@co0ontty/wand 4.102.0 → 4.103.0

package/dist/ai-team-live.js

@@ -91,7 +91,7 @@ function safeTailStart(output, start) {
  * 终端原始输出的尾部：先按尾部截窗，再剥 ANSI / 换行归一 / 压缩空行 / 截尾。
  * live 每 500ms 就可能算一遍，而 PTY 的 output 能长到几 MB —— 顺序反过来等于每半秒对全量
  * 跑一遍正则。丢掉的前缀计入 omittedChars，是**估算值（可能偏大也可能偏小，用于量级提示）**：
- * 按截窗点的原始字数计，含 ANSI 与控制字符，不精确到账。三条边界写进 docs/ai-teams.md。
+ * 按截窗点的原始字数计，含 ANSI 与控制字符，只用于量级提示，不精确到账。
  */
 function outputTailText(output) {
     const rawStart = Math.max(0, output.length - LIVE_OUTPUT_WINDOW_CHARS);

package/dist/apns-client.d.ts

@@ -0,0 +1,45 @@
+import { type KeyObject } from "node:crypto";
+import { type ClientHttp2Session } from "node:http2";
+export type ApnsEnvironment = "production" | "sandbox";
+export interface ApnsConfiguration {
+    keyId: string;
+    teamId: string;
+    topic: string;
+    environment: ApnsEnvironment;
+    key: KeyObject;
+}
+export interface ApnsMessage {
+    id: string;
+    token: string;
+    payload: string;
+    expiresAt: number;
+    collapseId: string;
+    /** ActivityKit has a distinct token and derived topic; never substitute an ordinary device token. */
+    pushType?: "alert" | "liveactivity";
+    priority?: 5 | 10;
+}
+export interface ApnsResult {
+    outcome: "accepted" | "invalid-device" | "retry" | "rejected";
+    /** Bounded, provider-defined diagnostic only. Never include a token, payload or raw error. */
+    reason: string;
+}
+export interface ApnsTransport {
+    send(message: ApnsMessage): Promise<ApnsResult>;
+    close(): void;
+}
+/** Deployment-owned paths/IDs only; the p8 itself never enters config.json, DTOs or logs. */
+export declare function loadApnsConfiguration(env?: NodeJS.ProcessEnv, configDirectory?: string): ApnsConfiguration | null;
+export declare function createApnsJwt(config: ApnsConfiguration, now?: number): string;
+export declare function classifyApnsResponse(status: number, reason: unknown): ApnsResult;
+/** Low-volume alerts: bounded HTTP/2 request per delivery, only Apple's fixed TLS endpoints. */
+export declare class ApnsClient implements ApnsTransport {
+    private readonly config;
+    private readonly open;
+    private jwt;
+    private jwtAt;
+    private closed;
+    private readonly connections;
+    constructor(config: ApnsConfiguration, open?: (url: string) => ClientHttp2Session);
+    send(message: ApnsMessage): Promise<ApnsResult>;
+    close(): void;
+}

package/dist/apns-client.js

@@ -0,0 +1,156 @@
+import { createPrivateKey, sign } from "node:crypto";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+import { connect } from "node:http2";
+/** Deployment-owned paths/IDs only; the p8 itself never enters config.json, DTOs or logs. */
+export function loadApnsConfiguration(env = process.env, configDirectory) {
+    // A deployment-local file is deliberately separate from public/runtime WandConfig projections.
+    // Explicit environment configuration wins as a whole; incomplete overrides fail closed.
+    const names = ["WAND_APNS_KEY_PATH", "WAND_APNS_KEY_ID", "WAND_APNS_TEAM_ID", "WAND_APNS_TOPIC"];
+    const localFile = configDirectory ? path.join(configDirectory, "apns.json") : null;
+    if (!names.some(name => env[name]) && !env.WAND_APNS_ENVIRONMENT && localFile && existsSync(localFile)) {
+        try {
+            const stat = statSync(localFile);
+            if (!stat.isFile() || stat.size > 4096 || (stat.mode & 0o077) !== 0)
+                throw new Error();
+            const local = JSON.parse(readFileSync(localFile, "utf8"));
+            if (!local || typeof local !== "object" || Array.isArray(local))
+                throw new Error();
+            const fields = ["keyPath", "keyId", "teamId", "topic", "environment"];
+            if (fields.some(field => typeof local[field] !== "string"))
+                throw new Error();
+            env = Object.fromEntries([...names, "WAND_APNS_ENVIRONMENT"].map((name, index) => [name, local[fields[index]]]));
+        }
+        catch {
+            throw new Error("本机 apns.json 不可用：需要权限0600的有效推送配置文件。");
+        }
+    }
+    const values = [env.WAND_APNS_KEY_PATH, env.WAND_APNS_KEY_ID, env.WAND_APNS_TEAM_ID, env.WAND_APNS_TOPIC];
+    if (values.every(value => !value))
+        return null;
+    if (values.some(value => !value))
+        throw new Error("APNs 配置不完整：需要 KEY_PATH、KEY_ID、TEAM_ID 和 TOPIC。");
+    const [keyPath, keyId, teamId, topic] = values;
+    if (!/^[A-Z0-9]{10}$/.test(keyId) || !/^[A-Z0-9]{10}$/.test(teamId)
+        || !/^[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+$/.test(topic) || topic.length > 255) {
+        throw new Error("APNs 的 key/team/topic 配置格式无效。");
+    }
+    const environment = env.WAND_APNS_ENVIRONMENT ?? "production";
+    if (environment !== "production" && environment !== "sandbox")
+        throw new Error("APNs environment 必须是 production 或 sandbox。");
+    try {
+        if (!path.isAbsolute(keyPath))
+            throw new Error();
+        const stat = statSync(keyPath);
+        if (!stat.isFile() || stat.size > 16_384 || (stat.mode & 0o077) !== 0)
+            throw new Error();
+        const key = createPrivateKey(readFileSync(keyPath));
+        if (key.asymmetricKeyType !== "ec" || key.asymmetricKeyDetails?.namedCurve !== "prime256v1")
+            throw new Error();
+        return { keyId: keyId, teamId: teamId, topic: topic, environment, key };
+    }
+    catch {
+        throw new Error("APNs 私钥不可用：需要本机可读、权限0600的P-256 p8文件。");
+    }
+}
+export function createApnsJwt(config, now = Date.now()) {
+    const header = Buffer.from(JSON.stringify({ alg: "ES256", kid: config.keyId })).toString("base64url");
+    const claims = Buffer.from(JSON.stringify({ iss: config.teamId, iat: Math.floor(now / 1000) })).toString("base64url");
+    const input = `${header}.${claims}`;
+    return `${input}.${sign("sha256", Buffer.from(input), { key: config.key, dsaEncoding: "ieee-p1363" }).toString("base64url")}`;
+}
+export function classifyApnsResponse(status, reason) {
+    const safe = typeof reason === "string" && /^[A-Za-z]{1,64}$/.test(reason) ? reason : `HTTP${status}`;
+    if (status === 200)
+        return { outcome: "accepted", reason: "AcceptedByAPNs" };
+    if (status === 410 || (status === 400 && ["BadDeviceToken", "DeviceTokenNotForTopic", "Unregistered"].includes(safe))) {
+        return { outcome: "invalid-device", reason: safe };
+    }
+    return { outcome: status === 0 || status === 429 || status >= 500 || safe === "ExpiredProviderToken" ? "retry" : "rejected", reason: safe };
+}
+/** Low-volume alerts: bounded HTTP/2 request per delivery, only Apple's fixed TLS endpoints. */
+export class ApnsClient {
+    config;
+    open;
+    jwt = "";
+    jwtAt = 0;
+    closed = false;
+    connections = new Set();
+    constructor(config, open = connect) {
+        this.config = config;
+        this.open = open;
+    }
+    send(message) {
+        if (this.closed)
+            return Promise.resolve({ outcome: "retry", reason: "Stopped" });
+        const now = Date.now();
+        if (!this.jwt || now - this.jwtAt > 50 * 60_000) {
+            this.jwt = createApnsJwt(this.config, now);
+            this.jwtAt = now;
+        }
+        return new Promise(resolve => {
+            const endpoint = this.config.environment === "sandbox" ? "https://api.sandbox.push.apple.com" : "https://api.push.apple.com";
+            const connection = this.open(endpoint);
+            this.connections.add(connection);
+            let settled = false;
+            const finish = (result) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                this.connections.delete(connection);
+                connection.destroy();
+                resolve(result);
+            };
+            const timer = setTimeout(() => finish({ outcome: "retry", reason: "Timeout" }), 10_000);
+            timer.unref();
+            connection.on("error", () => finish({ outcome: "retry", reason: "ConnectionError" }));
+            connection.on("close", () => finish({ outcome: "retry", reason: "ConnectionClosed" }));
+            connection.once("connect", () => {
+                if (settled)
+                    return;
+                try {
+                    const request = connection.request({
+                        ":method": "POST", ":path": `/3/device/${message.token}`,
+                        authorization: `bearer ${this.jwt}`,
+                        "apns-topic": message.pushType === "liveactivity" ? `${this.config.topic}.push-type.liveactivity` : this.config.topic,
+                        "apns-push-type": message.pushType ?? "alert", "apns-priority": String(message.priority ?? (message.pushType === "liveactivity" ? 5 : 10)), "apns-id": message.id,
+                        "apns-expiration": String(Math.floor(message.expiresAt / 1000)), "apns-collapse-id": message.collapseId,
+                        "content-type": "application/json",
+                    });
+                    let status = 0;
+                    let body = "";
+                    request.setEncoding("utf8");
+                    request.on("response", headers => { status = Number(headers[":status"] ?? 0); });
+                    request.on("data", (chunk) => {
+                        body += chunk;
+                        if (Buffer.byteLength(body) > 4096)
+                            finish({ outcome: "retry", reason: "ResponseTooLarge" });
+                    });
+                    request.on("error", () => finish({ outcome: "retry", reason: "StreamError" }));
+                    request.on("end", () => {
+                        let reason;
+                        try {
+                            reason = JSON.parse(body).reason;
+                        }
+                        catch { /* empty success body */ }
+                        const result = classifyApnsResponse(status, reason);
+                        if (result.reason === "ExpiredProviderToken")
+                            this.jwt = "";
+                        finish(result);
+                    });
+                    request.end(message.payload);
+                }
+                catch {
+                    finish({ outcome: "retry", reason: "RequestError" });
+                }
+            });
+        });
+    }
+    close() {
+        this.closed = true;
+        for (const connection of this.connections)
+            connection.destroy();
+        this.connections.clear();
+    }
+}

package/dist/apns-service.d.ts

@@ -0,0 +1,29 @@
+import type { ApnsConfiguration, ApnsTransport } from "./apns-client.js";
+import type { WandStorage } from "./storage.js";
+import type { ProcessEvent, SessionSnapshot } from "./types.js";
+export declare class ApnsService {
+    private readonly storage;
+    readonly configuration: ApnsConfiguration | null;
+    private readonly transport;
+    private readonly credentialDigest;
+    private readonly getSession;
+    private readonly warn;
+    private readonly now;
+    private stopped;
+    private running;
+    private timer;
+    private lastSweep;
+    private nextWarningAt;
+    private report;
+    constructor(storage: WandStorage, configuration: ApnsConfiguration | null, transport: ApnsTransport | null, credentialDigest: () => string, getSession: (id: string) => SessionSnapshot | null, warn?: (message: string) => void, now?: () => number);
+    get available(): boolean;
+    start(): void;
+    /** Called only by SessionCompletionTracker when it creates a NEW successful completion fact. */
+    completed(sessionId: string, revision: number): void;
+    ingest(event: ProcessEvent): void;
+    private enqueue;
+    /** A single bounded consumer, independent from the lifetime of PTY/Render/Core. */
+    flush(): Promise<void>;
+    private drain;
+    dispose(): void;
+}

package/dist/apns-service.js

@@ -0,0 +1,156 @@
+import { apnsDigest } from "./storage/apns-repository.js";
+export class ApnsService {
+    storage;
+    configuration;
+    transport;
+    credentialDigest;
+    getSession;
+    warn;
+    now;
+    stopped = false;
+    running = null;
+    timer = null;
+    lastSweep = 0;
+    nextWarningAt = 0;
+    report(message) {
+        if (this.now() < this.nextWarningAt)
+            return;
+        this.nextWarningAt = this.now() + 60_000;
+        this.warn(message);
+    }
+    constructor(storage, configuration, transport, credentialDigest, getSession, warn = () => { }, now = Date.now) {
+        this.storage = storage;
+        this.configuration = configuration;
+        this.transport = transport;
+        this.credentialDigest = credentialDigest;
+        this.getSession = getSession;
+        this.warn = warn;
+        this.now = now;
+        storage.onClose(() => this.dispose());
+    }
+    get available() { return !!this.configuration && !!this.transport && !this.stopped; }
+    start() {
+        if (!this.available || this.timer)
+            return;
+        this.timer = setInterval(() => { void this.flush(); }, 2000);
+        this.timer.unref();
+        void this.flush(); // includes persisted, still-actionable outbox entries after a restart.
+    }
+    /** Called only by SessionCompletionTracker when it creates a NEW successful completion fact. */
+    completed(sessionId, revision) {
+        if (!this.available)
+            return;
+        try {
+            const session = this.getSession(sessionId);
+            if (!session || session.archived)
+                return;
+            this.enqueue(sessionId, "completed", String(revision));
+        }
+        catch {
+            this.report("APNs 无法读取会话提醒事实；不影响执行。");
+        }
+    }
+    ingest(event) {
+        if (!this.available || (event.type !== "status" && event.type !== "ended"))
+            return;
+        try {
+            const session = this.getSession(event.sessionId);
+            if (!session || session.archived)
+                return;
+            // The durable request ID is the fact. Never hash permission contents/tool arguments into a payload.
+            const requestId = session.pendingEscalation?.requestId;
+            if (requestId)
+                this.enqueue(session.id, "permission", requestId);
+        }
+        catch {
+            this.report("APNs 无法读取会话提醒事实；不影响执行。");
+        }
+    }
+    enqueue(sessionId, kind, revision) {
+        try {
+            const config = this.configuration;
+            const capacityAvailable = this.storage.apns.enqueue(sessionId, kind, revision, this.credentialDigest(), config.topic, config.environment, this.now());
+            if (!capacityAvailable)
+                this.report("APNs 提醒队列已满，部分提醒可能被丢弃；执行与历史不受影响。");
+            void this.flush();
+        }
+        catch {
+            this.report("APNs 提醒未能入队；执行与历史不受影响。");
+        }
+    }
+    /** A single bounded consumer, independent from the lifetime of PTY/Render/Core. */
+    flush() {
+        if (!this.available)
+            return Promise.resolve();
+        if (!this.running) {
+            this.running = this.drain().catch(() => {
+                if (!this.stopped)
+                    this.report("APNs 队列暂不可用，将稍后重试。");
+            }).finally(() => { this.running = null; });
+        }
+        return this.running;
+    }
+    async drain() {
+        if (this.now() - this.lastSweep >= 60_000) {
+            this.storage.apns.sweep(this.now());
+            this.lastSweep = this.now();
+        }
+        // Bound work per pump even under an event burst. Pending work remains in SQLite.
+        for (let i = 0; i < 32 && !this.stopped; i++) {
+            const job = this.storage.apns.due(this.now());
+            if (!job)
+                return;
+            const device = this.storage.apns.device(job.device_id);
+            const session = this.getSession(job.session_id);
+            const stale = !device || !device.enabled || device.generation !== job.generation
+                || device.expires_at <= this.now() || device.credential_digest !== this.credentialDigest()
+                || device.topic !== this.configuration.topic || device.environment !== this.configuration.environment
+                || job.expires_at <= this.now() || !session || session.archived
+                || (job.kind === "permission" && session.pendingEscalation?.requestId !== job.revision)
+                || (job.kind === "completed" && ((session.viewedCompletionRevision ?? 0) >= Number(job.revision)
+                    || (session.completionRevision ?? 0) !== Number(job.revision) || !!session.pendingEscalation
+                    || session.ptyBusy === true || session.structuredState?.inFlight === true));
+            if (stale) {
+                this.storage.apns.finish(job.id, "canceled", "NoLongerActionable");
+                continue;
+            }
+            const payload = JSON.stringify({
+                aps: { alert: {
+                        title: job.kind === "permission" ? "需要你的授权" : "回复已完成",
+                        body: job.kind === "permission" ? "Wand 会话正在等待确认，点击查看。" : "Wand 会话已有新结果，点击查看。",
+                    }, sound: "default", "thread-id": apnsDigest(`${device.server_id}:${job.session_id}`).slice(0, 32) },
+                eventId: job.event_id, sessionId: job.session_id, serverId: device.server_id, kind: job.kind,
+            });
+            let result;
+            try {
+                result = await this.transport.send({ id: job.id, token: device.token, payload,
+                    expiresAt: job.expires_at, collapseId: job.event_id });
+            }
+            catch {
+                result = { outcome: "retry", reason: "TransportFailure" };
+            }
+            if (this.stopped)
+                return; // storage may have closed while the HTTP/2 request was in flight.
+            if (result.outcome === "accepted")
+                this.storage.apns.finish(job.id, "accepted", result.reason);
+            else if (result.outcome === "invalid-device") {
+                this.storage.apns.finish(job.id, "failed", result.reason);
+                this.storage.apns.invalidateDevice(job.device_id, job.generation);
+            }
+            else if (result.outcome === "retry" && job.attempts < 4) {
+                this.storage.apns.retry(job.id, job.attempts + 1, this.now() + Math.min(60_000, 2000 * 2 ** job.attempts), result.reason);
+            }
+            else {
+                this.storage.apns.finish(job.id, "failed", result.reason);
+                this.report(`APNs 未接受提醒（${result.reason}），不影响会话执行。`);
+            }
+        }
+    }
+    dispose() {
+        this.stopped = true;
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = null;
+        this.transport?.close();
+    }
+}

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
-  "commit": "9fbc1da896aa6d8c29b8da1f602a3017956e89c5",
-  "builtAt": "2026-10-22T00:06:11.299Z",
-  "version": "4.102.0",
+  "commit": "54a477b44332156a4ccebc55c1879bff23fa78a5",
+  "builtAt": "2026-10-24T13:20:55.647Z",
+  "version": "4.103.0",
   "channel": "stable"
 }

package/dist/conversation-service.d.ts

@@ -31,6 +31,8 @@ interface ConversationExecutionTarget {
 /** Business coordination only; all execution remains in StructuredSessionManager / AiTeamRunner. */
 export declare class ConversationService {
     private readonly deps;
+    private external?;
+    attachExternal(service: NonNullable<ConversationService["external"]>): void;
     constructor(deps: {
         storage: WandStorage;
         structured: Pick<StructuredSessionManager, "createSession" | "createRelaySession" | "get" | "sendMessage" | "appendRelayTurns">;

package/dist/conversation-service.js

@@ -50,6 +50,8 @@ function stableJson(value) {
 /** Business coordination only; all execution remains in StructuredSessionManager / AiTeamRunner. */
 export class ConversationService {
     deps;
+    external;
+    attachExternal(service) { this.external = service; }
     constructor(deps) {
         this.deps = deps;
     }
@@ -281,6 +283,9 @@ export class ConversationService {
         return candidates.reduce((latest, turn) => latest ? this.laterTurn(instance, latest, turn) : turn, undefined);
     }
     summary(instance, knownTurns) {
+        const externalGroup = this.external?.groupForConversation(instance.id);
+        if (externalGroup)
+            instance = { ...instance, external: this.external.metadata(externalGroup) };
         const tasks = this.storage.conversationTasks(instance.id).flatMap((link) => {
             const task = this.storage.getWandTask(link.taskId);
             const receipt = task ? this.storage.conversationTaskStartup(task.id) : null;
@@ -290,7 +295,7 @@ export class ConversationService {
         });
         const employee = instance.peerEmployeeId ? this.storage.getSiliconEmployee(instance.peerEmployeeId) : null;
         const lifecycle = this.storage.conversationListState(instance.id);
-        let unavailableReason = lifecycle.deleting ? "对话正在删除，请稍后重试。" : lifecycle.dissolvedAt ? "群聊已解散，恢复后可以继续聊天。" : null;
+        let unavailableReason = lifecycle.deleting ? "对话正在删除，请稍后重试。" : lifecycle.dissolvedAt ? instance.external ? "此钉钉群镜像已暂停接收新输入，不影响真实钉钉群。" : "群聊已解散，恢复后可以继续聊天。" : null;
         if (instance.kind === "dm") {
             try {
                 requireTeamEmployee(this.storage, instance.peerEmployeeId ?? "");
@@ -306,7 +311,7 @@ export class ConversationService {
         const title = instance.kind === "dm" ? employee?.name ?? instance.name
             : instance.nameSource === "custom" ? instance.name : tasks.at(-1)?.task.title ?? instance.name;
         // 私聊标题已说明对方身份；只保留自己的署名，群聊仍需区分发言人。
-        const previewAuthor = last?.role === "user" ? `${this.selfName()}：`
+        const previewAuthor = last?.role === "user" ? `${instance.external ? last.author?.name ?? "钉钉成员" : this.selfName()}：`
             : instance.kind === "group" && last ? `${last.author?.name ?? "系统"}：` : "";
         const team = instance.team ? projectTeamEmployees(instance.team, this.storage) : null;
         return { ...instance, ...lifecycle, team: team ? { ...team, members: team.members.map((member) => ({
@@ -314,7 +319,7 @@ export class ConversationService {
                 })) } : null,
             title, unavailableReason, memberUnavailableReasons: this.memberReasons(instance), tasks,
             preview: last ? `${previewAuthor}${lastText.slice(0, 160)}`
-                : instance.kind === "group" ? "群已建立，尚未派任务" : "还没有消息", messageAt };
+                : instance.external ? "钉钉群已接入，等待消息同步" : instance.kind === "group" ? "群已建立，尚未派任务" : "还没有消息", messageAt };
     }
     list() {
         return this.storage.listConversations().map((instance) => this.summary(instance))
@@ -403,6 +408,8 @@ export class ConversationService {
         for (const taskId of taskIds)
             this.storage.deleteWandTask(taskId);
         this.storage.deleteConversation(id);
+        if (instance.external)
+            this.external?.removeMirror(id);
     }
     history(id) { return this.turns(this.requireInstance(id)); }
     detail(id, select = turns => turns) {
@@ -633,6 +640,10 @@ export class ConversationService {
     prepare(id, requestId, explicitCwd) {
         return this.request(requestId, "prepare", { explicitCwd }, id, (receipt) => {
             const instance = this.requireInstance(id);
+            if (instance.external) {
+                receipt.state = "accepted";
+                return;
+            }
             const session = this.communicationChannel(instance, this.cwd(explicitCwd));
             receipt.sessionId = session.id;
             receipt.state = "accepted";
@@ -671,6 +682,13 @@ export class ConversationService {
     }
     send(id, requestId, input, target, explicitCwd, echo = true, executionTarget, executionPreference) {
         const preference = parseConversationExecutionPreference(executionPreference);
+        if (this.storage.getConversation(id)?.external) {
+            if (!this.external)
+                throw new Error("钉钉连接器尚未启动。");
+            if (target || executionTarget || preference)
+                throw new Error("钉钉群消息不能作为内部任务或临时员工配置派发。");
+            return this.external.send(id, requestId, input);
+        }
         return this.request(requestId, "send", { input, target, explicitCwd, echo,
             ...(preference ? { executionPreference: preference } : {}),
             ...(executionTarget?.workspaceId ? { workspaceId: executionTarget.workspaceId } : {}),
@@ -812,6 +830,8 @@ export class ConversationService {
     dispatch(id, requestId, input) {
         return this.request(requestId, "dispatch", input, id, (receipt, commit) => {
             const instance = this.requireInstance(id);
+            if (instance.external)
+                throw new Error("钉钉群不是内部团队任务群，请在群内明确 @已接入的员工。");
             // Older clients may still use the task form in a DM. It now starts a session, never a task group.
             if (instance.kind === "dm") {
                 if (input.continueTaskId)

package/dist/conversation-types.d.ts

@@ -13,6 +13,8 @@ export type ConversationTarget = {
 export interface ConversationInstance {
     id: string;
     owner: string;
+    /** Real external group mirror; ordinary messages never enter the internal team dispatcher. */
+    external?: import("./dingtalk-types.js").DingTalkExternalConversation;
     kind: "dm" | "group";
     peerEmployeeId: string | null;
     name: string;

package/dist/dingtalk-auth.d.ts

@@ -0,0 +1,41 @@
+import { boundedFetch, type DwsTransport } from "./dingtalk-dws.js";
+import type { DingTalkAccount } from "./dingtalk-types.js";
+/** Structured device OAuth, not scraping localized CLI stderr. Codes stay in memory and are exchanged over stdin. */
+export declare class DingTalkAuth {
+    private readonly dws;
+    private readonly request;
+    private attempts;
+    constructor(dws: DwsTransport, request?: typeof boundedFetch);
+    accounts(): Promise<DingTalkAccount[]>;
+    private json;
+    begin(): Promise<{
+        id: string;
+        state: "failed" | "cancelled" | "connected" | "waiting" | "exchanging";
+        url: string | undefined;
+        userCode: string | undefined;
+        expiresAt: string;
+        error: string | undefined;
+        account: DingTalkAccount | undefined;
+    }>;
+    get(id: string): {
+        id: string;
+        state: "failed" | "cancelled" | "connected" | "waiting" | "exchanging";
+        url: string | undefined;
+        userCode: string | undefined;
+        expiresAt: string;
+        error: string | undefined;
+        account: DingTalkAccount | undefined;
+    };
+    cancel(id: string): {
+        id: string;
+        state: "failed" | "cancelled" | "connected" | "waiting" | "exchanging";
+        url: string | undefined;
+        userCode: string | undefined;
+        expiresAt: string;
+        error: string | undefined;
+        account: DingTalkAccount | undefined;
+    };
+    private public;
+    private poll;
+    dispose(): void;
+}