@sendbird/cli 0.0.0-stage → 0.4.0

package/dist/diagnostics.js

@@ -0,0 +1,664 @@
+import { permissionMatches } from "./acl.js";
+export { permissionMatches } from "./acl.js";
+import { proPermission } from "./pro-api.js";
+/** Read-only evidence collection. No SDK connection, Chat user token read, or mutation probe. */
+import { z } from "zod";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { readProject } from "./project.js";
+import { sdkConfigSchema } from "./sdk-config.js";
+import { CliError, encodeSegment, profile, request, } from "./core.js";
+import { definitions } from "./catalog.js";
+import { sdkDefinitions } from "./sdk-catalog.js";
+import { checkAppOrg, execute, context, transport, verify, } from "./runner.js";
+const status = z.enum(["allowed", "denied", "unknown"]);
+const checkSchema = z.object({
+    id: z.string(),
+    status,
+    source: z.string(),
+    reason: z.string(),
+});
+const observed = z.boolean().nullable();
+export const doctorSchema = z
+    .object({
+    ok: z.literal(true),
+    node: z.string(),
+    profile: z.string(),
+    environment: z.enum(["staging", "prod"]),
+    org_id: z.string().optional(),
+    app_id: z.string().optional(),
+    role: z.unknown().optional(),
+    application: z
+        .object({
+        name: z.string().nullable(),
+        region: z.string().nullable(),
+        family: z.enum(["standard", "delight"]).nullable(),
+    })
+        .nullable(),
+    checks: z.array(checkSchema),
+    assessment: z
+        .object({
+        command: z.string(),
+        status,
+        mutation_attempted: z.literal(false),
+        input_validated: z.literal(false),
+        resource_id: z.string().nullable(),
+        channel_type: z.string().nullable(),
+        actor_user_id: z.string().nullable(),
+        note: z.string(),
+    })
+        .nullable(),
+    subscription: z.object({
+        status: z.enum(["observed", "unavailable", "scope_unverified"]),
+        name: z.string().nullable(),
+        display_name: z.string().nullable(),
+        type: z.string().nullable(),
+        is_self_service_pro: observed,
+    }),
+    features: z.array(z.object({
+        feature: z.string(),
+        entitlement: observed,
+        reported_enabled: observed,
+        detail_snapshot: observed,
+        activation: z.enum([
+            "reported_enabled",
+            "reported_disabled",
+            "conflicting",
+            "unknown",
+        ]),
+        runtime_verified: z.literal(false),
+    })),
+    limits: z.array(z.object({
+        metric: z.string(),
+        included_units: z.number().nullable(),
+        configured_hard_limit: z.number().nullable(),
+        source: z.string(),
+    })),
+    app_capacity: z.object({
+        count: z.number().int().nonnegative().nullable(),
+        maximum: z.number().int().nonnegative().nullable(),
+        source: z.string(),
+    }),
+    regions: z.array(z.object({
+        id: z.string(),
+        family: z.enum(["standard", "delight"]),
+        available: observed,
+        chat: observed,
+        calls: observed,
+    })),
+    actor: z
+        .object({
+        user_id: z.string(),
+        active: observed,
+        membership: z.enum([
+            "joined",
+            "invited",
+            "absent",
+            "unknown",
+            "not_applicable",
+        ]),
+        membership_complete: z.boolean(),
+    })
+        .nullable(),
+    next: z.array(z.string()),
+})
+    .strict();
+const row = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : {};
+const text = (v) => (typeof v === "string" ? v : null);
+const bool = (v) => (typeof v === "boolean" ? v : null);
+const num = (v) => typeof v === "number" && Number.isFinite(v) ? v : null;
+const integer = (v) => Number.isSafeInteger(v) && Number(v) >= 0 ? Number(v) : null;
+const sourceRoot = "Gate reference ACL and explicit CLI safety prerequisites; server remains authoritative";
+export function commandPermissions(command, type) {
+    const proDefinition = definitions.find((d) => d.name === command);
+    const proRule = proDefinition && proPermission(proDefinition, type);
+    if (proRule)
+        return [proRule];
+    if (command === "org create")
+        return []; // Authenticated onboarding; no existing-org ACL.
+    if (command === "app create")
+        return ["organization.applications.all"];
+    if (command === "app feature set" ||
+        command === "app rename" ||
+        command === "app auth-policy set" ||
+        /^calls (settings .+ set|push (create|update|delete))$/.test(command))
+        return ["application.settings.all"];
+    if (command.startsWith("chat user ")) {
+        if (command === "chat user token get")
+            return ["application.users.all", "calls.studio.all"];
+        if (command === "chat user get")
+            return [
+                "application.users.view",
+                "moderation.openChannel.view",
+                "moderation.groupChannel.view",
+                "calls.studio.all",
+                "notifications.userInsights.view",
+            ];
+        if (command === "chat user list" || command === "chat user search")
+            return ["application.users.view", "notifications.campaign.view"];
+        if (/ (get|list|search)$/.test(command))
+            return ["application.users.view"];
+        if ([
+            "chat user delete",
+            "chat user activate",
+            "chat user deactivate",
+        ].includes(command))
+            return ["application.users.all"];
+        return ["application.users.all", "calls.studio.all"];
+    }
+    if (command.startsWith("chat channel ") &&
+        !sdkDefinitions.some((d) => d.name === command)) {
+        if (!["open", "group", "supergroup"].includes(type ?? ""))
+            return null;
+        const name = type === "open"
+            ? "openChannel"
+            : type === "group"
+                ? "groupChannel"
+                : "supergroupChannel";
+        return [
+            `moderation.${name}.${/ (get|list|search)$/.test(command) ? "view" : "all"}`,
+        ];
+    }
+    if (/^billing plan (list|check|change)$/.test(command))
+        return ["organization.general.all"];
+    // SDK authorization is not inherited from the Dashboard role. This is only
+    // the stricter Gate prerequisite for the CLI's memory-only user-token read.
+    if (sdkDefinitions.some((d) => d.name === command))
+        return ["application.users.all", "calls.studio.all"];
+    return null;
+}
+const featureKeys = [
+    ["supergroup", "supergroup", "super_group_channel"],
+    ["poll", "poll", "poll"],
+    ["delivery_receipt", "delivery_receipt", "delivery_receipt"],
+    ["reactions", "reactions", "reactions"],
+    ["translation_tools", "translation_tools", "auto_trans"],
+    ["image_moderation", "image_moderation", "image_moderation"],
+    ["profanity_filter", "profanity_filter", "profanity_filter"],
+    ["announcement", "announcement", "announcement"],
+    ["message_search", "message_search_index", "message_search_v3"],
+];
+export function featureEvidence(plan, detail, enabled) {
+    return featureKeys.map(([feature, key, legacy]) => {
+        let entitlement = bool(row(plan[key]).enabled);
+        if (feature === "message_search") {
+            const query = bool(row(plan.message_search_query).enabled);
+            entitlement =
+                entitlement === false || query === false
+                    ? false
+                    : entitlement === true && query === true
+                        ? true
+                        : null;
+        }
+        const a = bool(enabled[feature]), b = bool(detail[legacy]);
+        return {
+            feature,
+            entitlement,
+            reported_enabled: a,
+            detail_snapshot: b,
+            activation: a !== null && b !== null && a !== b
+                ? "conflicting"
+                : a === true
+                    ? "reported_enabled"
+                    : a === false
+                        ? "reported_disabled"
+                        : "unknown",
+            runtime_verified: false,
+        };
+    });
+}
+/** Read-only comparison of ./sendbird.json and ./sdk-config.json in the working directory with the diagnosed app. */
+export function projectContextChecks(cwd, appId, env) {
+    const out = [];
+    if (existsSync(join(cwd, "sendbird.json")))
+        try {
+            // existsSync passed, so readProject returns the parsed marker or throws.
+            const project = readProject(cwd);
+            if (appId && project.app_id !== appId)
+                out.push({
+                    id: "project_marker",
+                    status: "unknown",
+                    source: "./sendbird.json",
+                    reason: `The repository marker binds app ${project.app_id}, not the diagnosed app ${appId}; commands run with --project target the marker's app.`,
+                });
+            else
+                out.push({
+                    id: "project_marker",
+                    status: appId ? "allowed" : "unknown",
+                    source: "./sendbird.json",
+                    reason: appId
+                        ? `The repository marker binds the diagnosed app ${project.app_id}.`
+                        : `The repository marker binds app ${project.app_id}; no app was selected for comparison.`,
+                });
+        }
+        catch (e) {
+            out.push({
+                id: "project_marker",
+                status: "unknown",
+                source: "./sendbird.json",
+                reason: e.message,
+            });
+        }
+    if (existsSync(join(cwd, "sdk-config.json")))
+        try {
+            const parsed = sdkConfigSchema.safeParse(JSON.parse(readFileSync(join(cwd, "sdk-config.json"), "utf8")));
+            if (!parsed.success)
+                out.push({
+                    id: "project_sdk_config",
+                    status: "unknown",
+                    source: "./sdk-config.json",
+                    reason: "File is not an unmodified app sdk-config output; compare it manually with app sdk-config --raw.",
+                });
+            else if ((appId && parsed.data.app_id !== appId) ||
+                parsed.data.environment !== env)
+                out.push({
+                    id: "project_sdk_config",
+                    status: "unknown",
+                    source: "./sdk-config.json",
+                    reason: `Explicit SDK config binds app ${parsed.data.app_id} (${parsed.data.environment}, ${parsed.data.api_host}); SDK commands using --sdk-config-file connect there, not to app ${appId ?? "(unselected)"} on ${env}.`,
+                });
+            else
+                out.push({
+                    id: "project_sdk_config",
+                    status: appId ? "allowed" : "unknown",
+                    source: "./sdk-config.json",
+                    reason: appId
+                        ? `Explicit SDK config matches the diagnosed app (${parsed.data.api_host}).`
+                        : "SDK config is present, but no app was selected for comparison.",
+                });
+        }
+        catch {
+            out.push({
+                id: "project_sdk_config",
+                status: "unknown",
+                source: "./sdk-config.json",
+                reason: "File could not be parsed as JSON.",
+            });
+        }
+    return out;
+}
+export async function diagnose(opts, fields = {}, injected, cwd = process.cwd()) {
+    const command = fields.command?.replace(/^sendbird\s+/, "").trim();
+    const d = command
+        ? [...definitions, ...sdkDefinitions].find((d) => d.name === command)
+        : undefined;
+    if (command && !d)
+        throw new CliError("E_INPUT", "Unknown diagnostic command; use sendbird commands --compact", 2);
+    if (fields.type && !["open", "group", "supergroup"].includes(fields.type))
+        throw new CliError("E_INPUT", "--type must be open, group or supergroup", 2);
+    for (const [key, value] of Object.entries(fields))
+        if (value !== undefined &&
+            (typeof value !== "string" ||
+                value.length > 2048 ||
+                /[\x00-\x1f\x7f]/.test(value)))
+            throw new CliError("E_INPUT", `Invalid diagnostic ${key}`, 2);
+    const selected = context(opts), p = profile(selected.profile), t = injected ?? transport(selected);
+    if (t.env !== p.env)
+        throw new CliError("E_CONTEXT", "Diagnostic transport environment does not match profile", 5);
+    const who = await verify(t);
+    const organizations = who.organizations ?? (who.organization ? [who.organization] : []);
+    const sole = typeof who.organization?.uid === "string"
+        ? who.organization.uid
+        : organizations.length === 1
+            ? text(organizations[0].uid)
+            : undefined;
+    const orgId = selected.orgId ?? sole ?? null, appId = selected.appId ?? null;
+    const permissions = Array.isArray(row(who.role).permissions) &&
+        row(who.role).permissions instanceof Array
+        ? row(who.role).permissions.filter((v) => typeof v === "string")
+        : null;
+    const checks = [];
+    const add = (id, s, source, reason) => checks.push({ id, status: s, source, reason });
+    const read = async (path, app, query) => {
+        try {
+            return {
+                ok: true,
+                data: row(await request(t, { method: "GET", path, appId: app, query })),
+            };
+        }
+        catch (e) {
+            return {
+                ok: false,
+                code: e instanceof CliError ? e.code : "E_INTERNAL",
+            };
+        }
+    };
+    let org = {}, app = {}, plan = {}, enabled = {};
+    add("authentication", "allowed", "GET /dashboard/auth/verify2/", "Authenticated for the selected environment.");
+    const orgMember = orgId && organizations.some((o) => o.uid === orgId);
+    if (orgId && !orgMember)
+        add("organization", "denied", "GET /dashboard/auth/verify2/", "Selected organization was not returned for this account.");
+    else if (orgId) {
+        const r = await read(`/dashboard_api/organizations/${encodeSegment(orgId)}/`);
+        if (r.ok && r.data.uid === orgId) {
+            org = r.data;
+            add("organization", "allowed", "Organization detail", "Selected organization identity verified.");
+        }
+        else
+            add("organization", r.ok ? "unknown" : r.code === "E_PERMISSION" ? "denied" : "unknown", "Organization detail", r.ok
+                ? "Response has a different or missing organization UID."
+                : `Organization read failed: ${r.code}.`);
+    }
+    else
+        add("organization", "unknown", "Selected context", "Select an accessible organization.");
+    if (appId && orgMember && org.uid === orgId) {
+        try {
+            app = await checkAppOrg(t, appId, orgId);
+            add("application", "allowed", "GET application get_detail and organization binding", "Application belongs to the selected organization.");
+        }
+        catch (e) {
+            add("application", e instanceof CliError &&
+                ["E_PERMISSION", "E_CONTEXT", "E_NOT_FOUND"].includes(e.code)
+                ? "denied"
+                : "unknown", "Application identity/access", `Cannot verify selected app: ${e instanceof CliError ? e.code : "E_INTERNAL"}.`);
+        }
+    }
+    else if (appId)
+        add("application", "unknown", "Selected context", "Verify organization access before inspecting the app.");
+    const result = {
+        ok: true,
+        node: process.version,
+        profile: p.name,
+        environment: p.env,
+        org_id: orgId ?? undefined,
+        app_id: appId ?? undefined,
+        role: who.role,
+        application: app.app_id === appId
+            ? {
+                name: text(app.app_name),
+                region: text(app.region),
+                family: typeof app.is_delight_region === "boolean"
+                    ? app.is_delight_region
+                        ? "delight"
+                        : "standard"
+                    : null,
+            }
+            : null,
+        checks,
+        assessment: null,
+        subscription: {
+            status: "scope_unverified",
+            name: null,
+            display_name: null,
+            type: null,
+            is_self_service_pro: null,
+        },
+        features: [],
+        limits: [],
+        app_capacity: {
+            count: null,
+            maximum: integer(org.max_application_count),
+            source: "Organization max_application_count and account-scoped application list count",
+        },
+        regions: [],
+        actor: null,
+        next: [],
+    };
+    // Customer project files in the working directory are read-only, non-secret evidence.
+    for (const c of projectContextChecks(cwd, appId, p.env))
+        checks.push(c);
+    if (checks.some((c) => c.id.startsWith("project_") && c.status === "unknown"))
+        result.next.push("Compare project files with the intended app/environment before explicitly selecting --project or --sdk-config-file. These local files do not establish command denial or execution access.");
+    if (p.env === "staging" && appId)
+        result.next.push("Client code for this staging app must use its api_host/ws_host from app sdk-config --raw (customApiHost/customWebSocketHost); default SDK hosts reach production only.");
+    if (d?.method === "SDK")
+        result.next.push("For a failure reported from a customer project, compare its README, sendbird.json and any --sdk-config-file (app_id, api_host, ws_host) with app sdk-config before changing auth or moderation settings.");
+    if (orgId === sole && org.uid === orgId) {
+        const [sub, apps] = await Promise.all([
+            read("/dashboard_api/billing/subscriptions/info/", undefined, {
+                product: "CHAT",
+            }),
+            read("/dashboard/applications/", undefined, { limit: 1, offset: 0 }),
+        ]);
+        if (sub.ok) {
+            const current = row(sub.data.current_subscription);
+            plan = row(current.plan);
+            const name = text(current.subscription_name), kind = text(current.subscription_type);
+            result.subscription = {
+                status: "observed",
+                name,
+                display_name: text(current.display_name),
+                type: kind,
+                is_self_service_pro: name === null || kind === null
+                    ? null
+                    : kind !== "SELF_SERVE"
+                        ? false
+                        : /^plan_b_/.test(name)
+                            ? true
+                            : /^(plan_a_|developer$|free$|free_trial$)/.test(name)
+                                ? false
+                                : null,
+            };
+            add("subscription", name ? "allowed" : "unknown", "GET subscriptions/info?product=CHAT", name
+                ? "Organization Chat subscription observed; app.plan is not the organization tier."
+                : "No current subscription identity was returned.");
+            result.limits = [
+                "mau",
+                "pc",
+                "message_retention_period",
+                "file_storage",
+                "upload_traffic",
+            ].map((metric) => ({
+                metric,
+                included_units: num(row(plan[metric]).purchased_units),
+                configured_hard_limit: num(row(plan[metric]).hard_limit),
+                source: `current_subscription.plan.${metric}`,
+            }));
+        }
+        else {
+            result.subscription.status = "unavailable";
+            add("subscription", "unknown", "GET subscriptions/info?product=CHAT", `Subscription read failed: ${sub.code}; this does not prove that the feature is unavailable.`);
+        }
+        if (apps.ok && Array.isArray(apps.data.results)) {
+            const count = integer(apps.data.count);
+            result.app_capacity.count =
+                count !== null && count >= apps.data.results.length ? count : null;
+        }
+    }
+    else
+        add("subscription", "unknown", "Billing account scope", "Cannot bind account-scoped billing to the selected organization; skipped.");
+    for (const [key, family] of [
+        ["regions", "standard"],
+        ["delight_regions", "delight"],
+    ])
+        for (const [id, value] of Object.entries(row(org[key]))) {
+            const r = row(value), features = row(r.features), a = bool(r.allowed), b = bool(r.allow_app_creation);
+            result.regions.push({
+                id,
+                family,
+                available: a === false || b === false
+                    ? false
+                    : a === true && b === true
+                        ? true
+                        : null,
+                chat: bool(features.chat),
+                calls: bool(features.calls),
+            });
+        }
+    if (app.app_id === appId) {
+        const f = await read(`/dashboard_api/applications/${encodeSegment(appId)}/enabled_features/`);
+        if (f.ok)
+            enabled = f.data;
+        else
+            add("feature_read", "unknown", "GET application enabled_features", `Feature evidence unavailable: ${f.code}; not a denial of the requested operation.`);
+        result.features = featureEvidence(plan, row(app.current_premium_features), enabled);
+    }
+    if (command && d) {
+        const sdk = d.method === "SDK";
+        const required = commandPermissions(command, fields.type);
+        const usable = required?.filter((permission) => !permission.startsWith("calls.") || org.is_videochat_enabled === true);
+        add("implementation", "allowed", "Installed command catalog", "Command is implemented in this CLI build.");
+        if (required === null || permissions === null)
+            add("role", "unknown", sourceRoot, "No complete reference permission rule or role permission list is available.");
+        else if (required.length === 0)
+            add("role", "allowed", sourceRoot, "No existing-organization permission is required by this reference rule.");
+        else
+            add("role", usable?.some((req) => permissions.some((g) => permissionMatches(g, req)))
+                ? "allowed"
+                : "denied", sourceRoot, `Required any: ${required.join(", ")}. ${sdk ? "This is the CLI OAuth token-read prerequisite, not SDK user authorization." : "Additional server restrictions may apply."}`);
+        if (d.scope === "app" && !app.app_id)
+            add("target", "unknown", "Selected context", "Select and verify an application before executing this command.");
+        if (command === "app create") {
+            const { count, maximum } = result.app_capacity;
+            add("app_capacity", count === null || maximum === null
+                ? "unknown"
+                : count >= maximum
+                    ? "denied"
+                    : "allowed", result.app_capacity.source, count === null || maximum === null
+                ? "App capacity is not known."
+                : `${count} apps observed; configured maximum ${maximum}. This is a snapshot, not a reservation.`);
+            if (org.is_chat_paused === true)
+                add("chat_paused", "denied", "Organization detail", "Organization reports Chat paused.");
+            const region = fields.region ?? selected.region;
+            const candidates = result.regions.filter((r) => r.id === region && r.family === "standard");
+            add("region", !region || candidates.length !== 1 || candidates[0].available === null
+                ? "unknown"
+                : candidates[0].available
+                    ? "allowed"
+                    : "denied", "Organization regions", region
+                ? `Standard region ${region} is ${candidates[0]?.available === true ? "available" : "not confirmed available"}. Delight selection and Calls activation need their own execution checks.`
+                : "No intended creation region supplied.");
+        }
+        const needed = [];
+        if (fields.type === "supergroup")
+            needed.push("supergroup");
+        if (command.includes("poll"))
+            needed.push("poll");
+        if (command.endsWith("translate"))
+            needed.push("translation_tools");
+        for (const key of needed) {
+            const f = result.features.find((f) => f.feature === key);
+            add(`feature:${key}`, "unknown", "Subscription + enabled_features + get_detail", f
+                ? `Plan entitlement=${f.entitlement}; enabled API=${f.reported_enabled}; detail=${f.detail_snapshot}. Runtime not tested. Do not gate this operation on a false snapshot alone.`
+                : "No feature evidence is available.");
+        }
+        if (sdk) {
+            if (!fields.asUser)
+                add("sdk_actor", "unknown", "Diagnostic input", "Pass --as-user to inspect the actor. Doctor never connects or creates a Chat user.");
+            else if (app.app_id === appId) {
+                const r = await read(`/platform/v3/users/${encodeSegment(fields.asUser)}`, appId, { with_access_token: false });
+                result.actor = {
+                    user_id: fields.asUser,
+                    active: null,
+                    membership: fields.type === "open" ? "not_applicable" : "unknown",
+                    membership_complete: false,
+                };
+                if (r.ok && r.data.user_id === fields.asUser) {
+                    result.actor.active = bool(r.data.is_active);
+                    add("sdk_actor", result.actor.active === false ? "denied" : "allowed", "GET user without access token", "Actor identity observed. User token presence and SDK authentication are not checked.");
+                }
+                else
+                    add("sdk_actor", !r.ok && r.code === "E_NOT_FOUND" ? "denied" : "unknown", "GET user without access token", r.ok
+                        ? "Actor identity response mismatch."
+                        : `Actor read unavailable: ${r.code}. A forbidden diagnostic read is not proof of SDK denial.`);
+                if (fields.id && ["group", "supergroup"].includes(fields.type ?? "")) {
+                    const kind = fields.type === "supergroup"
+                        ? "supergroup_channels"
+                        : "group_channels";
+                    const detail = await read(`/platform/v3/${kind}/${encodeSegment(fields.id)}`, appId);
+                    if (detail.ok) {
+                        const completeIdentity = typeof detail.data.channel_url === "string" &&
+                            typeof detail.data.is_super === "boolean";
+                        if (!completeIdentity)
+                            add("channel_type", "unknown", "GET channel", "Channel response has missing or malformed identity/type fields; this is not proof of access denial.");
+                        else if (detail.data.channel_url !== fields.id ||
+                            detail.data.is_super !== (fields.type === "supergroup"))
+                            add("channel_type", "denied", "GET channel", "The channel identity/type does not match the requested target.");
+                    }
+                    let token;
+                    let found;
+                    let complete = false;
+                    const seen = new Set();
+                    for (let page = 0; page < 5; page++) {
+                        const members = await read(`/platform/v3/${kind}/${encodeSegment(fields.id)}/members`, appId, { limit: 100, ...(token ? { token } : {}) });
+                        if (!members.ok || !Array.isArray(members.data.members))
+                            break;
+                        found = members.data.members
+                            .map(row)
+                            .find((m) => m.user_id === fields.asUser);
+                        const next = text(members.data.next);
+                        if (members.data.next !== "" && !next)
+                            break;
+                        if (!next) {
+                            complete = true;
+                            break;
+                        }
+                        if (found)
+                            break;
+                        if (seen.has(next))
+                            break;
+                        seen.add(next);
+                        token = next;
+                    }
+                    result.actor.membership =
+                        found?.state === "joined"
+                            ? "joined"
+                            : found?.state === "invited"
+                                ? "invited"
+                                : found
+                                    ? "unknown"
+                                    : complete
+                                        ? "absent"
+                                        : "unknown";
+                    result.actor.membership_complete = complete;
+                    add("membership", found?.state === "joined"
+                        ? "allowed"
+                        : /^chat message (send|file|reply|update|delete)/.test(command) &&
+                            (found?.state === "invited" || (!found && complete))
+                            ? "denied"
+                            : "unknown", "Bounded Dashboard member pages", `Actor membership: ${result.actor.membership}. ${complete ? "Reached final page." : "Not a complete membership inventory."} Join/accept/leave/moderation have different SDK rules; no membership was changed.`);
+                }
+            }
+            add("sdk_authorization", "unknown", "SDK runtime", "No SDK connection or Chat user token read was performed. Sender/operator permissions and runtime feature support remain server decisions.");
+        }
+        let observedRead;
+        if (d.method === "GET" &&
+            !d.secret &&
+            (!d.scope || d.scope !== "app" || app.app_id === appId)) {
+            try {
+                // Reuse the real parser, target binding and response contract, for GETs
+                // only. Credential-bearing GETs and SDK connections are never probed.
+                await execute(d, {
+                    params: {
+                        ...(fields.id ? { id: fields.id } : {}),
+                        ...(fields.type ? { type: fields.type } : {}),
+                    },
+                }, selected, t);
+                observedRead = "allowed";
+                add("operation_read", "allowed", "Requested GET command", "The read completed with the real command contract. Reference ACL hints do not override this server result.");
+            }
+            catch (e) {
+                observedRead =
+                    e instanceof CliError &&
+                        ["E_PERMISSION", "E_CONTEXT", "E_NOT_FOUND"].includes(e.code)
+                        ? "denied"
+                        : "unknown";
+                add("operation_read", observedRead, "Requested GET command", `Read did not complete: ${e instanceof CliError ? e.code : "E_INTERNAL"}. Missing input, response mismatch and read failure remain distinct from feature availability.`);
+            }
+        }
+        const mutation = d.method === "SDK"
+            ? Boolean(d.mutates)
+            : d.method !== "GET";
+        if (mutation)
+            add("mutation_validation", "unknown", "Read-only preflight", "No mutation was attempted. Full payload, uniqueness, concurrency and final server authorization are not verified.");
+        result.assessment = {
+            command,
+            status: observedRead ??
+                (checks.some((c) => !c.id.startsWith("project_") && c.status === "denied")
+                    ? "denied"
+                    : "unknown"),
+            mutation_attempted: false,
+            input_validated: false,
+            resource_id: fields.id ?? null,
+            channel_type: fields.type ?? null,
+            actor_user_id: fields.asUser ?? null,
+            note: "Read-only evidence, not execution authorization. A successful diagnosis does not guarantee that the requested operation will succeed.",
+        };
+    }
+    if (!appId)
+        result.next.push("Select an application before diagnosing an app command.");
+    if (result.features.some((f) => f.activation === "conflicting"))
+        result.next.push("Feature sources disagree; compare sources and verify actual operation in an authorized test scenario.");
+    return doctorSchema.parse(result);
+}
+//# sourceMappingURL=diagnostics.js.map