@kodelyth/line 2026.5.39 → 2026.5.42

package/runtime-api.ts

@@ -0,0 +1,179 @@
+// Private runtime barrel for the bundled LINE extension.
+// Keep this barrel thin and aligned with the local extension surface.
+
+export type {
+  ChannelAccountSnapshot,
+  ChannelPlugin,
+  KlawConfig,
+  KlawPluginApi,
+  PluginRuntime,
+} from "klaw/plugin-sdk/core";
+export type { ChannelGatewayContext, ChannelStatusIssue } from "klaw/plugin-sdk/channel-contract";
+export { clearAccountEntryFields } from "klaw/plugin-sdk/core";
+export { buildChannelConfigSchema } from "klaw/plugin-sdk/channel-config-schema";
+export type { ReplyPayload } from "klaw/plugin-sdk/reply-runtime";
+export type { ChannelSetupDmPolicy, ChannelSetupWizard } from "klaw/plugin-sdk/setup";
+export {
+  buildComputedAccountStatusSnapshot,
+  buildTokenChannelStatusSummary,
+} from "klaw/plugin-sdk/status-helpers";
+export {
+  DEFAULT_ACCOUNT_ID,
+  formatDocsLink,
+  setSetupChannelEnabled,
+  splitSetupEntries,
+} from "klaw/plugin-sdk/setup";
+export { setLineRuntime } from "./src/runtime.js";
+export { firstDefined, normalizeAllowFrom } from "./src/bot-access.js";
+export { downloadLineMedia } from "./src/download.js";
+export { probeLineBot } from "./src/probe.js";
+export { buildTemplateMessageFromPayload } from "./src/template-messages.js";
+export {
+  createQuickReplyItems,
+  pushFlexMessage,
+  pushLocationMessage,
+  pushMessageLine,
+  pushMessagesLine,
+  pushTemplateMessage,
+  pushTextMessageWithQuickReplies,
+  sendMessageLine,
+} from "./src/send.js";
+export { monitorLineProvider } from "./src/monitor.js";
+export { hasLineDirectives, parseLineDirectives } from "./src/reply-payload-transform.js";
+export {
+  listLineAccountIds,
+  normalizeAccountId,
+  resolveDefaultLineAccountId,
+  resolveLineAccount,
+} from "./src/accounts.js";
+export { type NormalizedAllowFrom } from "./src/bot-access.js";
+export { resolveLineChannelAccessToken } from "./src/channel-access-token.js";
+export {
+  LineChannelConfigSchema,
+  LineConfigSchema,
+  type LineConfigSchemaType,
+} from "./src/config-schema.js";
+export {
+  resolveExactLineGroupConfigKey,
+  resolveLineGroupConfigEntry,
+  resolveLineGroupLookupIds,
+  resolveLineGroupsConfig,
+} from "./src/group-keys.js";
+export {
+  type CodeBlock,
+  convertCodeBlockToFlexBubble,
+  convertLinksToFlexBubble,
+  convertTableToFlexBubble,
+  extractCodeBlocks,
+  extractLinks,
+  extractMarkdownTables,
+  hasMarkdownToConvert,
+  type MarkdownLink,
+  type MarkdownTable,
+  type ProcessedLineMessage,
+  processLineMessage,
+  stripMarkdown,
+} from "./src/markdown-to-line.js";
+export {
+  createAudioMessage,
+  createFlexMessage,
+  createImageMessage,
+  createLocationMessage,
+  createTextMessageWithQuickReplies,
+  createVideoMessage,
+  getUserDisplayName,
+  getUserProfile,
+  pushImageMessage,
+  replyMessageLine,
+  showLoadingAnimation,
+} from "./src/send.js";
+export { validateLineSignature } from "./src/signature.js";
+export {
+  type ButtonsTemplate,
+  type CarouselColumn,
+  type CarouselTemplate,
+  type ConfirmTemplate,
+  createButtonMenu,
+  createButtonTemplate,
+  createCarouselColumn,
+  createConfirmTemplate,
+  createImageCarousel,
+  createImageCarouselColumn,
+  createLinkMenu,
+  createProductCarousel,
+  createTemplateCarousel,
+  createYesNoConfirm,
+  type ImageCarouselColumn,
+  type ImageCarouselTemplate,
+  type TemplateMessage,
+} from "./src/template-messages.js";
+export type {
+  LineChannelData,
+  LineConfig,
+  LineProbeResult,
+  ResolvedLineAccount,
+} from "./src/types.js";
+export { createLineNodeWebhookHandler, readLineWebhookRequestBody } from "./src/webhook-node.js";
+export {
+  createLineWebhookMiddleware,
+  type LineWebhookOptions,
+  startLineWebhook,
+  type StartLineWebhookOptions,
+} from "./src/webhook.js";
+export { parseLineWebhookBody } from "./src/webhook-utils.js";
+export { datetimePickerAction, messageAction, postbackAction, uriAction } from "./src/actions.js";
+export type { Action } from "./src/actions.js";
+export {
+  createActionCard,
+  createAgendaCard,
+  createAppleTvRemoteCard,
+  createCarousel,
+  createDeviceControlCard,
+  createEventCard,
+  createImageCard,
+  createInfoCard,
+  createListCard,
+  createMediaPlayerCard,
+  createNotificationBubble,
+  createReceiptCard,
+  toFlexMessage,
+} from "./src/flex-templates.js";
+export type {
+  CardAction,
+  FlexBox,
+  FlexBubble,
+  FlexButton,
+  FlexCarousel,
+  FlexComponent,
+  FlexContainer,
+  FlexImage,
+  FlexText,
+  ListItem,
+} from "./src/flex-templates.js";
+export {
+  cancelDefaultRichMenu,
+  createDefaultMenuConfig,
+  createGridLayout,
+  createRichMenu,
+  createRichMenuAlias,
+  deleteRichMenu,
+  deleteRichMenuAlias,
+  getDefaultRichMenuId,
+  getRichMenu,
+  getRichMenuIdOfUser,
+  getRichMenuList,
+  linkRichMenuToUser,
+  linkRichMenuToUsers,
+  setDefaultRichMenu,
+  unlinkRichMenuFromUser,
+  unlinkRichMenuFromUsers,
+  uploadRichMenuImage,
+} from "./src/rich-menu.js";
+export type {
+  CreateRichMenuParams,
+  RichMenuArea,
+  RichMenuAreaRequest,
+  RichMenuRequest,
+  RichMenuResponse,
+  RichMenuSize,
+} from "./src/rich-menu.js";

package/secret-contract-api.ts

@@ -0,0 +1,4 @@
+// Line does not expose secret-contract surfaces.
+export const secretTargetRegistryEntries: readonly [] = [];
+
+export function collectRuntimeConfigAssignments(): void {}

package/setup-api.ts

@@ -0,0 +1,2 @@
+export { lineSetupAdapter } from "./src/setup-core.js";
+export { lineSetupWizard } from "./src/setup-surface.js";

package/setup-entry.ts

@@ -0,0 +1,9 @@
+import { defineBundledChannelSetupEntry } from "klaw/plugin-sdk/channel-entry-contract";
+
+export default defineBundledChannelSetupEntry({
+  importMetaUrl: import.meta.url,
+  plugin: {
+    specifier: "./api.js",
+    exportName: "lineSetupPlugin",
+  },
+});

package/src/account-helpers.ts

@@ -0,0 +1,16 @@
+type LineCredentialAccount = {
+  channelAccessToken?: string;
+  channelSecret?: string;
+};
+
+export function hasLineCredentials(account: LineCredentialAccount): boolean {
+  return Boolean(account.channelAccessToken?.trim() && account.channelSecret?.trim());
+}
+
+export function parseLineAllowFromId(raw: string): string | null {
+  const trimmed = raw.trim().replace(/^line:(?:user:)?/i, "");
+  if (!/^U[a-f0-9]{32}$/i.test(trimmed)) {
+    return null;
+  }
+  return trimmed;
+}

package/src/accounts.test.ts

@@ -0,0 +1,288 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import type { KlawConfig } from "klaw/plugin-sdk/config-contracts";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  resolveLineAccount,
+  resolveDefaultLineAccountId,
+  normalizeAccountId,
+  DEFAULT_ACCOUNT_ID,
+} from "./accounts.js";
+
+describe("LINE accounts", () => {
+  const tempDirs: string[] = [];
+
+  const createSecretFile = (fileName: string, contents: string) => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "klaw-line-account-"));
+    tempDirs.push(dir);
+    const filePath = path.join(dir, fileName);
+    fs.writeFileSync(filePath, contents, "utf8");
+    return filePath;
+  };
+
+  beforeEach(() => {
+    vi.stubEnv("LINE_CHANNEL_ACCESS_TOKEN", "");
+    vi.stubEnv("LINE_CHANNEL_SECRET", "");
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+    for (const dir of tempDirs.splice(0)) {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  describe("resolveLineAccount", () => {
+    it("resolves account from config", () => {
+      const cfg: KlawConfig = {
+        channels: {
+          line: {
+            enabled: true,
+            channelAccessToken: "test-token",
+            channelSecret: "test-secret",
+            name: "Test Bot",
+          },
+        },
+      };
+
+      const account = resolveLineAccount({ cfg });
+
+      expect(account.accountId).toBe(DEFAULT_ACCOUNT_ID);
+      expect(account.enabled).toBe(true);
+      expect(account.channelAccessToken).toBe("test-token");
+      expect(account.channelSecret).toBe("test-secret");
+      expect(account.name).toBe("Test Bot");
+      expect(account.tokenSource).toBe("config");
+    });
+
+    it("resolves account from environment variables", () => {
+      vi.stubEnv("LINE_CHANNEL_ACCESS_TOKEN", "env-token");
+      vi.stubEnv("LINE_CHANNEL_SECRET", "env-secret");
+
+      const cfg: KlawConfig = {
+        channels: {
+          line: {
+            enabled: true,
+          },
+        },
+      };
+
+      const account = resolveLineAccount({ cfg });
+
+      expect(account.channelAccessToken).toBe("env-token");
+      expect(account.channelSecret).toBe("env-secret");
+      expect(account.tokenSource).toBe("env");
+    });
+
+    it("resolves named account", () => {
+      const cfg: KlawConfig = {
+        channels: {
+          line: {
+            enabled: true,
+            accounts: {
+              business: {
+                enabled: true,
+                channelAccessToken: "business-token",
+                channelSecret: "business-secret",
+                name: "Business Bot",
+              },
+            },
+          },
+        },
+      };
+
+      const account = resolveLineAccount({ cfg, accountId: "business" });
+
+      expect(account.accountId).toBe("business");
+      expect(account.enabled).toBe(true);
+      expect(account.channelAccessToken).toBe("business-token");
+      expect(account.channelSecret).toBe("business-secret");
+      expect(account.name).toBe("Business Bot");
+    });
+
+    it("uses configured defaultAccount when accountId is omitted", () => {
+      const cfg: KlawConfig = {
+        channels: {
+          line: {
+            defaultAccount: "business",
+            accounts: {
+              business: {
+                enabled: true,
+                channelAccessToken: "business-token",
+                channelSecret: "business-secret",
+                name: "Business Bot",
+              },
+            },
+          },
+        },
+      };
+
+      const account = resolveLineAccount({ cfg });
+
+      expect(account.accountId).toBe("business");
+      expect(account.enabled).toBe(true);
+      expect(account.channelAccessToken).toBe("business-token");
+      expect(account.channelSecret).toBe("business-secret");
+      expect(account.name).toBe("Business Bot");
+    });
+
+    it("returns empty token when not configured", () => {
+      const cfg: KlawConfig = {};
+
+      const account = resolveLineAccount({ cfg });
+
+      expect(account.channelAccessToken).toBe("");
+      expect(account.channelSecret).toBe("");
+      expect(account.tokenSource).toBe("none");
+    });
+
+    it("resolves default account credentials from files", () => {
+      const cfg: KlawConfig = {
+        channels: {
+          line: {
+            tokenFile: createSecretFile("token.txt", "file-token\n"),
+            secretFile: createSecretFile("secret.txt", "file-secret\n"),
+          },
+        },
+      };
+
+      const account = resolveLineAccount({ cfg });
+
+      expect(account.channelAccessToken).toBe("file-token");
+      expect(account.channelSecret).toBe("file-secret");
+      expect(account.tokenSource).toBe("file");
+    });
+
+    it("resolves named account credentials from account-level files", () => {
+      const cfg: KlawConfig = {
+        channels: {
+          line: {
+            accounts: {
+              business: {
+                tokenFile: createSecretFile("business-token.txt", "business-file-token\n"),
+                secretFile: createSecretFile("business-secret.txt", "business-file-secret\n"),
+              },
+            },
+          },
+        },
+      };
+
+      const account = resolveLineAccount({ cfg, accountId: "business" });
+
+      expect(account.channelAccessToken).toBe("business-file-token");
+      expect(account.channelSecret).toBe("business-file-secret");
+      expect(account.tokenSource).toBe("file");
+    });
+
+    it.runIf(process.platform !== "win32")("rejects symlinked token and secret files", () => {
+      const dir = fs.mkdtempSync(path.join(os.tmpdir(), "klaw-line-account-"));
+      tempDirs.push(dir);
+      const tokenFile = path.join(dir, "token.txt");
+      const tokenLink = path.join(dir, "token-link.txt");
+      const secretFile = path.join(dir, "secret.txt");
+      const secretLink = path.join(dir, "secret-link.txt");
+      fs.writeFileSync(tokenFile, "file-token\n", "utf8");
+      fs.writeFileSync(secretFile, "file-secret\n", "utf8");
+      fs.symlinkSync(tokenFile, tokenLink);
+      fs.symlinkSync(secretFile, secretLink);
+
+      const cfg: KlawConfig = {
+        channels: {
+          line: {
+            tokenFile: tokenLink,
+            secretFile: secretLink,
+          },
+        },
+      };
+
+      const account = resolveLineAccount({ cfg });
+      expect(account.channelAccessToken).toBe("");
+      expect(account.channelSecret).toBe("");
+      expect(account.tokenSource).toBe("none");
+    });
+  });
+
+  describe("resolveDefaultLineAccountId", () => {
+    it.each([
+      {
+        name: "prefers channels.line.defaultAccount when configured",
+        cfg: {
+          channels: {
+            line: {
+              defaultAccount: "business",
+              accounts: {
+                business: { enabled: true },
+                support: { enabled: true },
+              },
+            },
+          },
+        } satisfies KlawConfig,
+        expected: "business",
+      },
+      {
+        name: "normalizes channels.line.defaultAccount before lookup",
+        cfg: {
+          channels: {
+            line: {
+              defaultAccount: "Business Ops",
+              accounts: {
+                "business-ops": { enabled: true },
+              },
+            },
+          },
+        } satisfies KlawConfig,
+        expected: "business-ops",
+      },
+      {
+        name: "returns first named account when default not configured",
+        cfg: {
+          channels: {
+            line: {
+              accounts: {
+                business: { enabled: true },
+              },
+            },
+          },
+        } satisfies KlawConfig,
+        expected: "business",
+      },
+      {
+        name: "falls back when channels.line.defaultAccount is missing",
+        cfg: {
+          channels: {
+            line: {
+              defaultAccount: "missing",
+              accounts: {
+                business: { enabled: true },
+              },
+            },
+          },
+        } satisfies KlawConfig,
+        expected: "business",
+      },
+      {
+        name: "prefers the default account when base credentials are configured",
+        cfg: {
+          channels: {
+            line: {
+              channelAccessToken: "base-token",
+              accounts: {
+                business: { enabled: true },
+              },
+            },
+          },
+        } satisfies KlawConfig,
+        expected: DEFAULT_ACCOUNT_ID,
+      },
+    ])("$name", ({ cfg, expected }) => {
+      expect(resolveDefaultLineAccountId(cfg)).toBe(expected);
+    });
+  });
+
+  describe("normalizeAccountId", () => {
+    it("trims and lowercases account ids", () => {
+      expect(normalizeAccountId("  Business  ")).toBe("business");
+    });
+  });
+});

package/src/accounts.ts

@@ -0,0 +1,187 @@
+import {
+  DEFAULT_ACCOUNT_ID,
+  normalizeAccountId as normalizeSharedAccountId,
+  normalizeOptionalAccountId,
+} from "klaw/plugin-sdk/account-id";
+import type { KlawConfig } from "klaw/plugin-sdk/account-resolution";
+import { resolveAccountEntry } from "klaw/plugin-sdk/account-resolution";
+import { tryReadSecretFileSync } from "klaw/plugin-sdk/core";
+import type {
+  LineAccountConfig,
+  LineConfig,
+  LineTokenSource,
+  ResolvedLineAccount,
+} from "./types.js";
+
+export { DEFAULT_ACCOUNT_ID } from "klaw/plugin-sdk/account-id";
+
+function readFileIfExists(filePath: string | undefined): string | undefined {
+  return tryReadSecretFileSync(filePath, "LINE credential file", { rejectSymlink: true });
+}
+
+function resolveToken(params: {
+  accountId: string;
+  baseConfig?: LineConfig;
+  accountConfig?: LineAccountConfig;
+}): { token: string; tokenSource: LineTokenSource } {
+  const { accountId, baseConfig, accountConfig } = params;
+
+  if (accountConfig?.channelAccessToken?.trim()) {
+    return { token: accountConfig.channelAccessToken.trim(), tokenSource: "config" };
+  }
+
+  const accountFileToken = readFileIfExists(accountConfig?.tokenFile);
+  if (accountFileToken) {
+    return { token: accountFileToken, tokenSource: "file" };
+  }
+
+  if (accountId === DEFAULT_ACCOUNT_ID) {
+    if (baseConfig?.channelAccessToken?.trim()) {
+      return { token: baseConfig.channelAccessToken.trim(), tokenSource: "config" };
+    }
+
+    const baseFileToken = readFileIfExists(baseConfig?.tokenFile);
+    if (baseFileToken) {
+      return { token: baseFileToken, tokenSource: "file" };
+    }
+
+    const envToken = process.env.LINE_CHANNEL_ACCESS_TOKEN?.trim();
+    if (envToken) {
+      return { token: envToken, tokenSource: "env" };
+    }
+  }
+
+  return { token: "", tokenSource: "none" };
+}
+
+function resolveSecret(params: {
+  accountId: string;
+  baseConfig?: LineConfig;
+  accountConfig?: LineAccountConfig;
+}): string {
+  const { accountId, baseConfig, accountConfig } = params;
+
+  if (accountConfig?.channelSecret?.trim()) {
+    return accountConfig.channelSecret.trim();
+  }
+
+  const accountFileSecret = readFileIfExists(accountConfig?.secretFile);
+  if (accountFileSecret) {
+    return accountFileSecret;
+  }
+
+  if (accountId === DEFAULT_ACCOUNT_ID) {
+    if (baseConfig?.channelSecret?.trim()) {
+      return baseConfig.channelSecret.trim();
+    }
+
+    const baseFileSecret = readFileIfExists(baseConfig?.secretFile);
+    if (baseFileSecret) {
+      return baseFileSecret;
+    }
+
+    const envSecret = process.env.LINE_CHANNEL_SECRET?.trim();
+    if (envSecret) {
+      return envSecret;
+    }
+  }
+
+  return "";
+}
+
+export function resolveLineAccount(params: {
+  cfg: KlawConfig;
+  accountId?: string;
+}): ResolvedLineAccount {
+  const cfg = params.cfg;
+  const accountId = normalizeSharedAccountId(params.accountId ?? resolveDefaultLineAccountId(cfg));
+  const lineConfig = cfg.channels?.line as LineConfig | undefined;
+  const accounts = lineConfig?.accounts;
+  const accountConfig =
+    accountId !== DEFAULT_ACCOUNT_ID ? resolveAccountEntry(accounts, accountId) : undefined;
+
+  const { token, tokenSource } = resolveToken({
+    accountId,
+    baseConfig: lineConfig,
+    accountConfig,
+  });
+
+  const secret = resolveSecret({
+    accountId,
+    baseConfig: lineConfig,
+    accountConfig,
+  });
+
+  const {
+    accounts: _ignoredAccounts,
+    defaultAccount: _ignoredDefaultAccount,
+    ...lineBase
+  } = (lineConfig ?? {}) as LineConfig & {
+    accounts?: unknown;
+    defaultAccount?: unknown;
+  };
+  const mergedConfig: LineConfig & LineAccountConfig = {
+    ...lineBase,
+    ...accountConfig,
+  };
+
+  const enabled =
+    accountConfig?.enabled ??
+    (accountId === DEFAULT_ACCOUNT_ID ? (lineConfig?.enabled ?? true) : false);
+
+  const name =
+    accountConfig?.name ?? (accountId === DEFAULT_ACCOUNT_ID ? lineConfig?.name : undefined);
+
+  return {
+    accountId,
+    name,
+    enabled,
+    channelAccessToken: token,
+    channelSecret: secret,
+    tokenSource,
+    config: mergedConfig,
+  };
+}
+
+export function listLineAccountIds(cfg: KlawConfig): string[] {
+  const lineConfig = cfg.channels?.line as LineConfig | undefined;
+  const accounts = lineConfig?.accounts;
+  const ids = new Set<string>();
+
+  if (
+    lineConfig?.channelAccessToken?.trim() ||
+    lineConfig?.tokenFile ||
+    process.env.LINE_CHANNEL_ACCESS_TOKEN?.trim()
+  ) {
+    ids.add(DEFAULT_ACCOUNT_ID);
+  }
+
+  if (accounts) {
+    for (const id of Object.keys(accounts)) {
+      ids.add(id);
+    }
+  }
+
+  return Array.from(ids);
+}
+
+export function resolveDefaultLineAccountId(cfg: KlawConfig): string {
+  const preferred = normalizeOptionalAccountId(
+    (cfg.channels?.line as LineConfig | undefined)?.defaultAccount,
+  );
+  if (
+    preferred &&
+    listLineAccountIds(cfg).some((accountId) => normalizeSharedAccountId(accountId) === preferred)
+  ) {
+    return preferred;
+  }
+  const ids = listLineAccountIds(cfg);
+  if (ids.includes(DEFAULT_ACCOUNT_ID)) {
+    return DEFAULT_ACCOUNT_ID;
+  }
+  return ids[0] ?? DEFAULT_ACCOUNT_ID;
+}
+
+export function normalizeAccountId(accountId: string | undefined): string {
+  return normalizeSharedAccountId(accountId);
+}