@krischoichoi/channel-weixin 0.6.0

package/lib/auth/login.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Weixin QR login state machine (WX2).
+ *
+ * Wraps the iLink `get_bot_qrcode` / `get_qrcode_status` calls with the full
+ * upstream state machine (wait/scaned/confirmed/expired/need_verifycode/
+ * verify_code_blocked/scaned_but_redirect/binded_redirect). The Channel
+ * Contract states (pending/authenticated/expired/failed) may normalize the
+ * upstream states, but the internal machine keeps full fidelity so none of the
+ * upstream information is lost.
+ *
+ * Redirect (`scaned_but_redirect`) updates the {@link ILinkClient} baseUrl for
+ * all later calls. Verify codes are submitted through {@link WeixinQrAuth.submitVerifyCode}
+ * — never through stdin — so the CLI/ChannelService owns that UX.
+ */
+import type { AuthChallenge, AuthStatePoll } from '@krischoichoi/channel-core';
+import type { ILinkClient } from '../ilink/client.js';
+import type { ILinkQrStatus } from '../ilink/types.js';
+export interface WeixinQrAuthOptions {
+    client: ILinkClient;
+    /** Recent locally-held bot tokens, supplied by the credential owner. */
+    localTokens?: readonly string[];
+    /** Injectable clock (tests). */
+    now?: () => number;
+    /** Optional expiry budget in ms (default 5 min). */
+    expiresInMs?: number;
+}
+/** Full fidelity upstream state + redirect/baseUrl tracking. */
+export interface WeixinQrAuthInternalState {
+    status: ILinkQrStatus | 'unknown' | 'failed';
+    /** Effective base URL after IDC redirect. */
+    baseUrl?: string;
+    botToken?: string;
+    ilinkBotId?: string;
+    userId?: string;
+    pendingVerifyCode?: boolean;
+    /** True when `binded_redirect` reports the bot is already bound. */
+    alreadyBound?: boolean;
+}
+/** Map a raw upstream status (already validated) to a Channel AuthState. */
+export declare function toChannelState(status: ILinkQrStatus | 'unknown'): AuthStatePoll['state'];
+export declare class WeixinQrAuth {
+    private readonly client;
+    private readonly now;
+    private readonly expiresInMs;
+    private readonly localTokens?;
+    /** The last known full-fidelity upstream state. */
+    private state;
+    /** Active challenge state. */
+    private activeId?;
+    private qrcode?;
+    private startedAt;
+    private pendingVerifyCode?;
+    constructor(options: WeixinQrAuthOptions);
+    /** Current full-fidelity internal state. */
+    getState(): WeixinQrAuthInternalState;
+    /** Whether the last known state is authenticated. */
+    get isAuthenticated(): boolean;
+    /**
+     * Begin QR auth: fetch a fresh QR challenge from the iLink client.
+     * Returns the Channel Contract {@link AuthChallenge}.
+     */
+    beginAuth(): Promise<AuthChallenge>;
+    /**
+     * Poll the QR status. On `scaned_but_redirect`, updates the client baseUrl
+     * from `redirect_host`. On `confirmed`, records token/botId/baseUrl/userId
+     * and returns the applicable Channel AuthStatePoll.
+     */
+    pollAuth(challenge: AuthChallenge): Promise<AuthStatePoll>;
+    /**
+     * Submit a phone-verify code (from the ChannelService/CLI — never stdin
+     * inside the adapter). Clears any previously pending code.
+     */
+    submitVerifyCode(code: string): void;
+    /** The credential-ready result produced by a `confirmed` poll. */
+    get confirmedCredential(): {
+        token: string;
+        ilinkBotId: string;
+        userId?: string;
+        baseUrl: string;
+    } | undefined;
+}
+export type { AuthChallenge, AuthStatePoll };
+//# sourceMappingURL=login.d.ts.map

package/lib/auth/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/auth/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAE/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAyB,MAAM,mBAAmB,CAAC;AAE9E,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,WAAW,CAAC;IACpB,wEAAwE;IACxE,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,gEAAgE;AAChE,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC7C,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,oEAAoE;IACpE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAYD,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAgBxF;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAoB;IAEjD,mDAAmD;IACnD,OAAO,CAAC,KAAK,CAA2C;IACxD,8BAA8B;IAC9B,OAAO,CAAC,QAAQ,CAAC,CAAS;IAC1B,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,iBAAiB,CAAC,CAAS;gBAEvB,OAAO,EAAE,mBAAmB;IAOxC,4CAA4C;IAC5C,QAAQ,IAAI,yBAAyB;IAIrC,qDAAqD;IACrD,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC;IAsBzC;;;;OAIG;IACG,QAAQ,CAAC,SAAS,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAiGhE;;;OAGG;IACH,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAKpC,kEAAkE;IAClE,IAAI,mBAAmB,IACnB;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GACvE,SAAS,CAQZ;CACF;AAED,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC"}

package/lib/auth/login.js

@@ -0,0 +1,202 @@
+import { ChannelError } from '@krischoichoi/channel-core';
+const EMPTY = {
+    status: 'unknown',
+    baseUrl: undefined,
+    botToken: undefined,
+    ilinkBotId: undefined,
+    userId: undefined,
+    pendingVerifyCode: false,
+    alreadyBound: false,
+};
+/** Map a raw upstream status (already validated) to a Channel AuthState. */
+export function toChannelState(status) {
+    switch (status) {
+        case 'confirmed':
+        case 'binded_redirect':
+            return 'authenticated';
+        case 'expired':
+        case 'verify_code_blocked':
+            return 'failed';
+        case 'need_verifycode':
+        case 'scaned_but_redirect':
+        case 'scaned':
+        case 'wait':
+            return 'pending';
+        default:
+            return 'pending';
+    }
+}
+export class WeixinQrAuth {
+    client;
+    now;
+    expiresInMs;
+    localTokens;
+    /** The last known full-fidelity upstream state. */
+    state = { ...EMPTY };
+    /** Active challenge state. */
+    activeId;
+    qrcode;
+    startedAt = 0;
+    pendingVerifyCode;
+    constructor(options) {
+        this.client = options.client;
+        this.now = options.now ?? Date.now;
+        this.expiresInMs = options.expiresInMs ?? 3 * 60_000;
+        this.localTokens = options.localTokens;
+    }
+    /** Current full-fidelity internal state. */
+    getState() {
+        return { ...this.state };
+    }
+    /** Whether the last known state is authenticated. */
+    get isAuthenticated() {
+        return this.state.status === 'confirmed' || this.state.status === 'binded_redirect';
+    }
+    /**
+     * Begin QR auth: fetch a fresh QR challenge from the iLink client.
+     * Returns the Channel Contract {@link AuthChallenge}.
+     */
+    async beginAuth() {
+        const started = this.now();
+        const qr = await this.client.getBotQrcode({ localTokens: this.localTokens });
+        // Reset internal machine for a fresh challenge.
+        this.state = { ...EMPTY };
+        this.activeId = `weixin-qr-${started}`;
+        this.qrcode = qr.qrcode;
+        this.startedAt = started;
+        this.pendingVerifyCode = undefined;
+        if (!qr.qrcode && !qr.qrcode_img_content) {
+            throw new ChannelError('CHANNEL_AUTH_FAILED', 'weixin QR login: server returned no qrcode');
+        }
+        return {
+            id: this.activeId,
+            instruction: '请使用微信扫描二维码',
+            qrUrl: qr.qrcode_img_content,
+            expiresAt: started + this.expiresInMs,
+        };
+    }
+    /**
+     * Poll the QR status. On `scaned_but_redirect`, updates the client baseUrl
+     * from `redirect_host`. On `confirmed`, records token/botId/baseUrl/userId
+     * and returns the applicable Channel AuthStatePoll.
+     */
+    async pollAuth(challenge) {
+        if (this.activeId !== challenge.id || !this.qrcode) {
+            throw new ChannelError('CHANNEL_AUTH_FAILED', 'weixin QR auth: poll used a stale/invalid challenge');
+        }
+        if (challenge.expiresAt !== undefined && this.now() > challenge.expiresAt) {
+            this.state.status = 'expired';
+            return { state: 'expired', detail: 'weixin QR code expired' };
+        }
+        let response;
+        try {
+            response = await this.client.getQrcodeStatus(this.qrcode, {
+                verifyCode: this.pendingVerifyCode,
+            });
+        }
+        catch (error) {
+            // getQrcodeStatus already maps long-poll aborts/timeouts to `wait`, so
+            // a throw here is a genuine protocol/network error — surface as failed.
+            this.state.status = 'unknown';
+            return {
+                state: 'failed',
+                detail: error instanceof Error ? error.message : String(error),
+            };
+        }
+        const status = (response.status ?? 'wait');
+        this.state.status = status;
+        switch (status) {
+            case 'scaned_but_redirect': {
+                if (response.redirect_host) {
+                    const newBase = `https://${response.redirect_host}`;
+                    try {
+                        this.client.setBaseUrl(newBase);
+                        this.state.baseUrl = this.client.baseUrl;
+                    }
+                    catch {
+                        this.state.status = 'failed';
+                        return { state: 'failed', detail: 'weixin QR redirect returned an untrusted iLink host' };
+                    }
+                }
+                return { state: 'pending', detail: 'weixin QR scanned; redirecting to IDC host' };
+            }
+            case 'need_verifycode': {
+                this.state.pendingVerifyCode = this.state.pendingVerifyCode === undefined ? true : undefined;
+                return { state: 'pending', detail: 'weixin QR requires a phone-verified code' };
+            }
+            case 'scaned': {
+                // After a verify code is accepted, the status may return to scaned.
+                if (this.pendingVerifyCode)
+                    this.pendingVerifyCode = undefined;
+                return { state: 'pending', detail: 'weixin QR scanned; waiting for confirmation' };
+            }
+            case 'confirmed': {
+                if (!response.bot_token || !response.ilink_bot_id) {
+                    this.state.status = 'failed';
+                    return { state: 'failed', detail: 'weixin QR confirmed but server omitted bot identity' };
+                }
+                this.state.botToken = response.bot_token;
+                this.state.ilinkBotId = response.ilink_bot_id;
+                this.state.userId = response.ilink_user_id;
+                this.state.alreadyBound = false;
+                if (response.baseurl) {
+                    try {
+                        this.client.setBaseUrl(response.baseurl);
+                        this.state.baseUrl = this.client.baseUrl;
+                    }
+                    catch {
+                        this.state.status = 'failed';
+                        return { state: 'failed', detail: 'weixin QR confirmation returned an untrusted iLink host' };
+                    }
+                }
+                else if (!this.client.baseUrl) {
+                    this.state.baseUrl = this.client.baseUrl;
+                }
+                return { state: 'authenticated', detail: 'weixin QR confirmed and authenticated' };
+            }
+            case 'binded_redirect': {
+                this.state.alreadyBound = true;
+                if (response.redirect_host) {
+                    const newBase = `https://${response.redirect_host}`;
+                    try {
+                        this.client.setBaseUrl(newBase);
+                        this.state.baseUrl = this.client.baseUrl;
+                    }
+                    catch {
+                        this.state.status = 'failed';
+                        return { state: 'failed', detail: 'weixin QR binding returned an untrusted iLink host' };
+                    }
+                }
+                return { state: 'authenticated', detail: 'weixin bot already bound; existing credentials remain valid' };
+            }
+            case 'expired':
+                return { state: 'expired', detail: 'weixin QR code expired' };
+            case 'verify_code_blocked':
+                this.state.pendingVerifyCode = undefined;
+                return { state: 'failed', detail: 'weixin QR verify code blocked after repeated failures' };
+            case 'wait':
+            default:
+                return { state: 'pending', detail: 'awaiting WeChat scan' };
+        }
+    }
+    /**
+     * Submit a phone-verify code (from the ChannelService/CLI — never stdin
+     * inside the adapter). Clears any previously pending code.
+     */
+    submitVerifyCode(code) {
+        this.pendingVerifyCode = code;
+        this.state.pendingVerifyCode = true;
+    }
+    /** The credential-ready result produced by a `confirmed` poll. */
+    get confirmedCredential() {
+        if (this.state.status !== 'confirmed' || !this.state.botToken || !this.state.ilinkBotId)
+            return undefined;
+        return {
+            token: this.state.botToken,
+            ilinkBotId: this.state.ilinkBotId,
+            userId: this.state.userId,
+            baseUrl: this.state.baseUrl ?? this.client.baseUrl,
+        };
+    }
+}
+//# sourceMappingURL=login.js.map

package/lib/auth/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/auth/login.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AA2B1D,MAAM,KAAK,GAA8B;IACvC,MAAM,EAAE,SAAS;IACjB,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,SAAS;IACnB,UAAU,EAAE,SAAS;IACrB,MAAM,EAAE,SAAS;IACjB,iBAAiB,EAAE,KAAK;IACxB,YAAY,EAAE,KAAK;CACpB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,MAAiC;IAC9D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,WAAW,CAAC;QACjB,KAAK,iBAAiB;YACpB,OAAO,eAAe,CAAC;QACzB,KAAK,SAAS,CAAC;QACf,KAAK,qBAAqB;YACxB,OAAO,QAAQ,CAAC;QAClB,KAAK,iBAAiB,CAAC;QACvB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM;YACT,OAAO,SAAS,CAAC;QACnB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,YAAY;IACN,MAAM,CAAc;IACpB,GAAG,CAAe;IAClB,WAAW,CAAS;IACpB,WAAW,CAAqB;IAEjD,mDAAmD;IAC3C,KAAK,GAA8B,EAAE,GAAG,KAAK,EAAE,CAAC;IACxD,8BAA8B;IACtB,QAAQ,CAAU;IAClB,MAAM,CAAU;IAChB,SAAS,GAAG,CAAC,CAAC;IACd,iBAAiB,CAAU;IAEnC,YAAY,OAA4B;QACtC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,GAAG,MAAM,CAAC;QACrD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,4CAA4C;IAC5C,QAAQ;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,qDAAqD;IACrD,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,iBAAiB,CAAC;IACtF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7E,gDAAgD;QAChD,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,aAAa,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC;QACzB,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QAEnC,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,CAAC;YACzC,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;QAC9F,CAAC;QAED,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,QAAQ;YACjB,WAAW,EAAE,YAAY;YACzB,KAAK,EAAE,EAAE,CAAC,kBAAkB;YAC5B,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC,WAAW;SACtC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,SAAwB;QACrC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACnD,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,qDAAqD,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;YAC1E,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QAChE,CAAC;QAED,IAAI,QAA+B,CAAC;QACpC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE;gBACxD,UAAU,EAAE,IAAI,CAAC,iBAAiB;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,wEAAwE;YACxE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,QAAQ;gBACf,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC/D,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAkB,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QAE3B,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,qBAAqB,CAAC,CAAC,CAAC;gBAC3B,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;oBAC3B,MAAM,OAAO,GAAG,WAAW,QAAQ,CAAC,aAAa,EAAE,CAAC;oBACpD,IAAI,CAAC;wBACH,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;wBAChC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;oBAC3C,CAAC;oBAAC,MAAM,CAAC;wBACP,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;wBAC7B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC;oBAC5F,CAAC;gBACH,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;YACpF,CAAC;YACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,IAAI,CAAC,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7F,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;YAClF,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,oEAAoE;gBACpE,IAAI,IAAI,CAAC,iBAAiB;oBAAE,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;gBAC/D,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;YACrF,CAAC;YACD,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;oBAClD,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;oBAC7B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC;gBAC5F,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC;gBACzC,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,QAAQ,CAAC,YAAY,CAAC;gBAC9C,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC;gBAC3C,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC;gBAChC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACrB,IAAI,CAAC;wBACH,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;wBACzC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;oBAC3C,CAAC;oBAAC,MAAM,CAAC;wBACP,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;wBAC7B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,yDAAyD,EAAE,CAAC;oBAChG,CAAC;gBACH,CAAC;qBAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAChC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC3C,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;YACrF,CAAC;YACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;gBACvB,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;gBAC/B,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;oBAC3B,MAAM,OAAO,GAAG,WAAW,QAAQ,CAAC,aAAa,EAAE,CAAC;oBACpD,IAAI,CAAC;wBACH,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;wBAChC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;oBAC3C,CAAC;oBAAC,MAAM,CAAC;wBACP,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;wBAC7B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;oBAC3F,CAAC;gBACH,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,6DAA6D,EAAE,CAAC;YAC3G,CAAC;YACD,KAAK,SAAS;gBACZ,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;YAChE,KAAK,qBAAqB;gBACxB,IAAI,CAAC,KAAK,CAAC,iBAAiB,GAAG,SAAS,CAAC;gBACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;YAC9F,KAAK,MAAM,CAAC;YACZ;gBACE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAChE,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,IAAY;QAC3B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC;IACtC,CAAC;IAED,kEAAkE;IAClE,IAAI,mBAAmB;QAGrB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAC1G,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;YAC1B,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;YACjC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;YACzB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;SACnD,CAAC;IACJ,CAAC;CACF"}

package/lib/config.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Weixin adapter configuration (Schemastery).
+ *
+ * Per doc section 29 — the channels-weixin config exposes iLink base URLs,
+ * network timeouts and reconnect policy. Credentials are NEVER configured in
+ * YAML; they live in the read/write credential store resolved at start.
+ */
+import Schema from '@deepseek-ai/schemastery';
+import type { Volatile } from '@deepseek-ai/cordis';
+export interface WeixinIlinkConfig {
+    /** API base URL; may be redirected per-account after QR login. */
+    baseUrl: string;
+    /** CDN base URL for media. */
+    cdnBaseUrl: string;
+    /** bot_agent value sent in base_info. */
+    botAgent?: string;
+}
+export interface WeixinNetworkConfig {
+    /** Per-request timeout in ms. */
+    timeoutMs: number;
+    /** Initial getUpdates long-poll timeout in ms. */
+    longPollTimeoutMs: number;
+}
+export interface WeixinReconnectConfig {
+    enabled: boolean;
+    baseDelayMs: number;
+    maxDelayMs: number;
+}
+export interface WeixinConfig {
+    enabled: boolean;
+    /** Local DSH account alias; default 'main'. */
+    accountId: string;
+    ilink: WeixinIlinkConfig;
+    network: WeixinNetworkConfig;
+    reconnect: WeixinReconnectConfig;
+}
+/**
+ * Activation-time config shape (Harness 0.2.0): volatile fields resolve to a
+ * `Volatile<T>` live handle instead of a plain value. `apply()` unwraps them
+ * once via `resolveVolatileConfig` into a plain `WeixinConfig`. Weixin has no
+ * runtime-writable config beyond the enabled intent, so `enabled` is the only
+ * volatile field.
+ */
+export interface WeixinConfigLive {
+    enabled: Volatile<boolean>;
+    accountId: string;
+    ilink: WeixinIlinkConfig;
+    network: WeixinNetworkConfig;
+    reconnect: WeixinReconnectConfig;
+}
+export declare const Config: Schema<WeixinConfigLive>;
+//# sourceMappingURL=config.d.ts.map

package/lib/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,MAAM,MAAM,0BAA0B,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGpD,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,8BAA8B;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,SAAS,EAAE,qBAAqB,CAAC;CAClC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,SAAS,EAAE,qBAAqB,CAAC;CAClC;AAMD,eAAO,MAAM,MAAM,EAqBF,MAAM,CAAC,gBAAgB,CAAC,CAAC"}

package/lib/config.js

@@ -0,0 +1,36 @@
+/**
+ * Weixin adapter configuration (Schemastery).
+ *
+ * Per doc section 29 — the channels-weixin config exposes iLink base URLs,
+ * network timeouts and reconnect policy. Credentials are NEVER configured in
+ * YAML; they live in the read/write credential store resolved at start.
+ */
+import Schema from '@deepseek-ai/schemastery';
+import { DEFAULT_BASE_URL, DEFAULT_CDN_BASE_URL } from './ilink/constants.js';
+// The runtime schema is genuine Schemastery (validation happens at the Loader
+// boundary); the annotation records the activation-time output shape. The cast
+// is required because Schemastery's inferred ObjectT models per-field optionality
+// more precisely than the hand-written `WeixinConfigLive` alias.
+export const Config = Schema.object({
+    // Harness 0.2.0 settings model: fields the control plane / settings page may
+    // write at runtime are declared `.volatile()` — `ctx.settings.update(
+    // entryId, patch)` accepts exactly these paths, and at activation they
+    // resolve to `Volatile<T>` handles (unwrapped by `resolveVolatileConfig`).
+    enabled: Schema.boolean().default(true).volatile(),
+    accountId: Schema.string().default('main'),
+    ilink: Schema.object({
+        baseUrl: Schema.string().default(DEFAULT_BASE_URL).description('Weixin iLink API base URL'),
+        cdnBaseUrl: Schema.string().default(DEFAULT_CDN_BASE_URL).description('Weixin CDN base URL'),
+        botAgent: Schema.string().description('bot_agent value for base_info'),
+    }),
+    network: Schema.object({
+        timeoutMs: Schema.natural().default(15000),
+        longPollTimeoutMs: Schema.natural().default(35000),
+    }),
+    reconnect: Schema.object({
+        enabled: Schema.boolean().default(true),
+        baseDelayMs: Schema.natural().default(2000),
+        maxDelayMs: Schema.natural().default(30000),
+    }),
+});
+//# sourceMappingURL=config.js.map

package/lib/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,MAAM,MAAM,0BAA0B,CAAC;AAE9C,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAgD9E,8EAA8E;AAC9E,+EAA+E;AAC/E,kFAAkF;AAClF,iEAAiE;AACjE,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,6EAA6E;IAC7E,sEAAsE;IACtE,uEAAuE;IACvE,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAClD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,WAAW,CAAC,2BAA2B,CAAC;QAC3F,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,WAAW,CAAC,qBAAqB,CAAC;QAC5F,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,+BAA+B,CAAC;KACvE,CAAC;IACF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1C,iBAAiB,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACnD,CAAC;IACF,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACvC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC3C,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KAC5C,CAAC;CACH,CAAwC,CAAC"}

package/lib/definition.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Weixin ChannelDefinition — control-plane entry.
+ *
+ * Weixin has NO credentials/config fields: it mounts at startup (autoStart)
+ * and the QR login happens on the MOUNTED adapter. The definition therefore
+ * delegates beginAuth/pollAuth/submitAuthInput to the live adapter so the M1
+ * QR flow itself is byte-for-byte unchanged (same WeixinAdapter methods, same
+ * challenge/state shapes). Only the ENTRY moves to the control plane.
+ *
+ * getConfiguredState() always reports configured=true because there is nothing
+ * to configure — the auth session decides authenticity. The UI never parses
+ * free-form detail text: [toPublicStatus] derives a structured AuthPhase and
+ * prompt entirely inside this host definition (doc §16).
+ */
+import { type ChannelAdapter, type AuthStatePoll } from '@krischoichoi/channel-core';
+import type { AuthProviderSession, ChannelDefinition, PublicAuthStatus, PublicQrPayload } from '@krischoichoi/channel-control';
+import type { WeixinConfig } from './config.js';
+import { type WeixinAdapterDeps } from './adapter.js';
+/** Options for [createWeixinDefinition]. */
+export interface WeixinDefinitionOptions {
+    /** Resolved Weixin config (already validated by Schemastery). */
+    config: WeixinConfig;
+    /** Injectable adapter deps (tests). */
+    deps: WeixinAdapterDeps;
+    /**
+     * Resolve the currently mounted adapter (doc §43). The definition drives the
+     * M1 auth flow through this seam so behavior stays identical to headless.
+     */
+    getAdapter: () => ChannelAdapter | undefined;
+    /** Durable store for the enabled intent (doc §21) when the host provides one. */
+    persistEnabled?: (enabled: boolean) => Promise<void>;
+    /**
+     * Optional owner-identity resolver. Returns the canonical
+     * sender.id of the Weixin account owner (the scanning QR userId). When
+     * provided, the returned definition exposes `resolveOwnerIdentity` so the
+     * control plane can safely bootstrap an owner-only policy. The caller is
+     * responsible for mapping storage — never exposes platform credential keys.
+     */
+    resolveOwnerIdentity?: (accountId: string) => Promise<string | undefined>;
+}
+/**
+ * Map a raw adapter AuthStatePoll into a structured control-plane
+ * PublicAuthStatus (doc §16/§17). This is the ONLY place detail text is
+ * interpreted — the Web plane switches on .phase, never on .detail.
+ */
+export declare function toPublicStatus(poll: AuthStatePoll, session: AuthProviderSession): PublicAuthStatus;
+/**
+ * Wrap a QR login URL into a structured PublicQrPayload (doc §17). A ready-made
+ * data:image is passed through as 'data-url'; every other value is 'content'
+ * that the browser renders into a QR image (via QRCode.toDataURL).
+ */
+export declare function toQrPayload(value: string, expiresAt?: number): PublicQrPayload;
+/**
+ * Build the Weixin ChannelDefinition. Weixin has no config fields (setup
+ * fields = []) and only the QR auth method. All auth methods delegate to the
+ * mounted adapter via [options.getAdapter].
+ */
+export declare function createWeixinDefinition(options: WeixinDefinitionOptions): ChannelDefinition;
+//# sourceMappingURL=definition.d.ts.map

package/lib/definition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition.d.ts","sourceRoot":"","sources":["../src/definition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,KAAK,cAAc,EAAsB,KAAK,aAAa,EAAyB,MAAM,4BAA4B,CAAC;AAChI,OAAO,KAAK,EAEV,mBAAmB,EACnB,iBAAiB,EAEjB,gBAAgB,EAChB,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAiB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAErE,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC,iEAAiE;IACjE,MAAM,EAAE,YAAY,CAAC;IACrB,uCAAuC;IACvC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;OAGG;IACH,UAAU,EAAE,MAAM,cAAc,GAAG,SAAS,CAAC;IAC7C,iFAAiF;IACjF,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC3E;AAID;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,mBAAmB,GAC3B,gBAAgB,CAuBlB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,CAM9E;AAUD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,iBAAiB,CAiF1F"}

package/lib/definition.js

@@ -0,0 +1,146 @@
+/**
+ * Weixin ChannelDefinition — control-plane entry.
+ *
+ * Weixin has NO credentials/config fields: it mounts at startup (autoStart)
+ * and the QR login happens on the MOUNTED adapter. The definition therefore
+ * delegates beginAuth/pollAuth/submitAuthInput to the live adapter so the M1
+ * QR flow itself is byte-for-byte unchanged (same WeixinAdapter methods, same
+ * challenge/state shapes). Only the ENTRY moves to the control plane.
+ *
+ * getConfiguredState() always reports configured=true because there is nothing
+ * to configure — the auth session decides authenticity. The UI never parses
+ * free-form detail text: [toPublicStatus] derives a structured AuthPhase and
+ * prompt entirely inside this host definition (doc §16).
+ */
+import { resolveVolatileConfig } from '@krischoichoi/channel-core';
+import { ControlError } from '@krischoichoi/channel-control';
+import { WeixinAdapter } from './adapter.js';
+const AUTH_NOT_READY_MSG = 'weixin adapter is not mounted; start the channel first';
+/**
+ * Map a raw adapter AuthStatePoll into a structured control-plane
+ * PublicAuthStatus (doc §16/§17). This is the ONLY place detail text is
+ * interpreted — the Web plane switches on .phase, never on .detail.
+ */
+export function toPublicStatus(poll, session) {
+    if (poll.state === 'authenticated') {
+        return { state: 'authenticated', phase: 'authorized', expiresAt: session.expiresAt };
+    }
+    if (poll.state === 'expired') {
+        return { state: 'expired', phase: 'expired', expiresAt: session.expiresAt };
+    }
+    if (poll.state === 'failed') {
+        return { state: 'failed', phase: 'failed', expiresAt: session.expiresAt };
+    }
+    // pending — derive a structured phase + prompt from the adapter detail.
+    const detail = poll.detail ?? '';
+    let phase = 'waiting-scan';
+    let prompt;
+    if (/verify|code/i.test(detail)) {
+        phase = 'verification-required';
+        prompt = { kind: 'verification-code', message: detail };
+    }
+    else if (/confirm|redirect/i.test(detail)) {
+        phase = 'waiting-confirm';
+        prompt = { kind: 'confirm-on-phone', message: detail };
+    }
+    return { state: 'pending', phase, prompt, expiresAt: session.expiresAt, detail };
+}
+/**
+ * Wrap a QR login URL into a structured PublicQrPayload (doc §17). A ready-made
+ * data:image is passed through as 'data-url'; every other value is 'content'
+ * that the browser renders into a QR image (via QRCode.toDataURL).
+ */
+export function toQrPayload(value, expiresAt) {
+    return {
+        kind: /^data:image\//i.test(value) ? 'data-url' : 'content',
+        value,
+        expiresAt,
+    };
+}
+/** Extract the stored AuthChallenge from a provider session's opaque state. */
+function challengeOf(session) {
+    return session.providerState.challenge;
+}
+const POLL_INTERVAL_MS = 3000;
+const DEFAULT_EXPIRES_MS = 3 * 60_000;
+/**
+ * Build the Weixin ChannelDefinition. Weixin has no config fields (setup
+ * fields = []) and only the QR auth method. All auth methods delegate to the
+ * mounted adapter via [options.getAdapter].
+ */
+export function createWeixinDefinition(options) {
+    const { config, deps, getAdapter } = options;
+    // Under Harness 0.2.0 volatile fields (enabled) arrive as `Volatile<T>`
+    // handles; unwrap them once so the definition sees plain values. Writes must
+    // NOT go through the config object — keep the live flag in a local mutable
+    // snapshot (mirrors qq/telegram's `snapshot.enabled`) and let
+    // persistEnabled() persist the intent through the settings forms.
+    const state = { enabled: resolveVolatileConfig(config).enabled };
+    const requireAdapter = () => getAdapter();
+    const pollCurrent = async (session) => {
+        const adapter = requireAdapter();
+        if (!adapter?.pollAuth) {
+            throw new ControlError('AUTH_NOT_READY', AUTH_NOT_READY_MSG);
+        }
+        const poll = await adapter.pollAuth(challengeOf(session));
+        return toPublicStatus(poll, session);
+    };
+    return {
+        id: 'weixin',
+        get enabled() {
+            return state.enabled;
+        },
+        async setEnabled(enabled) {
+            state.enabled = enabled;
+            await options.persistEnabled?.(enabled);
+        },
+        setup: {
+            fields: [],
+            authMethods: ['qr'],
+        },
+        getConfiguredState: async () => ({ configured: true, fields: {} }),
+        saveConfig: async () => {
+            // Nothing configurable — accept and ignore unknown keys (no-op).
+        },
+        beginAuth: async () => {
+            const adapter = requireAdapter();
+            if (!adapter?.beginAuth) {
+                throw new ControlError('AUTH_NOT_READY', AUTH_NOT_READY_MSG);
+            }
+            const challenge = await adapter.beginAuth();
+            return {
+                provider: 'weixin',
+                expiresAt: challenge.expiresAt ?? Date.now() + DEFAULT_EXPIRES_MS,
+                pollingIntervalMs: POLL_INTERVAL_MS,
+                qr: challenge.qrUrl ? toQrPayload(challenge.qrUrl, challenge.expiresAt) : undefined,
+                prompt: { kind: 'confirm-on-phone', message: challenge.instruction },
+                providerState: { challenge },
+            };
+        },
+        pollAuth: pollCurrent,
+        submitAuthInput: async (session, input) => {
+            const adapter = requireAdapter();
+            if (!adapter?.submitAuthInput) {
+                throw new ControlError('AUTH_NOT_READY', AUTH_NOT_READY_MSG);
+            }
+            await adapter.submitAuthInput(challengeOf(session), input);
+            return pollCurrent(session);
+        },
+        createAdapter: async () => new WeixinAdapter(config, deps),
+        autoStart: true,
+        // Declared access capability. Weixin is DM-only, no group
+        // mention activation in V1; owner is discovered from the account.
+        access: {
+            directMessages: true,
+            groups: false,
+            mentions: false,
+            ownerDiscovery: 'account',
+            identityLabels: { user: 'Weixin User ID' },
+        },
+        // Expose the optional owner-identity resolver wired by the plugin.
+        ...(options.resolveOwnerIdentity
+            ? { resolveOwnerIdentity: options.resolveOwnerIdentity }
+            : {}),
+    };
+}
+//# sourceMappingURL=definition.js.map

package/lib/definition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition.js","sourceRoot":"","sources":["../src/definition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAA+D,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAShI,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE7D,OAAO,EAAE,aAAa,EAA0B,MAAM,cAAc,CAAC;AAyBrE,MAAM,kBAAkB,GAAG,wDAAwD,CAAC;AAEpF;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAmB,EACnB,OAA4B;IAE5B,IAAI,IAAI,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;QACnC,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IAC5E,CAAC;IAED,wEAAwE;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,IAAI,KAAK,GAA8B,cAAc,CAAC;IACtD,IAAI,MAAoC,CAAC;IACzC,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,KAAK,GAAG,uBAAuB,CAAC;QAChC,MAAM,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC1D,CAAC;SAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,KAAK,GAAG,iBAAiB,CAAC;QAC1B,MAAM,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;AACnF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,SAAkB;IAC3D,OAAO;QACL,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAC3D,KAAK;QACL,SAAS;KACV,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,WAAW,CAAC,OAA4B;IAC/C,OAAQ,OAAO,CAAC,aAA8C,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,kBAAkB,GAAG,CAAC,GAAG,MAAM,CAAC;AAEtC;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAgC;IACrE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAE7C,wEAAwE;IACxE,6EAA6E;IAC7E,2EAA2E;IAC3E,8DAA8D;IAC9D,kEAAkE;IAClE,MAAM,KAAK,GAAyB,EAAE,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;IAEvF,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC;IAE1C,MAAM,WAAW,GAAG,KAAK,EAAE,OAA4B,EAA6B,EAAE;QACpF,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1D,OAAO,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,IAAI,OAAO;YACT,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,OAAgB;YAC/B,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;YACxB,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,EAAE;YACL,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC,IAAI,CAAC;SACpB;QACD,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAClE,UAAU,EAAE,KAAK,IAAI,EAAE;YACrB,iEAAiE;QACnE,CAAC;QACD,SAAS,EAAE,KAAK,IAAkC,EAAE;YAClD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO;gBACL,QAAQ,EAAE,QAAQ;gBAClB,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB;gBACjE,iBAAiB,EAAE,gBAAgB;gBACnC,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;gBACnF,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE;gBACpE,aAAa,EAAE,EAAE,SAAS,EAAE;aAC7B,CAAC;QACJ,CAAC;QACD,QAAQ,EAAE,WAAW;QACrB,eAAe,EAAE,KAAK,EACpB,OAA4B,EAC5B,KAAgB,EACW,EAAE;YAC7B,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC;gBAC9B,MAAM,IAAI,YAAY,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,OAAO,CAAC,eAAe,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QACD,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;QAC1D,SAAS,EAAE,IAAI;QACf,0DAA0D;QAC1D,kEAAkE;QAClE,MAAM,EAAE;YACN,cAAc,EAAE,IAAI;YACpB,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,KAAK;YACf,cAAc,EAAE,SAAS;YACzB,cAAc,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;SAC3C;QACD,mEAAmE;QACnE,GAAG,CAAC,OAAO,CAAC,oBAAoB;YAC9B,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}

package/lib/ilink/base-info.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Classification: A — DSH glue [keep].
+ *
+ * `base_info` payload builder. The official equivalent is api/api.js
+ * buildBaseInfo() but is OpenClaw coupled (reads bot_agent from OpenClaw config).
+ * DSH keeps its own neutral builder (DSH-specific bot_agent), which is pure
+ * glue, not protocol duplication.
+ */
+/**
+ * `base_info` payload attached to every iLink request.
+ */
+import type { ILinkBaseInfo } from './types.js';
+export declare const DEFAULT_BOT_AGENT = "DeepSeekHarness";
+export interface BuildBaseInfoOptions {
+    /** Optional channel/app version string. */
+    channelVersion?: string;
+    /** Optional bot agent override; defaults to `DeepSeekHarness`. */
+    botAgent?: string;
+}
+/** Build the `base_info` object sent with every iLink CGI request. */
+export declare function buildBaseInfo(opts?: BuildBaseInfoOptions): ILinkBaseInfo;
+//# sourceMappingURL=base-info.d.ts.map

package/lib/ilink/base-info.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-info.d.ts","sourceRoot":"","sources":["../../src/ilink/base-info.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH;;GAEG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,eAAO,MAAM,iBAAiB,oBAAoB,CAAC;AAEnD,MAAM,WAAW,oBAAoB;IACnC,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,sEAAsE;AACtE,wBAAgB,aAAa,CAAC,IAAI,GAAE,oBAAyB,GAAG,aAAa,CAM5E"}