@co0ontty/wand 4.102.0 → 4.103.0

package/dist/server-apns-routes.js

@@ -0,0 +1,111 @@
+import express from "express";
+import { authenticateBearerAppToken } from "./middleware/auth.js";
+import { apnsDigest } from "./storage/apns-repository.js";
+/** Mount before the global API auth gate: PUT requires the app bearer; DELETE has revoke-only authority. */
+export function registerApnsRoutes(app, deps) {
+    const router = express.Router();
+    let window = 0, requests = 0;
+    const bounded = (_req, res, next) => {
+        res.set("Cache-Control", "no-store");
+        if (Date.now() - window >= 60_000) {
+            window = Date.now();
+            requests = 0;
+        }
+        if (++requests > 120) {
+            res.set("Retry-After", "60").status(429).json({ error: "推送订阅请求过多。" });
+            return;
+        }
+        next();
+    };
+    router.use(bounded);
+    router.put("/subscription", express.json({ limit: "4kb", inflate: false }), (req, res) => {
+        if (!authenticateBearerAppToken(req, deps.storage, deps.config)) {
+            res.status(401).json({ error: "需要有效的应用连接凭据。", code: "unauthorized" });
+            return;
+        }
+        if (!deps.service.available) {
+            res.status(503).json({ error: "服务器尚未配置 APNs。", code: "apns_unavailable" });
+            return;
+        }
+        const { secret, deviceToken, environment, serverId } = req.body ?? {};
+        const config = deps.service.configuration;
+        if (typeof secret !== "string" || !/^[a-f0-9]{64}$/.test(secret)
+            || typeof deviceToken !== "string" || !/^[a-f0-9]{32,200}$/.test(deviceToken) || deviceToken.length % 2 !== 0
+            || environment !== config.environment || typeof serverId !== "string" || !/^[a-zA-Z0-9._:-]{1,128}$/.test(serverId)) {
+            res.status(400).json({ error: "推送订阅参数或 APNs 环境不匹配。", code: "invalid_apns_subscription" });
+            return;
+        }
+        // All connected apps currently share one instance-owner credential (not a multi-user account model).
+        // Bind to its digest so password/app-secret rotation revokes every existing subscription at send time.
+        const appToken = req.headers.authorization.slice("Bearer ".length).trim();
+        try {
+            deps.storage.apns.register({ secret, token: deviceToken, environment, topic: config.topic, serverId,
+                credentialDigest: apnsDigest(appToken) }, Date.now());
+            res.status(200).json({ available: true, leaseSeconds: 14 * 86_400 });
+        }
+        catch {
+            res.status(503).json({ error: "推送订阅暂不可用。", code: "apns_storage_unavailable" });
+        }
+    });
+    router.delete("/subscription", (req, res) => {
+        const header = req.headers.authorization;
+        const secret = typeof header === "string" && header.startsWith("Bearer ") ? header.slice(7) : "";
+        if (!/^[a-f0-9]{64}$/.test(secret)) {
+            res.status(401).json({ error: "需要设备撤销凭据。" });
+            return;
+        }
+        // This opaque, 256-bit capability can only revoke its own device. No login, listing, registration or sending.
+        // It remains usable after the profile/app credential is removed or rotated, allowing durable offline retries.
+        try {
+            deps.storage.apns.revoke(secret);
+            res.status(204).end();
+        }
+        catch {
+            res.status(503).json({ error: "推送撤销暂不可用。" });
+        }
+    });
+    router.put("/live-activity", express.json({ limit: "4kb", inflate: false }), (req, res) => {
+        if (!authenticateBearerAppToken(req, deps.storage, deps.config)) {
+            res.status(401).json({ error: "需要有效的应用连接凭据。", code: "unauthorized" });
+            return;
+        }
+        if (!deps.liveActivity?.available) {
+            res.status(503).json({ error: "服务器尚未配置远程灵动岛。", code: "apns_unavailable" });
+            return;
+        }
+        const { secret, activityId, activityToken, environment, serverId } = req.body ?? {};
+        const config = deps.liveActivity.configuration;
+        if (typeof secret !== "string" || !/^[a-f0-9]{64}$/.test(secret)
+            || typeof activityId !== "string" || !/^[A-Za-z0-9._:-]{1,200}$/.test(activityId)
+            || typeof activityToken !== "string" || !/^[a-f0-9]{32,512}$/.test(activityToken) || activityToken.length % 2 !== 0
+            || environment !== config.environment || typeof serverId !== "string" || !/^[A-Za-z0-9._:-]{1,128}$/.test(serverId)) {
+            res.status(400).json({ error: "灵动岛订阅参数或推送环境不匹配。", code: "invalid_live_activity_subscription" });
+            return;
+        }
+        const appToken = req.headers.authorization.slice(7).trim();
+        try {
+            deps.storage.liveActivities.register({ secret, activityId, token: activityToken, environment, serverId,
+                topic: config.topic, credentialDigest: apnsDigest(appToken) }, Date.now());
+            res.json({ available: true, leaseSeconds: 8 * 3600 });
+        }
+        catch {
+            res.status(503).json({ error: "灵动岛订阅暂不可用。", code: "apns_storage_unavailable" });
+        }
+    });
+    router.delete("/live-activity", (req, res) => {
+        const header = req.headers.authorization;
+        const secret = typeof header === "string" && header.startsWith("Bearer ") ? header.slice(7) : "";
+        if (!/^[a-f0-9]{64}$/.test(secret)) {
+            res.status(401).json({ error: "需要活动撤销凭据。" });
+            return;
+        }
+        try {
+            deps.storage.liveActivities.revoke(secret);
+            res.status(204).end();
+        }
+        catch {
+            res.status(503).json({ error: "活动撤销暂不可用。" });
+        }
+    });
+    app.use("/api/push/apns", router);
+}

package/dist/server-dingtalk-routes.d.ts

@@ -0,0 +1,8 @@
+import type { Express, RequestHandler } from "express";
+import type { DingTalkService } from "./dingtalk-service.js";
+/** All discovery, OAuth codes and provisioning controls are admin-scoped, no-store and never public DTO caches. */
+export declare function registerDingTalkRoutes(app: Express, deps: {
+    service: DingTalkService;
+    requireAdmin: RequestHandler;
+    install(): Promise<void>;
+}): void;

package/dist/server-dingtalk-routes.js

@@ -0,0 +1,35 @@
+import { DingTalkError } from "./dingtalk-dws.js";
+import { asyncRoute } from "./express-async.js";
+import { bodyObject, text } from "./server-request.js";
+/** All discovery, OAuth codes and provisioning controls are admin-scoped, no-store and never public DTO caches. */
+export function registerDingTalkRoutes(app, deps) {
+    const base = "/api/connectors/dingtalk";
+    app.use(base, deps.requireAdmin, (_req, res, next) => { res.setHeader("Cache-Control", "no-store"); next(); });
+    const route = (method, path, action, successStatus = 200) => {
+        app[method](base + path, asyncRoute(async (req, res) => {
+            try {
+                res.status(successStatus).json(await action(req));
+            }
+            catch (error) {
+                const safe = error instanceof DingTalkError ? error : new DingTalkError("operation_failed", "钉钉操作未完成，请检查当前接入状态。");
+                res.status(safe.code === "unauthorized" ? 401 : safe.code === "not_found" ? 404 : 400).json({ error: safe.message, code: safe.code, unknownDelivery: safe.unknownDelivery });
+            }
+        }));
+    };
+    route("get", "", () => deps.service.status());
+    route("post", "/install", async () => { await deps.install(); return { installed: true }; });
+    route("post", "/auth", () => deps.service.auth.begin());
+    route("get", "/auth/:id", req => deps.service.auth.get(req.params.id));
+    route("post", "/auth/:id/cancel", req => deps.service.auth.cancel(req.params.id));
+    route("get", "/groups", req => deps.service.discover(text(req.query.accountId), text(req.query.cursor)));
+    route("post", "/plans", req => {
+        const b = bodyObject(req.body);
+        return deps.service.plan({ accountId: b.accountId, groupIds: b.groupIds, employeeIds: b.employeeIds, excluded: b.excluded, robotNames: b.robotNames, candidateIndices: b.candidateIndices });
+    });
+    route("post", "/connections", req => { const b = bodyObject(req.body); return deps.service.connect(text(b.planId), b.confirmed === true); }, 202);
+    route("patch", "/bindings/:id", req => deps.service.updateBinding(req.params.id, bodyObject(req.body)));
+    route("post", "/bindings/:id/resume", req => deps.service.retryBinding(req.params.id), 202);
+    route("post", "/bindings/:id/remove", req => { if (bodyObject(req.body).confirmed !== true)
+        throw new DingTalkError("confirmation", "请确认仅移除此群中的员工绑定。"); return deps.service.removeBinding(req.params.id); });
+    route("post", "/groups/:id/refresh", req => deps.service.refreshGroup(req.params.id));
+}

package/dist/server.js

@@ -24,6 +24,11 @@ import { SessionLogger } from "./session-logger.js";
 import { coreHarnessAgentDir } from "./harness-engine.js";
 import { SessionRegistry } from "./session-registry.js";
 import { SessionCompletionTracker } from "./session-completion.js";
+import { ApnsClient, loadApnsConfiguration } from "./apns-client.js";
+import { ApnsService } from "./apns-service.js";
+import { LiveActivityService } from "./live-activity-service.js";
+import { apnsDigest } from "./storage/apns-repository.js";
+import { registerApnsRoutes } from "./server-apns-routes.js";
 import { resolveSystemAiContext } from "./session-ai-context.js";
 import { systemAiSessions } from "./system-ai-session-recorder.js";
 import { StructuredSessionManager } from "./structured-session-manager.js";
@@ -41,7 +46,7 @@ import { registerStorageCleanupRoutes } from "./server-storage-cleanup-routes.js
 import { LocalModelSetupService } from "./local-model-setup.js";
 import { DecisionExpertService } from "./decision-expert-service.js";
 import { DECISION_EXPERT_KEY } from "./decision-expert-identity.js";
-import { buildStructuredChatPersonaPayload, resolveAppConnectCode, } from "./server-app-connect.js";
+import { buildStructuredChatPersonaPayload, generateAppToken, resolveAppConnectCode, } from "./server-app-connect.js";
 import { resolveTrustProxy, sendRouteError } from "./server-request.js";
 import { registerAuthRoutes } from "./server-auth-routes.js";
 import { WebLoginTickets } from "./web-login-tickets.js";
@@ -66,6 +71,9 @@ import { registerSiliconEmployeeRoutes } from "./server-employee-routes.js";
 import { EmployeeImService } from "./employee-im.js";
 import { EmployeeImLifecycle } from "./employee-im-lifecycle.js";
 import { registerEmployeeImRoutes } from "./server-employee-im-routes.js";
+import { DwsClient } from "./dingtalk-dws.js";
+import { DingTalkService } from "./dingtalk-service.js";
+import { registerDingTalkRoutes } from "./server-dingtalk-routes.js";
 import { UserMemoryService } from "./user-memory.js";
 import { registerUserMemoryRoutes, userMemoryOperationLog } from "./server-user-memory.js";
 import { registerAttentionRoutes } from "./server-attention-routes.js";
@@ -414,7 +422,17 @@ export async function startServer(config, configPath, options = {}) {
         canStart: (session, scheduling) => taskExecutionQueue.canStartSession(session, scheduling),
         schedule: employeeId => taskExecutionQueue.scheduleDrain(employeeId),
     });
-    const sessionCompletions = new SessionCompletionTracker(storage, (id) => sessionRegistry.get(id));
+    let apnsConfiguration = null;
+    try {
+        apnsConfiguration = loadApnsConfiguration(process.env, configDir);
+    }
+    catch (error) {
+        wandWarn(error instanceof Error ? error.message : "APNs 配置不可用。");
+    }
+    const apns = new ApnsService(storage, apnsConfiguration, apnsConfiguration ? new ApnsClient(apnsConfiguration) : null, () => apnsDigest(generateAppToken(getEffectivePassword(storage, config), config.appSecret ?? "")), id => sessionRegistry.ownerOf(id) === "storage" ? null : sessionRegistry.getSlim(id), message => wandWarn(message));
+    let liveActivityFactsReady = false;
+    const liveActivities = new LiveActivityService(storage, apnsConfiguration, apnsConfiguration ? new ApnsClient(apnsConfiguration) : null, () => apnsDigest(generateAppToken(getEffectivePassword(storage, config), config.appSecret ?? "")), () => liveActivityFactsReady ? sessionRegistry.listSlim({ runtimeOnly: true }) : null, message => wandWarn(message));
+    const sessionCompletions = new SessionCompletionTracker(storage, (id) => sessionRegistry.get(id), (id, revision) => apns.completed(id, revision));
     let nextEmployeeImWarningAt = 0;
     const employeeIm = new EmployeeImService(storage, { onFailure: () => {
             if (Date.now() < nextEmployeeImWarningAt)
@@ -466,6 +484,14 @@ export async function startServer(config, configPath, options = {}) {
         notifySession: notifier.conversationSession, notifyChanged: () => notifier.system({ kind: "conversations-changed" }), deleteSession: id => { sessionRegistry.deleteWithProviderHistory(id); } });
     conversations = conversationService;
     conversationService.migrateExistingChats();
+    const dingtalkDws = new DwsClient(storage.directory());
+    const dingtalk = new DingTalkService({ storage, dws: dingtalkDws, config, structured: structuredSessions,
+        changed: () => notifier.system({ kind: "conversations-changed" }) });
+    conversationService.attachExternal(dingtalk);
+    storage.onClose(() => { dingtalk.dispose(); dingtalkDws.dispose(); });
+    // Restore only explicitly persisted subscriptions; startup never creates or publishes remote resources.
+    if (!testMode)
+        void dingtalk.restore().catch(() => wandWarn("钉钉连接恢复未完成，请在连接器检查授权。"));
     const scheduledTasks = new ScheduledTaskService({ storage, conversations: conversationService,
         getSession: id => sessionRegistry.get(id), defaultCwd: () => config.defaultCwd });
     for (const prefix of [CONVERSATION_RELAY_PREFIX, AI_TEAM_CHAT_PREFIX]) {
@@ -519,6 +545,7 @@ export async function startServer(config, configPath, options = {}) {
     // Route-specific parsers must run before the global parser. Once body-parser
     // has consumed a request, a later express.json() cannot tighten or widen it.
     registerFeedbackIngress(app, feedbackReceiver);
+    registerApnsRoutes(app, { storage, config, service: apns, liveActivity: liveActivities });
     app.use("/api/feedback/client", express.json({ limit: "32kb", inflate: false }));
     app.use("/api/decisions", express.json({ limit: "32kb" }));
     app.use("/api/optimize-prompt", express.json({ limit: "256kb" }));
@@ -662,6 +689,7 @@ export async function startServer(config, configPath, options = {}) {
         notifyEmployeeChanged: (employeeId) => notifyAiTeamRun({ kind: "silicon-employee-definition", employeeId }),
     });
     registerEmployeeImRoutes(app, { storage, im: employeeIm, requireAdmin });
+    registerDingTalkRoutes(app, { service: dingtalk, requireAdmin, install: () => dingtalkDws.install() });
     registerAttentionRoutes(app, { sessions: sessionRegistry, runner: aiTeams });
     registerConversationRoutes(app, conversationService);
     registerScheduledTaskRoutes(app, scheduledTasks);
@@ -821,6 +849,8 @@ export async function startServer(config, configPath, options = {}) {
         sessionRegistry.invalidateMessageProjection(event.sessionId);
         taskTitles.ingest(event);
         sessionCompletions.ingest(event);
+        apns.ingest(event);
+        liveActivities.ingest(event);
         missions.ingest(event);
         aiTeams.ingest(event);
         employeeImLifecycle.ingest(event);
@@ -832,7 +862,10 @@ export async function startServer(config, configPath, options = {}) {
         storage.recordTaskCommentSessionEvent(event);
         conversationService.ingestSessionEvent(event);
         scheduledTasks.ingestSessionEvent(event);
+        dingtalk.ingest(event);
         sessionCompletions.ingest(event);
+        apns.ingest(event);
+        liveActivities.ingest(event);
         missions.ingest(event);
         aiTeams.ingest(event);
         employeeImLifecycle.ingest(event);
@@ -847,7 +880,14 @@ export async function startServer(config, configPath, options = {}) {
     systemCalls.attach({ emit: event => wsManager.emitEvent(event), notifyConversation: notifier.conversationSession });
     // Re-attach structured CLI runs that kept going inside terminald while the
     // previous web process was down; fire-and-forget, failures are logged inside.
-    void structuredSessions.recoverDetachedRuns().then(() => taskExecutionQueue.drainAll());
+    apns.start();
+    liveActivities.start();
+    void structuredSessions.recoverDetachedRuns().then(() => {
+        liveActivityFactsReady = true;
+        return taskExecutionQueue.drainAll();
+    }, () => {
+        wandWarn("会话恢复未确认：暂缓灵动岛远程更新，不将旧状态判为完成。");
+    });
     aiTeams.reconcile();
     structuredSessions.resumeQueuedPiMessages();
     // ── Restart endpoint (needs server + wss in scope) ──
@@ -922,6 +962,8 @@ export async function startServer(config, configPath, options = {}) {
     await new Promise((resolve, reject) => {
         const cleanupFailedListen = async () => {
             shuttingDown = true;
+            dingtalk.dispose();
+            dingtalkDws.dispose();
             employeeImLifecycle.dispose();
             employeeIm.dispose();
             await scheduledTasks.dispose();
@@ -1204,6 +1246,10 @@ export async function startServer(config, configPath, options = {}) {
             if (activeFeedback === feedback)
                 activeFeedback = null;
             taskExecutionQueue.dispose();
+            apns.dispose();
+            liveActivities.dispose();
+            dingtalk.dispose();
+            dingtalkDws.dispose();
             employeeImLifecycle.dispose();
             employeeIm.dispose();
             taskTitles.dispose();

package/dist/session-completion.d.ts

@@ -4,9 +4,10 @@ import type { ProcessEvent, SessionSnapshot } from "./types.js";
 export declare class SessionCompletionTracker {
     private readonly storage;
     private readonly getSession;
+    private readonly onCompleted?;
     private readonly busyPty;
     private readonly completedPty;
     private readonly ended;
-    constructor(storage: WandStorage, getSession: (id: string) => SessionSnapshot | null);
+    constructor(storage: WandStorage, getSession: (id: string) => SessionSnapshot | null, onCompleted?: ((sessionId: string, revision: number) => void) | undefined);
     ingest(event: ProcessEvent): void;
 }

package/dist/session-completion.js

@@ -2,12 +2,14 @@
 export class SessionCompletionTracker {
     storage;
     getSession;
+    onCompleted;
     busyPty = new Set();
     completedPty = new Set();
     ended = new Map();
-    constructor(storage, getSession) {
+    constructor(storage, getSession, onCompleted) {
         this.storage = storage;
         this.getSession = getSession;
+        this.onCompleted = onCompleted;
     }
     ingest(event) {
         if (event.type === "started") {
@@ -55,8 +57,10 @@ export class SessionCompletionTracker {
         }
         if (completed) {
             const completion = this.storage.recordSessionCompletion(snapshot.id);
-            if (completion)
+            if (completion) {
                 Object.assign(data, completion);
+                this.onCompleted?.(snapshot.id, completion.completionRevision);
+            }
         }
     }
 }

package/dist/session-registry.d.ts

@@ -41,7 +41,9 @@ export declare class SessionRegistry {
     getLatest(id: string): SessionSnapshot | null;
     /** Runtime facts and membership only; list/policy reads must not hydrate transcripts. */
     getSlim(id: string): SessionSnapshot | null;
-    listSlim(): SessionSnapshot[];
+    listSlim(options?: {
+        runtimeOnly?: boolean;
+    }): SessionSnapshot[];
     /** Membership belongs to storage; both runners only refresh their live projection. */
     refreshSessionWorkspace(id: string): void;
     setSessionModel(id: string, model: string | null): SessionSnapshot | null;

package/dist/session-registry.js

@@ -173,7 +173,7 @@ export class SessionRegistry {
         const snapshot = this.structured.getSlim(id) ?? this.processes.getOwnedSlim(id) ?? this.storage.getSessionSlim(id);
         return snapshot ? { ...snapshot, ...this.storage.getSessionWorkspace(id), ...this.storage.getSessionCompletion(id) } : null;
     }
-    listSlim() {
+    listSlim(options) {
         const byId = new Map();
         for (const snapshot of this.structured.listSlim())
             byId.set(snapshot.id, snapshot);
@@ -183,6 +183,8 @@ export class SessionRegistry {
         }
         for (const snapshot of this.storage.loadSessionsSlim()) {
             const live = byId.get(snapshot.id);
+            if (options?.runtimeOnly && !live)
+                continue;
             byId.set(snapshot.id, live ? {
                 ...live, workspaceId: snapshot.workspaceId, workspaceTaskId: snapshot.workspaceTaskId,
                 completionRevision: snapshot.completionRevision,

package/dist/storage/apns-repository.d.ts

@@ -0,0 +1,52 @@
+import type { DatabaseSync } from "node:sqlite";
+import type { WandStorage } from "../storage.js";
+import type { ApnsEnvironment } from "../apns-client.js";
+export declare const APNS_SCHEMA = "\n  CREATE TABLE IF NOT EXISTS apns_devices (\n    id TEXT PRIMARY KEY, token TEXT NOT NULL, environment TEXT NOT NULL, topic TEXT NOT NULL,\n    server_id TEXT NOT NULL, credential_digest TEXT NOT NULL, generation INTEGER NOT NULL DEFAULT 1,\n    enabled INTEGER NOT NULL DEFAULT 1, expires_at INTEGER NOT NULL\n  );\n  CREATE INDEX IF NOT EXISTS apns_devices_active ON apns_devices(enabled, expires_at);\n  CREATE TABLE IF NOT EXISTS apns_events (\n    id TEXT PRIMARY KEY, session_id TEXT NOT NULL, kind TEXT NOT NULL,\n    revision TEXT NOT NULL, created_at INTEGER NOT NULL\n  );\n  CREATE TABLE IF NOT EXISTS apns_deliveries (\n    id TEXT PRIMARY KEY, event_id TEXT NOT NULL, device_id TEXT NOT NULL, generation INTEGER NOT NULL,\n    state TEXT NOT NULL DEFAULT 'pending', attempts INTEGER NOT NULL DEFAULT 0,\n    next_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, reason TEXT,\n    UNIQUE(event_id, device_id)\n  );\n  CREATE INDEX IF NOT EXISTS apns_deliveries_due ON apns_deliveries(state, next_at);\n";
+export type ApnsEventKind = "completed" | "permission";
+export interface ApnsDevice {
+    id: string;
+    token: string;
+    environment: ApnsEnvironment;
+    topic: string;
+    server_id: string;
+    credential_digest: string;
+    generation: number;
+    enabled: number;
+    expires_at: number;
+}
+export interface ApnsDelivery {
+    id: string;
+    event_id: string;
+    device_id: string;
+    generation: number;
+    attempts: number;
+    expires_at: number;
+    session_id: string;
+    kind: ApnsEventKind;
+    revision: string;
+}
+export declare function apnsDigest(value: string): string;
+/** The revocation capability is stored as a digest only, never returned by a read endpoint. */
+export declare class ApnsRepository {
+    private readonly db;
+    private readonly storage;
+    constructor(db: DatabaseSync, storage: WandStorage);
+    register(input: {
+        secret: string;
+        token: string;
+        environment: ApnsEnvironment;
+        topic: string;
+        serverId: string;
+        credentialDigest: string;
+    }, now: number): void;
+    revoke(secret: string): void;
+    private revokeDigest;
+    private cancelPending;
+    device(id: string): ApnsDevice | null;
+    enqueue(sessionId: string, kind: ApnsEventKind, revision: string, credentialDigest: string, topic: string, environment: ApnsEnvironment, now: number): boolean;
+    due(now: number): ApnsDelivery | null;
+    finish(id: string, state: "accepted" | "canceled" | "failed", reason: string): void;
+    retry(id: string, attempts: number, next: number, reason: string): void;
+    invalidateDevice(id: string, generation: number): void;
+    sweep(now: number): void;
+}

package/dist/storage/apns-repository.js

@@ -0,0 +1,108 @@
+import { createHash, randomUUID } from "node:crypto";
+export const APNS_SCHEMA = `
+  CREATE TABLE IF NOT EXISTS apns_devices (
+    id TEXT PRIMARY KEY, token TEXT NOT NULL, environment TEXT NOT NULL, topic TEXT NOT NULL,
+    server_id TEXT NOT NULL, credential_digest TEXT NOT NULL, generation INTEGER NOT NULL DEFAULT 1,
+    enabled INTEGER NOT NULL DEFAULT 1, expires_at INTEGER NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS apns_devices_active ON apns_devices(enabled, expires_at);
+  CREATE TABLE IF NOT EXISTS apns_events (
+    id TEXT PRIMARY KEY, session_id TEXT NOT NULL, kind TEXT NOT NULL,
+    revision TEXT NOT NULL, created_at INTEGER NOT NULL
+  );
+  CREATE TABLE IF NOT EXISTS apns_deliveries (
+    id TEXT PRIMARY KEY, event_id TEXT NOT NULL, device_id TEXT NOT NULL, generation INTEGER NOT NULL,
+    state TEXT NOT NULL DEFAULT 'pending', attempts INTEGER NOT NULL DEFAULT 0,
+    next_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, reason TEXT,
+    UNIQUE(event_id, device_id)
+  );
+  CREATE INDEX IF NOT EXISTS apns_deliveries_due ON apns_deliveries(state, next_at);
+`;
+export function apnsDigest(value) { return createHash("sha256").update(value).digest("hex"); }
+/** The revocation capability is stored as a digest only, never returned by a read endpoint. */
+export class ApnsRepository {
+    db;
+    storage;
+    constructor(db, storage) {
+        this.db = db;
+        this.storage = storage;
+    }
+    register(input, now) {
+        this.storage.transaction(() => {
+            const id = apnsDigest(input.secret);
+            const previous = this.device(id);
+            const changed = !previous || previous.token !== input.token || previous.environment !== input.environment
+                || previous.topic !== input.topic || previous.server_id !== input.serverId || previous.credential_digest !== input.credentialDigest || !previous.enabled;
+            // Same physical device may have saved two origins for this same server. Only the latest binding delivers.
+            const duplicates = this.db.prepare("SELECT id FROM apns_devices WHERE token = ? AND environment = ? AND topic = ? AND id != ? AND enabled = 1")
+                .all(input.token, input.environment, input.topic, id);
+            for (const device of duplicates)
+                this.revokeDigest(device.id);
+            if (changed)
+                this.cancelPending(id);
+            this.db.prepare(`INSERT INTO apns_devices (id, token, environment, topic, server_id, credential_digest, generation, enabled, expires_at)
+        VALUES (?, ?, ?, ?, ?, ?, 1, 1, ?) ON CONFLICT(id) DO UPDATE SET
+        token = excluded.token, environment = excluded.environment, topic = excluded.topic, server_id = excluded.server_id,
+        credential_digest = excluded.credential_digest, generation = apns_devices.generation + ?, enabled = 1, expires_at = excluded.expires_at`)
+                .run(id, input.token, input.environment, input.topic, input.serverId, input.credentialDigest, now + 14 * 86_400_000, changed ? 1 : 0);
+        });
+    }
+    revoke(secret) { this.storage.transaction(() => this.revokeDigest(apnsDigest(secret))); }
+    revokeDigest(id) {
+        this.db.prepare("UPDATE apns_devices SET enabled = 0, token = '' WHERE id = ?").run(id);
+        this.cancelPending(id);
+    }
+    cancelPending(id) {
+        this.db.prepare("UPDATE apns_deliveries SET state = 'canceled', reason = 'BindingChanged' WHERE device_id = ? AND state = 'pending'").run(id);
+    }
+    device(id) {
+        return this.db.prepare("SELECT * FROM apns_devices WHERE id = ?").get(id) ?? null;
+    }
+    enqueue(sessionId, kind, revision, credentialDigest, topic, environment, now) {
+        return this.storage.transaction(() => {
+            const eventId = apnsDigest(JSON.stringify([sessionId, kind, revision]));
+            const inserted = this.db.prepare("INSERT OR IGNORE INTO apns_events (id, session_id, kind, revision, created_at) VALUES (?, ?, ?, ?, ?)")
+                .run(eventId, sessionId, kind, revision, now);
+            if (!inserted.changes)
+                return true;
+            const count = this.db.prepare("SELECT COUNT(*) AS n FROM apns_deliveries WHERE state = 'pending'").get();
+            if (count.n >= 1000)
+                return false; // bounded best-effort queue; never delay execution for a notification.
+            const devices = this.db.prepare(`SELECT id, generation FROM apns_devices WHERE enabled = 1 AND expires_at > ?
+        AND credential_digest = ? AND topic = ? AND environment = ? LIMIT ?`)
+                .all(now, credentialDigest, topic, environment, 1000 - count.n);
+            const expiresAt = now + (kind === "permission" ? 15 * 60_000 : 60 * 60_000);
+            for (const device of devices) {
+                this.db.prepare(`INSERT INTO apns_deliveries (id, event_id, device_id, generation, next_at, expires_at)
+          VALUES (?, ?, ?, ?, ?, ?)`).run(randomUUID(), eventId, device.id, device.generation, now, expiresAt);
+            }
+            return devices.length < 1000 - count.n;
+        });
+    }
+    due(now) {
+        return this.db.prepare(`SELECT d.id, d.event_id, d.device_id, d.generation, d.attempts, d.expires_at,
+      e.session_id, e.kind, e.revision FROM apns_deliveries d JOIN apns_events e ON e.id = d.event_id
+      WHERE d.state = 'pending' AND d.next_at <= ? ORDER BY d.next_at, d.rowid LIMIT 1`).get(now) ?? null;
+    }
+    finish(id, state, reason) {
+        this.db.prepare("UPDATE apns_deliveries SET state = ?, reason = ? WHERE id = ? AND state = 'pending'").run(state, reason, id);
+    }
+    retry(id, attempts, next, reason) {
+        this.db.prepare("UPDATE apns_deliveries SET attempts = ?, next_at = ?, reason = ? WHERE id = ? AND state = 'pending'").run(attempts, next, reason, id);
+    }
+    invalidateDevice(id, generation) {
+        // A late APNs rejection for an old token must never disable its replacement.
+        const current = this.device(id);
+        if (current?.generation === generation)
+            this.revokeDigest(id);
+    }
+    sweep(now) {
+        this.storage.transaction(() => {
+            this.db.prepare("UPDATE apns_devices SET enabled = 0, token = '' WHERE expires_at <= ?").run(now);
+            this.db.prepare("UPDATE apns_deliveries SET state = 'canceled', reason = 'Expired' WHERE expires_at <= ? AND state = 'pending'").run(now);
+            this.db.prepare("DELETE FROM apns_deliveries WHERE expires_at < ?").run(now - 7 * 86_400_000);
+            this.db.prepare("DELETE FROM apns_events WHERE created_at < ? AND id NOT IN (SELECT event_id FROM apns_deliveries)").run(now - 7 * 86_400_000);
+            this.db.prepare("DELETE FROM apns_devices WHERE expires_at < ?").run(now - 7 * 86_400_000);
+        });
+    }
+}

package/dist/storage/conversations-repository.d.ts

@@ -48,6 +48,8 @@ export declare class ConversationRepository {
     conversationSessionIds(id: string): string[];
     conversationTaskStartup(taskId: string): ConversationRequest["receipt"] | null;
     appendConversationEvent(id: string, turn: ConversationTurn): void;
+    /** Exact message update scoped to its owning conversation; external echoes never create a second transcript. */
+    updateConversationEvent(id: string, messageId: string, patch: Partial<ConversationTurn>): boolean;
     conversationEvents(id: string): ConversationTurn[];
     /** List preview only needs the newest event, not the whole transcript. */
     lastConversationEvent(id: string): ConversationTurn | null;

package/dist/storage/conversations-repository.js

@@ -190,6 +190,16 @@ export class ConversationRepository {
         this.db.prepare("INSERT INTO conversation_messages(id, conversation_id, turn_json, created_at) VALUES (?, ?, ?, ?)")
             .run(messageId, id, JSON.stringify({ ...turn, messageId, conversationId: id, createdAt }), createdAt);
     }
+    /** Exact message update scoped to its owning conversation; external echoes never create a second transcript. */
+    updateConversationEvent(id, messageId, patch) {
+        const row = this.db.prepare("SELECT turn_json FROM conversation_messages WHERE id = ? AND conversation_id = ?").get(messageId, id);
+        if (!row)
+            return false;
+        const turn = JSON.parse(row.turn_json);
+        this.db.prepare("UPDATE conversation_messages SET turn_json = ? WHERE id = ? AND conversation_id = ?")
+            .run(JSON.stringify({ ...turn, ...patch, messageId, conversationId: id }), messageId, id);
+        return true;
+    }
     conversationEvents(id) {
         return this.db.prepare("SELECT turn_json FROM conversation_messages WHERE conversation_id = ? ORDER BY created_at, rowid")
             .all(id).map((row) => JSON.parse(row.turn_json));

package/dist/storage/dingtalk-repository.d.ts

@@ -0,0 +1,20 @@
+import type { DatabaseSync } from "node:sqlite";
+import type { DingTalkRecordKind, DingTalkRun } from "../dingtalk-types.js";
+/** Additive domain records. Secrets belong to the existing encrypted connector vault, never this table. */
+export declare const DINGTALK_SCHEMA = "CREATE TABLE IF NOT EXISTS dingtalk_records (\n  kind TEXT NOT NULL, id TEXT NOT NULL, data TEXT NOT NULL, updated_at TEXT NOT NULL,\n  PRIMARY KEY(kind, id)\n); CREATE INDEX IF NOT EXISTS dingtalk_records_kind_updated ON dingtalk_records(kind, updated_at);\nCREATE INDEX IF NOT EXISTS dingtalk_records_state ON dingtalk_records(kind, json_extract(data, '$.state'), id);\nCREATE INDEX IF NOT EXISTS dingtalk_records_delivery ON dingtalk_records(kind, json_extract(data, '$.delivery'), updated_at, id);\nCREATE INDEX IF NOT EXISTS dingtalk_records_binding_delivery ON dingtalk_records(kind, json_extract(data, '$.bindingId'), json_extract(data, '$.delivery'));";
+export declare class DingTalkRepository {
+    private readonly db;
+    constructor(db: DatabaseSync);
+    getDingTalkRecord<T>(kind: DingTalkRecordKind, id: string): T | null;
+    listDingTalkRecords<T>(kind: DingTalkRecordKind): T[];
+    saveDingTalkRecord(kind: DingTalkRecordKind, id: string, value: unknown): void;
+    /** Explicit mirror deletion removes body copies but retains content-free admission tombstones. */
+    clearDingTalkGroupHistory(groupId: string): void;
+    countDingTalkRecords(kind: DingTalkRecordKind): number;
+    pendingDingTalkDeliveries(): DingTalkRun[];
+    runningDingTalkPage(after: string): DingTalkRun[];
+    /** Recovery never replays a model or a resource write. A request claim is the boundary before sending. */
+    recoverDingTalkIntents(): void;
+    /** Claim before any I/O. An unknown outcome is retained across restarts, never automatically replayed. */
+    claimDingTalkRecord(kind: DingTalkRecordKind, id: string, value: unknown): boolean;
+}