@geoly-ai/social-hub-cli 0.3.16 → 0.3.18

package/dist/register-feishu-identities.js

@@ -0,0 +1,346 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { hubRequest } from "./client.js";
+import { assertApplyOrDryRun } from "./dry-run.js";
+import { withPermissionGates } from "./permission-runner.js";
+/**
+ * `social-hub feishu-identities …` —— Hub 用户 ↔ 飞书 open_id 映射的运维面。
+ *
+ * 替代 `scripts/sync-feishu-identities.mjs`：那个脚本要求运维手里有**生产
+ * `DATABASE_URL`**，而这里只需要一次 `social-hub auth login`。
+ *
+ * ## 为什么飞书查询在本机而不是服务端
+ *
+ * 飞书 `contact` 查询目前只能用**个人授权**（bot 缺 `contact:user.id:readonly`），
+ * 服务端既没有应用凭据也拿不到这个身份。所以形态是：本机 `lark-cli` 查 → PUT 给
+ * Hub 落库。Hub 侧对收到的值做形态白名单 + 占用冲突检测，写入面只认不受限的交互式
+ * admin 登录。
+ *
+ * ## 两个实测出来的坑（改这段前先读）
+ *
+ * 1. **飞书按邮箱批量查时，查不到的邮箱是静默省略、不报错的。** 未命中只能靠
+ *    「请求集合 − 返回集合」求差发现，不能指望非空校验或异常。
+ * 2. **`ok=true` 但结构不对（CLI 升级换 schema、输出被截断）绝不能当空结果。**
+ *    空结果的语义是「这批人都不在通讯录」，会把整批真人写成 `not_found` 并清空
+ *    既有 open_id；而我们其实根本没拿到答案，那是 `lookup_failed`。
+ *
+ * ## 防「一次误操作清空全部映射」
+ *
+ * `not_found` 会清空旧身份（离职语义）。如果登错飞书租户 / 授权对应的是另一个组织，
+ * 全部人都会「查不到」，一次 `--apply` 就能把所有映射抹掉。因此当**此前 resolved 的人
+ * 里有超过一半这次变成 not_found** 时直接拒绝，要显式 `--force-mass-not-found`。
+ */
+const execFileAsync = promisify(execFile);
+/** 一次 lark-cli 调用查多少个邮箱。飞书搜索接口对超长 query 不友好。 */
+const LOOKUP_BATCH_SIZE = 20;
+/** 一次 PUT 提交多少条（与服务端契约上限一致）。 */
+const UPSERT_BATCH_SIZE = 100;
+/** 超过这个比例的既有 resolved 变 not_found 就停机。 */
+const MASS_NOT_FOUND_RATIO = 0.5;
+class LookupError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+/** 错误码要能进 `^[a-z0-9_.-]{1,64}$`（服务端契约）。 */
+function normalizeErrorCode(raw) {
+    const cleaned = raw
+        .toLowerCase()
+        .replace(/[^a-z0-9_.-]/g, "_")
+        .slice(0, 64);
+    return cleaned || "lookup_failed";
+}
+/**
+ * 批量按邮箱查飞书 open_id，返回 email（小写）→ 用户对象。
+ *
+ * 抛 {@link LookupError} 表示「没拿到答案」；返回值里缺某个邮箱才表示「通讯录里没有」。
+ */
+async function lookupBatch(emails) {
+    let stdout;
+    try {
+        ({ stdout } = await execFileAsync("lark-cli", [
+            "contact",
+            "+search-user",
+            "--queries",
+            emails.join(","),
+            "--as",
+            "user",
+            "--format",
+            "json",
+        ], { maxBuffer: 16 * 1024 * 1024 }));
+    }
+    catch (error) {
+        throw new LookupError("cli_invocation_failed", `lark-cli 调用失败：${error instanceof Error ? error.message : String(error)}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+    }
+    catch {
+        throw new LookupError("malformed_response", "lark-cli 输出不是合法 JSON");
+    }
+    if (!parsed.ok) {
+        throw new LookupError(normalizeErrorCode(String(parsed.error?.subtype ?? parsed.error?.type ?? "lookup_failed")), `lark-cli lookup failed: ${JSON.stringify(parsed.error ?? {})}`);
+    }
+    // ok=true 但没有 users[] —— 见文件头第 2 条，这是 lookup_failed 不是空结果。
+    if (!Array.isArray(parsed.data?.users)) {
+        throw new LookupError("malformed_response", "lark-cli lookup returned no users[] array");
+    }
+    const byEmail = new Map();
+    for (const user of parsed.data.users) {
+        const openId = typeof user["open_id"] === "string" ? user["open_id"] : undefined;
+        const unionId = typeof user["union_id"] === "string" ? user["union_id"] : undefined;
+        // 同一条记录可能挂 email 与 enterprise_email 两个地址，两个都索引。
+        for (const raw of [user["email"], user["enterprise_email"]]) {
+            const key = String(raw ?? "").toLowerCase();
+            if (!key)
+                continue;
+            const existing = byEmail.get(key);
+            if (existing && existing.openId !== openId) {
+                // 一个邮箱命中两个不同的飞书人 —— 这是**歧义**，不是「后来的那个对」。
+                // 直接 Map 覆盖会静默挑一个，可能把告警 @ 给完全不相干的人。
+                byEmail.set(key, { ambiguous: true });
+                continue;
+            }
+            if (existing?.ambiguous)
+                continue;
+            byEmail.set(key, {
+                ...(openId === undefined ? {} : { openId }),
+                ...(unionId === undefined ? {} : { unionId }),
+            });
+        }
+    }
+    return byEmail;
+}
+const OPEN_ID_RE = /^ou_[A-Za-z0-9]{1,128}$/;
+const UNION_ID_RE = /^on_[A-Za-z0-9]{1,128}$/;
+/**
+ * 一条查询结果 → 一条待写入 entry。
+ *
+ * 🔴 **只有「飞书明确没返回这个邮箱」才是 `not_found`**（那一条会清空既有 open_id）。
+ * 其余所有"没拿到可用答案"的情况一律 `lookup_failed`：
+ *
+ * - 命中了人但**没有 open_id**（字段缺失/被裁剪）—— 我们并不知道这人不在通讯录；
+ * - open_id / union_id 形态非法 —— 与其写进库让渲染侧面对，不如当查询异常；
+ * - 一个邮箱命中多个不同的人 —— 歧义，挑一个可能 @ 到完全不相干的人。
+ *
+ * 把上面任何一种当成 `not_found`，代价都是**静默清空一个本来能 @ 的映射**。
+ */
+export function classifyHit(userId, hit) {
+    if (hit === undefined) {
+        // 飞书对查不到的邮箱是静默省略 —— 这才是真正的"通讯录里没这人"。
+        return { userId, resolveStatus: "not_found" };
+    }
+    if (hit.ambiguous) {
+        return {
+            userId,
+            resolveStatus: "lookup_failed",
+            lastErrorCode: "ambiguous_match",
+        };
+    }
+    const openId = hit.openId ?? null;
+    if (openId === null) {
+        return {
+            userId,
+            resolveStatus: "lookup_failed",
+            lastErrorCode: "missing_open_id",
+        };
+    }
+    if (!OPEN_ID_RE.test(openId)) {
+        return {
+            userId,
+            resolveStatus: "lookup_failed",
+            lastErrorCode: "malformed_open_id",
+        };
+    }
+    const unionId = hit.unionId ?? null;
+    if (unionId !== null && !UNION_ID_RE.test(unionId)) {
+        return {
+            userId,
+            resolveStatus: "lookup_failed",
+            lastErrorCode: "malformed_union_id",
+        };
+    }
+    return {
+        userId,
+        resolveStatus: "resolved",
+        openId,
+        ...(unionId === null ? {} : { unionId }),
+    };
+}
+/**
+ * 「这次同步是不是把大批既有映射抹掉了」。
+ *
+ * 单独抽出来是为了能被测试锁住：这是唯一挡在「登错飞书租户 → 全员 not_found →
+ * 一次 --apply 清空所有映射」前面的判据。注意 `lookup_failed` **不算**回归 ——
+ * 它根本不会清空 open_id。
+ */
+export function evaluateMassNotFound(previouslyResolved, entries, ratio = MASS_NOT_FOUND_RATIO) {
+    const regressions = entries.filter((entry) => entry.resolveStatus === "not_found" &&
+        previouslyResolved.has(entry.userId)).length;
+    return {
+        regressions,
+        massNotFound: previouslyResolved.size > 0 &&
+            regressions / previouslyResolved.size > ratio,
+    };
+}
+function buildQuery(params) {
+    const search = new URLSearchParams();
+    for (const [key, value] of Object.entries(params)) {
+        if (value !== undefined && value !== "")
+            search.set(key, value);
+    }
+    const rendered = search.toString();
+    return rendered ? `?${rendered}` : "";
+}
+export function registerFeishuIdentityCommands(program) {
+    const cmd = program
+        .command("feishu-identities")
+        .description("Hub 用户 ↔ 飞书 open_id 映射(运维同步面)");
+    cmd
+        .command("list")
+        .description("GET /v1/system/feishu-identities —— 含从未同步过的用户(resolveStatus=null)")
+        .option("--app-id <appId>", "只看某个飞书应用查出来的映射(默认不过滤)")
+        .option("--provider <provider>", "默认 feishu")
+        .option("--status <status>", "resolved | not_found | lookup_failed | unmapped")
+        .option("--include-inactive-users", "含已停用用户", false)
+        .action(async (opts) => {
+        await withPermissionGates({
+            command: "feishu-identities list",
+            gates: [{ resource: "systemMember", action: "list" }],
+        }, async () => {
+            const res = await hubRequest(`/v1/system/feishu-identities${buildQuery({
+                appId: opts.appId,
+                provider: opts.provider,
+                status: opts.status,
+                includeInactiveUsers: opts.includeInactiveUsers
+                    ? "true"
+                    : undefined,
+            })}`);
+            console.log(JSON.stringify(res, null, 2));
+        });
+    });
+    cmd
+        .command("sync")
+        .description("本机 lark-cli 查 open_id → PUT /v1/system/feishu-identities 落库(不需要 DATABASE_URL)")
+        .requiredOption("--app-id <appId>", "查询用的飞书应用 id(溯源:记录这批 open_id 从哪查来)")
+        .option("--domain <domain>", "只同步该邮箱域的用户", "cyberklick.com")
+        .option("--dry-run", "预览,不写库", false)
+        .option("--apply", "执行写入", false)
+        .option("--force-mass-not-found", "允许「超过一半既有 resolved 变 not_found」的写入(查错租户时正是这个形态)", false)
+        .action(async (opts) => {
+        await withPermissionGates({
+            command: "feishu-identities sync",
+            gates: [
+                { resource: "systemMember", action: "list" },
+                { resource: "systemMember", action: "update" },
+            ],
+            // 写入面只认交互式登录:API key 一律拒(服务端也会拒,这里提前给人话)。
+            userOnly: true,
+        }, async () => {
+            const domain = String(opts.domain).toLowerCase();
+            // 一次拿到「用户名册 + 当前映射状态」:这个端点本身就是
+            // users LEFT JOIN identities,不必再分页拉 /v1/system/users。
+            const current = await hubRequest(`/v1/system/feishu-identities${buildQuery({ appId: opts.appId })}`);
+            const targets = current.items.filter((item) => item.email.toLowerCase().endsWith(`@${domain}`));
+            const previouslyResolved = new Set(targets
+                .filter((item) => item.resolveStatus === "resolved")
+                .map((item) => item.userId));
+            const entries = [];
+            const report = {
+                domain,
+                appId: opts.appId,
+                candidates: targets.length,
+                resolved: 0,
+                notFound: 0,
+                lookupFailed: 0,
+                notFoundDetail: [],
+                lookupFailedDetail: [],
+            };
+            for (let i = 0; i < targets.length; i += LOOKUP_BATCH_SIZE) {
+                const batch = targets.slice(i, i + LOOKUP_BATCH_SIZE);
+                let byEmail = null;
+                let errorCode = "lookup_failed";
+                try {
+                    byEmail = await lookupBatch(batch.map((item) => item.email));
+                }
+                catch (error) {
+                    errorCode =
+                        error instanceof LookupError ? error.code : "lookup_failed";
+                    console.error(JSON.stringify({
+                        batch: Math.floor(i / LOOKUP_BATCH_SIZE),
+                        error: error instanceof Error ? error.message : String(error),
+                    }));
+                }
+                for (const item of batch) {
+                    if (byEmail === null) {
+                        // 整批查询失败 —— 这是「不知道」，绝不能写成 not_found。
+                        entries.push({
+                            userId: item.userId,
+                            resolveStatus: "lookup_failed",
+                            lastErrorCode: errorCode,
+                        });
+                        report.lookupFailed += 1;
+                        report.lookupFailedDetail.push(`${item.email} (${errorCode})`);
+                        continue;
+                    }
+                    const entry = classifyHit(item.userId, byEmail.get(item.email.toLowerCase()));
+                    entries.push(entry);
+                    if (entry.resolveStatus === "resolved") {
+                        report.resolved += 1;
+                    }
+                    else if (entry.resolveStatus === "not_found") {
+                        report.notFound += 1;
+                        report.notFoundDetail.push(item.email);
+                    }
+                    else {
+                        report.lookupFailed += 1;
+                        report.lookupFailedDetail.push(`${item.email} (${entry.lastErrorCode})`);
+                    }
+                }
+            }
+            // 防「查错租户 → 一次抹掉全部映射」:既有 resolved 大面积变 not_found
+            // 时停机。这个形态与「公司集体离职」不可区分,所以要人来拍板。
+            const { regressions, massNotFound } = evaluateMassNotFound(previouslyResolved, entries);
+            console.log(JSON.stringify({
+                ...report,
+                previouslyResolved: previouslyResolved.size,
+                resolvedBecameNotFound: regressions,
+                massNotFound,
+            }, null, 2));
+            if (massNotFound && !opts.forceMassNotFound) {
+                console.error(`Refusing to write: ${regressions}/${previouslyResolved.size} 个此前已解析的用户这次变成 not_found。` +
+                    "这通常意味着查询用的是另一个飞书租户/授权失效,而不是这些人真的离职了。" +
+                    "确认无误后加 --force-mass-not-found。");
+                process.exit(1);
+            }
+            if (entries.length === 0) {
+                console.log("没有待写入的条目。");
+                return;
+            }
+            if (!assertApplyOrDryRun(opts, {
+                command: "feishu-identities sync",
+                danger: "write",
+                summary: {
+                    appId: opts.appId,
+                    resolved: report.resolved,
+                    notFound: report.notFound,
+                    lookupFailed: report.lookupFailed,
+                },
+            })) {
+                return;
+            }
+            for (let i = 0; i < entries.length; i += UPSERT_BATCH_SIZE) {
+                const chunk = entries.slice(i, i + UPSERT_BATCH_SIZE);
+                const res = await hubRequest("/v1/system/feishu-identities", {
+                    method: "PUT",
+                    body: { appId: opts.appId, entries: chunk },
+                });
+                console.log(JSON.stringify(res, null, 2));
+            }
+        });
+    });
+}
+//# sourceMappingURL=register-feishu-identities.js.map

package/dist/register-feishu-identities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-feishu-identities.js","sourceRoot":"","sources":["../src/register-feishu-identities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,gDAAgD;AAChD,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,gCAAgC;AAChC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,0CAA0C;AAC1C,MAAM,oBAAoB,GAAG,GAAG,CAAC;AA6BjC,MAAM,WAAY,SAAQ,KAAK;IACpB,IAAI,CAAS;IACtB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,2CAA2C;AAC3C,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,OAAO,GAAG,GAAG;SAChB,WAAW,EAAE;SACb,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,OAAO,IAAI,eAAe,CAAC;AACpC,CAAC;AASD;;;;GAIG;AACH,KAAK,UAAU,WAAW,CAAC,MAAgB;IACzC,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAC/B,UAAU,EACV;YACE,SAAS;YACT,cAAc;YACd,WAAW;YACX,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAChB,MAAM;YACN,MAAM;YACN,UAAU;YACV,MAAM;SACP,EACD,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CACnB,uBAAuB,EACvB,iBAAiB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1E,CAAC;IACJ,CAAC;IAED,IAAI,MAIH,CAAC;IACF,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAkB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CACnB,kBAAkB,CAChB,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,eAAe,CAAC,CACvE,EACD,2BAA2B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAChE,CAAC;IACJ,CAAC;IACD,2DAA2D;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,WAAW,CACnB,oBAAoB,EACpB,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAuC,EAAE,CAAC;QACvE,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,gDAAgD;QAChD,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5C,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3C,yCAAyC;gBACzC,oCAAoC;gBACpC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACtC,SAAS;YACX,CAAC;YACD,IAAI,QAAQ,EAAE,SAAS;gBAAE,SAAS;YAClC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;gBACf,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;gBAC3C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAC7C,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAE9C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,GAA0B;IAE1B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,qCAAqC;QACrC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAClB,OAAO;YACL,MAAM;YACN,aAAa,EAAE,eAAe;YAC9B,aAAa,EAAE,iBAAiB;SACjC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC;IAClC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,MAAM;YACN,aAAa,EAAE,eAAe;YAC9B,aAAa,EAAE,iBAAiB;SACjC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM;YACN,aAAa,EAAE,eAAe;YAC9B,aAAa,EAAE,mBAAmB;SACnC,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC;IACpC,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,OAAO;YACL,MAAM;YACN,aAAa,EAAE,eAAe;YAC9B,aAAa,EAAE,oBAAoB;SACpC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM;QACN,aAAa,EAAE,UAAU;QACzB,MAAM;QACN,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,kBAAuC,EACvC,OAA+B,EAC/B,QAAgB,oBAAoB;IAEpC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAChC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,aAAa,KAAK,WAAW;QACnC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CACvC,CAAC,MAAM,CAAC;IACT,OAAO;QACL,WAAW;QACX,YAAY,EACV,kBAAkB,CAAC,IAAI,GAAG,CAAC;YAC3B,WAAW,GAAG,kBAAkB,CAAC,IAAI,GAAG,KAAK;KAChD,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAA0C;IAC5D,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IACnC,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,OAAgB;IAC7D,MAAM,GAAG,GAAG,OAAO;SAChB,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,+BAA+B,CAAC,CAAC;IAEhD,GAAG;SACA,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,mEAAmE,CACpE;SACA,MAAM,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;SACnD,MAAM,CAAC,uBAAuB,EAAE,WAAW,CAAC;SAC5C,MAAM,CACL,mBAAmB,EACnB,iDAAiD,CAClD;SACA,MAAM,CAAC,0BAA0B,EAAE,QAAQ,EAAE,KAAK,CAAC;SACnD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,mBAAmB,CACvB;YACE,OAAO,EAAE,wBAAwB;YACjC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;SACtD,EACD,KAAK,IAAI,EAAE;YACT,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,+BAA+B,UAAU,CAAC;gBACxC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;oBAC7C,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,SAAS;aACd,CAAC,EAAE,CACL,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,+EAA+E,CAChF;SACA,cAAc,CACb,kBAAkB,EAClB,mCAAmC,CACpC;SACA,MAAM,CAAC,mBAAmB,EAAE,YAAY,EAAE,gBAAgB,CAAC;SAC3D,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC;SACpC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC;SAChC,MAAM,CACL,wBAAwB,EACxB,iDAAiD,EACjD,KAAK,CACN;SACA,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,mBAAmB,CACvB;YACE,OAAO,EAAE,wBAAwB;YACjC,KAAK,EAAE;gBACL,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE;gBAC5C,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE;aAC/C;YACD,0CAA0C;YAC1C,QAAQ,EAAE,IAAI;SACf,EACD,KAAK,IAAI,EAAE;YACT,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAEjD,+BAA+B;YAC/B,sDAAsD;YACtD,MAAM,OAAO,GAAG,MAAM,UAAU,CAC9B,+BAA+B,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,CACnE,CAAC;YACF,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5C,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAChD,CAAC;YACF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,OAAO;iBACJ,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,UAAU,CAAC;iBACnD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAC9B,CAAC;YAEF,MAAM,OAAO,GAAkB,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG;gBACb,MAAM;gBACN,KAAK,EAAE,IAAI,CAAC,KAAe;gBAC3B,UAAU,EAAE,OAAO,CAAC,MAAM;gBAC1B,QAAQ,EAAE,CAAC;gBACX,QAAQ,EAAE,CAAC;gBACX,YAAY,EAAE,CAAC;gBACf,cAAc,EAAE,EAAc;gBAC9B,kBAAkB,EAAE,EAAc;aACnC,CAAC;YAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,iBAAiB,EAAE,CAAC;gBAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC;gBACtD,IAAI,OAAO,GAAkC,IAAI,CAAC;gBAClD,IAAI,SAAS,GAAG,eAAe,CAAC;gBAChC,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC/D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,SAAS;wBACP,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC;oBAC9D,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;wBACb,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,iBAAiB,CAAC;wBACxC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CACH,CAAC;gBACJ,CAAC;gBAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;wBACrB,qCAAqC;wBACrC,OAAO,CAAC,IAAI,CAAC;4BACX,MAAM,EAAE,IAAI,CAAC,MAAM;4BACnB,aAAa,EAAE,eAAe;4BAC9B,aAAa,EAAE,SAAS;yBACzB,CAAC,CAAC;wBACH,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;wBACzB,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,GAAG,CAAC,CAAC;wBAC/D,SAAS;oBACX,CAAC;oBACD,MAAM,KAAK,GAAG,WAAW,CACvB,IAAI,CAAC,MAAM,EACX,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CACtC,CAAC;oBACF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACpB,IAAI,KAAK,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;wBACvC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;oBACvB,CAAC;yBAAM,IAAI,KAAK,CAAC,aAAa,KAAK,WAAW,EAAE,CAAC;wBAC/C,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;wBACrB,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzC,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;wBACzB,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAC5B,GAAG,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,aAAa,GAAG,CACzC,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,gDAAgD;YAChD,iCAAiC;YACjC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,oBAAoB,CACxD,kBAAkB,EAClB,OAAO,CACR,CAAC;YAEF,OAAO,CAAC,GAAG,CACT,IAAI,CAAC,SAAS,CACZ;gBACE,GAAG,MAAM;gBACT,kBAAkB,EAAE,kBAAkB,CAAC,IAAI;gBAC3C,sBAAsB,EAAE,WAAW;gBACnC,YAAY;aACb,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;YAEF,IAAI,YAAY,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC5C,OAAO,CAAC,KAAK,CACX,sBAAsB,WAAW,IAAI,kBAAkB,CAAC,IAAI,2BAA2B;oBACrF,sCAAsC;oBACtC,gCAAgC,CACnC,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACzB,OAAO;YACT,CAAC;YAED,IACE,CAAC,mBAAmB,CAAC,IAAI,EAAE;gBACzB,OAAO,EAAE,wBAAwB;gBACjC,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE;oBACP,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;iBAClC;aACF,CAAC,EACF,CAAC;gBACD,OAAO;YACT,CAAC;YAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,iBAAiB,EAAE,CAAC;gBAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC;gBACtD,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,8BAA8B,EAC9B;oBACE,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE;iBAC5C,CACF,CAAC;gBACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/register-feishu-identities.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=register-feishu-identities.test.d.ts.map

package/dist/register-feishu-identities.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-feishu-identities.test.d.ts","sourceRoot":"","sources":["../src/register-feishu-identities.test.ts"],"names":[],"mappings":""}

package/dist/register-feishu-identities.test.js

@@ -0,0 +1,124 @@
+import { describe, expect, it } from "vitest";
+import { classifyHit, evaluateMassNotFound, } from "./register-feishu-identities.js";
+/**
+ * `not_found` 会**清空**已有的 open_id（离职语义）。如果 lark-cli 挂在另一个飞书
+ * 租户的授权上，全体查不到，一次 `--apply` 就能抹掉所有映射 —— 而这与「公司集体
+ * 离职」在数据上不可区分。这道判据是唯一挡在中间的东西，必须被锁住。
+ */
+describe("evaluateMassNotFound", () => {
+    const previously = new Set(["u1", "u2", "u3", "u4"]);
+    it("全部既有 resolved 变 not_found —— 停机", () => {
+        const result = evaluateMassNotFound(previously, [...previously].map((userId) => ({
+            userId,
+            resolveStatus: "not_found",
+        })));
+        expect(result).toEqual({ regressions: 4, massNotFound: true });
+    });
+    it("只掉一个人(真的有人离职)—— 放行", () => {
+        const result = evaluateMassNotFound(previously, [
+            { userId: "u1", resolveStatus: "not_found" },
+            { userId: "u2", resolveStatus: "resolved", openId: "ou_a" },
+            { userId: "u3", resolveStatus: "resolved", openId: "ou_b" },
+            { userId: "u4", resolveStatus: "resolved", openId: "ou_c" },
+        ]);
+        expect(result).toEqual({ regressions: 1, massNotFound: false });
+    });
+    /**
+     * `lookup_failed` 不清空 open_id，所以「整批查询失败」不该触发这道闸
+     * —— 否则真正危险的信号会被日常噪音淹没。
+     */
+    it("整批 lookup_failed 不算回归", () => {
+        const result = evaluateMassNotFound(previously, [...previously].map((userId) => ({
+            userId,
+            resolveStatus: "lookup_failed",
+            lastErrorCode: "token_expired",
+        })));
+        expect(result).toEqual({ regressions: 0, massNotFound: false });
+    });
+    it("此前一个都没映射上时不停机(首次同步)", () => {
+        const result = evaluateMassNotFound(new Set(), [
+            { userId: "u1", resolveStatus: "not_found" },
+            { userId: "u2", resolveStatus: "not_found" },
+        ]);
+        expect(result).toEqual({ regressions: 0, massNotFound: false });
+    });
+    it("恰好一半不触发,过半才触发(边界)", () => {
+        const half = evaluateMassNotFound(new Set(["u1", "u2"]), [
+            { userId: "u1", resolveStatus: "not_found" },
+            { userId: "u2", resolveStatus: "resolved", openId: "ou_a" },
+        ]);
+        expect(half.massNotFound).toBe(false);
+        const overHalf = evaluateMassNotFound(new Set(["u1", "u2", "u3"]), [
+            { userId: "u1", resolveStatus: "not_found" },
+            { userId: "u2", resolveStatus: "not_found" },
+            { userId: "u3", resolveStatus: "resolved", openId: "ou_a" },
+        ]);
+        expect(overHalf.massNotFound).toBe(true);
+    });
+    it("不在既有 resolved 名单里的 not_found 不算回归(本来就没映射)", () => {
+        const result = evaluateMassNotFound(new Set(["u1"]), [
+            { userId: "u9", resolveStatus: "not_found" },
+            { userId: "u8", resolveStatus: "not_found" },
+            { userId: "u1", resolveStatus: "resolved", openId: "ou_a" },
+        ]);
+        expect(result).toEqual({ regressions: 0, massNotFound: false });
+    });
+});
+/**
+ * 分类判据。只有「飞书压根没返回这个邮箱」才允许写 `not_found`
+ * —— 那一条会**清空**既有 open_id。其余"没拿到可用答案"必须是 `lookup_failed`。
+ */
+describe("classifyHit", () => {
+    it("飞书静默省略该邮箱 → not_found(真的不在通讯录)", () => {
+        expect(classifyHit("u1", undefined)).toEqual({
+            userId: "u1",
+            resolveStatus: "not_found",
+        });
+    });
+    it("命中了人但没有 open_id → lookup_failed,不清空既有映射", () => {
+        expect(classifyHit("u1", {})).toEqual({
+            userId: "u1",
+            resolveStatus: "lookup_failed",
+            lastErrorCode: "missing_open_id",
+        });
+    });
+    it("一个邮箱命中多个不同的人 → lookup_failed(歧义,不能挑一个)", () => {
+        expect(classifyHit("u1", { ambiguous: true })).toEqual({
+            userId: "u1",
+            resolveStatus: "lookup_failed",
+            lastErrorCode: "ambiguous_match",
+        });
+    });
+    it.each([
+        ["注入串", "ou_x></at><at user_id=all"],
+        ["缺前缀", "abc123"],
+        ["带引号", 'ou_abc"'],
+    ])("open_id 畸形(%s) → lookup_failed 而不是写进库", (_label, openId) => {
+        expect(classifyHit("u1", { openId })).toMatchObject({
+            resolveStatus: "lookup_failed",
+            lastErrorCode: "malformed_open_id",
+        });
+    });
+    it("union_id 畸形 → lookup_failed(不退化成只写 open_id)", () => {
+        expect(classifyHit("u1", { openId: "ou_ok1", unionId: "on_x></at>" })).toMatchObject({
+            resolveStatus: "lookup_failed",
+            lastErrorCode: "malformed_union_id",
+        });
+    });
+    it("合法命中 → resolved", () => {
+        expect(classifyHit("u1", { openId: "ou_ok1", unionId: "on_ok1" })).toEqual({
+            userId: "u1",
+            resolveStatus: "resolved",
+            openId: "ou_ok1",
+            unionId: "on_ok1",
+        });
+    });
+    it("没有 union_id 也能 resolved(该字段可缺)", () => {
+        expect(classifyHit("u1", { openId: "ou_ok1" })).toEqual({
+            userId: "u1",
+            resolveStatus: "resolved",
+            openId: "ou_ok1",
+        });
+    });
+});
+//# sourceMappingURL=register-feishu-identities.test.js.map

package/dist/register-feishu-identities.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-feishu-identities.test.js","sourceRoot":"","sources":["../src/register-feishu-identities.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,WAAW,EACX,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AAEzC;;;;GAIG;AACH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAErD,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,MAAM,GAAG,oBAAoB,CACjC,UAAU,EACV,CAAC,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC/B,MAAM;YACN,aAAa,EAAE,WAAoB;SACpC,CAAC,CAAC,CACJ,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC5B,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,EAAE;YAC9C,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE;YAC5C,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE;YAC3D,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE;YAC3D,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE;SAC5D,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,MAAM,GAAG,oBAAoB,CACjC,UAAU,EACV,CAAC,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC/B,MAAM;YACN,aAAa,EAAE,eAAwB;YACvC,aAAa,EAAE,eAAe;SAC/B,CAAC,CAAC,CACJ,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,GAAG,EAAE,EAAE;YAC7C,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE;YAC5C,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE;SAC7C,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;QAC3B,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE;YACvD,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE;YAC5C,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE;SAC5D,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEtC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE;YACjE,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE;YAC5C,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE;YAC5C,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE;SAC5D,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE;YACnD,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE;YAC5C,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE;YAC5C,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE;SAC5D,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3C,MAAM,EAAE,IAAI;YACZ,aAAa,EAAE,WAAW;SAC3B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACpC,MAAM,EAAE,IAAI;YACZ,aAAa,EAAE,eAAe;YAC9B,aAAa,EAAE,iBAAiB;SACjC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACrD,MAAM,EAAE,IAAI;YACZ,aAAa,EAAE,eAAe;YAC9B,aAAa,EAAE,iBAAiB;SACjC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,KAAK,EAAE,2BAA2B,CAAC;QACpC,CAAC,KAAK,EAAE,QAAQ,CAAC;QACjB,CAAC,KAAK,EAAE,SAAS,CAAC;KACnB,CAAC,CAAC,uCAAuC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;QAC7D,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;YAClD,aAAa,EAAE,eAAe;YAC9B,aAAa,EAAE,mBAAmB;SACnC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CACJ,WAAW,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAC/D,CAAC,aAAa,CAAC;YACd,aAAa,EAAE,eAAe;YAC9B,aAAa,EAAE,oBAAoB;SACpC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE;QACzB,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACzE,MAAM,EAAE,IAAI;YACZ,aAAa,EAAE,UAAU;YACzB,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACtD,MAAM,EAAE,IAAI;YACZ,aAAa,EAAE,UAAU;YACzB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/register-notify.js

@@ -1336,6 +1336,33 @@ function registerSourceConfigCommands(notify) {
             printJson(await requireClient().activateNotificationSourceConfig(teamId, opts.source, opts.id, expectedActive === undefined ? {} : { expectedActive }));
         });
     });
+    cfg
+        .command("narrow-history")
+        .description("POST .../configs/:fromConfigId/narrow-history — 保留 seq/游标，净化旧事件字段并迁移未触发 schedule（admin only）")
+        .option("-t, --team <teamId>", "Team UUID（缺省用当前 context）")
+        .requiredOption("--source <sourceId>", "sourceId")
+        .requiredOption("--from-config <uuid>", "需要净化的旧 config version id")
+        .requiredOption("--target-config <uuid>", "已激活、字段为旧版子集的目标 config version id")
+        .option("--expect-selection-hash <sha256>", "--apply 时必填：上一轮服务端 dry-run 返回的 selectionHash")
+        .option("--apply", "执行净化；缺省为服务端真实 dry-run（会校验配置、事件和 schedule，但不写数据）")
+        .action(async (opts) => {
+        await runNotify("admin", async () => {
+            const teamId = resolveTeamId(opts.team);
+            const apply = opts.apply === true;
+            const expectedSelectionHash = opts.expectSelectionHash;
+            if (apply && !expectedSelectionHash) {
+                fail("--apply 必须同时给 --expect-selection-hash <上一轮 dry-run 的 selectionHash>。");
+            }
+            if (!apply && expectedSelectionHash) {
+                fail("--expect-selection-hash 只可与 --apply 一起使用。");
+            }
+            printJson(await requireClient().narrowNotificationHistory(teamId, opts.source, opts.fromConfig, {
+                targetConfigId: opts.targetConfig,
+                apply,
+                ...(expectedSelectionHash ? { expectedSelectionHash } : {}),
+            }));
+        });
+    });
     cfg
         .command("set-enabled")
         .description("PUT .../notification-sources/:sourceId/enabled — 实时 kill switch（影响全部在途 schedule；不 bump sourceConfigVersion）")