@numa-tech/numa 1.20.3 → 1.20.4

package/dist/tasks/oss-query.d.ts

@@ -0,0 +1,56 @@
+import { z } from "zod";
+import { OssClient } from "../oss/client.js";
+import { OssTransferClient } from "../oss/transfers.js";
+import type { TaskResult } from "./types.js";
+export declare const ossQuerySchema: z.ZodObject<{
+    grant_id: z.ZodOptional<z.ZodNumber>;
+    bucket: z.ZodOptional<z.ZodString>;
+    prefix: z.ZodOptional<z.ZodString>;
+    ttl: z.ZodOptional<z.ZodNumber>;
+    marker: z.ZodOptional<z.ZodString>;
+    delimiter: z.ZodOptional<z.ZodLiteral<"/">>;
+    directories_only: z.ZodOptional<z.ZodBoolean>;
+    contains: z.ZodOptional<z.ZodString>;
+    suffix: z.ZodOptional<z.ZodString>;
+    ignore_case: z.ZodOptional<z.ZodBoolean>;
+    min_size: z.ZodOptional<z.ZodNumber>;
+    max_size: z.ZodOptional<z.ZodNumber>;
+    modified_after: z.ZodOptional<z.ZodString>;
+    modified_before: z.ZodOptional<z.ZodString>;
+    created_time_key: z.ZodOptional<z.ZodString>;
+    created_after: z.ZodOptional<z.ZodString>;
+    created_before: z.ZodOptional<z.ZodString>;
+    meta: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    content_type: z.ZodOptional<z.ZodString>;
+    sort: z.ZodDefault<z.ZodEnum<{
+        created: "created";
+        key: "key";
+        modified: "modified";
+        size: "size";
+    }>>;
+    order: z.ZodDefault<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+    limit: z.ZodDefault<z.ZodNumber>;
+    scan_limit: z.ZodDefault<z.ZodNumber>;
+    fields: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        contentType: "contentType";
+        createdAt: "createdAt";
+        etag: "etag";
+        key: "key";
+        kind: "kind";
+        lastModified: "lastModified";
+        metadata: "metadata";
+        sizeBytes: "sizeBytes";
+        storageClass: "storageClass";
+        type: "type";
+    }>>>;
+}, z.core.$strict>;
+export interface OssQueryDependencies {
+    clientFactory?: () => Pick<OssClient, "listGrants" | "issueSession">;
+    transferFactory?: () => OssTransferClient;
+    beforeExecute?: () => Promise<void>;
+}
+/** One bounded read workflow; a denied or ambiguous Grant never triggers a fallback. */
+export declare function runOssQuery(input: unknown, dependencies?: OssQueryDependencies): Promise<TaskResult>;

package/dist/tasks/oss-query.js

@@ -0,0 +1,125 @@
+import { z } from "zod";
+import { loadConfig } from "../config.js";
+import { OssClient } from "../oss/client.js";
+import { OssError, sanitizeOssOutput } from "../oss/errors.js";
+import { SEARCH_FIELDS, projectEntries, searchObjects, validateSearchOptions } from "../oss/search.js";
+import { OssTransferClient } from "../oss/transfers.js";
+const path = z.string().max(1024).refine(value => value === value.trim()
+    && !/[\\\u0000-\u001f\u007f]/u.test(value)
+    && !value.split("/").some(part => part === "." || part === ".."), "Invalid OSS path");
+export const ossQuerySchema = z.object({
+    grant_id: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional(),
+    bucket: z.string().min(1).max(63).regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/u).optional()
+        .describe("Exact bucket name; required with prefix when grant_id is omitted"),
+    prefix: path.optional().describe("Exact requested prefix; an explicit empty string requests the bucket root"),
+    ttl: z.number().int().min(900).max(3600).optional(),
+    marker: path.min(1).optional(), delimiter: z.literal("/").optional(), directories_only: z.boolean().optional(),
+    contains: z.string().min(1).max(1024).optional(), suffix: z.string().min(1).max(1024).optional(), ignore_case: z.boolean().optional(),
+    min_size: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).optional(),
+    max_size: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).optional(),
+    modified_after: z.string().optional(), modified_before: z.string().optional(),
+    created_time_key: z.string().optional(), created_after: z.string().optional(), created_before: z.string().optional(),
+    meta: z.array(z.string().max(2048)).max(20).optional(), content_type: z.string().optional(),
+    sort: z.enum(["key", "size", "modified", "created"]).default("key"), order: z.enum(["asc", "desc"]).default("asc"),
+    limit: z.number().int().min(1).max(1000).default(100), scan_limit: z.number().int().min(1).max(100000).default(1000),
+    fields: z.array(z.enum(SEARCH_FIELDS)).min(1).optional()
+}).strict();
+function covered(scope, root, prefix) {
+    const kind = scope?.trim().toUpperCase().replace(/^OSS_/u, "");
+    const normalized = (root ?? "").trim().replace(/^\/+|\/+$/gu, "");
+    if (!["BUCKET", "PREFIX"].includes(kind ?? "") || kind === "PREFIX" && !normalized
+        || !path.safeParse(normalized).success)
+        return false;
+    return !normalized || prefix === normalized || prefix.startsWith(`${normalized}/`);
+}
+// Grant schemas deliberately preserve backend extensions; never return them to the agent.
+function candidate(grant) {
+    return { grant_id: grant.grantId, bucket: grant.bucketName, prefix: grant.objectPrefix ?? "",
+        scope_type: grant.scopeType, permission_level: grant.permissionLevel };
+}
+/** Only selection hints; the issued session and OSS remain the authorization boundary. */
+function supportsQuery(grant, needsHead) {
+    // Nullable Grant metadata represents the absence of explicit policy actions.
+    // Session schemas use undefined for that same legacy permission-level fallback.
+    const actions = grant.actions ?? undefined;
+    const effect = grant.effect ?? undefined;
+    if (actions !== undefined || effect !== undefined) {
+        const required = needsHead ? ["oss:ListObjects", "oss:GetObject"] : ["oss:ListObjects"];
+        return effect === "Allow" && Array.isArray(actions)
+            && required.every(action => actions.includes(action) || actions.includes("oss:*"));
+    }
+    return ["ADMIN", "READ_ONLY", "READ_WRITE", "READ_WRITE_NO_DELETE"].includes(grant.permissionLevel?.trim().toUpperCase() ?? "");
+}
+function safe(value) {
+    const redacted = sanitizeOssOutput(value);
+    const stripUrls = (item) => {
+        if (typeof item === "string")
+            return item.replace(/https?:\/\/[^\s<>"']+/giu, "[REDACTED_URL]");
+        if (Array.isArray(item))
+            return item.map(stripUrls);
+        if (item && typeof item === "object")
+            return Object.fromEntries(Object.entries(item).map(([key, data]) => [key, stripUrls(data)]));
+        return item;
+    };
+    return stripUrls(redacted);
+}
+/** One bounded read workflow; a denied or ambiguous Grant never triggers a fallback. */
+export async function runOssQuery(input, dependencies = {}) {
+    const task = "oss.query";
+    const parsed = ossQuerySchema.safeParse(input);
+    if (!parsed.success)
+        return { status: "needs_input", task,
+            error: { code: "oss_input_invalid", message: "Supply valid OSS query parameters." },
+            missing: [...new Set(parsed.error.issues.map(issue => issue.path.join(".")).filter(Boolean))] };
+    const query = parsed.data;
+    if (query.grant_id === undefined && (query.bucket === undefined || query.prefix === undefined)) {
+        return { status: "needs_input", task, missing: [query.bucket === undefined ? "bucket" : "", query.prefix === undefined ? "prefix" : ""].filter(Boolean),
+            error: { code: "oss_target_required", message: "Specify grant_id, or both an exact bucket and prefix. Use an explicit empty prefix for the bucket root." } };
+    }
+    const options = { marker: query.marker, delimiter: query.delimiter, directoriesOnly: query.directories_only,
+        contains: query.contains, suffix: query.suffix, ignoreCase: query.ignore_case,
+        minSize: query.min_size, maxSize: query.max_size, modifiedAfter: query.modified_after, modifiedBefore: query.modified_before,
+        createdTimeKey: query.created_time_key, createdAfter: query.created_after, createdBefore: query.created_before,
+        meta: query.meta, contentType: query.content_type, sort: query.sort, order: query.order,
+        limit: query.limit, scanLimit: query.scan_limit, fields: query.fields?.join(",") };
+    try {
+        const validated = validateSearchOptions(options);
+        await dependencies.beforeExecute?.();
+        const client = dependencies.clientFactory?.() ?? new OssClient(loadConfig("oss"));
+        let grantId = query.grant_id;
+        if (grantId === undefined) {
+            const available = await client.listGrants();
+            // One platform request, with a hard ceiling on selection and candidate output.
+            if (available.grants.length > 10000)
+                return { status: "needs_input", task, missing: ["grant_id"],
+                    error: { code: "oss_grant_limit", message: "Too many Grants for automatic selection; provide the exact grant_id." } };
+            const matches = available.grants.filter(grant => grant.status === "ACTIVE" && grant.cloudPolicySynced
+                && grant.roleName && grant.bucketName === query.bucket && supportsQuery(grant, validated.needsHead)
+                && covered(grant.scopeType, grant.objectPrefix, query.prefix));
+            if (!matches.length)
+                return { status: "blocked", task,
+                    error: { code: "oss_grant_unavailable", message: "No enabled, synchronized Grant covers the requested bucket and prefix." } };
+            if (matches.length > 1)
+                return { status: "needs_input", task, missing: ["grant_id"],
+                    candidates: safe(matches.slice(0, 100).map(candidate)),
+                    error: { code: "oss_grant_ambiguous", message: "Multiple Grants cover this target; select an exact grant_id. At most 100 candidates are shown." } };
+            grantId = matches[0].grantId;
+        }
+        const session = await client.issueSession(grantId, query.ttl);
+        if (session.grantId !== grantId || query.bucket !== undefined && session.bucketName !== query.bucket
+            || query.prefix !== undefined && !covered(session.scopeType, session.objectPrefix, query.prefix)) {
+            return { status: "blocked", task, error: { code: "oss_target_mismatch", message: "The issued session does not cover the exact requested target." } };
+        }
+        const transfer = dependencies.transferFactory?.() ?? new OssTransferClient();
+        const result = await searchObjects(transfer, session, query.prefix, options);
+        return { status: "succeeded", task,
+            data: safe({ grant_id: grantId, bucket: session.bucketName, ...result, objects: projectEntries(result.objects, validated.fields) }) };
+    }
+    catch (error) {
+        if (!(error instanceof OssError))
+            throw error;
+        return { status: error.code === "oss_input_invalid" ? "needs_input" : "blocked", task,
+            error: { code: error.code, message: safe(error.message) } };
+    }
+}
+//# sourceMappingURL=oss-query.js.map

package/dist/tasks/oss-query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oss-query.js","sourceRoot":"","sources":["../../src/tasks/oss-query.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE/D,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE;OACnE,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;OACvC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAExF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAC7E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE;SAChF,QAAQ,CAAC,kEAAkE,CAAC;IAC/E,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2EAA2E,CAAC;IAC7G,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACnD,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9G,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrI,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAChF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAChF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpH,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3F,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAClH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACpH,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC,MAAM,EAAE,CAAC;AAQZ,SAAS,OAAO,CAAC,KAAgC,EAAE,IAA+B,EAAE,MAAc;IAChG,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,UAAU;WAC7E,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,CAAC,UAAU,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;AACrF,CAAC;AAED,0FAA0F;AAC1F,SAAS,SAAS,CAAC,KAAkB;IACnC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;QAC1F,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,gBAAgB,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;AAC3E,CAAC;AAED,0FAA0F;AAC1F,SAAS,aAAa,CAAC,KAAkB,EAAE,SAAkB;IAC3D,6EAA6E;IAC7E,gFAAgF;IAChF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,SAAS,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC;IACzC,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACxF,OAAO,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;eAC9C,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,sBAAsB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;AAClI,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,CAAC,IAAa,EAAW,EAAE;QAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE,gBAAgB,CAAC,CAAC;QAChG,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACnI,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,OAAO,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAc,EAAE,YAAY,GAAyB,EAAE;IACvF,MAAM,IAAI,GAAG,WAAW,CAAC;IACzB,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI;YACvD,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,oCAAoC,EAAE;YACnF,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1B,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QAC/F,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YACrJ,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,yGAAyG,EAAE,EAAE,CAAC;IACjK,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,CAAC,gBAAgB;QACzG,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,WAAW;QAC7E,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,cAAc,EAAE,cAAc,EAAE,KAAK,CAAC,eAAe;QAC5H,cAAc,EAAE,KAAK,CAAC,gBAAgB,EAAE,YAAY,EAAE,KAAK,CAAC,aAAa,EAAE,aAAa,EAAE,KAAK,CAAC,cAAc;QAC9G,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK;QACvF,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACrF,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,YAAY,CAAC,aAAa,EAAE,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,EAAE,EAAE,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAClF,IAAI,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5C,+EAA+E;YAC/E,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK;gBAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC;oBAC9F,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,sEAAsE,EAAE,EAAE,CAAC;YACxH,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,iBAAiB;mBAChG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,MAAM,IAAI,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC;mBAChG,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAO,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI;oBACnD,KAAK,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,wEAAwE,EAAE,EAAE,CAAC;YAChI,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC;oBACjF,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAc;oBACnE,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,gGAAgG,EAAE,EAAE,CAAC;YACtJ,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC/B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,MAAM;eAC/F,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACnG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,+DAA+D,EAAE,EAAE,CAAC;QACvJ,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,EAAE,EAAE,IAAI,IAAI,iBAAiB,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7E,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI;YAChC,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1I,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,QAAQ,CAAC;YAAE,MAAM,KAAK,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI;YACnF,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAW,EAAE,EAAE,CAAC;IAC1E,CAAC;AACH,CAAC"}

package/dist/tasks/runtime.d.ts

@@ -0,0 +1,151 @@
+import { z } from "zod";
+import { type AuthConfig } from "../config.js";
+import { type WecomNotifyDependencies } from "./wecom-notify.js";
+import { type OssQueryDependencies } from "./oss-query.js";
+import type { TaskResult } from "./types.js";
+export declare const TASKS: readonly [{
+    readonly name: "wecom.notify";
+    readonly tool: "numa_wecom_notify";
+    readonly module: "wecom";
+    readonly readOnly: false;
+    readonly description: "一次完成企微通道检查、精确收件人解析、已授权通知发送和未知结果查询。";
+    readonly schema: z.ZodObject<{
+        recipient_email: z.ZodOptional<z.ZodString>;
+        email_type: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>]>>;
+        recipient_user_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        content: z.ZodOptional<z.ZodString>;
+        message_type: z.ZodDefault<z.ZodEnum<{
+            markdown: "markdown";
+            text: "text";
+        }>>;
+        safe: z.ZodDefault<z.ZodBoolean>;
+        request_id: z.ZodOptional<z.ZodString>;
+        confirmed: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>;
+}, {
+    readonly name: "oss.query";
+    readonly tool: "numa_oss_query";
+    readonly module: "oss";
+    readonly readOnly: true;
+    readonly description: "一次完成精确目标的唯一 Grant 选择和有界 OSS 检索；歧义返回候选。";
+    readonly schema: z.ZodObject<{
+        grant_id: z.ZodOptional<z.ZodNumber>;
+        bucket: z.ZodOptional<z.ZodString>;
+        prefix: z.ZodOptional<z.ZodString>;
+        ttl: z.ZodOptional<z.ZodNumber>;
+        marker: z.ZodOptional<z.ZodString>;
+        delimiter: z.ZodOptional<z.ZodLiteral<"/">>;
+        directories_only: z.ZodOptional<z.ZodBoolean>;
+        contains: z.ZodOptional<z.ZodString>;
+        suffix: z.ZodOptional<z.ZodString>;
+        ignore_case: z.ZodOptional<z.ZodBoolean>;
+        min_size: z.ZodOptional<z.ZodNumber>;
+        max_size: z.ZodOptional<z.ZodNumber>;
+        modified_after: z.ZodOptional<z.ZodString>;
+        modified_before: z.ZodOptional<z.ZodString>;
+        created_time_key: z.ZodOptional<z.ZodString>;
+        created_after: z.ZodOptional<z.ZodString>;
+        created_before: z.ZodOptional<z.ZodString>;
+        meta: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        content_type: z.ZodOptional<z.ZodString>;
+        sort: z.ZodDefault<z.ZodEnum<{
+            created: "created";
+            key: "key";
+            modified: "modified";
+            size: "size";
+        }>>;
+        order: z.ZodDefault<z.ZodEnum<{
+            asc: "asc";
+            desc: "desc";
+        }>>;
+        limit: z.ZodDefault<z.ZodNumber>;
+        scan_limit: z.ZodDefault<z.ZodNumber>;
+        fields: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            contentType: "contentType";
+            createdAt: "createdAt";
+            etag: "etag";
+            key: "key";
+            kind: "kind";
+            lastModified: "lastModified";
+            metadata: "metadata";
+            sizeBytes: "sizeBytes";
+            storageClass: "storageClass";
+            type: "type";
+        }>>>;
+    }, z.core.$strict>;
+}];
+export interface TaskDependencies {
+    wecom?: WecomNotifyDependencies;
+    oss?: OssQueryDependencies;
+    /** Injection points keep tests offline; production always validates the selected profile. */
+    initializeProfile?: () => Promise<void>;
+    config?: (task: string) => AuthConfig;
+}
+export declare function inspectTasks(name?: string): {
+    name: "oss.query" | "wecom.notify";
+    tool: "numa_oss_query" | "numa_wecom_notify";
+    module: "oss" | "wecom";
+    description: "一次完成企微通道检查、精确收件人解析、已授权通知发送和未知结果查询。" | "一次完成精确目标的唯一 Grant 选择和有界 OSS 检索；歧义返回候选。";
+    read_only: boolean;
+    input_schema: z.core.ZodStandardJSONSchemaPayload<z.ZodObject<{
+        recipient_email: z.ZodOptional<z.ZodString>;
+        email_type: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>]>>;
+        recipient_user_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        content: z.ZodOptional<z.ZodString>;
+        message_type: z.ZodDefault<z.ZodEnum<{
+            markdown: "markdown";
+            text: "text";
+        }>>;
+        safe: z.ZodDefault<z.ZodBoolean>;
+        request_id: z.ZodOptional<z.ZodString>;
+        confirmed: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict> | z.ZodObject<{
+        grant_id: z.ZodOptional<z.ZodNumber>;
+        bucket: z.ZodOptional<z.ZodString>;
+        prefix: z.ZodOptional<z.ZodString>;
+        ttl: z.ZodOptional<z.ZodNumber>;
+        marker: z.ZodOptional<z.ZodString>;
+        delimiter: z.ZodOptional<z.ZodLiteral<"/">>;
+        directories_only: z.ZodOptional<z.ZodBoolean>;
+        contains: z.ZodOptional<z.ZodString>;
+        suffix: z.ZodOptional<z.ZodString>;
+        ignore_case: z.ZodOptional<z.ZodBoolean>;
+        min_size: z.ZodOptional<z.ZodNumber>;
+        max_size: z.ZodOptional<z.ZodNumber>;
+        modified_after: z.ZodOptional<z.ZodString>;
+        modified_before: z.ZodOptional<z.ZodString>;
+        created_time_key: z.ZodOptional<z.ZodString>;
+        created_after: z.ZodOptional<z.ZodString>;
+        created_before: z.ZodOptional<z.ZodString>;
+        meta: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        content_type: z.ZodOptional<z.ZodString>;
+        sort: z.ZodDefault<z.ZodEnum<{
+            created: "created";
+            key: "key";
+            modified: "modified";
+            size: "size";
+        }>>;
+        order: z.ZodDefault<z.ZodEnum<{
+            asc: "asc";
+            desc: "desc";
+        }>>;
+        limit: z.ZodDefault<z.ZodNumber>;
+        scan_limit: z.ZodDefault<z.ZodNumber>;
+        fields: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            contentType: "contentType";
+            createdAt: "createdAt";
+            etag: "etag";
+            key: "key";
+            kind: "kind";
+            lastModified: "lastModified";
+            metadata: "metadata";
+            sizeBytes: "sizeBytes";
+            storageClass: "storageClass";
+            type: "type";
+        }>>>;
+    }, z.core.$strict>>;
+    result_statuses: string[];
+}[];
+/** Validate configuration only. Clients obtain/reuse tokens and the server enforces authorization. */
+export declare function validateTaskIdentity(config: AuthConfig): void;
+export declare function runTask(name: string, input: unknown, dependencies?: TaskDependencies): Promise<TaskResult>;

package/dist/tasks/runtime.js

@@ -0,0 +1,71 @@
+import { z } from "zod";
+import { loadConfig } from "../config.js";
+import { currentPlatformProfile, initializePlatformProfile } from "../platform-profile.js";
+import { runWecomNotify, wecomNotifySchema } from "./wecom-notify.js";
+import { runOssQuery, ossQuerySchema } from "./oss-query.js";
+export const TASKS = [
+    { name: "wecom.notify", tool: "numa_wecom_notify", module: "wecom", readOnly: false,
+        description: "一次完成企微通道检查、精确收件人解析、已授权通知发送和未知结果查询。", schema: wecomNotifySchema },
+    { name: "oss.query", tool: "numa_oss_query", module: "oss", readOnly: true,
+        description: "一次完成精确目标的唯一 Grant 选择和有界 OSS 检索；歧义返回候选。", schema: ossQuerySchema },
+];
+export function inspectTasks(name) {
+    return TASKS.filter(task => name === undefined || task.name === name).map(task => ({
+        name: task.name, tool: task.tool, module: task.module,
+        description: task.description, read_only: task.readOnly,
+        input_schema: z.toJSONSchema(task.schema, { io: "input" }),
+        result_statuses: ["succeeded", "needs_input", "blocked", "pending"],
+    }));
+}
+/** Validate configuration only. Clients obtain/reuse tokens and the server enforces authorization. */
+export function validateTaskIdentity(config) {
+    if (!config.backendBaseUrl || !config.discoveryUrl || !config.clientId?.trim())
+        throw Object.assign(new Error(), { code: "TASK_CONFIGURATION_REQUIRED" });
+    if (config.authenticationMode === "client_credentials") {
+        if (config.clientId === "mcp-client" || Boolean(config.clientSecret) === Boolean(config.clientSecretFile))
+            throw Object.assign(new Error(), { code: "TASK_MACHINE_IDENTITY_REQUIRED" });
+    }
+    else if (config.clientSecret || config.clientSecretFile) {
+        // An explicit browser identity must not accidentally consume machine credentials.
+        throw Object.assign(new Error(), { code: "TASK_IDENTITY_CONFLICT" });
+    }
+}
+const configurationMessages = {
+    TASK_CONFIGURATION_REQUIRED: "Configure the selected platform API, issuer and client before running this task.",
+    TASK_MACHINE_IDENTITY_REQUIRED: "Machine mode requires a dedicated client and exactly one Secret source in this process environment. No browser fallback was attempted.",
+    TASK_IDENTITY_CONFLICT: "Browser mode and machine credentials conflict. Correct this process configuration; identity was not changed.",
+};
+export async function runTask(name, input, dependencies = {}) {
+    const task = TASKS.find(item => item.name === name);
+    if (!task)
+        return { task: name, status: "blocked", error: { code: "TASK_UNKNOWN", message: "Unknown task. Use task inspect to list supported tasks." } };
+    // Validate shape before loading a profile, obtaining credentials, or making any network requests.
+    const parsed = task.schema.safeParse(input);
+    if (!parsed.success)
+        return { task: name, status: "needs_input",
+            missing: [...new Set(parsed.error.issues.map(issue => issue.path.join(".") || "input"))],
+            error: { code: "TASK_INPUT_INVALID", message: "Task input does not match its schema. Correct the listed fields." } };
+    try {
+        const beforeExecute = async () => {
+            if (dependencies.initializeProfile)
+                await dependencies.initializeProfile();
+            else if (!currentPlatformProfile())
+                await initializePlatformProfile();
+            const config = dependencies.config?.(name) ?? loadConfig(name === "oss.query" ? "oss" : "platform");
+            validateTaskIdentity(config);
+        };
+        const result = name === "wecom.notify"
+            ? await runWecomNotify(parsed.data, { ...dependencies.wecom, beforeExecute })
+            : await runOssQuery(parsed.data, { ...dependencies.oss, beforeExecute });
+        // Each task owns output projection/redaction. Do not rewrite opaque recovery IDs here.
+        return result;
+    }
+    catch (error) {
+        // Never expose provider exceptions, request objects, credentials, or arbitrary response bodies.
+        const rawCode = error && typeof error === "object" && "code" in error ? error.code : undefined;
+        const code = typeof rawCode === "string" && /^[A-Za-z][A-Za-z0-9_]{0,79}$/u.test(rawCode) ? rawCode : "TASK_CONFIGURATION_OR_AUTH_FAILED";
+        return { task: name, status: "blocked", error: { code,
+                message: configurationMessages[code] ?? "Task initialization failed. Check the selected profile and process authentication configuration; no alternate identity was used." } };
+    }
+}
+//# sourceMappingURL=runtime.js.map

package/dist/tasks/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/tasks/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAmB,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAgC,MAAM,mBAAmB,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,cAAc,EAA6B,MAAM,gBAAgB,CAAC;AAGxF,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK;QACjF,WAAW,EAAE,oCAAoC,EAAE,MAAM,EAAE,iBAAiB,EAAE;IAChF,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI;QACxE,WAAW,EAAE,wCAAwC,EAAE,MAAM,EAAE,cAAc,EAAE;CACzE,CAAC;AAUX,MAAM,UAAU,YAAY,CAAC,IAAa;IACxC,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjF,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM;QACrD,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ;QACvD,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;QAC1D,eAAe,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC;KACpE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE;QAC5E,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,kBAAkB,KAAK,oBAAoB,EAAE,CAAC;QACvD,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;YACvG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;IACjF,CAAC;SAAM,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC1D,kFAAkF;QAClF,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,MAAM,qBAAqB,GAA2B;IACpD,2BAA2B,EAAE,kFAAkF;IAC/G,8BAA8B,EAAE,wIAAwI;IACxK,sBAAsB,EAAE,8GAA8G;CACvI,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,KAAc,EAAE,YAAY,GAAqB,EAAE;IAC7F,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,yDAAyD,EAAE,EAAE,CAAC;IACzJ,kGAAkG;IAClG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa;YAC7D,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC;YACxF,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,kEAAkE,EAAE,EAAE,CAAC;IACvH,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE;YAC/B,IAAI,YAAY,CAAC,iBAAiB;gBAAE,MAAM,YAAY,CAAC,iBAAiB,EAAE,CAAC;iBACtE,IAAI,CAAC,sBAAsB,EAAE;gBAAE,MAAM,yBAAyB,EAAE,CAAC;YACtE,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACpG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,KAAK,cAAc;YACpC,CAAC,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC;YAC7E,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;QAC3E,uFAAuF;QACvF,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gGAAgG;QAChG,MAAM,OAAO,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC;QAC1I,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI;gBACnD,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,kIAAkI,EAAE,EAAE,CAAC;IACnL,CAAC;AACH,CAAC"}

package/dist/tasks/tools.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { type TaskDependencies } from "./runtime.js";
+export declare function registerTaskTools(server: McpServer, modules: ReadonlySet<string>, dependencies?: TaskDependencies): void;

package/dist/tasks/tools.js

@@ -0,0 +1,16 @@
+import { TASKS, runTask } from "./runtime.js";
+export function registerTaskTools(server, modules, dependencies = {}) {
+    for (const task of TASKS) {
+        if (!modules.has(task.module))
+            continue;
+        server.registerTool(task.tool, {
+            description: `${task.description} Call this task directly; configuration/authentication and required lookups run internally, without separate auth/catalog/capability calls. Uses this MCP process identity and environment. Returns succeeded, needs_input, blocked or pending. ${task.readOnly ? "Read-only bounded query; ambiguous Grants require user selection." : "SIDE EFFECT: requires user-approved exact recipients and content, confirmed=true and a stable request_id. ACCEPTED is not delivery. pending must be recovered with numa_wecom_status using the same request_id; never resend."}`,
+            inputSchema: task.schema,
+            annotations: { readOnlyHint: task.readOnly, destructiveHint: false, idempotentHint: task.readOnly, openWorldHint: true },
+        }, async (input) => {
+            const result = await runTask(task.name, input, dependencies);
+            return { isError: result.status === "blocked", content: [{ type: "text", text: JSON.stringify(result) }], structuredContent: { ...result } };
+        });
+    }
+}
+//# sourceMappingURL=tools.js.map

package/dist/tasks/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/tasks/tools.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAyB,MAAM,cAAc,CAAC;AAErE,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,OAA4B,EAAE,YAAY,GAAqB,EAAE;IACpH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QACxC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE;YAC7B,WAAW,EAAE,GAAG,IAAI,CAAC,WAAW,mPAAmP,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,mEAAmE,CAAC,CAAC,CAAC,+NAA+N,EAAE;YAC1kB,WAAW,EAAE,IAAI,CAAC,MAAM;YACxB,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE;SACzH,EAAE,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;YAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,iBAAiB,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;QACxJ,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/tasks/types.d.ts

@@ -0,0 +1,14 @@
+/** A task result is actionable without another discovery/preflight model turn. */
+export interface TaskResult {
+    status: "succeeded" | "needs_input" | "blocked" | "pending";
+    task: string;
+    data?: unknown;
+    error?: {
+        code: string;
+        message: string;
+    };
+    missing?: string[];
+    candidates?: unknown[];
+    request_id?: string;
+}
+export declare function taskExitCode(result: TaskResult): number;

package/dist/tasks/types.js

@@ -0,0 +1,4 @@
+export function taskExitCode(result) {
+    return { succeeded: 0, needs_input: 2, blocked: 3, pending: 4 }[result.status];
+}
+//# sourceMappingURL=types.js.map

package/dist/tasks/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/tasks/types.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACjF,CAAC"}

package/dist/tasks/wecom-notify.d.ts

@@ -0,0 +1,26 @@
+import { z } from "zod";
+import { WecomClient } from "../wecom/client.js";
+import type { TaskResult } from "./types.js";
+/** Optional fields let both entry points return actionable needs_input results. */
+export declare const wecomNotifySchema: z.ZodObject<{
+    recipient_email: z.ZodOptional<z.ZodString>;
+    email_type: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>]>>;
+    recipient_user_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    content: z.ZodOptional<z.ZodString>;
+    message_type: z.ZodDefault<z.ZodEnum<{
+        markdown: "markdown";
+        text: "text";
+    }>>;
+    safe: z.ZodDefault<z.ZodBoolean>;
+    request_id: z.ZodOptional<z.ZodString>;
+    confirmed: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strict>;
+type NotifyClient = Pick<WecomClient, "capabilities" | "recipientByEmail" | "send" | "statusByRequest">;
+export interface WecomNotifyDependencies {
+    client?: NotifyClient;
+    clientFactory?: () => NotifyClient;
+    beforeExecute?: () => Promise<void>;
+}
+/** Deterministic, bounded notification workflow shared by CLI and MCP. */
+export declare function runWecomNotify(input: unknown, dependencies?: WecomNotifyDependencies): Promise<TaskResult>;
+export {};