@senguoyun/dsh-arkme 0.1.39 → 0.1.40

package/lib/{persistent-runtime-DLrd2RMI.js → persistent-runtime-BDvChgZV.js}

@@ -27,6 +27,357 @@ var __exportAll = (all, no_symbols) => {
 	return target;
 };
 //#endregion
+//#region src/services/desktop-attention-bridge.ts
+const DESKTOP_BRIDGE_TIMEOUT_MS = 2e3;
+const DESKTOP_NOTIFICATION_RETRY_MS = 250;
+const MAX_NOTIFICATION_TITLE_LENGTH = 128;
+const MAX_NOTIFICATION_BODY_LENGTH = 512;
+const MAX_NATIVE_BADGE_COUNT = 999999;
+function nonEmptyBounded(value, maxLength) {
+	const normalized = value?.trim() ?? "";
+	return normalized !== "" && normalized.length <= maxLength ? normalized : void 0;
+}
+function isLoopbackHostname(hostname) {
+	return hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
+}
+/**
+* Resolve the native bridge only when the complete, client-injected contract is
+* present. Partial or non-loopback configuration is rejected as unavailable;
+* no credential is ever sent to a caller-controlled origin.
+*/
+function arkmeDesktopBridgeConfigFromEnv(env) {
+	const rawEndpoint = env.ARKME_DESKTOP_BRIDGE_URL?.trim() ?? "";
+	const token = nonEmptyBounded(env.ARKME_DESKTOP_BRIDGE_TOKEN, 512);
+	const sessionId = nonEmptyBounded(env.ARKME_DESKTOP_BRIDGE_SESSION_ID, 160);
+	if (rawEndpoint === "" && token === void 0 && sessionId === void 0) return void 0;
+	if (rawEndpoint === "" || token === void 0 || token.length < 16 || /\s/.test(token) || sessionId === void 0 || sessionId.length < 8 || !/^[A-Za-z0-9._:-]+$/.test(sessionId)) return void 0;
+	let endpoint;
+	try {
+		endpoint = new URL(rawEndpoint);
+	} catch {
+		return;
+	}
+	if (endpoint.protocol !== "http:" || !isLoopbackHostname(endpoint.hostname) || endpoint.port === "" || endpoint.username !== "" || endpoint.password !== "" || endpoint.pathname !== "/v1/actions" || endpoint.search !== "" || endpoint.hash !== "") return void 0;
+	return {
+		endpoint: endpoint.toString(),
+		token,
+		sessionId
+	};
+}
+function responseObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+async function requestArkmeDesktopBridge(config, fetchImpl, action, payload) {
+	const response = await fetchImpl(config.endpoint, {
+		method: "POST",
+		headers: {
+			authorization: `Bearer ${config.token}`,
+			"content-type": "application/json"
+		},
+		body: JSON.stringify({
+			schemaVersion: 1,
+			sessionId: config.sessionId,
+			action,
+			payload
+		}),
+		signal: AbortSignal.timeout(DESKTOP_BRIDGE_TIMEOUT_MS)
+	});
+	if (!response.ok) throw new Error(`desktop bridge returned HTTP ${String(response.status)}`);
+	const body = responseObject(await response.json());
+	const value = responseObject(body?.value);
+	if (body?.ok !== true || value === void 0) throw new Error("desktop bridge returned an invalid response");
+	return value;
+}
+function outcomeFromValue(value) {
+	if (typeof value.accepted !== "boolean") return void 0;
+	return value.outcome === "accepted" || value.outcome === "duplicate" || value.outcome === "unsupported" || value.outcome === "native-failed" || value.outcome === "expired" || value.outcome === "rate-limited" ? value.outcome : void 0;
+}
+var ArkmeDesktopAttentionBridge = class {
+	config;
+	fetchImpl;
+	capabilities;
+	badgeRevision = 0;
+	badgeSourceRevision = 0;
+	badgeGeneration;
+	lastBadgeCount;
+	badgeMutationTail = Promise.resolve();
+	constructor(config = arkmeDesktopBridgeConfigFromEnv(process.env), fetchImpl = fetch, badgeGeneration = Number(process.hrtime.bigint() / 1000n)) {
+		this.config = config;
+		this.fetchImpl = fetchImpl;
+		this.badgeGeneration = Number.isSafeInteger(badgeGeneration) && badgeGeneration > 0 ? badgeGeneration : Math.max(1, Date.now() * 1e3);
+	}
+	available() {
+		return this.config !== void 0;
+	}
+	async showNotification(payload) {
+		const capabilities = await this.readCapabilities(true);
+		if (capabilities?.notificationShow !== true) return {
+			fallbackToBrowser: true,
+			outcome: capabilities === void 0 ? "unavailable" : "unsupported"
+		};
+		const boundedPayload = {
+			...payload,
+			presentation: {
+				title: payload.presentation.title.trim().slice(0, MAX_NOTIFICATION_TITLE_LENGTH),
+				body: payload.presentation.body.trim().slice(0, MAX_NOTIFICATION_BODY_LENGTH)
+			}
+		};
+		for (let attempt = 0; attempt < 2; attempt += 1) {
+			try {
+				const outcome = outcomeFromValue(await this.request("notification.show", boundedPayload)) ?? "native-failed";
+				if (outcome !== "native-failed" || attempt > 0) return {
+					fallbackToBrowser: false,
+					outcome
+				};
+			} catch {
+				if (attempt > 0) return {
+					fallbackToBrowser: false,
+					outcome: "native-failed"
+				};
+			}
+			await new Promise((resolve) => {
+				setTimeout(resolve, DESKTOP_NOTIFICATION_RETRY_MS);
+			});
+		}
+		return {
+			fallbackToBrowser: false,
+			outcome: "native-failed"
+		};
+	}
+	async applyBadgeSummary(summary) {
+		const count = Math.min(MAX_NATIVE_BADGE_COUNT, Math.max(0, Math.trunc(Number.isFinite(summary.count) ? summary.count : 0)));
+		const revision = Math.trunc(summary.revision);
+		if (!Number.isSafeInteger(revision) || revision <= 0) return false;
+		const pending = this.badgeMutationTail.then(async () => await this.applyBadgeSnapshotSerial(count, revision));
+		this.badgeMutationTail = pending.then(() => void 0, () => void 0);
+		return await pending;
+	}
+	async resetBadgeCount() {
+		const pending = this.badgeMutationTail.then(async () => {
+			this.badgeGeneration += 1;
+			this.badgeRevision = 0;
+			this.badgeSourceRevision = 0;
+			this.lastBadgeCount = void 0;
+			for (let attempt = 0; attempt < 3; attempt += 1) if (await this.applyBadgeSnapshotSerial(0, 1)) return true;
+			return false;
+		});
+		this.badgeMutationTail = pending.then(() => void 0, () => void 0);
+		return await pending;
+	}
+	async applyBadgeSnapshotSerial(count, sourceRevision) {
+		if (sourceRevision < this.badgeSourceRevision || sourceRevision === this.badgeSourceRevision && count === this.lastBadgeCount) return true;
+		const capabilities = await this.readCapabilities();
+		if (capabilities === void 0) return this.config === void 0;
+		if (capabilities.badgeApplySnapshot.mode === "unsupported") return true;
+		const revision = Math.max(sourceRevision, this.badgeRevision + 1);
+		try {
+			const outcome = outcomeFromValue(await this.request("badge.applySnapshot", {
+				generation: this.badgeGeneration,
+				revision,
+				count
+			}));
+			if (outcome !== "accepted" && outcome !== "duplicate") return false;
+			this.badgeRevision = revision;
+			this.badgeSourceRevision = sourceRevision;
+			this.lastBadgeCount = count;
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	async readCapabilities(refresh = false) {
+		if (this.config === void 0) return void 0;
+		if (!refresh && this.capabilities !== void 0) return this.capabilities;
+		try {
+			const value = await this.request("capabilities.get", {});
+			if (value.schemaVersion !== 1 || value.sessionId !== this.config.sessionId) return void 0;
+			const capabilities = responseObject(value.capabilities);
+			const mode = responseObject(capabilities?.badgeApplySnapshot)?.mode;
+			if (capabilities?.notificationShow !== true && capabilities?.notificationShow !== false) return void 0;
+			if (mode !== "count" && mode !== "dot" && mode !== "unsupported") return void 0;
+			this.capabilities = {
+				notificationShow: capabilities.notificationShow,
+				badgeApplySnapshot: { mode }
+			};
+			return this.capabilities;
+		} catch {
+			return;
+		}
+	}
+	async request(action, payload) {
+		const config = this.config;
+		if (config === void 0) throw new Error("desktop bridge unavailable");
+		return await requestArkmeDesktopBridge(config, this.fetchImpl, action, payload);
+	}
+};
+//#endregion
+//#region src/account-session-owner.ts
+var ArkmeAccountSessionOwner = class {
+	store;
+	bridge;
+	bridgeRequired;
+	readyIdentity;
+	startTask;
+	mutationTail = Promise.resolve();
+	listeners = /* @__PURE__ */ new Set();
+	guestConversationProbe = async () => true;
+	scopeCloseBarrier = async () => void 0;
+	constructor(store, bridge, bridgeRequired = false) {
+		this.store = store;
+		this.bridge = bridge;
+		this.bridgeRequired = bridgeRequired;
+	}
+	start() {
+		this.startTask ??= this.attestCurrent();
+		return this.startTask;
+	}
+	attachGuestConversationProbe(probe) {
+		this.guestConversationProbe = probe;
+	}
+	attachScopeCloseBarrier(barrier) {
+		this.scopeCloseBarrier = barrier;
+	}
+	async write(session) {
+		await this.start();
+		await this.serial(async () => {
+			const current = await this.store.read();
+			if (current?.userId === session.userId) {
+				await this.store.write(session);
+				return;
+			}
+			const claimCurrentGuest = current === void 0 ? await this.guestConversationProbe() : void 0;
+			await this.transition({
+				kind: "account",
+				userId: session.userId,
+				...claimCurrentGuest === void 0 ? {} : { claimCurrentGuest }
+			}, async () => {
+				await this.store.write(session);
+			});
+		});
+	}
+	async delete() {
+		await this.start();
+		await this.serial(async () => {
+			if (await this.store.read() === void 0) return;
+			await this.transition({ kind: "guest" }, async () => {
+				await this.store.delete();
+			});
+		});
+	}
+	async scopedSession() {
+		if (this.startTask === void 0) return void 0;
+		await this.startTask;
+		const session = await this.store.read();
+		if (this.bridge === void 0 && !this.bridgeRequired) this.setReady(identityKey(session === void 0 ? { kind: "guest" } : {
+			kind: "account",
+			userId: session.userId
+		}));
+		return session !== void 0 && this.readyIdentity === identityKey({
+			kind: "account",
+			userId: session.userId
+		}) ? session : void 0;
+	}
+	ready() {
+		return this.readyIdentity !== void 0;
+	}
+	subscribe(listener) {
+		this.listeners.add(listener);
+		listener();
+		return () => {
+			this.listeners.delete(listener);
+		};
+	}
+	async attestCurrent() {
+		const session = await this.store.read();
+		const identity = session === void 0 ? { kind: "guest" } : {
+			kind: "account",
+			userId: session.userId
+		};
+		if (this.bridge === void 0) {
+			if (this.bridgeRequired) throw new Error("Arkme desktop account scope bridge is required");
+			this.setReady(identityKey(identity));
+			return;
+		}
+		const result = await this.bridge.attest(identity);
+		this.setReady(result.status === "ready" ? identityKey(identity) : void 0);
+	}
+	async transition(identity, mutate) {
+		if (this.bridge === void 0) {
+			if (this.bridgeRequired) throw new Error("Arkme desktop account scope bridge is required");
+			await mutate();
+			this.setReady(identityKey(identity));
+			return;
+		}
+		const previousIdentity = this.readyIdentity;
+		const prepared = await this.bridge.prepare(identity);
+		this.setReady(void 0);
+		try {
+			await this.scopeCloseBarrier();
+			await mutate();
+		} catch (error) {
+			try {
+				await this.bridge.abort(prepared.transitionRef);
+			} finally {
+				this.setReady(previousIdentity);
+			}
+			throw error;
+		}
+		const committed = await this.bridge.commit(prepared.transitionRef);
+		this.setReady(committed.status === "ready" ? identityKey(identity) : void 0);
+	}
+	async serial(action) {
+		const pending = this.mutationTail.then(action);
+		this.mutationTail = pending.catch(() => void 0);
+		await pending;
+	}
+	setReady(identity) {
+		if (this.readyIdentity === identity) return;
+		this.readyIdentity = identity;
+		for (const listener of this.listeners) listener();
+	}
+};
+function createArkmeAccountSessionOwner(store, fetchImpl, env = process.env) {
+	const required = env.ARKME_ACCOUNT_SCOPE_REQUIRED === "1";
+	const config = required ? arkmeDesktopBridgeConfigFromEnv(env) : void 0;
+	return new ArkmeAccountSessionOwner(store, config === void 0 ? void 0 : new HttpArkmeAccountScopeBridge(config, fetchImpl), required);
+}
+var HttpArkmeAccountScopeBridge = class {
+	config;
+	fetchImpl;
+	constructor(config, fetchImpl) {
+		this.config = config;
+		this.fetchImpl = fetchImpl;
+	}
+	async attest(identity) {
+		return status(await this.request("account.scope.attest", identity));
+	}
+	async prepare(identity) {
+		const value = await this.request("account.scope.prepare", identity);
+		const transitionRef = typeof value.transitionRef === "string" ? value.transitionRef : "";
+		if (!/^[A-Za-z0-9._:-]{8,160}$/.test(transitionRef)) throw new Error("Desktop account scope prepare response is invalid");
+		return { transitionRef };
+	}
+	async commit(transitionRef) {
+		return status(await this.request("account.scope.commit", { transitionRef }));
+	}
+	async abort(transitionRef) {
+		if (status(await this.request("account.scope.abort", { transitionRef })).status !== "ready") throw new Error("Desktop account scope abort response is invalid");
+		return { status: "ready" };
+	}
+	async request(action, payload) {
+		return await requestArkmeDesktopBridge(this.config, this.fetchImpl, action, payload);
+	}
+};
+function status(value) {
+	if (value.status !== "ready" && value.status !== "relaunch") throw new Error("Desktop account scope response is invalid");
+	return { status: value.status };
+}
+function identityKey(identity) {
+	if (identity.kind === "guest") return "guest";
+	if (!Number.isSafeInteger(identity.userId) || identity.userId <= 0) throw new Error("Arkme account scope identity is invalid");
+	return `account:${String(identity.userId)}`;
+}
+//#endregion
 //#region src/secret-value.ts
 var SecretValue = class {
 	#value;
@@ -38,15 +389,15 @@ var SecretValue = class {
 	}
 };
 //#endregion
-//#region src/managed-ai/credential.ts
+//#region src/managed-access-credential.ts
 const MAX_JWT_PAYLOAD_CHARS = 16 * 1024;
-/** Resolve the Host-owned bearer, refreshing a near-expiry JWT before it reaches the relay. */
+/** Resolve a current Host-owned Access credential without exposing refresh credentials to consumers. */
 async function resolveManagedAccessCredential(runtime, refreshWindowMillis = 6e4) {
 	let session = await runtime.requireSession();
 	if (managedAccessTokenExpiresWithin(session.accessToken, refreshWindowMillis)) session = await runtime.refreshAccessToken(session);
 	return new SecretValue(session.accessToken);
 }
-/** Treat a parseable JWT expiry as a refresh hint; opaque access tokens remain usable. */
+/** Treat a parseable JWT expiry as a refresh hint; opaque Access credentials remain usable. */
 function managedAccessTokenExpiresWithin(accessToken, windowMillis, nowMillis = Date.now()) {
 	const payload = accessToken.split(".")[1];
 	if (payload === void 0 || payload === "" || payload.length > MAX_JWT_PAYLOAD_CHARS) return false;
@@ -848,13 +1199,37 @@ var ServiceRuntime = class {
 	pendingSessionStore;
 	requestCoordinator = new ArkmeRequestCoordinator();
 	refreshInFlightByUserId = /* @__PURE__ */ new Map();
+	accountSessions;
 	pendingBindingSession;
-	constructor(config, sessionStore, stateStore, fetchImpl = fetch, pendingSessionStore) {
+	constructor(config, sessionStore, stateStore, fetchImpl = fetch, pendingSessionStore, accountSessions) {
 		this.config = config;
 		this.sessionStore = sessionStore;
 		this.stateStore = stateStore;
 		this.fetchImpl = fetchImpl;
 		this.pendingSessionStore = pendingSessionStore;
+		this.accountSessions = accountSessions ?? new ArkmeAccountSessionOwner(sessionStore);
+	}
+	async startAccountScope() {
+		await this.accountSessions.start();
+	}
+	attachGuestConversationProbe(probe) {
+		this.accountSessions.attachGuestConversationProbe(probe);
+	}
+	accountScopeReady() {
+		return this.accountSessions.ready();
+	}
+	subscribeAccountScope(listener) {
+		return this.accountSessions.subscribe(listener);
+	}
+	async accountScopedSession() {
+		await this.accountSessions.start();
+		return await this.accountSessions.scopedSession();
+	}
+	async writeSession(session) {
+		await this.accountSessions.write(session);
+	}
+	async deleteSession() {
+		await this.accountSessions.delete();
 	}
 	requestStats() {
 		return this.requestCoordinator.snapshotStats();
@@ -873,7 +1248,7 @@ var ServiceRuntime = class {
 		this.requestCoordinator.dispose();
 	}
 	async requireSession() {
-		const session = await this.sessionStore.read();
+		const session = await this.accountScopedSession();
 		if (session === void 0) throw new ArkmePluginError("login-required", "请先登录 Arkme", false, 401);
 		return session;
 	}
@@ -920,12 +1295,17 @@ var ServiceRuntime = class {
 					accessToken
 				};
 				if (this.isPendingBindingSession(session)) await this.writePendingBindingSession(updated);
-				else await this.sessionStore.write(updated);
+				else await this.writeSession(updated);
 				return updated;
 			} catch (error) {
-				if (error instanceof ArkmePluginError && ["auth-http-401", "auth-http-403"].includes(error.code)) {
+				if (error instanceof ArkmePluginError && error.code === "arkme-code-1004") {
 					if (this.isPendingBindingSession(session)) await this.clearPendingBindingSession();
 					else await this.sessionStore.delete();
+					throw new ArkmePluginError("account-unavailable", "当前即我账号暂不可用", false, 403);
+				}
+				if (error instanceof ArkmePluginError && ["auth-http-401", "auth-http-403"].includes(error.code)) {
+					if (this.isPendingBindingSession(session)) await this.clearPendingBindingSession();
+					else await this.deleteSession();
 					throw new ArkmePluginError("login-expired", "Arkme 登录已过期，请重新扫码", false, 401);
 				}
 				throw error;
@@ -11630,7 +12010,7 @@ function optionalString$3(value) {
 function optionalBooleanValue$1(value) {
 	return typeof value === "boolean" ? value : void 0;
 }
-function optionalRecord(value) {
+function optionalRecord$1(value) {
 	const record = objectValue$1(value);
 	return Object.keys(record).length === 0 ? void 0 : record;
 }
@@ -11755,7 +12135,7 @@ function arkoRunProjectionFromData(data) {
 	if (runUid === "" || status === "") return void 0;
 	const errorCode = stringValue$1(data.agent_run_error_code ?? data.error_code).trim();
 	const retryOfRunUid = stringValue$1(data.retry_of_run_uid).trim();
-	const clientAction = optionalRecord(data.agent_client_action ?? data.client_action);
+	const clientAction = optionalRecord$1(data.agent_client_action ?? data.client_action);
 	return {
 		runUid,
 		status,
@@ -11770,7 +12150,7 @@ function arkoCreatedRecordUids(value) {
 }
 function arkoStreamFrame(raw) {
 	try {
-		return optionalRecord(JSON.parse(raw));
+		return optionalRecord$1(JSON.parse(raw));
 	} catch {
 		return;
 	}
@@ -11930,7 +12310,7 @@ var ArkoService = class {
 		const normalizedRunUid = stringValue$1(data.run_uid).trim() || runUid.trim();
 		const sequence = numberValue$28(data.sequence);
 		const surfaceAssistantMsgId = numberValue$28(data.surface_assistant_msg_id);
-		const clientAction = optionalRecord(data.client_action);
+		const clientAction = optionalRecord$1(data.client_action);
 		if (normalizedRunUid !== runUid.trim() || !ARKO_RUN_STATUSES.has(status) || !Number.isSafeInteger(sequence) || sequence < 0 || !Number.isSafeInteger(surfaceAssistantMsgId) || surfaceAssistantMsgId <= 0) throw new ArkmePluginError("arko-run-status-contract-invalid", "Arko 运行状态响应不完整", true, 502);
 		return {
 			sessionId,
@@ -12116,12 +12496,12 @@ var ArkoService = class {
 				} else if (booleanValue$14(tail.error) || stringValue$1(tail.status).trim() === "error") status = "failed";
 				else status = ARKO_COMPLETED_STATUS;
 				createdRecordUids = arkoCreatedRecordUids(tail.created_record_uids);
-				const nextProfile = optionalRecord(tail.agent_profile);
+				const nextProfile = optionalRecord$1(tail.agent_profile);
 				if (nextProfile !== void 0) profile = arkoProfileFromData(nextProfile);
 				if (booleanValue$14(tail.error) || stringValue$1(tail.status).trim() === "error") errorMessage = stringValue$1(tail.error_message).trim() || "Arko 执行失败";
 			}
 			const type = stringValue$1(frame.type ?? frame.event).trim();
-			const payload = optionalRecord(frame.payload) ?? frame;
+			const payload = optionalRecord$1(frame.payload) ?? frame;
 			if (type === "message.delta") text += stringValue$1(payload.text ?? payload.content);
 			else if (type === "message.final") {
 				const finalText = stringValue$1(payload.text ?? payload.content);
@@ -12135,7 +12515,7 @@ var ArkoService = class {
 					status = doneRun.status;
 				} else status = ARKO_COMPLETED_STATUS;
 				createdRecordUids = arkoCreatedRecordUids(payload.created_record_uids);
-				const nextProfile = optionalRecord(payload.agent_profile);
+				const nextProfile = optionalRecord$1(payload.agent_profile);
 				if (nextProfile !== void 0) profile = arkoProfileFromData(nextProfile);
 			} else if (type === "error") {
 				terminal = true;
@@ -12624,7 +13004,7 @@ var AuthService = class {
 			this.runtime.invalidateScope(this.runtime.requestScope(userId));
 			this.runtime.clearRefreshForUser(userId);
 		}
-		await this.runtime.sessionStore.delete();
+		await this.runtime.deleteSession();
 		await this.runtime.clearPendingBindingSession();
 		this.profile.invalidate();
 		this.jiwoAttemptGeneration += 1;
@@ -12648,7 +13028,7 @@ var AuthService = class {
 			};
 			if (snapshot.status === "binding-required") {
 				await this.runtime.writePendingBindingSession(activeSession);
-				await this.runtime.sessionStore.delete();
+				await this.runtime.deleteSession();
 				this.lifecycle.reconnectChatRealtime();
 			}
 			return snapshot;
@@ -12930,12 +13310,12 @@ var AuthService = class {
 		const snapshot = await this.authSnapshotForSession(session, { forceProfile: true });
 		if (snapshot.status === "authenticated") {
 			await this.runtime.clearPendingBindingSession();
-			await this.runtime.sessionStore.write(session);
+			await this.runtime.writeSession(session);
 			this.lifecycle.reconnectChatRealtime();
 			return snapshot;
 		}
 		await this.runtime.writePendingBindingSession(session);
-		await this.runtime.sessionStore.delete();
+		await this.runtime.deleteSession();
 		this.lifecycle.reconnectChatRealtime();
 		return snapshot;
 	}
@@ -17051,187 +17431,6 @@ var ArkmeChatRealtimeRuntime = class {
 	}
 };
 //#endregion
-//#region src/services/desktop-attention-bridge.ts
-const DESKTOP_BRIDGE_TIMEOUT_MS = 2e3;
-const DESKTOP_NOTIFICATION_RETRY_MS = 250;
-const MAX_NOTIFICATION_TITLE_LENGTH = 128;
-const MAX_NOTIFICATION_BODY_LENGTH = 512;
-const MAX_NATIVE_BADGE_COUNT = 999999;
-function nonEmptyBounded(value, maxLength) {
-	const normalized = value?.trim() ?? "";
-	return normalized !== "" && normalized.length <= maxLength ? normalized : void 0;
-}
-function isLoopbackHostname(hostname) {
-	return hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
-}
-/**
-* Resolve the native bridge only when the complete, client-injected contract is
-* present. Partial or non-loopback configuration is rejected as unavailable;
-* no credential is ever sent to a caller-controlled origin.
-*/
-function arkmeDesktopBridgeConfigFromEnv(env) {
-	const rawEndpoint = env.ARKME_DESKTOP_BRIDGE_URL?.trim() ?? "";
-	const token = nonEmptyBounded(env.ARKME_DESKTOP_BRIDGE_TOKEN, 512);
-	const sessionId = nonEmptyBounded(env.ARKME_DESKTOP_BRIDGE_SESSION_ID, 160);
-	if (rawEndpoint === "" && token === void 0 && sessionId === void 0) return void 0;
-	if (rawEndpoint === "" || token === void 0 || token.length < 16 || /\s/.test(token) || sessionId === void 0 || sessionId.length < 8 || !/^[A-Za-z0-9._:-]+$/.test(sessionId)) return void 0;
-	let endpoint;
-	try {
-		endpoint = new URL(rawEndpoint);
-	} catch {
-		return;
-	}
-	if (endpoint.protocol !== "http:" || !isLoopbackHostname(endpoint.hostname) || endpoint.port === "" || endpoint.username !== "" || endpoint.password !== "" || endpoint.pathname !== "/v1/actions" || endpoint.search !== "" || endpoint.hash !== "") return void 0;
-	return {
-		endpoint: endpoint.toString(),
-		token,
-		sessionId
-	};
-}
-function responseObject(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-}
-function outcomeFromValue(value) {
-	if (typeof value.accepted !== "boolean") return void 0;
-	return value.outcome === "accepted" || value.outcome === "duplicate" || value.outcome === "unsupported" || value.outcome === "native-failed" || value.outcome === "expired" || value.outcome === "rate-limited" ? value.outcome : void 0;
-}
-var ArkmeDesktopAttentionBridge = class {
-	config;
-	fetchImpl;
-	capabilities;
-	badgeRevision = 0;
-	badgeSourceRevision = 0;
-	badgeGeneration;
-	lastBadgeCount;
-	badgeMutationTail = Promise.resolve();
-	constructor(config = arkmeDesktopBridgeConfigFromEnv(process.env), fetchImpl = fetch, badgeGeneration = Number(process.hrtime.bigint() / 1000n)) {
-		this.config = config;
-		this.fetchImpl = fetchImpl;
-		this.badgeGeneration = Number.isSafeInteger(badgeGeneration) && badgeGeneration > 0 ? badgeGeneration : Math.max(1, Date.now() * 1e3);
-	}
-	available() {
-		return this.config !== void 0;
-	}
-	async showNotification(payload) {
-		const capabilities = await this.readCapabilities(true);
-		if (capabilities?.notificationShow !== true) return {
-			fallbackToBrowser: true,
-			outcome: capabilities === void 0 ? "unavailable" : "unsupported"
-		};
-		const boundedPayload = {
-			...payload,
-			presentation: {
-				title: payload.presentation.title.trim().slice(0, MAX_NOTIFICATION_TITLE_LENGTH),
-				body: payload.presentation.body.trim().slice(0, MAX_NOTIFICATION_BODY_LENGTH)
-			}
-		};
-		for (let attempt = 0; attempt < 2; attempt += 1) {
-			try {
-				const outcome = outcomeFromValue(await this.request("notification.show", boundedPayload)) ?? "native-failed";
-				if (outcome !== "native-failed" || attempt > 0) return {
-					fallbackToBrowser: false,
-					outcome
-				};
-			} catch {
-				if (attempt > 0) return {
-					fallbackToBrowser: false,
-					outcome: "native-failed"
-				};
-			}
-			await new Promise((resolve) => {
-				setTimeout(resolve, DESKTOP_NOTIFICATION_RETRY_MS);
-			});
-		}
-		return {
-			fallbackToBrowser: false,
-			outcome: "native-failed"
-		};
-	}
-	async applyBadgeSummary(summary) {
-		const count = Math.min(MAX_NATIVE_BADGE_COUNT, Math.max(0, Math.trunc(Number.isFinite(summary.count) ? summary.count : 0)));
-		const revision = Math.trunc(summary.revision);
-		if (!Number.isSafeInteger(revision) || revision <= 0) return false;
-		const pending = this.badgeMutationTail.then(async () => await this.applyBadgeSnapshotSerial(count, revision));
-		this.badgeMutationTail = pending.then(() => void 0, () => void 0);
-		return await pending;
-	}
-	async resetBadgeCount() {
-		const pending = this.badgeMutationTail.then(async () => {
-			this.badgeGeneration += 1;
-			this.badgeRevision = 0;
-			this.badgeSourceRevision = 0;
-			this.lastBadgeCount = void 0;
-			for (let attempt = 0; attempt < 3; attempt += 1) if (await this.applyBadgeSnapshotSerial(0, 1)) return true;
-			return false;
-		});
-		this.badgeMutationTail = pending.then(() => void 0, () => void 0);
-		return await pending;
-	}
-	async applyBadgeSnapshotSerial(count, sourceRevision) {
-		if (sourceRevision < this.badgeSourceRevision || sourceRevision === this.badgeSourceRevision && count === this.lastBadgeCount) return true;
-		const capabilities = await this.readCapabilities();
-		if (capabilities === void 0) return this.config === void 0;
-		if (capabilities.badgeApplySnapshot.mode === "unsupported") return true;
-		const revision = Math.max(sourceRevision, this.badgeRevision + 1);
-		try {
-			const outcome = outcomeFromValue(await this.request("badge.applySnapshot", {
-				generation: this.badgeGeneration,
-				revision,
-				count
-			}));
-			if (outcome !== "accepted" && outcome !== "duplicate") return false;
-			this.badgeRevision = revision;
-			this.badgeSourceRevision = sourceRevision;
-			this.lastBadgeCount = count;
-			return true;
-		} catch {
-			return false;
-		}
-	}
-	async readCapabilities(refresh = false) {
-		if (this.config === void 0) return void 0;
-		if (!refresh && this.capabilities !== void 0) return this.capabilities;
-		try {
-			const value = await this.request("capabilities.get", {});
-			if (value.schemaVersion !== 1 || value.sessionId !== this.config.sessionId) return void 0;
-			const capabilities = responseObject(value.capabilities);
-			const mode = responseObject(capabilities?.badgeApplySnapshot)?.mode;
-			if (capabilities?.notificationShow !== true && capabilities?.notificationShow !== false) return void 0;
-			if (mode !== "count" && mode !== "dot" && mode !== "unsupported") return void 0;
-			this.capabilities = {
-				notificationShow: capabilities.notificationShow,
-				badgeApplySnapshot: { mode }
-			};
-			return this.capabilities;
-		} catch {
-			return;
-		}
-	}
-	async request(action, payload) {
-		const config = this.config;
-		if (config === void 0) throw new Error("desktop bridge unavailable");
-		const response = await this.fetchImpl(config.endpoint, {
-			method: "POST",
-			headers: {
-				authorization: `Bearer ${config.token}`,
-				"content-type": "application/json"
-			},
-			body: JSON.stringify({
-				schemaVersion: 1,
-				sessionId: config.sessionId,
-				action,
-				payload
-			}),
-			signal: AbortSignal.timeout(DESKTOP_BRIDGE_TIMEOUT_MS)
-		});
-		if (!response.ok) throw new Error(`desktop bridge returned HTTP ${String(response.status)}`);
-		const body = responseObject(await response.json());
-		const value = responseObject(body?.value);
-		if (body?.ok !== true || value === void 0) throw new Error("desktop bridge returned an invalid response");
-		return value;
-	}
-};
-//#endregion
 //#region src/services/chat-realtime-service.ts
 const MAX_PROJECTION_RETRIES = 5;
 const MAX_ATTENTION_SUMMARY_RETRIES = 5;
@@ -21997,6 +22196,17 @@ var ChatService = class {
 			}
 		}, session, options.signal);
 	}
+	async resolvePrivateChatPeer(sourceRef, signal) {
+		const session = await this.runtime.requireSession();
+		const source = await this.source.openSourceRef(sourceRef, session.userId);
+		if (source.kind !== "private_chat") throw new ArkmePluginError("user-ban-private-chat-required", "封禁操作仅支持一对一私聊用户", false);
+		const peerIds = [...new Set((await this.rawChatMembers(source.ownerRef, true, session, signal)).map((item) => Math.trunc(numberValue$19(item.user_id))).filter((userId) => Number.isSafeInteger(userId) && userId > 0 && userId !== session.userId))];
+		if (peerIds.length !== 1) throw new ArkmePluginError("user-ban-peer-invalid", "无法确认当前私聊用户，请刷新会话后重试", true, 409);
+		return {
+			userId: peerIds[0],
+			displayName: source.displayName
+		};
+	}
 	async rawChatMembers(chatSessionUid, activeOnly, session, signal) {
 		return listValue$16((await this.runtime.authenticatedChatPost("/api/v1/chats/members/list", {
 			chat_session_uid: chatSessionUid,
@@ -60595,6 +60805,78 @@ var VoiceprintService = class {
 	}
 };
 //#endregion
+//#region src/services/user-ban-service.ts
+function integer(value) {
+	if (typeof value === "number" && Number.isSafeInteger(value)) return value;
+	return 0;
+}
+function optionalRecord(raw, sourceRef, peer) {
+	const item = objectValue$1(raw);
+	if (Object.keys(item).length === 0) return void 0;
+	const userId = integer(item.user_id);
+	const status = integer(item.status);
+	const operatorId = integer(item.operator_id);
+	const bannedAtMillis = integer(item.banned_at);
+	const unbannedAtMillis = integer(item.unbanned_at);
+	const updatedAtMillis = integer(item.updated_at);
+	if (userId !== peer.userId || status !== 1 && status !== 2 || operatorId <= 0 || bannedAtMillis < 0 || unbannedAtMillis < 0 || updatedAtMillis <= 0 || status === 1 && bannedAtMillis <= 0 || status === 2 && unbannedAtMillis <= 0) throw new ArkmePluginError("user-ban-contract-invalid", "封禁服务返回的数据不完整", true, 502);
+	return {
+		sourceRef,
+		targetUserId: userId,
+		displayName: peer.displayName,
+		status: status === 1 ? "banned" : "unbanned",
+		operatorUserId: operatorId,
+		remark: stringValue$1(item.remark).trim(),
+		bannedAtMillis,
+		unbannedAtMillis,
+		updatedAtMillis
+	};
+}
+/** Owns employee-only user-ban behavior; Browser, SDK and Tools share this one path. */
+var UserBanService = class {
+	runtime;
+	peers;
+	constructor(runtime, peers) {
+		this.runtime = runtime;
+		this.peers = peers;
+	}
+	async status(sourceRef, signal) {
+		const peer = await this.peers.resolvePrivateChatPeer(sourceRef, signal);
+		const data = await this.runtime.authenticatedAuthReadPost("/api/v1/user-ban/status", { user_id: peer.userId }, void 0, signal, { bypassCache: true });
+		const exists = data.exists === true;
+		const record = optionalRecord(data.item, sourceRef, peer);
+		if (exists !== (record !== void 0) || data.banned !== (record?.status === "banned")) throw new ArkmePluginError("user-ban-contract-invalid", "封禁服务返回的数据不完整", true, 502);
+		return {
+			sourceRef,
+			targetUserId: peer.userId,
+			displayName: peer.displayName,
+			exists,
+			banned: record?.status === "banned",
+			...record === void 0 ? {} : { record }
+		};
+	}
+	async ban(sourceRef, remark = "", signal) {
+		return await this.setStatus(sourceRef, true, remark, signal);
+	}
+	async unban(sourceRef, remark = "", signal) {
+		return await this.setStatus(sourceRef, false, remark, signal);
+	}
+	async setStatus(sourceRef, banned, remarkInput, signal) {
+		const remark = remarkInput.trim();
+		if (Array.from(remark).length > 255) throw new ArkmePluginError("user-ban-remark-invalid", "封禁备注最多 255 个字符", false);
+		const peer = await this.peers.resolvePrivateChatPeer(sourceRef, signal);
+		const record = optionalRecord(await this.runtime.authenticatedAuthPost(banned ? "/api/v1/user-ban/ban" : "/api/v1/user-ban/unban", {
+			user_id: peer.userId,
+			remark
+		}, void 0, signal, {
+			bypassCache: true,
+			trackWriteOutcome: true
+		}), sourceRef, peer);
+		if (record === void 0 || record.status !== (banned ? "banned" : "unbanned")) throw new ArkmePluginError("user-ban-contract-invalid", "封禁服务返回的数据不完整", true, 502);
+		return record;
+	}
+};
+//#endregion
 //#region src/services/world-service.ts
 const ARKME_WORLD_IMAGE_REF_TTL_MILLIS = 900 * 1e3;
 const MAX_ARKME_WORLD_IMAGE_REFS = 2048;
@@ -61779,6 +62061,7 @@ var ArkmeService = class {
 	fetchImpl;
 	pendingSessionStore;
 	runtime;
+	accountScope;
 	billingGateway;
 	aiVideo;
 	arrangement;
@@ -61813,6 +62096,7 @@ var ArkmeService = class {
 	contactDirectory;
 	unmarkedSpeaker;
 	voiceprint;
+	userBan;
 	backgroundSoundPreferenceOwner;
 	fileTransfers;
 	localFileOpener;
@@ -61823,7 +62107,8 @@ var ArkmeService = class {
 		this.stateStore = stateStore;
 		this.fetchImpl = fetchImpl;
 		this.pendingSessionStore = pendingSessionStore;
-		this.runtime = new ServiceRuntime(config, sessionStore, stateStore, fetchImpl, pendingSessionStore);
+		this.accountScope = createArkmeAccountSessionOwner(sessionStore, fetchImpl);
+		this.runtime = new ServiceRuntime(config, sessionStore, stateStore, fetchImpl, pendingSessionStore, this.accountScope);
 		this.billingGateway = billingGateway ?? new HttpArkmeBillingGateway(this.runtime);
 		this.privacy = new ArkmePrivacyVisibilityService(this.runtime);
 		this.aiVideo = new AiVideoService(this.runtime);
@@ -61864,6 +62149,7 @@ var ArkmeService = class {
 		this.aiPolish = new GroupAiPolishService(this.runtime, this.source, { sendChatSourceTextRaw: async (...args) => await this.chat.sendChatSourceTextRaw(...args) });
 		this.realtime = new ChatRealtimeService(this.runtime, this.source, { chatTimelineItems: async (data, session, chatSessionUid) => await this.chat.chatTimelineItems(data, session, chatSessionUid) });
 		this.chat = new ChatService(this.runtime, this.source, this.profile, this.media, this.record, this.bot, this.arko, this.aiPolish, this.realtime, this.privacy, this.messageActions);
+		this.userBan = new UserBanService(this.runtime, this.chat);
 		this.botConversation = new BotConversationService(this.runtime, this.bot, this.chat, async () => {
 			await this.realtime.invalidateRecordProjection();
 		}, this.messageActions);
@@ -62134,6 +62420,7 @@ var ArkmeService = class {
 				sourceTextSend: true,
 				messageReadReceipts: true,
 				messageReport: true,
+				userBanManagement: true,
 				richContentRead: this.config.richMediaRenderEnabled !== false,
 				richContentSend: this.config.richMediaSendEnabled !== false,
 				...this.config.richMediaSendEnabled === false ? {} : { backgroundSound: true },
@@ -62530,6 +62817,15 @@ var ArkmeService = class {
 	async userCard(userId, signal) {
 		return await this.profile.userCard(userId, signal);
 	}
+	async userBanStatus(sourceRef, signal) {
+		return await this.userBan.status(sourceRef, signal);
+	}
+	async banPrivateChatUser(sourceRef, remark = "", signal) {
+		return await this.userBan.ban(sourceRef, remark, signal);
+	}
+	async unbanPrivateChatUser(sourceRef, remark = "", signal) {
+		return await this.userBan.unban(sourceRef, remark, signal);
+	}
 	async openPrivateChatFromUser(peerUserId, options = {}) {
 		return await this.chat.openPrivateChatFromUser(peerUserId, options);
 	}
@@ -64514,4 +64810,4 @@ async function invokePersistentArkmeExtension(extensionId, method, args) {
 	return jsonValue(await handler(jsonValue(args)));
 }
 //#endregion
-export { ARKME_VOICEPRINT_ENROLLMENT_MIN_DURATION_MS as $, inspectNativeBundleArtifactV3 as A, ARKME_EXTENSION_ICON_MAX_BYTES as B, ARKME_BUNDLE_MAX_BYTES as C, bundleSha256 as D, arkmeSandboxEntryId as E, assertExtensionArtifactSize as F, validateVoiceprintPcm16Wav as G, ARKME_EXTENSION_PREVIEW_MAX_BYTES as H, canonicalExtensionJson as I, arkmeRichBackgroundSound as J, isRecordingInstantOnOrAfterUnixEpoch as K, sha256Hex as L, packLocalNativeBundleDirectoryV3 as M, readNativeBundleTarballV3 as N, canonicalBundleJson as O, renderArkmeSandboxHostEntry as P, ARKME_VOICEPRINT_ENROLLMENT_MAX_DURATION_MS as Q, unpackArkmeExtension as R, ARKME_BUNDLE_ARTIFACT_KIND as S, ArkmeBundleArtifactError as T, ARKME_EXTENSION_RUNTIME_UNAVAILABLE_MESSAGE as U, ARKME_EXTENSION_MAX_BYTES as V, ArkmeService as W, ARKME_PROVIDER_CONTRACT_VERSION as X, ARKME_DEFAULT_SHARE_WEBSITE as Y, ARKME_VOICEPRINT_ENROLLMENT_MAX_AUDIO_BYTES as Z, arkmeClientContentDigest as _, persistentArkmeExtensionActive as a, arkmeNormalizedFileMimeType as at, verifyExtensionResolutionSignature as b, persistentExtensionBundleDirectory as c, recordingImportFileKind as ct, readPersistentExtensionActivation as d, ArkmePluginError as dt, ARKME_WORLD_PUBLISH_MAX_IMAGES as et, refreshPersistentClientWrapper as f, ArkmeOutgoingCallError as ft, activeProfileExtensionOwnerConflicts as g, renderArkmeBundleClientBundle as h, invokePersistentArkmeExtension as i, arkmeCanInlineLocalFile as it, packBundleFiles as j, inspectBundleArtifact as k, persistentExtensionPackageIdentity as l, sameRecordingImportIdentity as lt, writePersistentExtensionActivation as m, applyPersistentArkmeHostExtension as n, ARKME_RUNTIME_INSTANCE_ID as nt, persistentArkmeExtensionRuntimeState as o, arkmePickedFileKind as ot, repairPersistentExtensionInstallation as p, arkmeFileBackgroundSound as q, deactivatePersistentArkmeExtension as r, ARKME_TOOL_FILE_MAX_BYTES as rt, materializePersistentExtensionBundle as s, isArkmeBotAvatarRef as st, activatePersistentArkmeExtension as t, ARKME_WORLD_PUBLISH_MAX_IMAGE_BYTES as tt, quarantinePersistentExtension as u, MAX_RECORDING_IMPORT_BYTES as ut, arkmeClientContentDigestFromSource as v, ARKME_NATIVE_BUNDLE_ARTIFACT_KIND as w, verifyNativeBundleResolutionSignature as x, verifyBundleResolutionSignature as y, ARKME_EXTENSION_FORMAT as z };
+export { ARKME_VOICEPRINT_ENROLLMENT_MIN_DURATION_MS as $, inspectNativeBundleArtifactV3 as A, ARKME_EXTENSION_ICON_MAX_BYTES as B, ARKME_BUNDLE_MAX_BYTES as C, bundleSha256 as D, arkmeSandboxEntryId as E, assertExtensionArtifactSize as F, validateVoiceprintPcm16Wav as G, ARKME_EXTENSION_PREVIEW_MAX_BYTES as H, canonicalExtensionJson as I, arkmeRichBackgroundSound as J, isRecordingInstantOnOrAfterUnixEpoch as K, sha256Hex as L, packLocalNativeBundleDirectoryV3 as M, readNativeBundleTarballV3 as N, canonicalBundleJson as O, renderArkmeSandboxHostEntry as P, ARKME_VOICEPRINT_ENROLLMENT_MAX_DURATION_MS as Q, unpackArkmeExtension as R, ARKME_BUNDLE_ARTIFACT_KIND as S, ArkmeBundleArtifactError as T, ARKME_EXTENSION_RUNTIME_UNAVAILABLE_MESSAGE as U, ARKME_EXTENSION_MAX_BYTES as V, ArkmeService as W, ARKME_PROVIDER_CONTRACT_VERSION as X, ARKME_DEFAULT_SHARE_WEBSITE as Y, ARKME_VOICEPRINT_ENROLLMENT_MAX_AUDIO_BYTES as Z, arkmeClientContentDigest as _, persistentArkmeExtensionActive as a, arkmeNormalizedFileMimeType as at, verifyExtensionResolutionSignature as b, persistentExtensionBundleDirectory as c, recordingImportFileKind as ct, readPersistentExtensionActivation as d, ArkmePluginError as dt, ARKME_WORLD_PUBLISH_MAX_IMAGES as et, refreshPersistentClientWrapper as f, ArkmeOutgoingCallError as ft, activeProfileExtensionOwnerConflicts as g, renderArkmeBundleClientBundle as h, invokePersistentArkmeExtension as i, arkmeCanInlineLocalFile as it, packBundleFiles as j, inspectBundleArtifact as k, persistentExtensionPackageIdentity as l, sameRecordingImportIdentity as lt, writePersistentExtensionActivation as m, applyPersistentArkmeHostExtension as n, ARKME_RUNTIME_INSTANCE_ID as nt, persistentArkmeExtensionRuntimeState as o, arkmePickedFileKind as ot, repairPersistentExtensionInstallation as p, SecretValue as pt, arkmeFileBackgroundSound as q, deactivatePersistentArkmeExtension as r, ARKME_TOOL_FILE_MAX_BYTES as rt, materializePersistentExtensionBundle as s, isArkmeBotAvatarRef as st, activatePersistentArkmeExtension as t, ARKME_WORLD_PUBLISH_MAX_IMAGE_BYTES as tt, quarantinePersistentExtension as u, MAX_RECORDING_IMPORT_BYTES as ut, arkmeClientContentDigestFromSource as v, ARKME_NATIVE_BUNDLE_ARTIFACT_KIND as w, verifyNativeBundleResolutionSignature as x, verifyBundleResolutionSignature as y, ARKME_EXTENSION_FORMAT as z };