@openclaw/feishu 2026.7.1-beta.1 → 2026.7.1-beta.4

package/node_modules/@larksuiteoapi/node-sdk/es/index.js

@@ -20,6 +20,7 @@ import pickBy from 'lodash.pickby';
 import merge from 'lodash.merge';
 import qs from 'querystring';
 import WebSocket from 'ws';
+import { gzipSync } from 'zlib';
 import http from 'http';
 import https from 'https';
 import { promises } from 'dns';
@@ -87331,6 +87332,18 @@ class AppTicketManager {
     }
 }
 
+/**
+ * Build an error message for a token response that is missing its expected
+ * field. Only the API's own `code`/`msg` are echoed back — never request
+ * credentials (app_secret, app_ticket, tokens) — so the message is safe to
+ * surface to callers and logs.
+ */
+function buildTokenError(field, response) {
+    var _a, _b;
+    const code = (_a = response === null || response === void 0 ? void 0 : response.code) !== null && _a !== void 0 ? _a : 'unknown';
+    const msg = (_b = response === null || response === void 0 ? void 0 : response.msg) !== null && _b !== void 0 ? _b : 'no message';
+    return `failed to get ${field}, code: ${code}, msg: ${msg}`;
+}
 class TokenManager {
     constructor(params) {
         this.appId = params.appId;
@@ -87351,6 +87364,29 @@ class TokenManager {
         });
         this.logger.debug('token manager is ready');
     }
+    /**
+     * POST a token endpoint and return the validated response body.
+     *
+     * On transport failure the original error is logged and rethrown — so the
+     * caller sees the real cause (EPIPE, timeout, ...) instead of a secondary
+     * "Cannot destructure ... of undefined". On an HTTP-200 business failure the
+     * required field is absent; we throw an error carrying only the API's
+     * code/msg and never cache an undefined token.
+     */
+    requestToken(url, body, requiredField) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.httpInstance
+                .post(url, body)
+                .catch((e) => {
+                this.logger.error(e);
+                throw e;
+            });
+            if (!response || !response[requiredField]) {
+                throw new Error(buildTokenError(requiredField, response));
+            }
+            return response;
+        });
+    }
     getCustomTenantAccessToken() {
         var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
@@ -87362,15 +87398,10 @@ class TokenManager {
                 return cachedTenantAccessToken;
             }
             this.logger.debug('request token');
-            // @ts-ignore
-            const { tenant_access_token, expire } = yield this.httpInstance
-                .post(`${this.domain}/open-apis/auth/v3/tenant_access_token/internal`, {
+            const { tenant_access_token, expire } = yield this.requestToken(`${this.domain}/open-apis/auth/v3/tenant_access_token/internal`, {
                 app_id: this.appId,
                 app_secret: this.appSecret,
-            })
-                .catch((e) => {
-                this.logger.error(e);
-            });
+            }, 'tenant_access_token');
             yield ((_b = this.cache) === null || _b === void 0 ? void 0 : _b.set(CTenantAccessToken, tenant_access_token, 
             // Due to the time-consuming network, the expiration time needs to be 3 minutes earlier
             new Date().getTime() + expire * 1000 - 3 * 60 * 1000, {
@@ -87401,27 +87432,17 @@ class TokenManager {
             }
             this.logger.debug('get app access token');
             // 获取app_access_token
-            // @ts-ignore
-            const { app_access_token } = yield this.httpInstance
-                .post(`${this.domain}/open-apis/auth/v3/app_access_token`, {
+            const { app_access_token } = yield this.requestToken(`${this.domain}/open-apis/auth/v3/app_access_token`, {
                 app_id: this.appId,
                 app_secret: this.appSecret,
                 app_ticket: appTicket,
-            })
-                .catch((e) => {
-                this.logger.error(e);
-            });
+            }, 'app_access_token');
             this.logger.debug('get tenant access token');
             // 获取tenant_access_token
-            // @ts-ignore
-            const { tenant_access_token, expire } = yield this.httpInstance
-                .post(`${this.domain}/open-apis/auth/v3/tenant_access_token`, {
+            const { tenant_access_token, expire } = yield this.requestToken(`${this.domain}/open-apis/auth/v3/tenant_access_token`, {
                 app_access_token,
                 tenant_key: tenantKey,
-            })
-                .catch((e) => {
-                this.logger.error(e);
-            });
+            }, 'tenant_access_token');
             // 设置tenant_access_token
             yield this.cache.set(`larkMarketAccessToken${tenantKey}`, tenant_access_token, 
             // Due to the time-consuming network, the expiration time needs to be 3 minutes earlier
@@ -88888,10 +88909,15 @@ class DataCache {
     deleteCache(message_id) {
         this.cache.delete(message_id);
     }
+    // Idempotent: re-arming an already-running sweep is a no-op, so it is safe
+    // to call again on start() after a previous destroy().
     clearAtInterval() {
+        if (this.timer) {
+            return;
+        }
         // magic number，10s expired
         const clearIntervalMs = 10000;
-        setInterval(() => {
+        this.timer = setInterval(() => {
             const now = Date.now();
             this.cache.forEach((value, key) => {
                 var _a;
@@ -88902,6 +88928,20 @@ class DataCache {
                 }
             });
         }, clearIntervalMs);
+        // Don't let the sweep timer keep the Node process alive on its own; the
+        // process should be free to exit once nothing else references the loop.
+        if (typeof this.timer.unref === 'function') {
+            this.timer.unref();
+        }
+    }
+    // Stop the sweep timer and drop cached fragments. Called from
+    // WSClient.close() so the client releases its event-loop handle.
+    destroy() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = undefined;
+        }
+        this.cache.clear();
     }
 }
 
@@ -89436,6 +89476,7 @@ class WSClient {
             this.reconnectInterval = undefined;
         }
         this.clearLiveness();
+        this.dataCache.destroy();
         this.isConnecting = false;
         this.currentReconnectAttempts = 0;
         const wsInstance = this.wsConfig.getWSInstance();
@@ -89467,6 +89508,9 @@ class WSClient {
             // getConnectionStatus() reflects the fresh start.
             this.terminalError = false;
             this.currentReconnectAttempts = 0;
+            // Re-arm the cache sweep in case the client was previously close()d
+            // (which destroys the timer); idempotent when already running.
+            this.dataCache.clearAtInterval();
             this.logger.info('[ws]', `receive events or callbacks through persistent connection only available in self-build & Feishu app, Configured in:
         Developer Console(开发者后台)
           ->
@@ -89742,6 +89786,105 @@ class Aily {
     }
 }
 
+function assertPlainObject(value, path) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new Error(`${path} must be an object`);
+    }
+}
+/**
+ * The confirm page silently discards the whole payload on any shape mismatch,
+ * so unknown keys (typos, or sensitive manifest fields like `security`)
+ * must fail loudly here instead.
+ */
+function assertAllowedKeys(obj, allowed, path) {
+    for (const key of Object.keys(obj)) {
+        if (!allowed.includes(key)) {
+            throw new Error(`${path}.${key} is not allowed; allowed keys: ${allowed.join(', ')}`);
+        }
+    }
+}
+function validateStringArray(value, path) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!Array.isArray(value)) {
+        throw new Error(`${path} must be an array of strings`);
+    }
+    value.forEach((item, idx) => {
+        if (typeof item !== 'string' || item === '') {
+            throw new Error(`${path}[${idx}] must be a non-empty string`);
+        }
+    });
+    return value;
+}
+/**
+ * Validate the shape of `addons` and rebuild it from the 5 known public
+ * fields only, so nothing outside the whitelist can ever be serialized.
+ */
+function normalizeAddons(addons) {
+    assertPlainObject(addons, 'addons');
+    assertAllowedKeys(addons, ['scopes', 'events', 'callbacks'], 'addons');
+    let itemCount = 0;
+    const pick = (value, path) => {
+        var _a;
+        const items = validateStringArray(value, path);
+        itemCount += (_a = items === null || items === void 0 ? void 0 : items.length) !== null && _a !== void 0 ? _a : 0;
+        return items;
+    };
+    const normalized = {};
+    if (addons.scopes !== undefined) {
+        assertPlainObject(addons.scopes, 'addons.scopes');
+        assertAllowedKeys(addons.scopes, ['tenant', 'user'], 'addons.scopes');
+        normalized.scopes = {
+            tenant: pick(addons.scopes.tenant, 'addons.scopes.tenant'),
+            user: pick(addons.scopes.user, 'addons.scopes.user'),
+        };
+    }
+    if (addons.events !== undefined) {
+        assertPlainObject(addons.events, 'addons.events');
+        assertAllowedKeys(addons.events, ['items'], 'addons.events');
+        if (addons.events.items !== undefined) {
+            assertPlainObject(addons.events.items, 'addons.events.items');
+            assertAllowedKeys(addons.events.items, ['tenant', 'user'], 'addons.events.items');
+            normalized.events = {
+                items: {
+                    tenant: pick(addons.events.items.tenant, 'addons.events.items.tenant'),
+                    user: pick(addons.events.items.user, 'addons.events.items.user'),
+                },
+            };
+        }
+    }
+    if (addons.callbacks !== undefined) {
+        assertPlainObject(addons.callbacks, 'addons.callbacks');
+        assertAllowedKeys(addons.callbacks, ['items'], 'addons.callbacks');
+        normalized.callbacks = {
+            items: pick(addons.callbacks.items, 'addons.callbacks.items'),
+        };
+    }
+    // An all-empty addons is treated as "no addons" by the confirm page —
+    // passing one is always a caller bug, so surface it at build time.
+    if (itemCount === 0) {
+        throw new Error('addons must contain at least one scope, event or callback');
+    }
+    return normalized;
+}
+/**
+ * Validate `addons` and encode it into the URL-safe string carried by the
+ * `addons` query param of the one-click app creation / update link.
+ *
+ * Encoding pipeline (fixed by the platform):
+ * `JSON.stringify → gzip → base64 → URL-safe ('+' → '-', '/' → '_') → strip '=' padding`.
+ * The result only contains `A-Z a-z 0-9 - _` and needs no further escaping.
+ */
+function encodeAddons(addons) {
+    const json = JSON.stringify(normalizeAddons(addons));
+    return gzipSync(Buffer.from(json, 'utf8'))
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+}
+
 function createError(code, description) {
     return { code, description };
 }
@@ -89896,7 +90039,10 @@ function startPolling(ctx) {
 function registerApp(options) {
     var _a, _b, _c, _d;
     return __awaiter(this, void 0, void 0, function* () {
-        const { domain, source, signal, onQRCodeReady, onStatusChange, appPreset } = options;
+        const { domain, source, signal, onQRCodeReady, onStatusChange, appPreset, addons, createOnly, appId } = options;
+        if (appId !== undefined && (typeof appId !== 'string' || appId === '')) {
+            throw new Error('appId must be a non-empty string');
+        }
         const baseUrl = `https://${domain !== null && domain !== void 0 ? domain : DEFAULT_FEISHU_DOMAIN}`;
         const beginRes = yield begin(baseUrl);
         const qrCodeUrl = new URL(beginRes.verification_uri_complete);
@@ -89906,6 +90052,19 @@ function registerApp(options) {
         if (appPreset) {
             applyAppPreset(qrCodeUrl, appPreset);
         }
+        if (addons) {
+            qrCodeUrl.searchParams.set('addons', encodeAddons(addons));
+        }
+        // The landing page only honors the literal value 'true'; anything else is
+        // treated as absent, so the param is simply omitted in that case.
+        if (createOnly === true) {
+            qrCodeUrl.searchParams.set('createOnly', 'true');
+        }
+        // When both are present the page gives createOnly precedence and ignores
+        // clientID, so the two params can be passed through together as-is.
+        if (appId) {
+            qrCodeUrl.searchParams.set('clientID', appId);
+        }
         onQRCodeReady({
             url: qrCodeUrl.toString(),
             expireIn: (_a = beginRes.expires_in) !== null && _a !== void 0 ? _a : 600,
@@ -93664,4 +93823,4 @@ function cardActionId(action) {
     return `${action.tag}|${(_b = action.name) !== null && _b !== void 0 ? _b : ''}|${(_c = action.option) !== null && _c !== void 0 ? _c : ''}|${valuePart}`;
 }
 
-export { AESCipher, Aily, AppType, CAppTicket, CTenantAccessToken, CardActionHandler, Client, Domain, EventDispatcher, LarkChannel, LarkChannelError, LoggerLevel, WSClient, adaptDefault, adaptExpress, adaptKoa, adaptKoaRouter, createLarkChannel, defaultHttpInstance, generateChallenge, messageCard, normalize, normalizeBotAdded, normalizeCardAction, normalizeComment, normalizeReaction, registerApp, withAll, withHelpDeskCredential, withTenantKey, withTenantToken, withUserAccessToken };
+export { AESCipher, Aily, AppType, CAppTicket, CTenantAccessToken, CardActionHandler, Client, DefaultCache, Domain, EventDispatcher, LarkChannel, LarkChannelError, LoggerLevel, LoggerProxy, WSClient, adaptDefault, adaptExpress, adaptKoa, adaptKoaRouter, createLarkChannel, defaultHttpInstance, defaultLogger, generateChallenge, internalCache, messageCard, normalize, normalizeBotAdded, normalizeCardAction, normalizeComment, normalizeReaction, registerApp, withAll, withHelpDeskCredential, withTenantKey, withTenantToken, withUserAccessToken };

package/node_modules/@larksuiteoapi/node-sdk/lib/index.js

@@ -24,6 +24,7 @@ var pickBy = require('lodash.pickby');
 var merge = require('lodash.merge');
 var qs$1 = require('querystring');
 var WebSocket = require('ws');
+var zlib = require('zlib');
 var http = require('http');
 var https = require('https');
 var dns = require('dns');
@@ -87349,6 +87350,18 @@ class AppTicketManager {
     }
 }
 
+/**
+ * Build an error message for a token response that is missing its expected
+ * field. Only the API's own `code`/`msg` are echoed back — never request
+ * credentials (app_secret, app_ticket, tokens) — so the message is safe to
+ * surface to callers and logs.
+ */
+function buildTokenError(field, response) {
+    var _a, _b;
+    const code = (_a = response === null || response === void 0 ? void 0 : response.code) !== null && _a !== void 0 ? _a : 'unknown';
+    const msg = (_b = response === null || response === void 0 ? void 0 : response.msg) !== null && _b !== void 0 ? _b : 'no message';
+    return `failed to get ${field}, code: ${code}, msg: ${msg}`;
+}
 class TokenManager {
     constructor(params) {
         this.appId = params.appId;
@@ -87369,6 +87382,29 @@ class TokenManager {
         });
         this.logger.debug('token manager is ready');
     }
+    /**
+     * POST a token endpoint and return the validated response body.
+     *
+     * On transport failure the original error is logged and rethrown — so the
+     * caller sees the real cause (EPIPE, timeout, ...) instead of a secondary
+     * "Cannot destructure ... of undefined". On an HTTP-200 business failure the
+     * required field is absent; we throw an error carrying only the API's
+     * code/msg and never cache an undefined token.
+     */
+    requestToken(url, body, requiredField) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.httpInstance
+                .post(url, body)
+                .catch((e) => {
+                this.logger.error(e);
+                throw e;
+            });
+            if (!response || !response[requiredField]) {
+                throw new Error(buildTokenError(requiredField, response));
+            }
+            return response;
+        });
+    }
     getCustomTenantAccessToken() {
         var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
@@ -87380,15 +87416,10 @@ class TokenManager {
                 return cachedTenantAccessToken;
             }
             this.logger.debug('request token');
-            // @ts-ignore
-            const { tenant_access_token, expire } = yield this.httpInstance
-                .post(`${this.domain}/open-apis/auth/v3/tenant_access_token/internal`, {
+            const { tenant_access_token, expire } = yield this.requestToken(`${this.domain}/open-apis/auth/v3/tenant_access_token/internal`, {
                 app_id: this.appId,
                 app_secret: this.appSecret,
-            })
-                .catch((e) => {
-                this.logger.error(e);
-            });
+            }, 'tenant_access_token');
             yield ((_b = this.cache) === null || _b === void 0 ? void 0 : _b.set(CTenantAccessToken, tenant_access_token, 
             // Due to the time-consuming network, the expiration time needs to be 3 minutes earlier
             new Date().getTime() + expire * 1000 - 3 * 60 * 1000, {
@@ -87419,27 +87450,17 @@ class TokenManager {
             }
             this.logger.debug('get app access token');
             // 获取app_access_token
-            // @ts-ignore
-            const { app_access_token } = yield this.httpInstance
-                .post(`${this.domain}/open-apis/auth/v3/app_access_token`, {
+            const { app_access_token } = yield this.requestToken(`${this.domain}/open-apis/auth/v3/app_access_token`, {
                 app_id: this.appId,
                 app_secret: this.appSecret,
                 app_ticket: appTicket,
-            })
-                .catch((e) => {
-                this.logger.error(e);
-            });
+            }, 'app_access_token');
             this.logger.debug('get tenant access token');
             // 获取tenant_access_token
-            // @ts-ignore
-            const { tenant_access_token, expire } = yield this.httpInstance
-                .post(`${this.domain}/open-apis/auth/v3/tenant_access_token`, {
+            const { tenant_access_token, expire } = yield this.requestToken(`${this.domain}/open-apis/auth/v3/tenant_access_token`, {
                 app_access_token,
                 tenant_key: tenantKey,
-            })
-                .catch((e) => {
-                this.logger.error(e);
-            });
+            }, 'tenant_access_token');
             // 设置tenant_access_token
             yield this.cache.set(`larkMarketAccessToken${tenantKey}`, tenant_access_token, 
             // Due to the time-consuming network, the expiration time needs to be 3 minutes earlier
@@ -88906,10 +88927,15 @@ class DataCache {
     deleteCache(message_id) {
         this.cache.delete(message_id);
     }
+    // Idempotent: re-arming an already-running sweep is a no-op, so it is safe
+    // to call again on start() after a previous destroy().
     clearAtInterval() {
+        if (this.timer) {
+            return;
+        }
         // magic number，10s expired
         const clearIntervalMs = 10000;
-        setInterval(() => {
+        this.timer = setInterval(() => {
             const now = Date.now();
             this.cache.forEach((value, key) => {
                 var _a;
@@ -88920,6 +88946,20 @@ class DataCache {
                 }
             });
         }, clearIntervalMs);
+        // Don't let the sweep timer keep the Node process alive on its own; the
+        // process should be free to exit once nothing else references the loop.
+        if (typeof this.timer.unref === 'function') {
+            this.timer.unref();
+        }
+    }
+    // Stop the sweep timer and drop cached fragments. Called from
+    // WSClient.close() so the client releases its event-loop handle.
+    destroy() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = undefined;
+        }
+        this.cache.clear();
     }
 }
 
@@ -89454,6 +89494,7 @@ class WSClient {
             this.reconnectInterval = undefined;
         }
         this.clearLiveness();
+        this.dataCache.destroy();
         this.isConnecting = false;
         this.currentReconnectAttempts = 0;
         const wsInstance = this.wsConfig.getWSInstance();
@@ -89485,6 +89526,9 @@ class WSClient {
             // getConnectionStatus() reflects the fresh start.
             this.terminalError = false;
             this.currentReconnectAttempts = 0;
+            // Re-arm the cache sweep in case the client was previously close()d
+            // (which destroys the timer); idempotent when already running.
+            this.dataCache.clearAtInterval();
             this.logger.info('[ws]', `receive events or callbacks through persistent connection only available in self-build & Feishu app, Configured in:
         Developer Console(开发者后台)
           ->
@@ -89760,6 +89804,105 @@ class Aily {
     }
 }
 
+function assertPlainObject(value, path) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new Error(`${path} must be an object`);
+    }
+}
+/**
+ * The confirm page silently discards the whole payload on any shape mismatch,
+ * so unknown keys (typos, or sensitive manifest fields like `security`)
+ * must fail loudly here instead.
+ */
+function assertAllowedKeys(obj, allowed, path) {
+    for (const key of Object.keys(obj)) {
+        if (!allowed.includes(key)) {
+            throw new Error(`${path}.${key} is not allowed; allowed keys: ${allowed.join(', ')}`);
+        }
+    }
+}
+function validateStringArray(value, path) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!Array.isArray(value)) {
+        throw new Error(`${path} must be an array of strings`);
+    }
+    value.forEach((item, idx) => {
+        if (typeof item !== 'string' || item === '') {
+            throw new Error(`${path}[${idx}] must be a non-empty string`);
+        }
+    });
+    return value;
+}
+/**
+ * Validate the shape of `addons` and rebuild it from the 5 known public
+ * fields only, so nothing outside the whitelist can ever be serialized.
+ */
+function normalizeAddons(addons) {
+    assertPlainObject(addons, 'addons');
+    assertAllowedKeys(addons, ['scopes', 'events', 'callbacks'], 'addons');
+    let itemCount = 0;
+    const pick = (value, path) => {
+        var _a;
+        const items = validateStringArray(value, path);
+        itemCount += (_a = items === null || items === void 0 ? void 0 : items.length) !== null && _a !== void 0 ? _a : 0;
+        return items;
+    };
+    const normalized = {};
+    if (addons.scopes !== undefined) {
+        assertPlainObject(addons.scopes, 'addons.scopes');
+        assertAllowedKeys(addons.scopes, ['tenant', 'user'], 'addons.scopes');
+        normalized.scopes = {
+            tenant: pick(addons.scopes.tenant, 'addons.scopes.tenant'),
+            user: pick(addons.scopes.user, 'addons.scopes.user'),
+        };
+    }
+    if (addons.events !== undefined) {
+        assertPlainObject(addons.events, 'addons.events');
+        assertAllowedKeys(addons.events, ['items'], 'addons.events');
+        if (addons.events.items !== undefined) {
+            assertPlainObject(addons.events.items, 'addons.events.items');
+            assertAllowedKeys(addons.events.items, ['tenant', 'user'], 'addons.events.items');
+            normalized.events = {
+                items: {
+                    tenant: pick(addons.events.items.tenant, 'addons.events.items.tenant'),
+                    user: pick(addons.events.items.user, 'addons.events.items.user'),
+                },
+            };
+        }
+    }
+    if (addons.callbacks !== undefined) {
+        assertPlainObject(addons.callbacks, 'addons.callbacks');
+        assertAllowedKeys(addons.callbacks, ['items'], 'addons.callbacks');
+        normalized.callbacks = {
+            items: pick(addons.callbacks.items, 'addons.callbacks.items'),
+        };
+    }
+    // An all-empty addons is treated as "no addons" by the confirm page —
+    // passing one is always a caller bug, so surface it at build time.
+    if (itemCount === 0) {
+        throw new Error('addons must contain at least one scope, event or callback');
+    }
+    return normalized;
+}
+/**
+ * Validate `addons` and encode it into the URL-safe string carried by the
+ * `addons` query param of the one-click app creation / update link.
+ *
+ * Encoding pipeline (fixed by the platform):
+ * `JSON.stringify → gzip → base64 → URL-safe ('+' → '-', '/' → '_') → strip '=' padding`.
+ * The result only contains `A-Z a-z 0-9 - _` and needs no further escaping.
+ */
+function encodeAddons(addons) {
+    const json = JSON.stringify(normalizeAddons(addons));
+    return zlib.gzipSync(Buffer.from(json, 'utf8'))
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+}
+
 function createError(code, description) {
     return { code, description };
 }
@@ -89914,7 +90057,10 @@ function startPolling(ctx) {
 function registerApp(options) {
     var _a, _b, _c, _d;
     return __awaiter(this, void 0, void 0, function* () {
-        const { domain, source, signal, onQRCodeReady, onStatusChange, appPreset } = options;
+        const { domain, source, signal, onQRCodeReady, onStatusChange, appPreset, addons, createOnly, appId } = options;
+        if (appId !== undefined && (typeof appId !== 'string' || appId === '')) {
+            throw new Error('appId must be a non-empty string');
+        }
         const baseUrl = `https://${domain !== null && domain !== void 0 ? domain : DEFAULT_FEISHU_DOMAIN}`;
         const beginRes = yield begin(baseUrl);
         const qrCodeUrl = new URL(beginRes.verification_uri_complete);
@@ -89924,6 +90070,19 @@ function registerApp(options) {
         if (appPreset) {
             applyAppPreset(qrCodeUrl, appPreset);
         }
+        if (addons) {
+            qrCodeUrl.searchParams.set('addons', encodeAddons(addons));
+        }
+        // The landing page only honors the literal value 'true'; anything else is
+        // treated as absent, so the param is simply omitted in that case.
+        if (createOnly === true) {
+            qrCodeUrl.searchParams.set('createOnly', 'true');
+        }
+        // When both are present the page gives createOnly precedence and ignores
+        // clientID, so the two params can be passed through together as-is.
+        if (appId) {
+            qrCodeUrl.searchParams.set('clientID', appId);
+        }
         onQRCodeReady({
             url: qrCodeUrl.toString(),
             expireIn: (_a = beginRes.expires_in) !== null && _a !== void 0 ? _a : 600,
@@ -93688,9 +93847,11 @@ exports.CAppTicket = CAppTicket;
 exports.CTenantAccessToken = CTenantAccessToken;
 exports.CardActionHandler = CardActionHandler;
 exports.Client = Client;
+exports.DefaultCache = DefaultCache;
 exports.EventDispatcher = EventDispatcher;
 exports.LarkChannel = LarkChannel;
 exports.LarkChannelError = LarkChannelError;
+exports.LoggerProxy = LoggerProxy;
 exports.WSClient = WSClient;
 exports.adaptDefault = adaptDefault;
 exports.adaptExpress = adaptExpress;
@@ -93698,7 +93859,9 @@ exports.adaptKoa = adaptKoa;
 exports.adaptKoaRouter = adaptKoaRouter;
 exports.createLarkChannel = createLarkChannel;
 exports.defaultHttpInstance = defaultHttpInstance;
+exports.defaultLogger = defaultLogger;
 exports.generateChallenge = generateChallenge;
+exports.internalCache = internalCache;
 exports.messageCard = messageCard;
 exports.normalize = normalize;
 exports.normalizeBotAdded = normalizeBotAdded;