@dsh-overdrive/gateway 0.1.4 → 0.1.5

package/dist/index.js

@@ -108,7 +108,7 @@ async function handleCommand(adapter, client, command, sessionId, chatId, aggreg
 }
 /** 单个适配器的接线：白名单 → 命令面/upsert → sendMessage；按钮 → resolveApproval；事件流经轨迹聚合。 */
 export async function wireAdapter(adapter, client, opts) {
-    const allow = new Allowlist(opts.allowlist);
+    const allow = new Allowlist(opts.allowlist, opts.allowAll);
     const chatIds = new Map();
     const aggregator = new TrajectoryAggregator();
     const deltas = new DeltaTracker();
@@ -147,7 +147,7 @@ export async function wireAdapter(adapter, client, opts) {
             await adapter.send(msg.chatId, { text: `❌ 出错了：${message}` }).catch(() => undefined);
         }
     });
-    adapter.onReply(async (buttonId) => {
+    adapter.onReply(async (buttonId, sender) => {
         try {
             const idx = buttonId.indexOf(':');
             if (idx < 0)
@@ -155,6 +155,15 @@ export async function wireAdapter(adapter, client, opts) {
             const action = buttonId.slice(0, idx);
             const reqId = buttonId.slice(idx + 1);
             if ((action === 'approve' || action === 'reject') && reqId) {
+                // 安全边界：审批按钮必须校验点击者（维护者评审指出：未授权用户可代授权）
+                const senderKey = buildSessionKey(adapter.id, { chatId: sender.chatId, userId: sender.userId });
+                if (!allow.allows(senderKey)) {
+                    console.warn(`[gateway][${adapter.id}] 按钮点击者不在白名单，拒绝批准: ${senderKey}`);
+                    if (sender.chatId) {
+                        await adapter.send(sender.chatId, { text: '⛔ 你不在白名单里，不能批准该操作。' }).catch(() => undefined);
+                    }
+                    return;
+                }
                 await client.resolveApproval(reqId, action);
             }
         }
@@ -192,6 +201,7 @@ async function main() {
     const dshToken = process.env.DSH_TOKEN ?? 'dev-token';
     const allowlist = (process.env.ALLOWLIST ?? '')
         .split(',').map((s) => s.trim()).filter(Boolean);
+    const allowAll = process.env.ALLOW_ALL === '1';
     const adapterIds = parseAdapterIds(process.env.GATEWAY_ADAPTERS ?? 'cli');
     const env = adapterEnvFromProcess();
     const asr = createTranscriber({
@@ -206,7 +216,7 @@ async function main() {
     const adapters = adapterIds.map((id) => createAdapter(id, env));
     for (const adapter of adapters) {
         await adapter.connect();
-        await wireAdapter(adapter, client, { allowlist, asr });
+        await wireAdapter(adapter, client, { allowlist, allowAll, asr });
         console.log(`[gateway] ${adapter.id} 适配器已就绪`);
     }
     const consolePort = Number(process.env.GATEWAY_CONSOLE_PORT ?? 3190);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAoB,MAAM,oBAAoB,CAAC;AAErE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAsB,MAAM,eAAe,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAuB,MAAM,UAAU,CAAC;AAElE;;;GAGG;AACH,MAAM,OAAO,YAAY;IACN,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAE3C,OAAO,CAAC,SAAiB,EAAE,UAAsB;QAC/C,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO;QACtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1B,UAAU,EAAE,CAAC;IACf,CAAC;IAED,kEAAkE;IAClE,UAAU,CAAC,SAAiB;QAC1B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;CACF;AAED,6CAA6C;AAC7C,MAAM,UAAU,YAAY,CAAC,EAAe;IAC1C,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,kBAAkB;YACrB,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,KAAK,eAAe;YAClB,OAAO,IAAI,CAAC,CAAC,wCAAwC;QACvD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACzF,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC;QAC3D,CAAC;QACD,KAAK,oBAAoB;YACvB,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QAClE,KAAK,kBAAkB;YACrB,OAAO;gBACL,OAAO,EAAE;oBACP,IAAI,EAAE,WAAW,EAAE,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ;oBACtE,OAAO,EAAE;wBACP,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;wBAC5C,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;qBAC7C;iBACF;aACF,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO,EAAE,CAAC,MAAM,KAAK,kBAAkB;gBACrC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;gBACpC,CAAC,CAAC,IAAI,CAAC;QACX,KAAK,WAAW;YACd,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;QACtF,KAAK,OAAO;YACV,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC;QACtD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAQD,uDAAuD;AACvD,KAAK,UAAU,aAAa,CAC1B,OAAgB,EAChB,MAAqB,EACrB,OAAsB,EACtB,SAAiB,EACjB,MAAc,EACd,UAAgC;IAEhC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,OAAO,GAAG,UAAU,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,IAAI,iBAAiB,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACrC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACjF,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YACzG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM;gBAC3B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC1F,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,GAAG,CAAC,KAAK,CAAC,MAAM,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpD,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE;gBACzB,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,aAAa,OAAO,CAAC,MAAM,IAAI;aACrF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB,EAChB,MAAqB,EACrB,IAAiB;IAEjB,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;IAElC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,EAAE,eAAe,GAAG,CAAC,MAAM,SAAS,GAAG,CAAC,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACnH,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAE7B,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACvE,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;gBAC3E,OAAO;YACT,CAAC;YAED,+CAA+C;YAC/C,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;gBACrD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACxD,IAAI,UAAU,EAAE,CAAC;oBACf,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,YAAY,UAAU,EAAE,CAAC,CAAC,CAAC,UAAU,UAAU,EAAE,CAAC;oBACnF,GAAG,CAAC,KAAK,GAAG,SAAS,CAAC;oBACtB,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,EAAE,WAAW,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC3E,CAAC;YACH,CAAC;YAED,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5F,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,EAAE,yBAAyB,GAAG,EAAE,CAAC,CAAC;YACnE,MAAM,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CAAC,aAAa,OAAO,CAAC,EAAE,WAAW,OAAO,EAAE,CAAC,CAAC;YAC3D,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAyB,CAAC;YAC9D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;gBAC3D,MAAM,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,CAAC,SAAiB,EAAU,EAAE;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IAC9C,CAAC,CAAC;IAEF,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;QAC1B,0DAA0D;QAC1D,IAAI,EAAE,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAChC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACzF,CAAC;aAAM,IAAI,EAAE,CAAC,IAAI,KAAK,kBAAkB,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACjE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QAED,4DAA4D;QAC5D,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,EAAE,QAAQ,GAAG,CAAC,IAAI,WAAW,MAAM,EAAE,CAAC,CAAC;YACxE,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAC7C,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,EAAE,SAAS,GAAG,CAAC,IAAI,MAAM,MAAM,EAAE,CAAC,EACzE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,OAAO,CAAC,EAAE,UAAU,GAAG,CAAC,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CACjI,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,uBAAuB,CAAC;IACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,WAAW,CAAC;IACtD,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;SAC5C,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,MAAM,EAAE,GAAG,CAAC,SAAS;QACrB,OAAO,EAAE,GAAG,CAAC,UAAU;QACvB,KAAK,EAAE,GAAG,CAAC,QAAQ;KACpB,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAEtD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,qBAAqB;IAE5C,MAAM,QAAQ,GAAc,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1E,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,gCAAgC,WAAW,GAAG,CAAC,CAAC;IAE5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AACnF,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC;IAAE,KAAK,IAAI,EAAE,CAAC;AAEvD,sBAAsB;AACtB,OAAO,EAAE,UAAU,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAoB,MAAM,oBAAoB,CAAC;AAErE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,SAAS,EAAsB,MAAM,eAAe,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAuB,MAAM,UAAU,CAAC;AAElE;;;GAGG;AACH,MAAM,OAAO,YAAY;IACN,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAE3C,OAAO,CAAC,SAAiB,EAAE,UAAsB;QAC/C,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO;QACtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1B,UAAU,EAAE,CAAC;IACf,CAAC;IAED,kEAAkE;IAClE,UAAU,CAAC,SAAiB;QAC1B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;CACF;AAED,6CAA6C;AAC7C,MAAM,UAAU,YAAY,CAAC,EAAe;IAC1C,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,kBAAkB;YACrB,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,KAAK,eAAe;YAClB,OAAO,IAAI,CAAC,CAAC,wCAAwC;QACvD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACzF,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC;QAC3D,CAAC;QACD,KAAK,oBAAoB;YACvB,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QAClE,KAAK,kBAAkB;YACrB,OAAO;gBACL,OAAO,EAAE;oBACP,IAAI,EAAE,WAAW,EAAE,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ;oBACtE,OAAO,EAAE;wBACP,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;wBAC5C,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;qBAC7C;iBACF;aACF,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO,EAAE,CAAC,MAAM,KAAK,kBAAkB;gBACrC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;gBACpC,CAAC,CAAC,IAAI,CAAC;QACX,KAAK,WAAW;YACd,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;QACtF,KAAK,OAAO;YACV,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC;QACtD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAUD,uDAAuD;AACvD,KAAK,UAAU,aAAa,CAC1B,OAAgB,EAChB,MAAqB,EACrB,OAAsB,EACtB,SAAiB,EACjB,MAAc,EACd,UAAgC;IAEhC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,OAAO,GAAG,UAAU,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,IAAI,iBAAiB,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACrC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACjF,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YACzG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM;gBAC3B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC1F,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,GAAG,CAAC,KAAK,CAAC,MAAM,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpD,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE;gBACzB,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,aAAa,OAAO,CAAC,MAAM,IAAI;aACrF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB,EAChB,MAAqB,EACrB,IAAiB;IAEjB,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;IAElC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,EAAE,eAAe,GAAG,CAAC,MAAM,SAAS,GAAG,CAAC,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACnH,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAE7B,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACvE,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;gBAC3E,OAAO;YACT,CAAC;YAED,+CAA+C;YAC/C,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;gBACrD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACxD,IAAI,UAAU,EAAE,CAAC;oBACf,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,YAAY,UAAU,EAAE,CAAC,CAAC,CAAC,UAAU,UAAU,EAAE,CAAC;oBACnF,GAAG,CAAC,KAAK,GAAG,SAAS,CAAC;oBACtB,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,EAAE,WAAW,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC3E,CAAC;YACH,CAAC;YAED,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5F,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,EAAE,yBAAyB,GAAG,EAAE,CAAC,CAAC;YACnE,MAAM,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,CAAC,KAAK,CAAC,aAAa,OAAO,CAAC,EAAE,WAAW,OAAO,EAAE,CAAC,CAAC;YAC3D,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO;YACpB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAyB,CAAC;YAC9D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;gBAC3D,sCAAsC;gBACtC,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBAChG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC7B,OAAO,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,EAAE,sBAAsB,SAAS,EAAE,CAAC,CAAC;oBACvE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;wBAClB,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBAC3F,CAAC;oBACD,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,CAAC,SAAiB,EAAU,EAAE;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IAC9C,CAAC,CAAC;IAEF,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;QAC1B,0DAA0D;QAC1D,IAAI,EAAE,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAChC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACzF,CAAC;aAAM,IAAI,EAAE,CAAC,IAAI,KAAK,kBAAkB,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACjE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QAED,4DAA4D;QAC5D,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,EAAE,QAAQ,GAAG,CAAC,IAAI,WAAW,MAAM,EAAE,CAAC,CAAC;YACxE,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAC7C,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,EAAE,SAAS,GAAG,CAAC,IAAI,MAAM,MAAM,EAAE,CAAC,EACzE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,OAAO,CAAC,EAAE,UAAU,GAAG,CAAC,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CACjI,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,uBAAuB,CAAC;IACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,WAAW,CAAC;IACtD,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;SAC5C,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC;IAC/C,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,MAAM,EAAE,GAAG,CAAC,SAAS;QACrB,OAAO,EAAE,GAAG,CAAC,UAAU;QACvB,KAAK,EAAE,GAAG,CAAC,QAAQ;KACpB,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAEtD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,qBAAqB;IAE5C,MAAM,QAAQ,GAAc,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1E,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,gCAAgC,WAAW,GAAG,CAAC,CAAC;IAE5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AACnF,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC;IAAE,KAAK,IAAI,EAAE,CAAC;AAEvD,sBAAsB;AACtB,OAAO,EAAE,UAAU,EAAE,CAAC"}

package/dist/session.d.ts

@@ -2,9 +2,13 @@ export declare function buildSessionKey(adapterId: string, msg: {
     chatId: string;
     userId: string;
 }): string;
-/** 空列表 = 开发模式放行所有；生产环境必须显式配置。 */
+/**
+ * 白名单：默认 fail-closed —— 只有显式配置了条目才放行；
+ * 开发环境可用 ALLOW_ALL=1 显式放行所有（比空列表隐式放行安全得多）。
+ */
 export declare class Allowlist {
     private readonly entries;
-    constructor(entries: string[]);
+    private readonly allowAll;
+    constructor(entries: string[], allowAll?: boolean);
     allows(key: string): boolean;
 }

package/dist/session.js

@@ -2,14 +2,19 @@ import { sessionKey } from '@dsh-overdrive/sdk';
 export function buildSessionKey(adapterId, msg) {
     return sessionKey(adapterId, msg.chatId, msg.userId);
 }
-/** 空列表 = 开发模式放行所有；生产环境必须显式配置。 */
+/**
+ * 白名单：默认 fail-closed —— 只有显式配置了条目才放行；
+ * 开发环境可用 ALLOW_ALL=1 显式放行所有（比空列表隐式放行安全得多）。
+ */
 export class Allowlist {
     entries;
-    constructor(entries) {
+    allowAll;
+    constructor(entries, allowAll = false) {
         this.entries = entries;
+        this.allowAll = allowAll;
     }
     allows(key) {
-        return this.entries.length === 0 || this.entries.includes(key);
+        return this.allowAll || (this.entries.length > 0 && this.entries.includes(key));
     }
 }
 //# sourceMappingURL=session.js.map

package/dist/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,MAAM,UAAU,eAAe,CAC7B,SAAiB,EACjB,GAAuC;IAEvC,OAAO,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,iCAAiC;AACjC,MAAM,OAAO,SAAS;IACS;IAA7B,YAA6B,OAAiB;QAAjB,YAAO,GAAP,OAAO,CAAU;IAAG,CAAC;IAElD,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC;CACF"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,MAAM,UAAU,eAAe,CAC7B,SAAiB,EACjB,GAAuC;IAEvC,OAAO,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,SAAS;IAED;IACA;IAFnB,YACmB,OAAiB,EACjB,WAAW,KAAK;QADhB,YAAO,GAAP,OAAO,CAAU;QACjB,aAAQ,GAAR,QAAQ,CAAQ;IAChC,CAAC;IAEJ,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAClF,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
-{
+{
   "name": "@dsh-overdrive/gateway",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "type": "module",
   "scripts": {
     "build": "tsc"

package/src/adapter.ts

@@ -12,6 +12,12 @@ export interface OutboundPayload {
   buttons?: OutboundButton[];
 }
 
+/** 按钮回执的点击者身份（用于白名单校验）。chatId 在个别平台回调中可能缺失，缺失时按未授权处理（fail-closed）。 */
+export interface ReplySender {
+  chatId: string;
+  userId: string;
+}
+
 /** 平台适配器契约：M2/M3 的 WhatsApp/Telegram/… 都实现它。 */
 export interface Adapter {
   readonly id: string;
@@ -22,5 +28,6 @@ export interface Adapter {
   /** 可选：连接状态（供控制台）。 */
   status?(): { connected: boolean };
   onMessage(cb: (msg: NormalizedMessage) => void): void;
-  onReply(cb: (buttonId: string) => void): void;
+  /** 按钮点击回执：buttonId + 点击者身份。身份缺失即传空字符串，由上层按未授权处理。 */
+  onReply(cb: (buttonId: string, sender: ReplySender) => void): void;
 }

package/src/adapters/cli.ts

@@ -5,7 +5,7 @@ import type { Adapter, NormalizedMessage, OutboundPayload } from '../adapter.js'
 export class CliAdapter implements Adapter {
   readonly id = 'cli';
   private messageCb?: (msg: NormalizedMessage) => void;
-  private replyCb?: (buttonId: string) => void;
+  private replyCb?: (buttonId: string, sender: { chatId: string; userId: string }) => void;
   private rl?: ReturnType<typeof createInterface>;
 
   async connect(): Promise<void> {
@@ -15,7 +15,7 @@ export class CliAdapter implements Adapter {
       if (!trimmed) return;
       const btn = trimmed.match(/^\/btn\s+(\S+)$/i);
       if (btn) {
-        this.replyCb?.(btn[1]);
+        this.replyCb?.(btn[1], { chatId: 'cli', userId: 'local' });
         return;
       }
       this.messageCb?.({ chatId: 'cli', userId: 'local', text: trimmed });
@@ -31,7 +31,7 @@ export class CliAdapter implements Adapter {
   }
 
   onMessage(cb: (msg: NormalizedMessage) => void): void { this.messageCb = cb; }
-  onReply(cb: (buttonId: string) => void): void { this.replyCb = cb; }
+  onReply(cb: (buttonId: string, sender: { chatId: string; userId: string }) => void): void { this.replyCb = cb; }
   /** CLI 是本地进程内适配器：恒为已连接。 */
   status(): { connected: boolean } { return { connected: true }; }
 }

package/src/adapters/dingtalk.ts

@@ -70,31 +70,46 @@ export function buildActionCard(text: string, buttons: OutboundButton[]): {
   };
 }
 
+export interface CardCallbackResult {
+  buttonId: string;
+  chatId?: string;
+  userId?: string;
+}
+
 /**
- * 钉钉卡片回调载荷 → 按钮 id（"approve:<reqId>"）。
- * Stream 模式下回调 JSON 的字段名（cardCallbackData / params / cardActionData）在不同卡片版本有差异，
- * 这里做多路径深度兜底解析；真机验证后可按实际字段收敛。找不到返回 null。
+ * 钉钉卡片回调载荷 → { buttonId, chatId?, userId? }。
+ * Stream 模式下回调 JSON 的字段名（cardCallbackData / params / cardActionData，以及会话/用户字段）
+ * 在不同卡片版本有差异，这里做多路径深度兜底解析；真机验证后可按实际字段收敛。找不到返回 null。
  */
-export function parseCardCallback(raw: unknown): string | null {
-  const visit = (obj: unknown, depth: number): string | null => {
-    if (depth > 5 || !obj || typeof obj !== 'object') return null;
+export function parseCardCallback(raw: unknown): CardCallbackResult | null {
+  let buttonId: string | null = null;
+  let chatId: string | undefined;
+  let userId: string | undefined;
+
+  const visit = (obj: unknown, depth: number): void => {
+    if (depth > 5 || !obj || typeof obj !== 'object') return;
     for (const [key, value] of Object.entries(obj as Record<string, unknown>)) {
-      if (typeof value === 'string' && (key === 'cardCallbackData' || key === 'params' || key === 'cardActionData')) {
+      if (!buttonId && typeof value === 'string' && (key === 'cardCallbackData' || key === 'params' || key === 'cardActionData')) {
         try {
           const parsed = JSON.parse(value) as { action?: string; reqId?: string };
           if ((parsed.action === 'approve' || parsed.action === 'reject') && typeof parsed.reqId === 'string' && parsed.reqId) {
-            return `${parsed.action}:${parsed.reqId}`;
+            buttonId = `${parsed.action}:${parsed.reqId}`;
           }
         } catch {
           /* 该字段不是 JSON 载荷，继续往下找 */
         }
       }
-      const found = visit(value, depth + 1);
-      if (found) return found;
+      if (!chatId && typeof value === 'string' && (key === 'conversationId' || key === 'conversation_id') && value) {
+        chatId = value;
+      }
+      if (!userId && typeof value === 'string' && (key === 'senderStaffId' || key === 'senderId' || key === 'userid' || key === 'userId') && value) {
+        userId = value;
+      }
+      if (typeof value === 'object') visit(value, depth + 1);
     }
-    return null;
   };
-  return visit(raw, 0);
+  visit(raw, 0);
+  return buttonId ? { buttonId, chatId, userId } : null;
 }
 
 // ── 适配器 ────────────────────────────────────────────────────
@@ -109,7 +124,7 @@ export class DingTalkAdapter implements Adapter {
   private client?: DWClient;
   private connected = false;
   private messageCb?: (msg: NormalizedMessage) => void;
-  private replyCb?: (buttonId: string) => void;
+  private replyCb?: (buttonId: string, sender: { chatId: string; userId: string }) => void;
   private readonly pendingButtons = new PendingButtons();
   /** conversationId → 最近的 sessionWebhook（回复通道，过期由钉钉侧管理） */
   private readonly webhooks = new Map<string, string>();
@@ -131,7 +146,7 @@ export class DingTalkAdapter implements Adapter {
       this.webhooks.set(parsed.chatId, parsed.sessionWebhook);
       const button = this.pendingButtons.match(parsed.chatId, parsed.text);
       if (button) {
-        this.replyCb?.(button.id);
+        this.replyCb?.(button.id, { chatId: parsed.chatId, userId: parsed.userId });
         return;
       }
       this.messageCb?.({ chatId: parsed.chatId, userId: parsed.userId, text: parsed.text });
@@ -144,8 +159,13 @@ export class DingTalkAdapter implements Adapter {
       } catch {
         return;
       }
-      const buttonId = parseCardCallback(data);
-      if (buttonId) this.replyCb?.(buttonId);
+      const result = parseCardCallback(data);
+      if (result) {
+        this.replyCb?.(result.buttonId, {
+          chatId: result.chatId ?? result.userId ?? '',
+          userId: result.userId ?? '',
+        });
+      }
     });
     await client.connect();
     this.connected = true;
@@ -181,6 +201,6 @@ export class DingTalkAdapter implements Adapter {
   }
 
   onMessage(cb: (msg: NormalizedMessage) => void): void { this.messageCb = cb; }
-  onReply(cb: (buttonId: string) => void): void { this.replyCb = cb; }
+  onReply(cb: (buttonId: string, sender: { chatId: string; userId: string }) => void): void { this.replyCb = cb; }
   status(): { connected: boolean } { return { connected: this.connected }; }
 }

package/src/adapters/discord.ts

@@ -64,7 +64,7 @@ export class DiscordAdapter implements Adapter {
   private readonly client: Client;
   private connected = false;
   private messageCb?: (msg: NormalizedMessage) => void;
-  private replyCb?: (buttonId: string) => void;
+  private replyCb?: (buttonId: string, sender: { chatId: string; userId: string }) => void;
 
   constructor(opts: DiscordAdapterOptions) {
     this.client = new Client({
@@ -89,7 +89,10 @@ export class DiscordAdapter implements Adapter {
       if (!interaction.isButton()) return;
       const button = interaction as ButtonInteraction;
       await button.deferUpdate().catch(() => undefined);
-      this.replyCb?.(button.customId);
+      this.replyCb?.(button.customId, {
+        chatId: button.channelId,
+        userId: button.user.id,
+      });
     });
   }
 
@@ -112,6 +115,6 @@ export class DiscordAdapter implements Adapter {
   }
 
   onMessage(cb: (msg: NormalizedMessage) => void): void { this.messageCb = cb; }
-  onReply(cb: (buttonId: string) => void): void { this.replyCb = cb; }
+  onReply(cb: (buttonId: string, sender: { chatId: string; userId: string }) => void): void { this.replyCb = cb; }
   status(): { connected: boolean } { return { connected: this.connected }; }
 }

package/src/adapters/feishu.ts

@@ -96,7 +96,7 @@ export class FeishuAdapter implements Adapter {
   private ws?: InstanceType<typeof WSClient>;
   private connected = false;
   private messageCb?: (msg: NormalizedMessage) => void;
-  private replyCb?: (buttonId: string) => void;
+  private replyCb?: (buttonId: string, sender: { chatId: string; userId: string }) => void;
   private readonly pendingButtons = new PendingButtons();
   /** chatId → 最近一条入站消息的 message_id（send 优先 reply，缺失则 create 兜底） */
   private readonly lastMessageIds = new Map<string, string>();
@@ -117,15 +117,26 @@ export class FeishuAdapter implements Adapter {
         const chatId = normalized.chatId;
         const button = this.pendingButtons.match(chatId, normalized.text);
         if (button) {
-          this.replyCb?.(button.id);
+          this.replyCb?.(button.id, { chatId, userId: normalized.userId });
           return;
         }
         this.messageCb?.(normalized);
       },
       // 原生交互卡片按钮回调 → 审批应答（Roadmap v0.2）
-      'card.action.trigger': async (data: { action?: { value?: unknown } }) => {
+      // 载荷字段（operator.open_id / context.open_chat_id）取自官方卡片回调事件；
+      // 个别版本字段名可能不同 —— 拿不到身份时上层按未授权处理（fail-closed），编号回复兜底不受影响。
+      'card.action.trigger': async (data: {
+        action?: { value?: unknown };
+        operator?: { open_id?: string };
+        context?: { open_chat_id?: string };
+      }) => {
         const buttonId = cardActionToButtonId(data?.action?.value);
-        if (buttonId) this.replyCb?.(buttonId);
+        if (buttonId) {
+          this.replyCb?.(buttonId, {
+            chatId: data?.context?.open_chat_id ?? '',
+            userId: data?.operator?.open_id ?? '',
+          });
+        }
       },
     });
     this.ws = new WSClient({
@@ -175,6 +186,6 @@ export class FeishuAdapter implements Adapter {
   }
 
   onMessage(cb: (msg: NormalizedMessage) => void): void { this.messageCb = cb; }
-  onReply(cb: (buttonId: string) => void): void { this.replyCb = cb; }
+  onReply(cb: (buttonId: string, sender: { chatId: string; userId: string }) => void): void { this.replyCb = cb; }
   status(): { connected: boolean } { return { connected: this.connected }; }
 }

package/src/adapters/slack.ts

@@ -69,7 +69,7 @@ export class SlackAdapter implements Adapter {
   private readonly app: InstanceType<typeof App>;
   private connected = false;
   private messageCb?: (msg: NormalizedMessage) => void;
-  private replyCb?: (buttonId: string) => void;
+  private replyCb?: (buttonId: string, sender: { chatId: string; userId: string }) => void;
 
   constructor(opts: SlackAdapterOptions) {
     this.app = new App({ token: opts.botToken, appToken: opts.appToken, socketMode: true });
@@ -82,8 +82,18 @@ export class SlackAdapter implements Adapter {
     });
     this.app.action(/^approve:|^reject:/, async ({ ack, body, respond }) => {
       await ack();
-      const action = (body as { actions?: Array<{ value?: string }> }).actions?.[0];
-      if (action?.value) this.replyCb?.(action.value);
+      const b = body as {
+        actions?: Array<{ value?: string }>;
+        user?: { id?: string };
+        channel?: { id?: string };
+      };
+      const action = b.actions?.[0];
+      if (action?.value) {
+        this.replyCb?.(action.value, {
+          chatId: b.channel?.id ?? '',
+          userId: b.user?.id ?? '',
+        });
+      }
       await respond({ text: '处理中…', replace_original: false }).catch(() => undefined);
     });
     await this.app.start(0); // Socket Mode 不需要端口；start(0) 仅建立连接
@@ -100,6 +110,6 @@ export class SlackAdapter implements Adapter {
   }
 
   onMessage(cb: (msg: NormalizedMessage) => void): void { this.messageCb = cb; }
-  onReply(cb: (buttonId: string) => void): void { this.replyCb = cb; }
+  onReply(cb: (buttonId: string, sender: { chatId: string; userId: string }) => void): void { this.replyCb = cb; }
   status(): { connected: boolean } { return { connected: this.connected }; }
 }

package/src/adapters/telegram.ts

@@ -69,7 +69,7 @@ export class TelegramAdapter implements Adapter {
   private readonly token: string;
   private connected = false;
   private messageCb?: (msg: NormalizedMessage) => void;
-  private replyCb?: (buttonId: string) => void;
+  private replyCb?: (buttonId: string, sender: { chatId: string; userId: string }) => void;
 
   constructor(opts: TelegramAdapterOptions) {
     this.token = opts.token;
@@ -86,7 +86,11 @@ export class TelegramAdapter implements Adapter {
     this.bot.on('callback_query:data', async (ctx) => {
       const data = ctx.callbackQuery.data;
       await ctx.answerCallbackQuery().catch(() => undefined);
-      this.replyCb?.(data);
+      const chat = ctx.callbackQuery.message?.chat as { id?: number | string } | undefined;
+      this.replyCb?.(data, {
+        chatId: String(chat?.id ?? ''),
+        userId: String(ctx.callbackQuery.from.id),
+      });
     });
     this.bot.catch((err) => console.error('[telegram]', err));
     void this.bot.start(); // 长轮询（自托管无需 webhook）
@@ -124,6 +128,6 @@ export class TelegramAdapter implements Adapter {
   }
 
   onMessage(cb: (msg: NormalizedMessage) => void): void { this.messageCb = cb; }
-  onReply(cb: (buttonId: string) => void): void { this.replyCb = cb; }
+  onReply(cb: (buttonId: string, sender: { chatId: string; userId: string }) => void): void { this.replyCb = cb; }
   status(): { connected: boolean } { return { connected: this.connected }; }
 }

package/src/adapters/wecom.ts

@@ -98,7 +98,7 @@ export class WeComAdapter implements Adapter {
   private server?: ReturnType<typeof createServer>;
   private connected = false;
   private messageCb?: (msg: NormalizedMessage) => void;
-  private replyCb?: (buttonId: string) => void;
+  private replyCb?: (buttonId: string, sender: { chatId: string; userId: string }) => void;
   private readonly pendingButtons = new PendingButtons();
   /** access_token 缓存：企业微信 token 有效期 7200s，且有获取频率限制，必须复用。 */
   private tokenCache?: { token: string; expiresAt: number };
@@ -143,7 +143,7 @@ export class WeComAdapter implements Adapter {
       if (!normalized) return;
       const button = this.pendingButtons.match(normalized.chatId, normalized.text);
       if (button) {
-        this.replyCb?.(button.id);
+        this.replyCb?.(button.id, { chatId: normalized.chatId, userId: normalized.userId });
         return;
       }
       this.messageCb?.(normalized);
@@ -178,7 +178,7 @@ export class WeComAdapter implements Adapter {
   }
 
   onMessage(cb: (msg: NormalizedMessage) => void): void { this.messageCb = cb; }
-  onReply(cb: (buttonId: string) => void): void { this.replyCb = cb; }
+  onReply(cb: (buttonId: string, sender: { chatId: string; userId: string }) => void): void { this.replyCb = cb; }
   status(): { connected: boolean } { return { connected: this.connected }; }
 }
 

package/src/adapters/whatsapp.ts

@@ -129,7 +129,7 @@ export class WhatsAppAdapter implements Adapter {
   private sock?: WASocket;
   private connected = false;
   private messageCb?: (msg: NormalizedMessage) => void;
-  private replyCb?: (buttonId: string) => void;
+  private replyCb?: (buttonId: string, sender: { chatId: string; userId: string }) => void;
   /** chatId → 当前 pending 按钮（编号回复 → 按钮 id，带 TTL 防过期误吞） */
   private readonly pendingButtons = new PendingButtons();
 
@@ -175,7 +175,10 @@ export class WhatsAppAdapter implements Adapter {
         if (buttonId) {
           const chatId = waRaw.key?.remoteJid;
           if (chatId) this.pendingButtons.consume(chatId);
-          this.replyCb?.(buttonId);
+          this.replyCb?.(buttonId, {
+            chatId: chatId ?? '',
+            userId: waRaw.key?.participant ?? chatId ?? '',
+          });
           continue;
         }
         const normalized = normalizeWhatsAppMessage(waRaw);
@@ -183,7 +186,10 @@ export class WhatsAppAdapter implements Adapter {
         // 编号回复兜底：若该 chat 有 pending 按钮且消息是数字（TTL 内），转成按钮点击
         const button = this.pendingButtons.match(normalized.msg.chatId, normalized.msg.text);
         if (button) {
-          this.replyCb?.(button.id);
+          this.replyCb?.(button.id, {
+            chatId: normalized.msg.chatId,
+            userId: normalized.msg.userId,
+          });
           continue;
         }
         this.messageCb?.(normalized.msg);
@@ -223,6 +229,6 @@ export class WhatsAppAdapter implements Adapter {
   }
 
   onMessage(cb: (msg: NormalizedMessage) => void): void { this.messageCb = cb; }
-  onReply(cb: (buttonId: string) => void): void { this.replyCb = cb; }
+  onReply(cb: (buttonId: string, sender: { chatId: string; userId: string }) => void): void { this.replyCb = cb; }
   status(): { connected: boolean } { return { connected: this.connected }; }
 }

package/src/index.ts

@@ -65,6 +65,8 @@ export function planOutbound(ev: ServerEvent): { payload: OutboundPayload } | nu
 
 export interface WireOptions {
   allowlist: string[];
+  /** 开发逃生口：ALLOW_ALL=1 跳过白名单（生产勿开）。 */
+  allowAll?: boolean;
   /** ASR 转写器；配置了 API key 时启用，语音消息转成文本再发给 agent。 */
   asr?: AsrTranscriber;
 }
@@ -131,7 +133,7 @@ export async function wireAdapter(
   client: GatewayClient,
   opts: WireOptions,
 ): Promise<void> {
-  const allow = new Allowlist(opts.allowlist);
+  const allow = new Allowlist(opts.allowlist, opts.allowAll);
   const chatIds = new Map<string, string>();
   const aggregator = new TrajectoryAggregator();
   const deltas = new DeltaTracker();
@@ -174,13 +176,22 @@ export async function wireAdapter(
     }
   });
 
-  adapter.onReply(async (buttonId) => {
+  adapter.onReply(async (buttonId, sender) => {
     try {
       const idx = buttonId.indexOf(':');
       if (idx < 0) return;
       const action = buttonId.slice(0, idx) as 'approve' | 'reject';
       const reqId = buttonId.slice(idx + 1);
       if ((action === 'approve' || action === 'reject') && reqId) {
+        // 安全边界：审批按钮必须校验点击者（维护者评审指出：未授权用户可代授权）
+        const senderKey = buildSessionKey(adapter.id, { chatId: sender.chatId, userId: sender.userId });
+        if (!allow.allows(senderKey)) {
+          console.warn(`[gateway][${adapter.id}] 按钮点击者不在白名单，拒绝批准: ${senderKey}`);
+          if (sender.chatId) {
+            await adapter.send(sender.chatId, { text: '⛔ 你不在白名单里，不能批准该操作。' }).catch(() => undefined);
+          }
+          return;
+        }
         await client.resolveApproval(reqId, action);
       }
     } catch (error) {
@@ -221,6 +232,7 @@ async function main(): Promise<void> {
   const dshToken = process.env.DSH_TOKEN ?? 'dev-token';
   const allowlist = (process.env.ALLOWLIST ?? '')
     .split(',').map((s) => s.trim()).filter(Boolean);
+  const allowAll = process.env.ALLOW_ALL === '1';
   const adapterIds = parseAdapterIds(process.env.GATEWAY_ADAPTERS ?? 'cli');
   const env = adapterEnvFromProcess();
   const asr = createTranscriber({
@@ -236,7 +248,7 @@ async function main(): Promise<void> {
   const adapters: Adapter[] = adapterIds.map((id) => createAdapter(id, env));
   for (const adapter of adapters) {
     await adapter.connect();
-    await wireAdapter(adapter, client, { allowlist, asr });
+    await wireAdapter(adapter, client, { allowlist, allowAll, asr });
     console.log(`[gateway] ${adapter.id} 适配器已就绪`);
   }
 

package/src/session.ts

@@ -7,11 +7,17 @@ export function buildSessionKey(
   return sessionKey(adapterId, msg.chatId, msg.userId);
 }
 
-/** 空列表 = 开发模式放行所有；生产环境必须显式配置。 */
+/**
+ * 白名单：默认 fail-closed —— 只有显式配置了条目才放行；
+ * 开发环境可用 ALLOW_ALL=1 显式放行所有（比空列表隐式放行安全得多）。
+ */
 export class Allowlist {
-  constructor(private readonly entries: string[]) {}
+  constructor(
+    private readonly entries: string[],
+    private readonly allowAll = false,
+  ) {}
 
   allows(key: string): boolean {
-    return this.entries.length === 0 || this.entries.includes(key);
+    return this.allowAll || (this.entries.length > 0 && this.entries.includes(key));
   }
 }

package/test/adapters.dingtalk.test.ts

@@ -37,13 +37,19 @@ describe('buildActionCard（钉钉 actionCard）', () => {
   });
 });
 
-describe('parseCardCallback（TOPIC_CARD 回调载荷 → 按钮 id）', () => {
+describe('parseCardCallback（TOPIC_CARD 回调载荷 → 按钮 id + 身份）', () => {
   it('识别 cardCallbackData 字段', () => {
-    expect(parseCardCallback({ cardPrivateData: { cardCallbackData: '{"action":"approve","reqId":"r1"}' } })).toBe('approve:r1');
+    expect(parseCardCallback({ cardPrivateData: { cardCallbackData: '{"action":"approve","reqId":"r1"}' } })).toMatchObject({ buttonId: 'approve:r1' });
   });
   it('识别 params / cardActionData 字段与嵌套结构', () => {
-    expect(parseCardCallback({ cardPrivateData: { params: '{"action":"reject","reqId":"r9"}' } })).toBe('reject:r9');
-    expect(parseCardCallback({ a: { b: { cardActionData: '{"action":"approve","reqId":"x"}' } } })).toBe('approve:x');
+    expect(parseCardCallback({ cardPrivateData: { params: '{"action":"reject","reqId":"r9"}' } })).toMatchObject({ buttonId: 'reject:r9' });
+    expect(parseCardCallback({ a: { b: { cardActionData: '{"action":"approve","reqId":"x"}' } } })).toMatchObject({ buttonId: 'approve:x' });
+  });
+  it('带回会话与用户身份（用于白名单校验）', () => {
+    expect(parseCardCallback({
+      cardPrivateData: { cardCallbackData: '{"action":"approve","reqId":"r1"}', userId: 'u1' },
+      conversationId: 'cid1',
+    })).toEqual({ buttonId: 'approve:r1', chatId: 'cid1', userId: 'u1' });
   });
   it('非法载荷返回 null', () => {
     expect(parseCardCallback(null)).toBeNull();
@@ -53,6 +59,6 @@ describe('parseCardCallback（TOPIC_CARD 回调载荷 → 按钮 id）', () => {
   });
   it('buttonCallbackData 与 parseCardCallback 往返一致', () => {
     const data = buttonCallbackData({ id: 'reject:r7', label: 'x' });
-    expect(parseCardCallback({ cardPrivateData: { cardCallbackData: data } })).toBe('reject:r7');
+    expect(parseCardCallback({ cardPrivateData: { cardCallbackData: data } })).toMatchObject({ buttonId: 'reject:r7' });
   });
 });