@krischoichoi/channel-control 0.6.0

package/lib/definitions/registry.js

@@ -0,0 +1,59 @@
+/**
+ * [ChannelDefinitionRegistry] — registration-order store of ChannelDefinitions.
+ *
+ * Each channel plugin registers exactly one definition at activation time; the
+ * control plane drives setup/authorization/runtime purely through these
+ * definitions (doc §14). Iteration is in registration order.
+ */
+import { ChannelDuplicateError, ChannelError } from '@krischoichoi/channel-core';
+export class ChannelDefinitionRegistry {
+    definitions = new Map();
+    listeners = new Set();
+    /**
+     * Subscribe to definition registrations. The returned disposer removes the
+     * listener. Fired synchronously after a successful register() — the control
+     * plane uses this to auto-start configured channels the moment their plugin
+     * registers the definition (doc §27), since channel plugins activate AFTER
+     * the channel-control plugin itself.
+     */
+    onRegister(listener) {
+        this.listeners.add(listener);
+        return () => {
+            this.listeners.delete(listener);
+        };
+    }
+    /** Register a definition; throws ChannelDuplicateError on duplicate id. */
+    register(definition) {
+        const { id } = definition;
+        if (this.definitions.has(id)) {
+            throw new ChannelDuplicateError(`channel definition '${id}' is already registered`);
+        }
+        this.definitions.set(id, definition);
+        for (const listener of this.listeners) {
+            listener(definition);
+        }
+    }
+    get(id) {
+        return this.definitions.get(id);
+    }
+    /** Require a definition, or raise a stable ChannelError. */
+    require(id) {
+        const definition = this.definitions.get(id);
+        if (!definition) {
+            throw new ChannelError('CHANNEL_ERROR', `channel definition '${id}' is not registered`);
+        }
+        return definition;
+    }
+    has(id) {
+        return this.definitions.has(id);
+    }
+    /** List definitions in registration order. */
+    list() {
+        return [...this.definitions.values()];
+    }
+    /** Remove a definition; returns whether it existed. */
+    unregister(id) {
+        return this.definitions.delete(id);
+    }
+}
+//# sourceMappingURL=registry.js.map

package/lib/definitions/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/definitions/registry.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAGjF,MAAM,OAAO,yBAAyB;IACnB,WAAW,GAAG,IAAI,GAAG,EAA6B,CAAC;IACnD,SAAS,GAAG,IAAI,GAAG,EAA2C,CAAC;IAEhF;;;;;;OAMG;IACH,UAAU,CAAC,QAAiD;QAC1D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,QAAQ,CAAC,UAA6B;QACpC,MAAM,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC;QAC1B,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,qBAAqB,CAC7B,uBAAuB,EAAE,yBAAyB,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QACrC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,4DAA4D;IAC5D,OAAO,CAAC,EAAU;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,YAAY,CACpB,eAAe,EACf,uBAAuB,EAAE,qBAAqB,CAC/C,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,8CAA8C;IAC9C,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,uDAAuD;IACvD,UAAU,CAAC,EAAU;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC;CACF"}

package/lib/errors.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Control-plane error hierarchy with stable machine-readable codes.
+ *
+ * Channel-level errors reuse [ChannelError] from @krischoichoi/channel-core (e.g.
+ * duplicate definition ids). The control plane additionally defines codes for
+ * its own security/session concerns (auth not supported, unknown/cancelled/
+ * expired sessions, rejected secret fields) that are NOT part of the core's
+ * fixed [ChannelErrorCode] union, so they live here without touching core.
+ */
+export type ControlErrorCode = 'CONTROL_ERROR' | 'CONTROL_DEFINITION_NOT_FOUND' | 'AUTH_NOT_SUPPORTED' | 'AUTH_SESSION_NOT_FOUND' | 'AUTH_SESSION_CANCELLED' | 'AUTH_SESSION_EXPIRED' | 'AUTH_NOT_READY' | 'ENABLE_NOT_SUPPORTED' | 'SECRET_FIELD_REJECTED' | 'NOT_A_SECRET_FIELD' | 'CREDENTIAL_NOT_SUPPORTED' | 'CREDENTIAL_READONLY' | 'INVALID_CREDENTIAL' | 'UNKNOWN_FIELD' | 'INVALID_ACCESS_POLICY' | 'CLAIM_NOT_FOUND' | 'CLAIM_EXPIRED' | 'CLAIM_CANCELLED' | 'CLAIM_NOT_SUPPORTED' | 'CLAIM_INVALID';
+/** Base control-plane error. */
+export declare class ControlError extends Error {
+    readonly code: ControlErrorCode;
+    constructor(code?: ControlErrorCode, message?: string, options?: ErrorOptions);
+}
+/** Whether a value is a control error with the given code. */
+export declare function isControlError(error: unknown, code?: ControlErrorCode): error is ControlError;
+/** Normalize an unknown thrown value into a ControlError with a stable code. */
+export declare function toControlError(error: unknown, code: ControlErrorCode, fallback?: string): ControlError;
+//# sourceMappingURL=errors.d.ts.map

package/lib/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GACxB,eAAe,GACf,8BAA8B,GAC9B,oBAAoB,GACpB,wBAAwB,GACxB,wBAAwB,GACxB,sBAAsB,GACtB,gBAAgB,GAChB,sBAAsB,GACtB,uBAAuB,GACvB,oBAAoB,GACpB,0BAA0B,GAC1B,qBAAqB,GACrB,oBAAoB,GACpB,eAAe,GACf,uBAAuB,GACvB,iBAAiB,GACjB,eAAe,GACf,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,CAAC;AAyBpB,gCAAgC;AAChC,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;gBAEpB,IAAI,GAAE,gBAAkC,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAK/F;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,gBAAgB,GAAG,KAAK,IAAI,YAAY,CAG7F;AAED,gFAAgF;AAChF,wBAAgB,cAAc,CAC5B,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,gBAAgB,EACtB,QAAQ,CAAC,EAAE,MAAM,GAChB,YAAY,CAId"}

package/lib/errors.js

@@ -0,0 +1,45 @@
+const MESSAGES = {
+    CONTROL_ERROR: 'channel control error',
+    CONTROL_DEFINITION_NOT_FOUND: 'channel definition is not registered',
+    AUTH_NOT_SUPPORTED: 'channel does not support interactive authorization',
+    AUTH_SESSION_NOT_FOUND: 'auth session not found',
+    AUTH_SESSION_CANCELLED: 'auth session was cancelled',
+    AUTH_SESSION_EXPIRED: 'auth session has expired',
+    AUTH_NOT_READY: 'channel is not mounted; start it before beginning auth',
+    ENABLE_NOT_SUPPORTED: 'channel does not support enable/disable',
+    SECRET_FIELD_REJECTED: 'secret fields must be saved through the credentials seam',
+    NOT_A_SECRET_FIELD: 'field is not a secret; save it through the config endpoint',
+    CREDENTIAL_NOT_SUPPORTED: 'field has no credential ref',
+    CREDENTIAL_READONLY: 'credential is read-only (not writable)',
+    INVALID_CREDENTIAL: 'credential value must be a string (empty string clears it)',
+    UNKNOWN_FIELD: 'channel has no such setup field',
+    INVALID_ACCESS_POLICY: 'access policy is invalid for this channel',
+    CLAIM_NOT_FOUND: 'owner claim not found',
+    CLAIM_EXPIRED: 'owner claim has expired',
+    CLAIM_CANCELLED: 'owner claim was cancelled',
+    CLAIM_NOT_SUPPORTED: 'channel does not support owner claim',
+    CLAIM_INVALID: 'owner claim is in an invalid state for this operation',
+};
+/** Base control-plane error. */
+export class ControlError extends Error {
+    code;
+    constructor(code = 'CONTROL_ERROR', message, options) {
+        super(message ?? MESSAGES[code], options);
+        this.name = 'ControlError';
+        this.code = code;
+    }
+}
+/** Whether a value is a control error with the given code. */
+export function isControlError(error, code) {
+    if (!(error instanceof ControlError))
+        return false;
+    return code === undefined || error.code === code;
+}
+/** Normalize an unknown thrown value into a ControlError with a stable code. */
+export function toControlError(error, code, fallback) {
+    if (error instanceof ControlError)
+        return error;
+    const message = error instanceof Error ? error.message : String(error);
+    return new ControlError(code, fallback ?? message);
+}
+//# sourceMappingURL=errors.js.map

package/lib/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AA+BA,MAAM,QAAQ,GAAqC;IACjD,aAAa,EAAE,uBAAuB;IACtC,4BAA4B,EAAE,sCAAsC;IACpE,kBAAkB,EAAE,oDAAoD;IACxE,sBAAsB,EAAE,wBAAwB;IAChD,sBAAsB,EAAE,4BAA4B;IACpD,oBAAoB,EAAE,0BAA0B;IAChD,cAAc,EAAE,wDAAwD;IACxE,oBAAoB,EAAE,yCAAyC;IAC/D,qBAAqB,EAAE,0DAA0D;IACjF,kBAAkB,EAAE,4DAA4D;IAChF,wBAAwB,EAAE,6BAA6B;IACvD,mBAAmB,EAAE,wCAAwC;IAC7D,kBAAkB,EAAE,4DAA4D;IAChF,aAAa,EAAE,iCAAiC;IAChD,qBAAqB,EAAE,2CAA2C;IAClE,eAAe,EAAE,uBAAuB;IACxC,aAAa,EAAE,yBAAyB;IACxC,eAAe,EAAE,2BAA2B;IAC5C,mBAAmB,EAAE,sCAAsC;IAC3D,aAAa,EAAE,uDAAuD;CACvE,CAAC;AAEF,gCAAgC;AAChC,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAmB;IAEhC,YAAY,OAAyB,eAAe,EAAE,OAAgB,EAAE,OAAsB;QAC5F,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,8DAA8D;AAC9D,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,IAAuB;IACpE,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,OAAO,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AACnD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAC5B,KAAc,EACd,IAAsB,EACtB,QAAiB;IAEjB,IAAI,KAAK,YAAY,YAAY;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,QAAQ,IAAI,OAAO,CAAC,CAAC;AACrD,CAAC"}

package/lib/index.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @krischoichoi/channel-control — universal Channel Control Plane.
+ *
+ * Exports the control-plane types (doc §14–§18), the sub-managers
+ * (definition registry, credential manager, auth session manager, runtime
+ * manager), the [ChannelControlService] (Cordis Service at ctx.channelControl)
+ * and the control-plane error hierarchy.
+ *
+ * This package is adapter-agnostic: it never imports channel-weixin/qq/
+ * dingtalk/lark/web. Platform differences are sealed behind ChannelDefinition.
+ *
+ * The Cordis plugin entry lives in ./plugin.ts (package export "./plugin").
+ */
+export * from './types.js';
+export * from './errors.js';
+export * from './config.js';
+export * from './definitions/registry.js';
+export * from './credentials/manager.js';
+export * from './auth/sanitizer.js';
+export * from './auth/session-manager.js';
+export * from './runtime/manager.js';
+export * from './runtime/mount-handle.js';
+export * from './access/policy-store.js';
+export * from './access/conversation-directory.js';
+export * from './access/conversation-directory-store.js';
+export * from './access/validation.js';
+export * from './access/materialize.js';
+export * from './access/manager.js';
+export * from './update-check.js';
+export * from './service.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC"}

package/lib/index.js

@@ -0,0 +1,31 @@
+/**
+ * @krischoichoi/channel-control — universal Channel Control Plane.
+ *
+ * Exports the control-plane types (doc §14–§18), the sub-managers
+ * (definition registry, credential manager, auth session manager, runtime
+ * manager), the [ChannelControlService] (Cordis Service at ctx.channelControl)
+ * and the control-plane error hierarchy.
+ *
+ * This package is adapter-agnostic: it never imports channel-weixin/qq/
+ * dingtalk/lark/web. Platform differences are sealed behind ChannelDefinition.
+ *
+ * The Cordis plugin entry lives in ./plugin.ts (package export "./plugin").
+ */
+export * from './types.js';
+export * from './errors.js';
+export * from './config.js';
+export * from './definitions/registry.js';
+export * from './credentials/manager.js';
+export * from './auth/sanitizer.js';
+export * from './auth/session-manager.js';
+export * from './runtime/manager.js';
+export * from './runtime/mount-handle.js';
+export * from './access/policy-store.js';
+export * from './access/conversation-directory.js';
+export * from './access/conversation-directory-store.js';
+export * from './access/validation.js';
+export * from './access/materialize.js';
+export * from './access/manager.js';
+export * from './update-check.js';
+export * from './service.js';
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC"}

package/lib/plugin.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Cordis plugin entry for @krischoichoi/channel-control (doc §12, §46).
+ *
+ * Instantiates the ChannelControlService, then auto-starts every configured
+ * channel (headless support, doc §25/§27). autoStartAll is guarded so a single
+ * misconfigured/broken channel can never crash profile activation. On fiber
+ * unload the plugin stops and disposes every runtime mount.
+ *
+ * The access manager is wired over the shared, durable channel-domain storage
+ * (`ctx.channels.resources.storage`) so policies written here and read by the
+ * harness resolver share one KV namespace. Owner identity resolution
+ * delegates to each registered definition's optional `resolveOwnerIdentity`.
+ */
+import { type Context } from '@deepseek-ai/cordis';
+import { Config, type Config as ChannelControlConfig } from './config.js';
+export declare const name = "channel-control";
+export declare const inject: string[];
+export { Config };
+export declare function apply(ctx: Context, config: ChannelControlConfig): void;
+//# sourceMappingURL=plugin.d.ts.map

package/lib/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAMnD,OAAO,EAAE,MAAM,EAAE,KAAK,MAAM,IAAI,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAE1E,eAAO,MAAM,IAAI,oBAAoB,CAAC;AACtC,eAAO,MAAM,MAAM,EAAE,MAAM,EAAgC,CAAC;AAE5D,OAAO,EAAE,MAAM,EAAE,CAAC;AAElB,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAyEtE"}

package/lib/plugin.js

@@ -0,0 +1,81 @@
+/**
+ * Cordis plugin entry for @krischoichoi/channel-control (doc §12, §46).
+ *
+ * Instantiates the ChannelControlService, then auto-starts every configured
+ * channel (headless support, doc §25/§27). autoStartAll is guarded so a single
+ * misconfigured/broken channel can never crash profile activation. On fiber
+ * unload the plugin stops and disposes every runtime mount.
+ *
+ * The access manager is wired over the shared, durable channel-domain storage
+ * (`ctx.channels.resources.storage`) so policies written here and read by the
+ * harness resolver share one KV namespace. Owner identity resolution
+ * delegates to each registered definition's optional `resolveOwnerIdentity`.
+ */
+import {} from '@deepseek-ai/cordis';
+import { ChannelControlService } from './service.js';
+import { ChannelStorageAccessPolicyStore } from './access/policy-store.js';
+import { ChannelStorageConversationDirectoryStore } from './access/conversation-directory-store.js';
+import { Config } from './config.js';
+export const name = 'channel-control';
+export const inject = ['channels', 'credentials'];
+export { Config };
+export function apply(ctx, config) {
+    const credentials = ctx.credentials;
+    const channels = ctx.channels;
+    // The resolver closure references `service`; annotate it explicitly so the
+    // self-reference resolves without circular-inference.
+    let service;
+    service = new ChannelControlService(ctx, {
+        credentials,
+        // Durable policy store over the same ChannelStorage the harness resolver reads.
+        accessStore: new ChannelStorageAccessPolicyStore(() => channels.resources.storage),
+        // Durable conversation-identity directory over the same shared storage.
+        conversationStore: new ChannelStorageConversationDirectoryStore(() => channels.resources.storage),
+        // Owner identity resolution delegates to the registered definition's hook.
+        resolveOwnerIdentity: async (channelId, accountId) => service.definitions.get(channelId)?.resolveOwnerIdentity?.(accountId),
+        // Prompt-only bundle update check over the same durable channel storage.
+        updateCheck: {
+            enabled: config.updateCheck.enabled,
+            intervalHours: config.updateCheck.intervalHours,
+            storage: () => channels.resources.storage,
+        },
+    });
+    // Fire-and-forget startup check (never blocks activation; offline-tolerant;
+    // prompt-only — it never installs anything).
+    void service.updates.trigger();
+    // Headless auto-start: definitions registered BEFORE this plugin activates
+    // are swept here; definitions registered afterwards (channel plugins
+    // activate after channel-control) are auto-started by the service's
+    // onRegister hook (doc §27). Unconfigured channels are skipped silently and
+    // a failed start never crashes plugin activation.
+    void (async () => {
+        try {
+            await service.runtime.autoStartAll();
+        }
+        catch (error) {
+            ctx.logger('channel-control').error('[channel-control] autoStartAll failed during activation', error);
+        }
+    })();
+    // On fiber unload, stop and dispose every mounted runtime adapter.
+    ctx.effect(() => {
+        return () => service.runtime.stopAll().catch(() => { });
+    });
+    // Event listeners for the owner-claim session manager and the conversation
+    // identity directory. Neither observe() ever throws intentionally (both catch
+    // and log internally), but wrap them anyway so a failure can never propagate
+    // back to the adapter inbound loop (which would treat the whole platform
+    // message as failed). The disposer is returned through ctx.effect teardown.
+    ctx.effect(() => {
+        const off = channels.on((event) => {
+            try {
+                service.ownerClaims.observe(event);
+                service.observeConversation(event);
+            }
+            catch (error) {
+                ctx.logger('channel-control').warn('[channel-control] channel event observe failed', error);
+            }
+        });
+        return off;
+    });
+}
+//# sourceMappingURL=plugin.js.map

package/lib/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAgB,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,EAAE,+BAA+B,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAE,wCAAwC,EAAE,MAAM,0CAA0C,CAAC;AACpG,OAAO,EAAE,MAAM,EAAuC,MAAM,aAAa,CAAC;AAE1E,MAAM,CAAC,MAAM,IAAI,GAAG,iBAAiB,CAAC;AACtC,MAAM,CAAC,MAAM,MAAM,GAAa,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAE5D,OAAO,EAAE,MAAM,EAAE,CAAC;AAElB,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAA4B;IAC9D,MAAM,WAAW,GAAI,GAAiD,CAAC,WAAW,CAAC;IACnF,MAAM,QAAQ,GAAI,GAA8C,CAAC,QAAQ,CAAC;IAE1E,2EAA2E;IAC3E,sDAAsD;IACtD,IAAI,OAA8B,CAAC;IACnC,OAAO,GAAG,IAAI,qBAAqB,CAAC,GAAG,EAAE;QACvC,WAAW;QACX,gFAAgF;QAChF,WAAW,EAAE,IAAI,+BAA+B,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC;QAClF,wEAAwE;QACxE,iBAAiB,EAAE,IAAI,wCAAwC,CAC7D,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CACjC;QACD,2EAA2E;QAC3E,oBAAoB,EAAE,KAAK,EACzB,SAAiB,EACjB,SAAiB,EACY,EAAE,CAC/B,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,oBAAoB,EAAE,CAAC,SAAS,CAAC;QACvE,yEAAyE;QACzE,WAAW,EAAE;YACX,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO;YACnC,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,aAAa;YAC/C,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO;SAC1C;KACF,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6CAA6C;IAC7C,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAE/B,2EAA2E;IAC3E,qEAAqE;IACrE,oEAAoE;IACpE,4EAA4E;IAC5E,kDAAkD;IAClD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,KAAK,CACjC,yDAAyD,EACzD,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,mEAAmE;IACnE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;QACd,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE;YAChC,IAAI,CAAC;gBACH,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACnC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAChC,gDAAgD,EAChD,KAAK,CACN,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC"}

package/lib/runtime/manager.d.ts

@@ -0,0 +1,73 @@
+/**
+ * [ChannelRuntimeManager] — start/stop/restart/status for mounted channel
+ * adapters (doc §21–§23, §25, §60; M2 Task 3 / M3 Task 6).
+ *
+ * Each mount lives in a Map keyed by `channelId:accountId` (default
+ * account 'main'). Starting an already-mounted key disposes the old mount
+ * first (restart semantics). The underlying mount is transactional — mirroring
+ * channel-core's mountChannelAdapter: register → start → rollback on failure
+ * (abort + stop + unregister + rethrow). Because the runtime must AWAIT
+ * startup and capture start errors (the opaque core handle does not expose a
+ * settle promise), the mount here drives the SAME Cordis effect directly and
+ * exposes a `ChannelMountHandle`-shaped disposer, so a failed start never
+ * leaves a residual registry entry and surfaces lastError via status().
+ *
+ * autoStartAll() mounts every registered definition whose autoStart is not
+ * false and whose dynamic configured state is configured; unconfigured
+ * channels are skipped silently (doc §25/§27) and a failing definition is
+ * logged, never allowed to crash plugin activation.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { ChannelAdapter } from '@krischoichoi/channel-core';
+import { ChannelDefinitionRegistry } from '../definitions/registry.js';
+import type { CredentialSeam } from '../credentials/manager.js';
+import type { ChannelRuntimeStatus } from '../types.js';
+export interface ChannelRuntimeManagerOptions {
+    ctx: Context;
+    registry: ChannelDefinitionRegistry;
+    credentials: CredentialSeam;
+}
+export declare class ChannelRuntimeManager {
+    private readonly mounts;
+    private readonly errors;
+    private readonly ctx;
+    private readonly registry;
+    private readonly credentials;
+    constructor(options: ChannelRuntimeManagerOptions);
+    key(channelId: string, accountId?: string): string;
+    start(channelId: string, accountId?: string): Promise<void>;
+    stop(channelId: string, accountId?: string): Promise<void>;
+    restart(channelId: string, accountId?: string, rollback?: () => Promise<void> | void): Promise<void>;
+    status(channelId: string, accountId?: string): Promise<ChannelRuntimeStatus>;
+    isRunning(channelId: string, accountId?: string): boolean;
+    /**
+     * The currently mounted adapter for a channel (doc §43: the Weixin
+     * definition delegates beginAuth/pollAuth/submitAuthInput to the mounted
+     * adapter so the M1 auth flow itself is unchanged). Returns undefined when
+     * not mounted.
+     */
+    adapter(channelId: string, accountId?: string): ChannelAdapter | undefined;
+    /**
+     * Auto-start ONE definition when it is registered (doc §27). Skips
+     * silently when autoStart is false or the channel is not configured; a
+     * failing start is logged and never thrown (registration must not crash
+     * the profile). Returns true when mounted.
+     */
+    autoStartOne(channelId: string): Promise<boolean>;
+    /**
+     * Mount every enabled+configured registered definition (doc §25, §27).
+     * Unconfigured channels are skipped silently. A failing start is logged and
+     * never propagates, so an unconfigured/broken channel cannot crash the
+     * profile. Returns { started, skipped } counts.
+     */
+    autoStartAll(): Promise<{
+        started: number;
+        skipped: number;
+        failed: number;
+    }>;
+    /** Dispose and forget every mounted adapter. */
+    stopAll(): Promise<void>;
+    private mountTransactional;
+    private mount;
+}
+//# sourceMappingURL=manager.d.ts.map

package/lib/runtime/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/runtime/manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAiB,MAAM,4BAA4B,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGxD,MAAM,WAAW,4BAA4B;IAC3C,GAAG,EAAE,OAAO,CAAC;IACb,QAAQ,EAAE,yBAAyB,CAAC;IACpC,WAAW,EAAE,cAAc,CAAC;CAC7B;AAUD,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAU;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiB;gBAEjC,OAAO,EAAE,4BAA4B;IAMjD,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM;IAI5C,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB3D,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY1D,OAAO,CACX,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GACpC,OAAO,CAAC,IAAI,CAAC;IA2CV,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA4ClF,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO;IAIzD;;;;;OAKG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI1E;;;;;OAKG;IACG,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmBvD;;;;;OAKG;IACG,YAAY,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAyCnF,gDAAgD;IAC1C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAW9B,OAAO,CAAC,kBAAkB;YAgDZ,KAAK;CAUpB"}