@openclaw/feishu 2026.7.1-beta.2 → 2026.7.1-beta.4

package/dist/send-result-BMQw-YhV.js

@@ -0,0 +1,287 @@
+import { d as isRecord$1 } from "./accounts-Bs5uJ4h0.js";
+import { createMessageReceiptFromOutboundResults } from "openclaw/plugin-sdk/channel-outbound";
+import { isRecord, normalizeOptionalLowercaseString } from "openclaw/plugin-sdk/string-coerce-runtime";
+//#region extensions/feishu/src/card-interaction.ts
+const FEISHU_CARD_INTERACTION_VERSION = "ocf1";
+function isInteractionKind(value) {
+	return value === "button" || value === "quick" || value === "meta";
+}
+function isMetadataValue(value) {
+	return value === null || value === void 0 || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function createFeishuCardInteractionEnvelope(envelope) {
+	return {
+		oc: FEISHU_CARD_INTERACTION_VERSION,
+		...envelope
+	};
+}
+function buildFeishuCardActionTextFallback(event) {
+	const actionValue = event.action.value;
+	if (isRecord$1(actionValue)) {
+		if (typeof actionValue.text === "string") return actionValue.text;
+		if (typeof actionValue.command === "string") return actionValue.command;
+		return JSON.stringify(actionValue);
+	}
+	return String(actionValue);
+}
+function decodeFeishuCardAction(params) {
+	const { event, now = Date.now() } = params;
+	const actionValue = event.action.value;
+	if (!isRecord$1(actionValue) || actionValue.oc !== "ocf1") return {
+		kind: "legacy",
+		text: buildFeishuCardActionTextFallback(event)
+	};
+	if (!isInteractionKind(actionValue.k) || typeof actionValue.a !== "string" || !actionValue.a) return {
+		kind: "invalid",
+		reason: "malformed"
+	};
+	if (actionValue.q !== void 0 && typeof actionValue.q !== "string") return {
+		kind: "invalid",
+		reason: "malformed"
+	};
+	if (actionValue.m !== void 0) {
+		if (!isRecord$1(actionValue.m)) return {
+			kind: "invalid",
+			reason: "malformed"
+		};
+		for (const value of Object.values(actionValue.m)) if (!isMetadataValue(value)) return {
+			kind: "invalid",
+			reason: "malformed"
+		};
+	}
+	if (actionValue.c !== void 0) {
+		if (!isRecord$1(actionValue.c)) return {
+			kind: "invalid",
+			reason: "malformed"
+		};
+		if (actionValue.c.u !== void 0 && typeof actionValue.c.u !== "string") return {
+			kind: "invalid",
+			reason: "malformed"
+		};
+		if (actionValue.c.h !== void 0 && typeof actionValue.c.h !== "string") return {
+			kind: "invalid",
+			reason: "malformed"
+		};
+		if (actionValue.c.s !== void 0 && typeof actionValue.c.s !== "string") return {
+			kind: "invalid",
+			reason: "malformed"
+		};
+		if (actionValue.c.e !== void 0 && !Number.isFinite(actionValue.c.e)) return {
+			kind: "invalid",
+			reason: "malformed"
+		};
+		if (actionValue.c.t !== void 0 && actionValue.c.t !== "p2p" && actionValue.c.t !== "group") return {
+			kind: "invalid",
+			reason: "malformed"
+		};
+		if (typeof actionValue.c.e === "number" && actionValue.c.e < now) return {
+			kind: "invalid",
+			reason: "stale"
+		};
+		const expectedUser = actionValue.c.u?.trim();
+		if (expectedUser && expectedUser !== (event.operator.open_id ?? "").trim()) return {
+			kind: "invalid",
+			reason: "wrong_user"
+		};
+		const expectedChat = actionValue.c.h?.trim();
+		if (expectedChat && expectedChat !== (event.context.chat_id ?? "").trim()) return {
+			kind: "invalid",
+			reason: "wrong_conversation"
+		};
+	}
+	return {
+		kind: "structured",
+		envelope: actionValue
+	};
+}
+//#endregion
+//#region extensions/feishu/src/native-card.ts
+const FEISHU_CARD_TEMPLATES = /* @__PURE__ */ new Set([
+	"blue",
+	"green",
+	"red",
+	"orange",
+	"purple",
+	"indigo",
+	"wathet",
+	"turquoise",
+	"yellow",
+	"grey",
+	"carmine",
+	"violet",
+	"lime"
+]);
+function resolveFeishuCardTemplate(template) {
+	const normalized = normalizeOptionalLowercaseString(template);
+	if (!normalized || !FEISHU_CARD_TEMPLATES.has(normalized)) return;
+	return normalized;
+}
+function escapeFeishuCardMarkdownText(text) {
+	return text.replace(/[&<>]/g, (char) => {
+		switch (char) {
+			case "&": return "&amp;";
+			case "<": return "&lt;";
+			case ">": return "&gt;";
+			default: return char;
+		}
+	});
+}
+function escapeFeishuCardPlainText(text) {
+	return escapeFeishuCardMarkdownText(text).replace(/([\\`*_{}[\]()#+\-!|>~])/g, "\\$1");
+}
+function resolveSafeFeishuButtonUrl(url) {
+	const trimmed = typeof url === "string" ? url.trim() : "";
+	if (!trimmed) return;
+	try {
+		const parsed = new URL(trimmed);
+		return parsed.protocol === "https:" || parsed.protocol === "http:" ? trimmed : void 0;
+	} catch {
+		return;
+	}
+}
+function sanitizeNativeFeishuButtonBehavior(behavior) {
+	if (!isRecord(behavior)) return;
+	if (behavior.type === "open_url") {
+		const safeUrl = resolveSafeFeishuButtonUrl(behavior.default_url) ?? resolveSafeFeishuButtonUrl(behavior.url);
+		return safeUrl ? {
+			type: "open_url",
+			default_url: safeUrl
+		} : void 0;
+	}
+	if (behavior.type === "callback" && isRecord(behavior.value) && behavior.value.oc === "ocf1") return {
+		type: "callback",
+		value: behavior.value
+	};
+}
+function sanitizeNativeFeishuCardButton(button) {
+	if (!isRecord(button)) return;
+	const text = isRecord(button.text) && typeof button.text.content === "string" ? button.text.content : void 0;
+	if (!text?.trim()) return;
+	const style = button.type === "danger" ? "danger" : button.type === "primary" || button.type === "success" ? "primary" : void 0;
+	const behaviors = Array.isArray(button.behaviors) ? button.behaviors.map((behavior) => sanitizeNativeFeishuButtonBehavior(behavior)).filter((behavior) => Boolean(behavior)) : [];
+	const rootSafeUrl = resolveSafeFeishuButtonUrl(button.url);
+	if (rootSafeUrl) behaviors.push({
+		type: "open_url",
+		default_url: rootSafeUrl
+	});
+	if (isRecord(button.value) && button.value.oc === "ocf1") behaviors.push({
+		type: "callback",
+		value: button.value
+	});
+	if (behaviors.length === 0) return;
+	return {
+		tag: "button",
+		text: {
+			tag: "plain_text",
+			content: text
+		},
+		type: style === "danger" ? "danger" : style === "primary" ? "primary" : "default",
+		behaviors
+	};
+}
+function sanitizeNativeFeishuCardElements(element) {
+	if (!isRecord(element) || typeof element.tag !== "string") return [];
+	if (element.tag === "hr") return [{ tag: "hr" }];
+	if (element.tag === "markdown" && typeof element.content === "string") return [{
+		tag: "markdown",
+		content: escapeFeishuCardMarkdownText(element.content)
+	}];
+	if (element.tag === "div" && isRecord(element.text)) {
+		const text = element.text;
+		if (text.tag === "lark_md" && typeof text.content === "string") return [{
+			tag: "markdown",
+			content: escapeFeishuCardMarkdownText(text.content)
+		}];
+		if (text.tag === "plain_text" && typeof text.content === "string") return [{
+			tag: "markdown",
+			content: escapeFeishuCardPlainText(text.content)
+		}];
+		return [];
+	}
+	if (element.tag === "button") {
+		const button = sanitizeNativeFeishuCardButton(element);
+		return button ? [button] : [];
+	}
+	if (element.tag === "action" && Array.isArray(element.actions)) return element.actions.map((action) => sanitizeNativeFeishuCardButton(action)).filter((action) => Boolean(action));
+	return [];
+}
+function sanitizeNativeFeishuCard(card) {
+	const normalizedCard = card.type === "interactive" && isRecord(card.card) ? card.card : card;
+	const body = isRecord(normalizedCard.body) ? normalizedCard.body : void 0;
+	const elements = (Array.isArray(body?.elements) ? body.elements : Array.isArray(normalizedCard.elements) ? normalizedCard.elements : []).flatMap((element) => sanitizeNativeFeishuCardElements(element)).filter((element) => Boolean(element));
+	if (elements.length === 0) return;
+	const header = isRecord(normalizedCard.header) ? normalizedCard.header : void 0;
+	const title = isRecord(header?.title) && typeof header.title.content === "string" ? header.title.content : void 0;
+	return {
+		schema: "2.0",
+		config: { width_mode: "fill" },
+		...title?.trim() ? { header: {
+			title: {
+				tag: "plain_text",
+				content: title
+			},
+			template: resolveFeishuCardTemplate(typeof header?.template === "string" ? header.template : void 0) ?? "blue"
+		} } : {},
+		body: { elements }
+	};
+}
+function readNativeFeishuCardJson(text, options) {
+	let trimmed = text?.trim();
+	const responsePrefix = options?.responsePrefix;
+	if (trimmed && responsePrefix && trimmed.startsWith(responsePrefix)) {
+		const suffix = trimmed.slice(responsePrefix.length);
+		if (/^\s+\{/.test(suffix)) trimmed = suffix.trimStart();
+	}
+	if (!trimmed?.startsWith("{") || !trimmed.endsWith("}")) return;
+	try {
+		const parsed = JSON.parse(trimmed);
+		return isRecord(parsed) ? sanitizeNativeFeishuCard(parsed) : void 0;
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region extensions/feishu/src/send-result.ts
+function resolveFeishuReceiptKind(msgType) {
+	switch (msgType) {
+		case "audio": return "voice";
+		case "image":
+		case "media":
+		case "file": return "media";
+		case "interactive": return "card";
+		case "post":
+		case "text": return "text";
+		default: return "unknown";
+	}
+}
+function createFeishuSendReceipt(params) {
+	const messageId = params.messageId?.trim();
+	const chatId = params.chatId.trim();
+	return createMessageReceiptFromOutboundResults({
+		results: messageId ? [{
+			channel: "feishu",
+			messageId,
+			chatId,
+			conversationId: chatId
+		}] : [],
+		...chatId ? { threadId: chatId } : {},
+		kind: params.kind ?? "unknown"
+	});
+}
+function assertFeishuMessageApiSuccess(response, errorPrefix) {
+	if (response.code !== 0) throw new Error(`${errorPrefix}: ${response.msg || `code ${response.code}`}`);
+}
+function toFeishuSendResult(response, chatId, kind) {
+	const messageId = response.data?.message_id ?? "unknown";
+	return {
+		messageId,
+		chatId,
+		receipt: createFeishuSendReceipt({
+			messageId,
+			chatId,
+			kind
+		})
+	};
+}
+//#endregion
+export { readNativeFeishuCardJson as a, FEISHU_CARD_INTERACTION_VERSION as c, decodeFeishuCardAction as d, toFeishuSendResult as i, buildFeishuCardActionTextFallback as l, createFeishuSendReceipt as n, resolveFeishuCardTemplate as o, resolveFeishuReceiptKind as r, sanitizeNativeFeishuCard as s, assertFeishuMessageApiSuccess as t, createFeishuCardInteractionEnvelope as u };

package/dist/{session-conversation-CZSMgac-.js → session-conversation-BYuoVJwl.js}

@@ -1,4 +1,4 @@
-import { r as parseFeishuConversationId, t as buildFeishuConversationId } from "./conversation-id-DuL575sn.js";
+import { r as parseFeishuConversationId, t as buildFeishuConversationId } from "./conversation-id-CdLdoot3.js";
 //#region extensions/feishu/src/session-conversation.ts
 function resolveFeishuParentConversationCandidates(rawId) {
 	const parsed = parseFeishuConversationId({ conversationId: rawId });

package/dist/session-key-api.js

@@ -1,2 +1,2 @@
-import { t as resolveFeishuSessionConversation } from "./session-conversation-CZSMgac-.js";
+import { t as resolveFeishuSessionConversation } from "./session-conversation-BYuoVJwl.js";
 export { resolveFeishuSessionConversation as resolveSessionConversation };

package/dist/setup-api.js

@@ -1,2 +1,2 @@
-import { i as feishuSetupAdapter, n as feishuSetupWizard, t as feishuPlugin } from "./channel-Bwm5rvHg.js";
+import { i as feishuSetupAdapter, n as feishuSetupWizard, t as feishuPlugin } from "./channel-DwCydAeD.js";
 export { feishuPlugin, feishuSetupAdapter, feishuSetupWizard };

package/dist/{subagent-hooks-1pqt5tAA.js → subagent-hooks-B2iWPYJ1.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
 import { r as normalizeFeishuTarget } from "./targets-BUjQ1TcA.js";
-import { r as parseFeishuConversationId, t as buildFeishuConversationId } from "./conversation-id-DuL575sn.js";
+import { r as parseFeishuConversationId, t as buildFeishuConversationId } from "./conversation-id-CdLdoot3.js";
 import { n as getFeishuThreadBindingManager } from "./thread-bindings-V0bwk0A1.js";
 import { normalizeOptionalLowercaseString, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/feishu/src/subagent-hooks.ts

package/dist/subagent-hooks-api.js

@@ -1,6 +1,6 @@
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 //#region extensions/feishu/subagent-hooks-api.ts
-const loadFeishuSubagentHooksModule = createLazyRuntimeModule(() => import("./subagent-hooks-1pqt5tAA.js").then((n) => n.i));
+const loadFeishuSubagentHooksModule = createLazyRuntimeModule(() => import("./subagent-hooks-B2iWPYJ1.js").then((n) => n.i));
 function registerFeishuSubagentHooks(api) {
 	api.on("subagent_delivery_target", async (event) => {
 		const { handleFeishuSubagentDeliveryTarget } = await loadFeishuSubagentHooksModule();

package/node_modules/@larksuiteoapi/node-sdk/README.md

@@ -681,6 +681,38 @@ try {
 }
 ```
 
+#### Custom scopes/events/callbacks (addons) and updating an existing app
+
+When creating an app, use `addons` to **incrementally** request scopes, event subscriptions and callbacks on top of the platform base template. They are pre-filled into the confirm page shown after the user scans the QR code, and take effect once the user confirms:
+
+```typescript
+// Create: incrementally request scopes/events/callbacks, and only allow
+// creating a new app (selecting an existing app is disabled)
+const result = await lark.registerApp({
+    addons: {
+        scopes: { tenant: ['im:message:send_as_bot'], user: ['calendar:calendar:read'] },
+        events: { items: { tenant: ['im.message.receive_v1'] } },
+        callbacks: { items: ['card.action.trigger'] },
+    },
+    createOnly: true,
+    onQRCodeReady(info) { /* ... */ },
+});
+
+// Update: pass the appId of an existing app to let the user re-scan and
+// confirm, incrementally granting scopes to that app
+await lark.registerApp({
+    appId: 'cli_xxx',
+    addons: { scopes: { tenant: ['drive:drive.metadata:readonly'] } },
+    onQRCodeReady(info) { /* ... */ },
+});
+```
+
+Notes:
+
+- `addons` is **additive only**: items are merged on top of the base template; base permissions can never be removed.
+- Only the 5 public config types (tenant/user scopes, tenant/user events, callbacks) are supported. Sensitive config (event subscription type and request URLs, `security.*`, encrypt keys, etc.) cannot travel via `addons` — use the [update application config OpenAPI](https://open.feishu.cn/document/uAjLw4CM/ukTMukTMukTM/application-v7/application-v7/application-config/patch) instead.
+- The SDK only validates the shape, not the item names; names unknown to the platform catalog are silently ignored by the confirm page.
+
 #### `registerApp` parameters
 
 | Parameter | Description | Type | Required | Default |
@@ -695,6 +727,14 @@ try {
 | appPreset.avatar | App avatar URL(s). 1-6 URLs supported; the first one is selected by default. Allowed formats: png / jpg / jpeg / webp / gif (gif is sampled to a single frame, not animated) | string \| string[] | No | - |
 | appPreset.name | App name. Supports the `{user}` placeholder (replaced with the scanning user's name) | string | No | - |
 | appPreset.desc | App description. Supports the `{user}` placeholder | string | No | - |
+| addons | Incremental scopes/events/callbacks pre-filled into the confirm page, effective after user confirmation. See "Custom scopes/events/callbacks" above | AppAddons | No | - |
+| addons.scopes.tenant | App-identity (tenant) scopes, e.g. `im:message:send_as_bot` | string[] | No | - |
+| addons.scopes.user | User-identity scopes, e.g. `calendar:calendar:read` | string[] | No | - |
+| addons.events.items.tenant | App-identity events, e.g. `im.message.receive_v1` | string[] | No | - |
+| addons.events.items.user | User-identity events, e.g. `calendar.calendar.event.changed_v4` | string[] | No | - |
+| addons.callbacks.items | Callbacks, e.g. `card.action.trigger` | string[] | No | - |
+| createOnly | When `true`, the landing page only allows creating a new app — the "select existing app" entry is hidden, preventing accidental overwrite of an existing app's config. Takes precedence over `appId` when both are set | boolean | No | - |
+| appId | App ID (`cli_` prefix) of an existing app. When set, the flow updates that app's config: the confirm page shows the diff brought by `addons` and the user explicitly re-authorizes. Ignored when `createOnly` is `true` — the page still runs the create-new-app flow | string | No | - |
 
 #### Return value
 

package/node_modules/@larksuiteoapi/node-sdk/README.zh.md

@@ -743,6 +743,36 @@ try {
 }
 ```
 
+#### 自定义权限/事件/回调（addons）与更新已有应用
+
+创建应用时，可通过 `addons` 在平台基础模板上**增量**申请权限、事件订阅和回调，这些配置会预填到用户扫码后的确认页中，用户确认后生效：
+
+```typescript
+// 创建：增量申请权限/事件/回调，且只允许创建新应用（不可选择已有应用）
+const result = await lark.registerApp({
+    addons: {
+        scopes: { tenant: ['im:message:send_as_bot'], user: ['calendar:calendar:read'] },
+        events: { items: { tenant: ['im.message.receive_v1'] } },
+        callbacks: { items: ['card.action.trigger'] },
+    },
+    createOnly: true,
+    onQRCodeReady(info) { /* ... */ },
+});
+
+// 更新：传入已有应用的 appId，让用户重新扫码确认，为该应用增量开通权限
+await lark.registerApp({
+    appId: 'cli_xxx',
+    addons: { scopes: { tenant: ['drive:drive.metadata:readonly'] } },
+    onQRCodeReady(info) { /* ... */ },
+});
+```
+
+注意：
+
+- `addons` 仅支持在基础模板上**增量叠加**，不支持删减基础权限。
+- 仅支持 5 类公开配置（应用/用户身份权限、应用/用户身份事件、回调）。敏感配置（事件订阅方式与回调地址、`security.*`、加密 key 等）不能通过 `addons` 传入，需调用[更新应用开发配置 OpenAPI](https://open.feishu.cn/document/uAjLw4CM/ukTMukTMukTM/application-v7/application-v7/application-config/patch)。
+- SDK 只校验数据形状，不校验权限点/事件/回调名称是否存在；平台目录中不存在的名称会被确认页忽略。
+
 #### `registerApp`参数
 
 | 参数             | 描述                                                                                       | 类型          | 必须 | 默认                       |
@@ -757,6 +787,14 @@ try {
 | appPreset.avatar | 应用头像 URL，支持 1-6 个；传多个时默认选中第一个。支持 png / jpg / jpeg / webp / gif（gif 自动取一帧，不保留动图）           | string \| string[] | 否  | -                |
 | appPreset.name | 应用名称，支持 `{user}` 占位符（替换为扫码用户名称）                                                              | string      | 否  | -                        |
 | appPreset.desc | 应用描述，支持 `{user}` 占位符                                                                          | string      | 否  | -                        |
+| addons         | 增量权限/事件/回调配置，预填到扫码后的确认页，用户确认后生效。详见上方「自定义权限/事件/回调」                                              | AppAddons   | 否  | -                        |
+| addons.scopes.tenant | 应用身份权限列表，如 `im:message:send_as_bot`                                                          | string[]    | 否  | -                        |
+| addons.scopes.user | 用户身份权限列表，如 `calendar:calendar:read`                                                            | string[]    | 否  | -                        |
+| addons.events.items.tenant | 应用身份事件列表，如 `im.message.receive_v1`                                                      | string[]    | 否  | -                        |
+| addons.events.items.user | 用户身份事件列表，如 `calendar.calendar.event.changed_v4`                                           | string[]    | 否  | -                        |
+| addons.callbacks.items | 回调列表，如 `card.action.trigger`                                                                  | string[]    | 否  | -                        |
+| createOnly     | 为 `true` 时落地页仅允许创建新应用，隐藏「选择已有应用」入口，避免误选已有应用导致其配置被覆盖。与 `appId` 同时传入时优先级更高                          | boolean     | 否  | -                        |
+| appId          | 已有应用的 App ID（`cli_` 开头）。传入后流程变为更新该应用的配置：确认页展示 `addons` 带来的权限 diff，用户确认后生效。`createOnly` 为 `true` 时被忽略，仍走创建新应用流程 | string      | 否  | -                        |
 
 #### 返回值