions allowed. */
+const TASK_TERMINAL_STATUSES = [
+	"completed",
+	"failed",
+	"cancelled"
+];
+/** Creator type discriminator. */
+const TASK_CREATOR_TYPES = {
+	AGENT: "agent",
+	ADMIN: "admin"
+};
+const taskCreatorTypeSchema = z.enum(["agent", "admin"]);
+const taskMessageEventSchema = z.enum([
+	"assigned",
+	"status_changed",
+	"cancelled"
+]);
+z.object({
+	taskId: z.string(),
+	event: taskMessageEventSchema,
+	title: z.string(),
+	body: z.string().default(""),
+	status: taskStatusSchema,
+	fromStatus: taskStatusSchema.optional(),
+	originRef: z.string().nullable().optional()
+});
+/** Create task input. Used by both agent API and admin API. */
+const createTaskSchema = z.object({
+	title: z.string().min(1).max(500),
+	body: z.string().optional(),
+	assigneeAgentId: z.string().optional(),
+	originRef: z.string().max(500).optional(),
+	metadata: z.record(z.string(), z.unknown()).optional()
+});
+/** Admin-only create: allows passing an explicit organizationId. */
+const adminCreateTaskSchema = createTaskSchema.extend({ organizationId: z.string().optional() });
+/**
+* Agent-facing status update. Agents may only self-report working/completed/failed.
+* Cancellation goes through the dedicated cancel endpoint.
+*/
+const updateTaskStatusSchema = z.object({
+	status: z.enum([
+		"working",
+		"completed",
+		"failed"
+	]),
+	result: z.string().optional()
+});
+/** Admin-facing update — may re-assign or re-target status (within legal transitions). */
+const adminUpdateTaskSchema = z.object({
+	assigneeAgentId: z.string().nullable().optional(),
+	status: taskStatusSchema.optional(),
+	result: z.string().optional()
+});
+const linkTaskChatSchema = z.object({ chatId: z.string().min(1) });
+const taskSchema = z.object({
+	id: z.string(),
+	organizationId: z.string(),
+	title: z.string(),
+	body: z.string(),
+	status: taskStatusSchema,
+	assigneeAgentId: z.string().nullable(),
+	createdByType: taskCreatorTypeSchema,
+	createdById: z.string(),
+	originRef: z.string().nullable(),
+	result: z.string().nullable(),
+	metadata: z.record(z.string(), z.unknown()),
+	createdAt: z.string(),
+	updatedAt: z.string(),
+	cancelledAt: z.string().nullable(),
+	cancelledByType: taskCreatorTypeSchema.nullable(),
+	cancelledById: z.string().nullable()
+});
+const taskChatLinkSchema = z.object({
+	taskId: z.string(),
+	chatId: z.string(),
+	linkedByAgentId: z.string().nullable(),
+	linkedAt: z.string()
+});
+taskSchema.extend({ chats: z.array(taskChatLinkSchema) });
+const taskListQuerySchema = z.object({
+	status: taskStatusSchema.optional(),
+	assigneeAgentId: z.string().optional(),
+	originRef: z.string().optional(),
+	limit: z.coerce.number().int().min(1).max(100).default(20),
+	cursor: z.string().optional()
+});
+/**
+* Task health signals derived from associated chats' session state + recent messages.
+* See hub-task-design Section 9.
+*/
+const TASK_HEALTH_SIGNALS = {
+	NORMAL: "normal",
+	IDLE_ISLAND: "idle_island",
+	AWAITING_REPLY: "awaiting_reply",
+	NO_CHAT: "no_chat",
+	NOT_APPLICABLE: "not_applicable"
+};
+const taskHealthSignalSchema = z.enum([
+	"normal",
+	"idle_island",
+	"awaiting_reply",
+	"no_chat",
+	"not_applicable"
+]);
+z.object({
+	taskId: z.string(),
+	signal: taskHealthSignalSchema,
+	reason: z.string()
+});
+const userStatusSchema = z.enum(["active", "suspended"]);
+z.object({
+	id: z.string(),
+	username: z.string(),
+	displayName: z.string(),
+	avatarUrl: z.string().nullable(),
+	status: userStatusSchema,
+	createdAt: z.string(),
+	updatedAt: z.string()
+});
+z.object({
+	username: z.string().min(1).max(100),
+	displayName: z.string().min(1).max(200),
+	password: z.string().min(8).max(200)
+});
+z.object({
+	displayName: z.string().min(1).max(200).optional(),
+	password: z.string().min(8).max(200).optional()
+});
+/**
+* First-frame auth envelope sent by the SDK on the client WS connection.
+* The server rejects the connection with close code 4401 if this frame does
+* not arrive within {@link WS_AUTH_FRAME_TIMEOUT_MS} or fails verification.
+*/
+const wsAuthFrameSchema = z.object({
+	type: z.literal("auth"),
+	token: z.string().min(1)
+});
+/** How long the server waits for the first `auth` frame before closing the WS. */
+const WS_AUTH_FRAME_TIMEOUT_MS = 5e3;
+//#endregion
+//#region src/core/feishu.ts
+var feishu_exports = /* @__PURE__ */ __exportAll({
+	bindFeishuBot: () => bindFeishuBot,
+	bindFeishuUser: () => bindFeishuUser
+});
+/**
+* Feishu-related core operations: bind-bot, bind-user.
+*
+* All agent-scoped calls carry both the member access JWT (Authorization)
+* and the acting agent UUID (X-Agent-Id); the server's agent-selector
+* middleware enforces Rule R-RUN.
+*/
+async function bindFeishuBot(serverUrl, accessToken, agentId, appId, appSecret) {
+	const res = await fetch(`${serverUrl}/api/v1/agent/me/feishu-bot`, {
+		method: "PUT",
+		headers: {
+			Authorization: `Bearer ${accessToken}`,
+			[AGENT_SELECTOR_HEADER]: agentId,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({
+			appId,
+			appSecret
+		})
+	});
+	if (!res.ok) {
+		const body = await res.json().catch(() => ({}));
+		throw new Error(body.error ?? `Bind Feishu bot failed: HTTP ${res.status}`);
+	}
+}
+async function bindFeishuUser(serverUrl, accessToken, agentId, humanAgentId, feishuUserId, displayName) {
+	const res = await fetch(`${serverUrl}/api/v1/agent/delegated/${encodeURIComponent(humanAgentId)}/feishu-user`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${accessToken}`,
+			[AGENT_SELECTOR_HEADER]: agentId,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({
+			feishuUserId,
+			displayName
+		})
+	});
+	if (!res.ok) {
+		const body = await res.json().catch(() => ({}));
+		throw new Error(body.error ?? `Bind Feishu user failed: HTTP ${res.status}`);
+	}
+}
+//#endregion
+export { updateOrganizationSchema as $, createOrganizationSchema as A, paginationQuerySchema as B, clientRegisterSchema as C, createAgentSchema as D, createAdapterMappingSchema as E, isRedactedEnvValue as F, sendToAgentSchema as G, runtimeStateMessageSchema as H, linkTaskChatSchema as I, taskListQuerySchema as J, sessionOutputMessageSchema as K, loginSchema as L, delegateFeishuUserSchema as M, dryRunAgentRuntimeConfigSchema as N, createChatSchema as O, inboxPollQuerySchema as P, updateMemberSchema as Q, messageSourceSchema as R, agentTypeSchema as S, createAdapterConfigSchema as T, selfServiceFeishuBotSchema as U, refreshTokenSchema as V, sendMessageSchema as W, updateAgentRuntimeConfigSchema as X, updateAdapterConfigSchema as Y, updateAgentSchema as Z, addParticipantSchema as _, AGENT_SELECTOR_HEADER as a, agentBindRequestSchema as b, AGENT_TYPES as c, SYSTEM_CONFIG_DEFAULTS as d, updateSystemConfigSchema as et, TASK_CREATOR_TYPES as f, WS_AUTH_FRAME_TIMEOUT_MS as g, TASK_TERMINAL_STATUSES as h, AGENT_BIND_REJECT_REASONS as i, createTaskSchema as j, createMemberSchema as k, AGENT_VISIBILITY as l, TASK_STATUSES as m, bindFeishuUser as n, wsAuthFrameSchema as nt, AGENT_SOURCES as o, TASK_HEALTH_SIGNALS as p, sessionStateMessageSchema as q, feishu_exports as r, AGENT_STATUSES as s, bindFeishuBot as t, updateTaskStatusSchema as tt, DEFAULT_AGENT_RUNTIME_CONFIG_PAYLOAD as u, adminCreateTaskSchema as v, connectTokenExchangeSchema as w, agentRuntimeConfigPayloadSchema as x, adminUpdateTaskSchema as y, notificationQuerySchema as z };