@xdxer/dingtalk-agent 0.1.4-beta.8 → 0.1.4-beta.9

package/dist/src/multica-provider.js

@@ -0,0 +1,685 @@
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync, } from 'node:fs';
+import { dirname, join, relative, resolve } from 'node:path';
+import { WORKSPACE_STATE_ROOT, inspectAgentProject, showDevelopmentWorkspace, } from './development-workspace.js';
+import { digest, stableStringify } from './events.js';
+export const MULTICA_EVIDENCE_ROOT = '.dingtalk-agent/development-workspace-evidence';
+export const MULTICA_BOOT_SKILL = 'dingtalk-agent-boot-multica';
+class MulticaReadFailure extends Error {
+    category;
+    constructor(category) {
+        super(category);
+        this.category = category;
+    }
+}
+export function planMulticaWorkspace(start, name, options = {}) {
+    const target = resolveMulticaTarget(start, name, options.env || process.env, options.cliVersion || '', options.agentIdOverride);
+    const state = target.workspace.state;
+    const expected = {
+        workspaceId: target.workspaceId,
+        runtimeId: target.runtimeId,
+        agentId: target.agentId,
+        skills: [...target.skills].sort(),
+    };
+    const observed = {
+        workspaceId: state?.binding.remoteWorkspaceId || '',
+        runtimeId: state?.binding.runtimeId || '',
+        agentId: state?.binding.agentId || '',
+        skillSetHash: state?.binding.observedSkillSetHash || '',
+    };
+    const expectedSkillSetHash = digest(stableStringify(expected.skills));
+    const diff = [];
+    if (observed.workspaceId !== expected.workspaceId)
+        diff.push('workspace.scope');
+    if (observed.runtimeId !== expected.runtimeId)
+        diff.push('runtime.binding');
+    if (expected.agentId) {
+        if (observed.agentId !== expected.agentId)
+            diff.push('agent.binding');
+    }
+    else if (!observed.agentId)
+        diff.push('agent.create');
+    if (observed.skillSetHash !== expectedSkillSetHash)
+        diff.push('skills.assignments');
+    const operations = readOperations(target);
+    const planId = `multica_plan_${digest(stableStringify({
+        workspace: name,
+        desiredHash: target.workspace.desiredHash,
+        expected,
+        observed,
+        diff: [...diff].sort(),
+        blocking: [...target.blocking].sort(),
+        operations,
+    })).slice(0, 24)}`;
+    return {
+        $schema: 'dingtalk-agent/multica-workspace-plan@1',
+        planId,
+        workspace: name,
+        provider: 'multica',
+        profile: target.profile,
+        desiredHash: target.workspace.desiredHash,
+        currentState: target.workspace.status,
+        expected,
+        observed,
+        diff: [...diff].sort(),
+        blocking: [...target.blocking].sort(),
+        operations,
+        writes: [],
+        remoteRead: false,
+        remoteWrite: false,
+        sideEffect: false,
+        dingtalkSideEffect: false,
+    };
+}
+export function inspectMulticaWorkspace(start, name, options = {}) {
+    const plan = planMulticaWorkspace(start, name, options);
+    if (!options.execute)
+        return plan;
+    requireReadConfirmation(options, 'workspace inspect');
+    if (plan.blocking.length) {
+        throw new Error(`Multica inspect 前置条件不完整: ${plan.blocking.join(', ')}`);
+    }
+    return executeInspection(start, name, plan, options, options.persist !== false);
+}
+export function listMulticaWorkspaceResources(start, name, options = {}) {
+    const plan = planMulticaWorkspace(start, name, options);
+    if (!options.execute)
+        return plan;
+    requireReadConfirmation(options, 'workspace remote-list');
+    if (plan.blocking.length) {
+        throw new Error(`Multica remote-list 前置条件不完整: ${plan.blocking.join(', ')}`);
+    }
+    const inspection = executeInspection(start, name, plan, options, false);
+    return {
+        $schema: 'dingtalk-agent/multica-workspace-resource-list@1',
+        passed: inspection.passed,
+        workspace: inspection.workspace,
+        provider: 'multica',
+        profile: inspection.profile,
+        inspectionId: inspection.inspectionId,
+        resources: inspection.resources,
+        failures: inspection.failures,
+        calls: inspection.calls,
+        remoteRead: true,
+        remoteWrite: false,
+        sideEffect: 'remote-read',
+        dingtalkSideEffect: false,
+    };
+}
+export function statusMulticaWorkspace(start, name, cliVersion = '') {
+    const info = inspectAgentProject(start, cliVersion);
+    const workspace = requireMulticaWorkspace(info.root, name, cliVersion);
+    const latestPath = latestPointerPath(info.root, name);
+    if (!existsSync(latestPath))
+        return emptyStatus(workspace);
+    const pointer = readJsonObject(latestPath, 'Multica inspection latest pointer');
+    if (pointer.$schema !== 'dingtalk-agent/multica-inspection-pointer@1') {
+        throw new Error('Multica inspection latest pointer schema 非法');
+    }
+    const evidencePath = stringField(pointer.evidencePath, 'pointer.evidencePath');
+    const reportPath = safeProjectPath(info.root, evidencePath, true);
+    const reportSource = readFileSync(reportPath, 'utf8');
+    const evidenceIntegrity = sha256(reportSource) === stringField(pointer.reportHash, 'pointer.reportHash');
+    const report = JSON.parse(reportSource);
+    if (report.$schema !== 'dingtalk-agent/multica-workspace-inspection@1' || report.workspace !== name) {
+        throw new Error('Multica inspection report 与 Workspace 不匹配');
+    }
+    assertRedacted(report);
+    const state = workspace.state;
+    const stateMatched = Boolean(evidenceIntegrity && report.passed && state &&
+        state.provider === 'multica' && ['verifying', 'ready'].includes(state.status) &&
+        state.desiredHash === workspace.desiredHash && state.observedHash === report.observedHash &&
+        state.binding.inspectionId === report.inspectionId &&
+        state.binding.evidencePath === evidencePath);
+    return {
+        $schema: 'dingtalk-agent/multica-workspace-status@1',
+        workspace: name,
+        provider: 'multica',
+        available: true,
+        inspectionId: report.inspectionId,
+        passed: report.passed,
+        readyForApply: report.readyForApply && stateMatched,
+        providerReady: false,
+        evidencePath,
+        evidenceIntegrity,
+        stateMatched,
+        desiredHash: workspace.desiredHash,
+        observedHash: report.observedHash,
+        diff: [...report.diff],
+        failures: [...report.failures],
+        remoteRead: false,
+        remoteWrite: false,
+        sideEffect: false,
+        dingtalkSideEffect: false,
+    };
+}
+function executeInspection(start, name, plan, options, persist) {
+    const env = options.env || process.env;
+    const target = resolveMulticaTarget(start, name, env, options.cliVersion || '', options.agentIdOverride);
+    const command = options.command || env.DTA_MULTICA_BIN || 'multica';
+    const timeoutMs = positiveTimeout(options.timeoutMs);
+    if (persist) {
+        const plannedEvidence = options.out || join(MULTICA_EVIDENCE_ROOT, safeName(name), 'multica-inspections', 'planned.json');
+        safeProjectPath(target.root, plannedEvidence, false);
+        latestPointerPath(target.root, name);
+        safeProjectPath(target.root, join(WORKSPACE_STATE_ROOT, `${name}.json`), false);
+    }
+    const calls = [];
+    const failures = [];
+    const diff = [];
+    let cliVersion = '';
+    let principalHash = '';
+    let serverHash = '';
+    let resources = emptyResources();
+    try {
+        const version = runRead(command, ['--version'], 'cli.version', target.root, env, timeoutMs, calls);
+        cliVersion = parseMulticaVersion(version.stdout || version.stderr);
+        const config = runRead(command, profileArgs(target, ['config', 'show']), 'profile.config', target.root, env, timeoutMs, calls);
+        const parsedConfig = parseConfig(config.stdout, target.profile);
+        serverHash = parsedConfig.server ? digest(parsedConfig.server) : '';
+        if (parsedConfig.workspaceId && parsedConfig.workspaceId !== target.workspaceId) {
+            throw new MulticaReadFailure('scope.profile-workspace-mismatch');
+        }
+        const auth = runRead(command, profileArgs(target, ['auth', 'status']), 'auth.status', target.root, env, timeoutMs, calls);
+        const principal = parseAuth(auth.stdout + '\n' + auth.stderr);
+        if (!principal)
+            throw new MulticaReadFailure('auth.not-authenticated');
+        principalHash = digest(principal);
+        const workspaceList = jsonArray(runRead(command, profileArgs(target, ['workspace', 'list', '--output', 'json']), 'workspace.list', target.root, env, timeoutMs, calls).stdout, 'workspace list');
+        const workspaceMatches = workspaceList.filter((item) => idOf(item) === target.workspaceId);
+        if (workspaceMatches.length !== 1)
+            throw new MulticaReadFailure('scope.workspace-list-mismatch');
+        const workspaceGet = jsonObject(runRead(command, profileArgs(target, ['workspace', 'get', target.workspaceId, '--output', 'json']), 'workspace.get', target.root, env, timeoutMs, calls).stdout, 'workspace get');
+        if (idOf(workspaceGet) !== target.workspaceId) {
+            throw new MulticaReadFailure('scope.workspace-get-mismatch');
+        }
+        resources.workspace = {
+            id: resourceId(idOf(workspaceGet), 'workspace.id'),
+            name: safeDisplay(workspaceGet.name),
+            slug: safeDisplay(workspaceGet.slug),
+        };
+        const runtimes = jsonArray(runRead(command, scopedArgs(target, ['runtime', 'list', '--output', 'json']), 'runtime.list', target.root, env, timeoutMs, calls).stdout, 'runtime list');
+        const runtimeMatches = runtimes.filter((item) => idOf(item) === target.runtimeId);
+        if (runtimeMatches.length !== 1)
+            throw new MulticaReadFailure('scope.runtime-mismatch');
+        const runtime = runtimeMatches[0];
+        const runtimeWorkspace = optionalField(runtime.workspace_id);
+        if (runtimeWorkspace && runtimeWorkspace !== target.workspaceId) {
+            throw new MulticaReadFailure('scope.runtime-workspace-mismatch');
+        }
+        resources.runtime = {
+            id: resourceId(idOf(runtime), 'runtime.id'),
+            workspaceId: runtimeWorkspace || target.workspaceId,
+            name: safeDisplay(runtime.name),
+            provider: safeDisplay(runtime.provider),
+            status: safeDisplay(runtime.status),
+        };
+        const agents = jsonArray(runRead(command, scopedArgs(target, ['agent', 'list', '--include-archived', '--output', 'json']), 'agent.list', target.root, env, timeoutMs, calls).stdout, 'agent list');
+        resources.agentCandidates = agents
+            .filter((item) => optionalField(item.name) === target.projectName)
+            .map((item) => ({
+            id: resourceId(idOf(item), 'agent candidate.id'),
+            name: safeDisplay(item.name),
+            archived: Boolean(optionalField(item.archived_at)),
+        }))
+            .sort((a, b) => a.id.localeCompare(b.id));
+        const catalog = jsonArray(runRead(command, scopedArgs(target, ['skill', 'list', '--output', 'json']), 'skill.list', target.root, env, timeoutMs, calls).stdout, 'skill list');
+        resources.catalogSkills = catalog.map((item) => ({
+            id: resourceId(idOf(item), 'skill.id'),
+            workspaceId: optionalField(item.workspace_id) || target.workspaceId,
+            name: safeDisplay(item.name),
+        })).sort(compareNamedResource);
+        if (resources.catalogSkills.some((item) => item.workspaceId !== target.workspaceId)) {
+            throw new MulticaReadFailure('scope.skill-workspace-mismatch');
+        }
+        if (target.agentId) {
+            const agentMatches = agents.filter((item) => idOf(item) === target.agentId);
+            if (agentMatches.length !== 1)
+                throw new MulticaReadFailure('scope.agent-list-mismatch');
+            const agent = jsonObject(runRead(command, scopedArgs(target, ['agent', 'get', target.agentId, '--output', 'json']), 'agent.get', target.root, env, timeoutMs, calls).stdout, 'agent get');
+            const agentWorkspace = optionalField(agent.workspace_id);
+            const agentRuntime = optionalField(agent.runtime_id);
+            if (idOf(agent) !== target.agentId || agentWorkspace !== target.workspaceId ||
+                agentRuntime !== target.runtimeId) {
+                throw new MulticaReadFailure('scope.agent-binding-mismatch');
+            }
+            resources.agent = {
+                id: target.agentId,
+                workspaceId: agentWorkspace,
+                runtimeId: agentRuntime,
+                name: safeDisplay(agent.name),
+                status: safeDisplay(agent.status),
+                archived: Boolean(optionalField(agent.archived_at)),
+            };
+            const assigned = jsonArray(runRead(command, scopedArgs(target, ['agent', 'skills', 'list', target.agentId, '--output', 'json']), 'agent.skills', target.root, env, timeoutMs, calls).stdout, 'agent skills list');
+            resources.assignedSkills = assigned.map((item) => ({
+                id: resourceId(idOf(item), 'assigned skill.id'),
+                name: safeDisplay(item.name),
+                enabled: item.enabled === undefined ? true : Boolean(item.enabled),
+            })).sort(compareNamedResource);
+        }
+        else if (resources.agentCandidates.length > 0) {
+            throw new MulticaReadFailure('agent.unbound-name-candidates');
+        }
+        else {
+            diff.push('agent.create');
+        }
+        for (const name of target.skills) {
+            const candidates = resources.catalogSkills.filter((item) => item.name === name);
+            if (candidates.length > 1)
+                throw new MulticaReadFailure(`skills.duplicate:${name}`);
+            if (candidates.length === 0) {
+                diff.push(`skill.create:${name}`);
+                continue;
+            }
+            if (target.agentId && !resources.assignedSkills.some((item) => item.id === candidates[0].id && item.enabled)) {
+                diff.push(`skill.assign:${name}`);
+            }
+        }
+    }
+    catch (error) {
+        failures.push(error instanceof MulticaReadFailure ? error.category : 'provider.read-failed');
+    }
+    const canonical = {
+        cliVersion,
+        profile: target.profile,
+        principalHash,
+        serverHash,
+        expected: plan.expected,
+        resources,
+    };
+    const observedHash = digest(stableStringify(canonical));
+    const passed = failures.length === 0;
+    const inspectionId = `multica_inspect_${digest(stableStringify({
+        desiredHash: target.workspace.desiredHash,
+        observedHash,
+        passed,
+        diff: [...diff].sort(),
+        failures,
+    })).slice(0, 24)}`;
+    const defaultEvidencePath = join(MULTICA_EVIDENCE_ROOT, safeName(name), 'multica-inspections', `${inspectionId}.json`);
+    const evidencePath = options.out
+        ? relative(target.root, safeProjectPath(target.root, options.out, false))
+        : defaultEvidencePath;
+    const report = {
+        $schema: 'dingtalk-agent/multica-workspace-inspection@1',
+        passed,
+        readyForApply: passed,
+        providerReady: false,
+        inspectionId,
+        workspace: name,
+        provider: 'multica',
+        profile: target.profile,
+        cliVersion,
+        desiredHash: target.workspace.desiredHash,
+        observedHash,
+        expected: plan.expected,
+        auth: { authenticated: Boolean(principalHash), principalHash, serverHash },
+        resources,
+        diff: [...diff].sort(),
+        failures: [...failures].sort(),
+        calls,
+        evidencePath,
+        remoteRead: true,
+        remoteWrite: false,
+        sideEffect: 'remote-read',
+        dingtalkSideEffect: false,
+    };
+    assertRedacted(report);
+    if (persist)
+        persistInspection(target, plan, report);
+    return report;
+}
+function persistInspection(target, plan, report) {
+    const reportPath = safeProjectPath(target.root, report.evidencePath, false);
+    atomicJson(reportPath, report);
+    const reportSource = readFileSync(reportPath, 'utf8');
+    const pointer = {
+        $schema: 'dingtalk-agent/multica-inspection-pointer@1',
+        inspectionId: report.inspectionId,
+        evidencePath: report.evidencePath,
+        reportHash: sha256(reportSource),
+    };
+    atomicJson(latestPointerPath(target.root, target.workspace.name), pointer);
+    if (!report.passed)
+        return;
+    const expectedSkillSetHash = digest(stableStringify([...target.skills].sort()));
+    const observedSkillSetHash = digest(stableStringify(report.resources.assignedSkills
+        .filter((item) => item.enabled).map((item) => item.name).sort()));
+    const state = {
+        $schema: 'dingtalk-agent/workspace-state@1',
+        workspace: target.workspace.name,
+        provider: 'multica',
+        status: 'verifying',
+        binding: {
+            profile: target.profile,
+            remoteWorkspaceId: target.workspaceId,
+            runtimeId: target.runtimeId,
+            agentId: target.agentId,
+            cliVersion: report.cliVersion,
+            principalHash: report.auth.principalHash,
+            serverHash: report.auth.serverHash,
+            inspectionId: report.inspectionId,
+            evidencePath: report.evidencePath,
+            sourceHash: target.workspace.sourceHash,
+            expectedSkillSetHash,
+            observedSkillSetHash,
+        },
+        desiredHash: target.workspace.desiredHash,
+        observedHash: report.observedHash,
+        lastPlanId: plan.planId,
+        lastReceiptId: '',
+        lastEvalId: '',
+    };
+    atomicJson(safeProjectPath(target.root, join(WORKSPACE_STATE_ROOT, `${target.workspace.name}.json`), false), state);
+}
+function resolveMulticaTarget(start, name, env, cliVersion, agentIdOverride = '') {
+    const info = inspectAgentProject(start, cliVersion);
+    const workspace = requireMulticaWorkspace(info.root, name, cliVersion);
+    const provider = workspace.provider;
+    const blocking = [];
+    const resolveRef = (ref, label, optional = false) => {
+        if (!ref)
+            return '';
+        const variable = ref.startsWith('env:') ? ref.slice(4) : '';
+        const value = variable ? String(env[variable] || '').trim() : '';
+        if (!value) {
+            if (!optional)
+                blocking.push(label);
+            return '';
+        }
+        try {
+            return resourceId(value, label);
+        }
+        catch {
+            blocking.push(`${label}.invalid`);
+            return '';
+        }
+    };
+    const workspaceId = resolveRef(provider.workspaceIdFrom, 'workspace-id');
+    const runtimeId = resolveRef(provider.runtimeIdFrom, 'runtime-id');
+    let agentId = '';
+    if (agentIdOverride) {
+        try {
+            agentId = resourceId(agentIdOverride, 'agent-id-override');
+        }
+        catch {
+            blocking.push('agent-id-override.invalid');
+        }
+    }
+    else if (provider.agentIdFrom)
+        agentId = resolveRef(provider.agentIdFrom, 'agent-id');
+    else if (workspace.state?.binding.agentId) {
+        try {
+            agentId = resourceId(workspace.state.binding.agentId, 'state.agent-id');
+        }
+        catch {
+            blocking.push('state.agent-id.invalid');
+        }
+    }
+    return {
+        root: info.root,
+        projectName: info.project.name,
+        skills: [...new Set([...info.project.skills, MULTICA_BOOT_SKILL])].sort(),
+        workspace,
+        profile: provider.profile,
+        workspaceId,
+        runtimeId,
+        agentId,
+        blocking,
+    };
+}
+function requireMulticaWorkspace(start, name, cliVersion) {
+    const workspace = showDevelopmentWorkspace(start, name, cliVersion);
+    if (workspace.provider.kind !== 'multica' || workspace.legacy) {
+        throw new Error(`Workspace ${name} 不是 multica Provider；W3 不执行 ${workspace.provider.kind}`);
+    }
+    return workspace;
+}
+function readOperations(target) {
+    const operations = [
+        { id: 'cli.version', argv: ['--version'] },
+        { id: 'profile.config', argv: profileArgs(target, ['config', 'show']) },
+        { id: 'auth.status', argv: profileArgs(target, ['auth', 'status']) },
+        { id: 'workspace.list', argv: profileArgs(target, ['workspace', 'list', '--output', 'json']) },
+        { id: 'workspace.get', argv: profileArgs(target, ['workspace', 'get', target.workspaceId || '<workspace-id>', '--output', 'json']) },
+        { id: 'runtime.list', argv: scopedArgs(target, ['runtime', 'list', '--output', 'json']) },
+        { id: 'agent.list', argv: scopedArgs(target, ['agent', 'list', '--include-archived', '--output', 'json']) },
+        { id: 'skill.list', argv: scopedArgs(target, ['skill', 'list', '--output', 'json']) },
+    ];
+    if (target.agentId)
+        operations.push({ id: 'agent.get', argv: scopedArgs(target, ['agent', 'get', target.agentId, '--output', 'json']) }, { id: 'agent.skills', argv: scopedArgs(target, ['agent', 'skills', 'list', target.agentId, '--output', 'json']) });
+    return operations;
+}
+function profileArgs(target, args) {
+    return ['--profile', target.profile, ...args];
+}
+function scopedArgs(target, args) {
+    return ['--profile', target.profile, '--workspace-id', target.workspaceId || '<workspace-id>', ...args];
+}
+function runRead(command, argv, id, cwd, env, timeoutMs, calls) {
+    const run = spawnSync(command, argv, {
+        cwd,
+        env,
+        encoding: 'utf8',
+        timeout: timeoutMs,
+        maxBuffer: 16 * 1024 * 1024,
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    const stdout = String(run.stdout || '');
+    const stderr = String(run.stderr || '');
+    const exitCode = typeof run.status === 'number' ? run.status : 1;
+    const passed = !run.error && exitCode === 0;
+    calls.push({
+        id,
+        argv: argv.map(safeArg),
+        exitCode,
+        stdoutHash: sha256(stdout),
+        stderrHash: sha256(stderr),
+        passed,
+    });
+    if (!passed)
+        throw new MulticaReadFailure(`command.${id}`);
+    return { stdout, stderr };
+}
+function parseMulticaVersion(value) {
+    const match = value.match(/\bmultica\s+([0-9]+\.[0-9]+\.[0-9]+(?:[-+][A-Za-z0-9.-]+)?)/i);
+    if (!match)
+        throw new MulticaReadFailure('cli.version-invalid');
+    return match[1];
+}
+function parseConfig(value, profile) {
+    const fields = new Map();
+    for (const line of value.split(/\r?\n/)) {
+        const match = line.match(/^([^:]+):\s*(.*)$/);
+        if (match)
+            fields.set(match[1].trim().toLowerCase(), match[2].trim());
+    }
+    if ((fields.get('profile') || '') !== profile)
+        throw new MulticaReadFailure('profile.mismatch');
+    const normalize = (item) => item && item !== '(not set)' ? item : '';
+    return {
+        server: normalize(fields.get('server_url')),
+        workspaceId: normalize(fields.get('workspace_id')),
+    };
+}
+function parseAuth(value) {
+    if (/not authenticated|invalid or expired/i.test(value))
+        return '';
+    const user = value.split(/\r?\n/).find((line) => /^User:\s+/i.test(line.trim())) || '';
+    const server = value.split(/\r?\n/).find((line) => /^Server:\s+/i.test(line.trim())) || '';
+    const token = value.split(/\r?\n/).find((line) => /^Token:\s+/i.test(line.trim())) || '';
+    return user && server && token ? `${user.trim()}|${server.trim()}` : '';
+}
+function jsonArray(value, label) {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw new MulticaReadFailure(`json.${label}`);
+    }
+    if (!Array.isArray(parsed) || parsed.some((item) => !item || typeof item !== 'object' || Array.isArray(item))) {
+        throw new MulticaReadFailure(`shape.${label}`);
+    }
+    return parsed;
+}
+function jsonObject(value, label) {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw new MulticaReadFailure(`json.${label}`);
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new MulticaReadFailure(`shape.${label}`);
+    }
+    return parsed;
+}
+function readJsonObject(path, label) {
+    if (lstatSync(path).isSymbolicLink())
+        throw new Error(`${label} 不能是符号链接`);
+    return jsonObject(readFileSync(path, 'utf8'), label);
+}
+function idOf(value) {
+    return optionalField(value.id);
+}
+function stringField(value, label) {
+    if (typeof value !== 'string' || !value)
+        throw new Error(`${label} 必须是非空字符串`);
+    return value;
+}
+function optionalField(value) {
+    return typeof value === 'string' ? value : '';
+}
+function resourceId(value, label) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{1,127}$/.test(value) ||
+        /^(?:mul_|mcn_|sk-|bearer)/i.test(value)) {
+        throw new Error(`${label} 不是安全的稳定资源 ID`);
+    }
+    return value;
+}
+function safeDisplay(value) {
+    const text = typeof value === 'string' ? value : '';
+    if (!text)
+        return '';
+    if (/(?:mul_|mcn_|sk-[A-Za-z0-9]|bearer\s|access[_-]?token|client[_-]?secret|password)/i.test(text)) {
+        return `[redacted:${digest(text).slice(0, 12)}]`;
+    }
+    return text.length > 160 ? `${text.slice(0, 157)}...` : text;
+}
+function safeArg(value) {
+    return safeDisplay(value);
+}
+function compareNamedResource(a, b) {
+    return a.name.localeCompare(b.name) || a.id.localeCompare(b.id);
+}
+function emptyResources() {
+    return {
+        workspace: null,
+        runtime: null,
+        agent: null,
+        agentCandidates: [],
+        catalogSkills: [],
+        assignedSkills: [],
+    };
+}
+function emptyStatus(workspace) {
+    return {
+        $schema: 'dingtalk-agent/multica-workspace-status@1',
+        workspace: workspace.name,
+        provider: 'multica',
+        available: false,
+        inspectionId: '',
+        passed: false,
+        readyForApply: false,
+        providerReady: false,
+        evidencePath: '',
+        evidenceIntegrity: false,
+        stateMatched: false,
+        desiredHash: workspace.desiredHash,
+        observedHash: workspace.observedHash,
+        diff: [],
+        failures: ['inspection.missing'],
+        remoteRead: false,
+        remoteWrite: false,
+        sideEffect: false,
+        dingtalkSideEffect: false,
+    };
+}
+function latestPointerPath(root, name) {
+    return safeProjectPath(root, join(MULTICA_EVIDENCE_ROOT, safeName(name), 'multica-inspections', 'latest.json'), false);
+}
+function safeName(value) {
+    if (!/^[a-z0-9](?:[a-z0-9._-]{0,62}[a-z0-9])?$/.test(value)) {
+        throw new Error(`Workspace name 非法: ${value}`);
+    }
+    return value;
+}
+function safeProjectPath(root, ref, mustExist) {
+    const rootReal = realpathSync(resolve(root));
+    const candidate = resolve(rootReal, ref);
+    const rel = relative(rootReal, candidate);
+    if (rel === '..' || rel.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`)) {
+        throw new Error(`Multica Provider 路径必须位于 Project 内: ${ref}`);
+    }
+    if (mustExist && !existsSync(candidate))
+        throw new Error(`Multica evidence 不存在: ${ref}`);
+    if (existsSync(candidate)) {
+        if (lstatSync(candidate).isSymbolicLink()) {
+            throw new Error(`Multica Provider 路径不能是符号链接: ${ref}`);
+        }
+        if (!isInside(rootReal, realpathSync(candidate))) {
+            throw new Error(`Multica Provider 真实路径越出 Project: ${ref}`);
+        }
+    }
+    let ancestor = dirname(candidate);
+    while (!existsSync(ancestor)) {
+        const parent = dirname(ancestor);
+        if (parent === ancestor)
+            break;
+        ancestor = parent;
+    }
+    if (!existsSync(ancestor) || !isInside(rootReal, realpathSync(ancestor))) {
+        throw new Error(`Multica Provider 父目录真实路径越出 Project: ${ref}`);
+    }
+    return candidate;
+}
+function isInside(root, candidate) {
+    const rel = relative(root, candidate);
+    return rel === '' || (rel !== '..' && !rel.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`));
+}
+function atomicJson(path, value) {
+    mkdirSync(dirname(path), { recursive: true });
+    const temp = `${path}.tmp-${process.pid}`;
+    const source = `${JSON.stringify(value, null, 2)}\n`;
+    writeFileSync(temp, source, { mode: 0o600 });
+    renameSync(temp, path);
+    if (readFileSync(path, 'utf8') !== source)
+        throw new Error(`原子写后回读不一致: ${path}`);
+}
+function assertRedacted(value) {
+    const source = JSON.stringify(value);
+    if (/(?:mul_|mcn_|sk-[A-Za-z0-9]|bearer\s|access[_-]?token|client[_-]?secret|password)/i.test(source)) {
+        throw new Error('Multica inspection 脱敏失败：检测到疑似凭据');
+    }
+}
+function positiveTimeout(value) {
+    if (value === undefined)
+        return 30_000;
+    if (!Number.isFinite(value) || value < 100 || value > 300_000) {
+        throw new Error('Multica read timeout 必须在 100..300000 ms');
+    }
+    return Math.floor(value);
+}
+function requireReadConfirmation(options, command) {
+    if (!options.execute || !options.yes) {
+        throw new Error(`${command} 会读取当前 Multica 身份和远端 scope；必须同时传 --execute --yes`);
+    }
+}
+function sha256(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+//# sourceMappingURL=multica-provider.js.map