@krischoichoi/channel-dingtalk 0.6.0

package/lib/ai-card.d.ts

@@ -0,0 +1,64 @@
+/**
+ * DingTalk AI Card — the streaming reply (`ReplyHandle`).
+ *
+ * DingTalk streaming is modeled as: create card → update card with content
+ * (status 'update') → finalize card (status 'finished') → failure card
+ * (status 'failed'). This maps directly onto the reply contract:
+ * - `append(delta)` / `replace(message)` → update the card body
+ * - `finish()` → finalize the card
+ * - `fail(error)` → mark the card failed
+ *
+ * The handle does NOT throttle internally — ReplyRouter owns throttling via
+ * config `reply.updateIntervalMs`. It guards no-op updates (skip when the text
+ * is unchanged) and serializes card operations so concurrent router flushes
+ * cannot interleave. State is observable for tests: `status`, `cardId`,
+ * `text`, `error` and an `updates` record of applied operations.
+ */
+import type { ChannelLogger, ChannelTarget, OutboundMessage, ReplyHandle } from '@krischoichoi/channel-core';
+import type { DingTalkUpstream } from './upstream.js';
+export type DingTalkCardStatus = 'idle' | 'active' | 'finished' | 'failed';
+/** One applied card operation (observable test surface). */
+export interface DingTalkCardUpdate {
+    kind: 'created' | 'update' | 'finished' | 'failed';
+    /** Card text at the time of the operation. */
+    text?: string;
+    /** Clock timestamp (injectable). */
+    at: number;
+    /** Error detail when the operation itself failed. */
+    error?: string;
+}
+export interface DingTalkCardReplyOptions {
+    upstream: DingTalkUpstream;
+    /** Conversation the card is attached to. */
+    target: ChannelTarget;
+    logger: ChannelLogger;
+    /** Create the card on the first delta; otherwise only at `finish`. */
+    createOnFirstDelta: boolean;
+    /** Injectable clock (tests). */
+    now?: () => number;
+}
+export declare class DingTalkCardReply implements ReplyHandle {
+    private readonly options;
+    status: DingTalkCardStatus;
+    cardId?: string;
+    text: string;
+    /** Original failure value passed to `fail()`, if any. */
+    error?: unknown;
+    /** Ordered record of applied card operations. */
+    readonly updates: DingTalkCardUpdate[];
+    private readonly now;
+    private queue;
+    /** Card API/template failures fall back to one final sessionWebhook text reply. */
+    private cardUnavailable;
+    constructor(options: DingTalkCardReplyOptions);
+    append(delta: string): Promise<void>;
+    replace(message: OutboundMessage): Promise<void>;
+    finish(message?: OutboundMessage): Promise<void>;
+    fail(error: unknown): Promise<void>;
+    private get finalized();
+    private push;
+    private createCard;
+    private record;
+    private enqueue;
+}
+//# sourceMappingURL=ai-card.d.ts.map

package/lib/ai-card.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-card.d.ts","sourceRoot":"","sources":["../src/ai-card.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,eAAe,EACf,WAAW,EACZ,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE3E,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,QAAQ,CAAC;IACnD,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,4CAA4C;IAC5C,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,aAAa,CAAC;IACtB,sEAAsE;IACtE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,iBAAkB,YAAW,WAAW;IAcvC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAbpC,MAAM,EAAE,kBAAkB,CAAU;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,SAAM;IACV,yDAAyD;IACzD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iDAAiD;IACjD,QAAQ,CAAC,OAAO,EAAE,kBAAkB,EAAE,CAAM;IAE5C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,KAAK,CAAoC;IACjD,mFAAmF;IACnF,OAAO,CAAC,eAAe,CAAS;gBAEH,OAAO,EAAE,wBAAwB;IAI9D,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASpC,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhD,MAAM,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BhD,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBnC,OAAO,KAAK,SAAS,GAEpB;YAEa,IAAI;YAaJ,UAAU;IAgBxB,OAAO,CAAC,MAAM;IASd,OAAO,CAAC,OAAO;CAQhB"}

package/lib/ai-card.js

@@ -0,0 +1,150 @@
+export class DingTalkCardReply {
+    options;
+    status = 'idle';
+    cardId;
+    text = '';
+    /** Original failure value passed to `fail()`, if any. */
+    error;
+    /** Ordered record of applied card operations. */
+    updates = [];
+    now;
+    queue = Promise.resolve();
+    /** Card API/template failures fall back to one final sessionWebhook text reply. */
+    cardUnavailable = false;
+    constructor(options) {
+        this.options = options;
+        this.now = options.now ?? Date.now;
+    }
+    append(delta) {
+        return this.enqueue(async () => {
+            if (this.finalized)
+                return;
+            if (!delta)
+                return;
+            this.text += delta;
+            await this.push();
+        });
+    }
+    replace(message) {
+        return this.enqueue(async () => {
+            if (this.finalized)
+                return;
+            if (message.text === undefined)
+                return;
+            // No-op guard: skip the network round-trip when nothing changed.
+            if (message.text === this.text)
+                return;
+            this.text = message.text;
+            await this.push();
+        });
+    }
+    finish(message) {
+        return this.enqueue(async () => {
+            if (this.finalized)
+                return;
+            const finalText = message?.text;
+            let needsSync = false;
+            if (finalText !== undefined && finalText !== this.text) {
+                this.text = finalText;
+                needsSync = true;
+            }
+            if (!this.cardId) {
+                // Nothing was streamed eagerly: create the final card now, or a card
+                // with no content when there is nothing to show.
+                if (this.text)
+                    await this.createCard();
+            }
+            else if (needsSync) {
+                await this.options.upstream.updateCard(this.cardId, this.text);
+                this.record('update', this.text);
+            }
+            if (this.cardUnavailable && this.text) {
+                await this.options.upstream.sendText(this.options.target, this.text);
+                this.record('update', this.text);
+            }
+            this.status = 'finished';
+            if (this.cardId) {
+                await this.options.upstream.finishCard(this.cardId, this.text);
+                this.record('finished', this.text);
+            }
+            else {
+                this.record('finished', undefined);
+            }
+        });
+    }
+    fail(error) {
+        return this.enqueue(async () => {
+            if (this.finalized)
+                return;
+            this.error = error;
+            this.status = 'failed';
+            if (this.cardId) {
+                try {
+                    await this.options.upstream.failCard(this.cardId, messageOf(error));
+                    this.record('failed', this.text);
+                }
+                catch (secondary) {
+                    // Marking the card failed must not mask the original error.
+                    this.options.logger.error('[channel-dingtalk] failed to mark card failed', secondary);
+                    this.record('failed', this.text, secondary);
+                }
+            }
+            else {
+                this.record('failed', this.text);
+            }
+        });
+    }
+    get finalized() {
+        return this.status === 'finished' || this.status === 'failed';
+    }
+    async push() {
+        if (this.cardId) {
+            await this.options.upstream.updateCard(this.cardId, this.text);
+            this.record('update', this.text);
+            return;
+        }
+        if (!this.options.createOnFirstDelta)
+            return; // buffer until finish
+        await this.createCard();
+        if (this.cardUnavailable)
+            return;
+        await this.options.upstream.updateCard(this.cardId, this.text);
+        this.record('update', this.text);
+    }
+    async createCard() {
+        if (this.cardUnavailable)
+            return;
+        try {
+            const result = await this.options.upstream.createCard(this.options.target, this.text);
+            this.cardId = result.cardId;
+            this.status = 'active';
+            this.record('created', this.text);
+        }
+        catch (error) {
+            // A card may be disabled for an otherwise valid bot. The session webhook
+            // can still deliver the completed answer, so defer that fallback to
+            // finish() rather than losing the whole Harness reply.
+            this.cardUnavailable = true;
+            this.options.logger.warn('[channel-dingtalk] AI Card unavailable; falling back to text', error);
+        }
+    }
+    record(kind, text, error) {
+        this.updates.push({
+            kind,
+            text,
+            at: this.now(),
+            error: error !== undefined ? String(error) : undefined,
+        });
+    }
+    enqueue(task) {
+        const next = this.queue.then(task, task);
+        this.queue = next.then(() => undefined, () => undefined);
+        return next;
+    }
+}
+function messageOf(error) {
+    if (error instanceof Error)
+        return error.message;
+    return String(error);
+}
+//# sourceMappingURL=ai-card.js.map

package/lib/ai-card.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-card.js","sourceRoot":"","sources":["../src/ai-card.ts"],"names":[],"mappings":"AAgDA,MAAM,OAAO,iBAAiB;IAcC;IAb7B,MAAM,GAAuB,MAAM,CAAC;IACpC,MAAM,CAAU;IAChB,IAAI,GAAG,EAAE,CAAC;IACV,yDAAyD;IACzD,KAAK,CAAW;IAChB,iDAAiD;IACxC,OAAO,GAAyB,EAAE,CAAC;IAE3B,GAAG,CAAe;IAC3B,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACjD,mFAAmF;IAC3E,eAAe,GAAG,KAAK,CAAC;IAEhC,YAA6B,OAAiC;QAAjC,YAAO,GAAP,OAAO,CAA0B;QAC5D,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YAC7B,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO;YAC3B,IAAI,CAAC,KAAK;gBAAE,OAAO;YACnB,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;YACnB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,OAAwB;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YAC7B,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO;YAC3B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO;YACvC,iEAAiE;YACjE,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;gBAAE,OAAO;YACvC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YACzB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,OAAyB;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YAC7B,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO;YAC3B,MAAM,SAAS,GAAG,OAAO,EAAE,IAAI,CAAC;YAChC,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBACvD,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;gBACtB,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,qEAAqE;gBACrE,iDAAiD;gBACjD,IAAI,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,CAAC;iBAAM,IAAI,SAAS,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/D,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,KAAc;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YAC7B,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO;YAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;YACvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;oBACpE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnC,CAAC;gBAAC,OAAO,SAAS,EAAE,CAAC;oBACnB,4DAA4D;oBAC5D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,EAAE,SAAS,CAAC,CAAC;oBACtF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAY,SAAS;QACnB,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC;IAChE,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB;YAAE,OAAO,CAAC,sBAAsB;QACpE,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO;QACjC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACtF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC5B,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,oEAAoE;YACpE,uDAAuD;YACvD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,8DAA8D,EAAE,KAAK,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,IAAgC,EAAE,IAAa,EAAE,KAAe;QAC7E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAChB,IAAI;YACJ,IAAI;YACJ,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;SACvD,CAAC,CAAC;IACL,CAAC;IAEO,OAAO,CAAC,IAAyB;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CACpB,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC"}

package/lib/auth/device-registration.d.ts

@@ -0,0 +1,18 @@
+import { type AuthProviderSession, type PublicAuthStatus } from '@krischoichoi/channel-control';
+export interface DingTalkDeviceAuthOptions {
+    baseUrl?: string;
+    source?: string;
+    fetcher?: typeof fetch;
+}
+export interface DingTalkDevicePollResult {
+    status: PublicAuthStatus;
+    credentials?: {
+        clientId: string;
+        clientSecret: string;
+    };
+}
+/** Start DingTalk's device registration flow and return only browser-safe data. */
+export declare function beginDingTalkDeviceAuth(options?: DingTalkDeviceAuthOptions): Promise<AuthProviderSession>;
+/** Poll DingTalk registration; credentials are returned only to the host definition. */
+export declare function pollDingTalkDeviceAuth(session: AuthProviderSession, options?: DingTalkDeviceAuthOptions): Promise<DingTalkDevicePollResult>;
+//# sourceMappingURL=device-registration.d.ts.map

package/lib/auth/device-registration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-registration.d.ts","sourceRoot":"","sources":["../../src/auth/device-registration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AA8B9G,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAOD,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,gBAAgB,CAAC;IACzB,WAAW,CAAC,EAAE;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAKD,mFAAmF;AACnF,wBAAsB,uBAAuB,CAC3C,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,mBAAmB,CAAC,CA0B9B;AAED,wFAAwF;AACxF,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,mBAAmB,EAC5B,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,wBAAwB,CAAC,CAoDnC"}

package/lib/auth/device-registration.js

@@ -0,0 +1,147 @@
+import { ControlError } from '@krischoichoi/channel-control';
+import { z } from 'zod';
+const RegistrationEnvelopeSchema = z.object({
+    errcode: z.union([z.number(), z.string()]).optional(),
+    errmsg: z.string().optional(),
+}).passthrough();
+const InitResponseSchema = RegistrationEnvelopeSchema.extend({
+    nonce: z.string().trim().min(1),
+});
+const BeginResponseSchema = RegistrationEnvelopeSchema.extend({
+    device_code: z.string().trim().min(1),
+    verification_uri_complete: z.string().trim().min(1),
+    expires_in: z.number().positive().optional(),
+    interval: z.number().positive().optional(),
+});
+const PollResponseSchema = RegistrationEnvelopeSchema.extend({
+    status: z.string().trim().min(1).optional(),
+    client_id: z.string().trim().min(1).optional(),
+    client_secret: z.string().trim().min(1).optional(),
+    fail_reason: z.string().optional(),
+});
+const DEFAULT_BASE_URL = 'https://oapi.dingtalk.com';
+const DEFAULT_SOURCE = 'DING_DWS_CLAW';
+/** Start DingTalk's device registration flow and return only browser-safe data. */
+export async function beginDingTalkDeviceAuth(options = {}) {
+    const fetcher = options.fetcher ?? fetch;
+    const baseUrl = normalizeBaseUrl(options.baseUrl ?? DEFAULT_BASE_URL);
+    const source = options.source ?? DEFAULT_SOURCE;
+    const init = await postRegistration(fetcher, `${baseUrl}/app/registration/init`, { source }, InitResponseSchema);
+    const begin = await postRegistration(fetcher, `${baseUrl}/app/registration/begin`, { nonce: init.nonce }, BeginResponseSchema);
+    const expiresAt = Date.now() + (begin.expires_in ?? 7200) * 1000;
+    return {
+        provider: 'dingtalk-registration',
+        expiresAt,
+        pollingIntervalMs: Math.max(3000, (begin.interval ?? 3) * 1000),
+        qr: { kind: 'content', value: begin.verification_uri_complete, expiresAt },
+        prompt: { kind: 'confirm-on-phone', message: '请使用手机钉钉扫码并确认授权' },
+        deviceCode: begin.device_code,
+        providerState: { baseUrl, deviceCode: begin.device_code },
+    };
+}
+/** Poll DingTalk registration; credentials are returned only to the host definition. */
+export async function pollDingTalkDeviceAuth(session, options = {}) {
+    const providerState = parseProviderState(session.providerState);
+    const fetcher = options.fetcher ?? fetch;
+    const payload = await postRegistration(fetcher, `${providerState.baseUrl}/app/registration/poll`, { device_code: providerState.deviceCode }, PollResponseSchema);
+    const status = (payload.status ?? 'WAITING').toUpperCase();
+    if (status === 'WAITING') {
+        return {
+            status: {
+                state: 'pending',
+                phase: 'waiting-scan',
+                expiresAt: session.expiresAt,
+                detail: '等待钉钉扫码授权中',
+            },
+        };
+    }
+    if (status === 'SUCCESS') {
+        if (!payload.client_id || !payload.client_secret) {
+            throw new ControlError('CONTROL_ERROR', 'dingtalk authorization did not return complete credentials');
+        }
+        return {
+            status: {
+                state: 'authenticated',
+                phase: 'authorized',
+                expiresAt: session.expiresAt,
+                detail: '钉钉扫码授权已完成，凭证已保存',
+            },
+            credentials: { clientId: payload.client_id, clientSecret: payload.client_secret },
+        };
+    }
+    if (status === 'FAIL' || status === 'EXPIRED') {
+        return {
+            status: {
+                state: 'expired',
+                phase: 'expired',
+                expiresAt: session.expiresAt,
+                detail: payload.fail_reason ?? payload.errmsg ?? '二维码已失效',
+            },
+        };
+    }
+    return {
+        status: {
+            state: 'pending',
+            phase: 'waiting-scan',
+            expiresAt: session.expiresAt,
+            detail: `当前状态：${status}`,
+        },
+    };
+}
+async function postRegistration(fetcher, url, body, schema) {
+    let response;
+    try {
+        response = await fetcher(url, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(body),
+        });
+    }
+    catch (error) {
+        throw new ControlError('CONTROL_ERROR', 'dingtalk authorization request failed', { cause: error });
+    }
+    let payload;
+    try {
+        payload = await response.json();
+    }
+    catch (error) {
+        throw new ControlError('CONTROL_ERROR', 'dingtalk authorization returned invalid JSON', { cause: error });
+    }
+    const envelope = RegistrationEnvelopeSchema.safeParse(payload);
+    if (!envelope.success) {
+        throw new ControlError('CONTROL_ERROR', 'dingtalk authorization returned an invalid response');
+    }
+    const errcode = envelope.data.errcode;
+    if (!response.ok || (errcode !== undefined && String(errcode) !== '0')) {
+        throw new ControlError('CONTROL_ERROR', 'dingtalk authorization request failed');
+    }
+    const parsed = schema.safeParse(payload);
+    if (!parsed.success) {
+        throw new ControlError('CONTROL_ERROR', 'dingtalk authorization returned an invalid response');
+    }
+    return parsed.data;
+}
+function parseProviderState(value) {
+    const parsed = z.object({
+        baseUrl: z.string().url(),
+        deviceCode: z.string().trim().min(1),
+    }).safeParse(value);
+    if (!parsed.success) {
+        throw new ControlError('CONTROL_ERROR', 'dingtalk auth session is missing device code');
+    }
+    return parsed.data;
+}
+function normalizeBaseUrl(value) {
+    const trimmed = value.trim().replace(/\/$/, '');
+    try {
+        const parsed = new URL(trimmed);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            throw new Error('unsupported URL protocol');
+        }
+    }
+    catch (error) {
+        throw new ControlError('CONTROL_ERROR', 'dingtalk registration base URL is invalid', { cause: error });
+    }
+    return trimmed;
+}
+//# sourceMappingURL=device-registration.js.map

package/lib/auth/device-registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-registration.js","sourceRoot":"","sources":["../../src/auth/device-registration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAmD,MAAM,+BAA+B,CAAC;AAC9G,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjB,MAAM,kBAAkB,GAAG,0BAA0B,CAAC,MAAM,CAAC;IAC3D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,MAAM,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,0BAA0B,CAAC,MAAM,CAAC;IAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAyBH,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AACrD,MAAM,cAAc,GAAG,eAAe,CAAC;AAEvC,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAAqC,EAAE;IAEvC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IACzC,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CACjC,OAAO,EACP,GAAG,OAAO,wBAAwB,EAClC,EAAE,MAAM,EAAE,EACV,kBAAkB,CACnB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,OAAO,EACP,GAAG,OAAO,yBAAyB,EACnC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EACrB,mBAAmB,CACpB,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;IACjE,OAAO;QACL,QAAQ,EAAE,uBAAuB;QACjC,SAAS;QACT,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC/D,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,yBAAyB,EAAE,SAAS,EAAE;QAC1E,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,gBAAgB,EAAE;QAC/D,UAAU,EAAE,KAAK,CAAC,WAAW;QAC7B,aAAa,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,WAAW,EAAwC;KAChG,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAA4B,EAC5B,UAAqC,EAAE;IAEvC,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CACpC,OAAO,EACP,GAAG,aAAa,CAAC,OAAO,wBAAwB,EAChD,EAAE,WAAW,EAAE,aAAa,CAAC,UAAU,EAAE,EACzC,kBAAkB,CACnB,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;YACL,MAAM,EAAE;gBACN,KAAK,EAAE,SAAS;gBAChB,KAAK,EAAE,cAAc;gBACrB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,WAAW;aACpB;SACF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YACjD,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,4DAA4D,CAAC,CAAC;QACxG,CAAC;QACD,OAAO;YACL,MAAM,EAAE;gBACN,KAAK,EAAE,eAAe;gBACtB,KAAK,EAAE,YAAY;gBACnB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,iBAAiB;aAC1B;YACD,WAAW,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,aAAa,EAAE;SAClF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO;YACL,MAAM,EAAE;gBACN,KAAK,EAAE,SAAS;gBAChB,KAAK,EAAE,SAAS;gBAChB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ;aAC1D;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE;YACN,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,cAAc;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,QAAQ,MAAM,EAAE;SACzB;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,OAAqB,EACrB,GAAW,EACX,IAA4B,EAC5B,MAAoB;IAEpB,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,uCAAuC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,8CAA8C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,qDAAqD,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,8CAA8C,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,2CAA2C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/lib/config.d.ts

@@ -0,0 +1,119 @@
+/**
+ * DingTalk adapter configuration (Schemastery).
+ *
+ * Every deployment-tunable parameter is configurable here — no hardcoded
+ * deployment constants. In 'gateway' mode platform credentials live inside the
+ * self-hosted HTTP gateway; in 'sdk' mode the DingTalk AppKey (clientId) is
+ * configured here as `upstream.clientId` while the AppSecret is resolved
+ * through `ctx.credentials` from the reference `upstream.clientSecretRef`
+ * (default `DSH_CHANNEL_DINGTALK_MAIN_CLIENT_SECRET`) and injected into the
+ * adapter as `deps.clientSecret`. Only the reference name — never the secret
+ * value — lives in config; credentials are never logged and never written into
+ * fixtures.
+ *
+ * A deprecated optional `upstream.clientSecret` field is kept so legacy
+ * plaintext configs still parse. It is migration-only: apply() writes its value
+ * into the credentials seam a single time and deletes it (see index.ts). It is
+ * never written and never read to build the SDK client.
+ */
+import Schema from '@deepseek-ai/schemastery';
+import type { Volatile } from '@deepseek-ai/cordis';
+/** Credential reference name for the DingTalk AppSecret (SDK mode, default). */
+export declare const DINGTALK_CLIENT_SECRET_REF = "DSH_CHANNEL_DINGTALK_MAIN_CLIENT_SECRET";
+export interface DingTalkReconnectConfig {
+    enabled: boolean;
+    baseDelayMs: number;
+    maxDelayMs: number;
+    maxRetries: number;
+}
+export interface DingTalkDedupConfig {
+    enabled: boolean;
+    windowMs: number;
+}
+export interface DingTalkCardConfig {
+    /**
+     * Create the AI Card on the first streamed delta (eager preview). When
+     * `false`, deltas buffer locally and the card is only created at `finish`.
+     */
+    createOnFirstDelta: boolean;
+    /**
+     * OPT-IN Card Platform template used for Harness interactive question
+     * actions. UNSET by default on purpose: a card template only renders buttons
+     * when it is published in YOUR organization's Card Platform and exposes the
+     * `text`/`actions` variables configured below, so advertising button support
+     * from a built-in third-party template id made every `ask_user_question`
+     * fail with "无法在当前渠道展示问题，已取消。". Without it the adapter stays
+     * `interactiveActions: false` and questions use the numbered-text reply path
+     * (same as Weixin).
+     */
+    interactiveTemplateId?: string;
+    /** Template variable carrying the card body text. */
+    interactiveTextParam: string;
+    /** Template variable carrying serialized button definitions. */
+    interactiveActionsParam: string;
+}
+/**
+ * Vendor AI Card template used by the STREAMING reply path (`ai-card.ts`:
+ * create instance → deliver → streaming update). It is unrelated to the
+ * opt-in interactive-actions template above and is never used to claim
+ * `interactiveActions`.
+ */
+export declare const DEFAULT_DINGTALK_INTERACTIVE_TEMPLATE_ID = "02fcf2f4-5e02-4a85-b672-46d1f715543e.schema";
+/**
+ * Upstream driver selection.
+ *
+ * - `'sdk'`     — inbound via the official `dingtalk-stream` SDK (WebSocket
+ *                stream mode); outbound uses the message-scoped
+ *                `sessionWebhook` and DingTalk's official AI Card OpenAPI.
+ * - `'gateway'` — inbound via the self-hosted HTTP gateway long-poll driver
+ *                (legacy protocol-level integration; outbound unchanged).
+ */
+export interface DingTalkUpstreamConfig {
+    mode: 'sdk' | 'gateway';
+    /** DingTalk AppKey (clientId) for SDK mode. Not a secret — may live in config. */
+    clientId?: string;
+    /**
+     * Credential reference name for the DingTalk AppSecret (SDK mode). Only the
+     * reference — never the real secret — is stored here; the value is resolved
+     * via `ctx.credentials` at startup and injected as `deps.clientSecret`.
+     * Defaults to `DSH_CHANNEL_DINGTALK_MAIN_CLIENT_SECRET`.
+     */
+    clientSecretRef?: string;
+}
+export interface DingTalkConfig {
+    enabled: boolean;
+    /** Account id within the dingtalk channel (defaults to 'main'). */
+    accountId: string;
+    /**
+     * Base URL of the self-hosted HTTP upstream (legacy gateway mode only).
+     * SDK mode ignores this value and calls DingTalk's official endpoints.
+     */
+    baseUrl: string;
+    /** Per-request timeout. */
+    timeoutMs: number;
+    /** Long-poll hang time for one receive cycle (gateway mode only). */
+    longPollTimeoutMs: number;
+    reconnect: DingTalkReconnectConfig;
+    dedup: DingTalkDedupConfig;
+    card: DingTalkCardConfig;
+    /** Upstream driver selection (official SDK vs self-hosted gateway). */
+    upstream: DingTalkUpstreamConfig;
+}
+/**
+ * Activation-time config shape (Harness 0.2.0): every volatile field resolves
+ * to a `Volatile<T>` live handle instead of a plain value. `apply()` unwraps
+ * these once via `resolveVolatileConfig` into a plain `DingTalkConfig`.
+ */
+export interface DingTalkConfigLive {
+    enabled: Volatile<boolean>;
+    accountId: Volatile<string>;
+    baseUrl: Volatile<string>;
+    timeoutMs: Volatile<number>;
+    longPollTimeoutMs: Volatile<number>;
+    reconnect: Volatile<DingTalkReconnectConfig>;
+    dedup: Volatile<DingTalkDedupConfig>;
+    card: Volatile<DingTalkCardConfig>;
+    upstream: Volatile<DingTalkUpstreamConfig>;
+}
+export declare const Config: Schema<DingTalkConfigLive>;
+//# sourceMappingURL=config.d.ts.map

package/lib/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,MAAM,MAAM,0BAA0B,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,4CAA4C,CAAC;AAEpF,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;OASG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qDAAqD;IACrD,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,gDAAgD,CAAC;AAEtG;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,uBAAuB,CAAC;IACnC,KAAK,EAAE,mBAAmB,CAAC;IAC3B,IAAI,EAAE,kBAAkB,CAAC;IACzB,uEAAuE;IACvE,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,SAAS,EAAE,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAC7C,KAAK,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACrC,IAAI,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACnC,QAAQ,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;CAC5C;AAMD,eAAO,MAAM,MAAM,EAyCF,MAAM,CAAC,kBAAkB,CAAC,CAAC"}

package/lib/config.js

@@ -0,0 +1,75 @@
+/**
+ * DingTalk adapter configuration (Schemastery).
+ *
+ * Every deployment-tunable parameter is configurable here — no hardcoded
+ * deployment constants. In 'gateway' mode platform credentials live inside the
+ * self-hosted HTTP gateway; in 'sdk' mode the DingTalk AppKey (clientId) is
+ * configured here as `upstream.clientId` while the AppSecret is resolved
+ * through `ctx.credentials` from the reference `upstream.clientSecretRef`
+ * (default `DSH_CHANNEL_DINGTALK_MAIN_CLIENT_SECRET`) and injected into the
+ * adapter as `deps.clientSecret`. Only the reference name — never the secret
+ * value — lives in config; credentials are never logged and never written into
+ * fixtures.
+ *
+ * A deprecated optional `upstream.clientSecret` field is kept so legacy
+ * plaintext configs still parse. It is migration-only: apply() writes its value
+ * into the credentials seam a single time and deletes it (see index.ts). It is
+ * never written and never read to build the SDK client.
+ */
+import Schema from '@deepseek-ai/schemastery';
+/** Credential reference name for the DingTalk AppSecret (SDK mode, default). */
+export const DINGTALK_CLIENT_SECRET_REF = 'DSH_CHANNEL_DINGTALK_MAIN_CLIENT_SECRET';
+/**
+ * Vendor AI Card template used by the STREAMING reply path (`ai-card.ts`:
+ * create instance → deliver → streaming update). It is unrelated to the
+ * opt-in interactive-actions template above and is never used to claim
+ * `interactiveActions`.
+ */
+export const DEFAULT_DINGTALK_INTERACTIVE_TEMPLATE_ID = '02fcf2f4-5e02-4a85-b672-46d1f715543e.schema';
+// The runtime schema is genuine Schemastery (validation happens at the Loader
+// boundary); the annotation records the activation-time output shape. The cast
+// is required because Schemastery's inferred ObjectT models per-field optionality
+// more precisely than the hand-written `DingTalkConfigLive` alias.
+export const Config = Schema.object({
+    // Harness 0.2.0 settings model: fields the control plane / settings page may
+    // write at runtime are declared `.volatile()` — they surface on the
+    // auto-generated settings form, `ctx.settings.update(entryId, patch)` accepts
+    // exactly these paths, and at activation they resolve to `Volatile<T>`
+    // handles (unwrapped by `resolveVolatileConfig` in definition.ts / apply()).
+    enabled: Schema.boolean().default(true).volatile(),
+    accountId: Schema.string().default('main').volatile(),
+    baseUrl: Schema.string().default('http://127.0.0.1:9100').volatile(),
+    timeoutMs: Schema.natural().default(30000).volatile(),
+    longPollTimeoutMs: Schema.natural().default(25000).volatile(),
+    reconnect: Schema.object({
+        enabled: Schema.boolean().default(true),
+        baseDelayMs: Schema.natural().default(1000),
+        maxDelayMs: Schema.natural().default(30000),
+        maxRetries: Schema.natural().default(10),
+    }).default({}).volatile(),
+    dedup: Schema.object({
+        enabled: Schema.boolean().default(true),
+        windowMs: Schema.natural().default(5000),
+    }).default({}).volatile(),
+    card: Schema.object({
+        createOnFirstDelta: Schema.boolean().default(true),
+        // Deliberately NO default: question buttons require a card template that is
+        // published in the operator's own Card Platform. A built-in third-party id
+        // made `interactiveActions` true everywhere and broke every question.
+        interactiveTemplateId: Schema.string(),
+        interactiveTextParam: Schema.string().default('text'),
+        interactiveActionsParam: Schema.string().default('actions'),
+    }).default({}).volatile(),
+    upstream: Schema.object({
+        mode: Schema.union(['sdk', 'gateway']).default('sdk'),
+        // The AppKey (clientId) is not a secret and may live in config.
+        clientId: Schema.string(),
+        // Credential reference name — never the secret value itself.
+        clientSecretRef: Schema.string().default(DINGTALK_CLIENT_SECRET_REF),
+        // DEPRECATED migration-only legacy plaintext field: kept so old configs
+        // still parse. apply() migrates its value to credentials a single time and
+        // deletes it. Never written, never read to build the SDK client.
+        clientSecret: Schema.string().hidden(),
+    }).default({}).volatile(),
+});
+//# sourceMappingURL=config.js.map

package/lib/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,MAAM,MAAM,0BAA0B,CAAC;AAG9C,gFAAgF;AAChF,MAAM,CAAC,MAAM,0BAA0B,GAAG,yCAAyC,CAAC;AAqCpF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,6CAA6C,CAAC;AA6DtG,8EAA8E;AAC9E,+EAA+E;AAC/E,kFAAkF;AAClF,mEAAmE;AACnE,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,6EAA6E;IAC7E,oEAAoE;IACpE,8EAA8E;IAC9E,uEAAuE;IACvE,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAClD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IACpE,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IACrD,iBAAiB,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IAC7D,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACvC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC3C,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3C,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KACzC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACvC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACzC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QAClB,kBAAkB,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClD,4EAA4E;QAC5E,2EAA2E;QAC3E,sEAAsE;QACtE,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE;QACtC,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;QACrD,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;KAC5D,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACtB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACrD,gEAAgE;QAChE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;QACzB,6DAA6D;QAC7D,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC;QACpE,wEAAwE;QACxE,2EAA2E;QAC3E,iEAAiE;QACjE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE;KACvC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1B,CAA0C,CAAC"}