@xmanrui/dsh-im 4.3.0 → 4.4.0

package/lib/client.js

@@ -571,7 +571,7 @@ var React23 = __toESM(require("react"), 1);
 // package.json
 var package_default = {
   name: "@xmanrui/dsh-im",
-  version: "4.3.0",
+  version: "4.4.0",
   description: "\u628A\u4E5D\u79CD IM \u673A\u5668\u4EBA\u548C\u516C\u7F51 AI Office \u63A5\u5165\u672C\u673A DeepSeek Harness\u3002 Connect nine IM channels and a public AI Office to a local DeepSeek Harness.",
   keywords: [
     "deepseek-harness",
@@ -841,6 +841,62 @@ var EN = Object.freeze({
   "IM\u673A\u5668\u4EBA": "IM bots",
   "IM\u673A\u5668\u4EBA\u8BBE\u7F6E": "IM bot settings",
   "\u66F4\u591A\u673A\u5668\u4EBA\u8BBE\u7F6E": "More bot settings",
+  "\u673A\u5668\u4EBA\u8BBE\u7F6E": "Bot settings",
+  "\u673A\u5668\u4EBA\u8BBE\u7F6E\u9875\u7B7E": "Bot settings tabs",
+  "\u6295\u9012\u8BBE\u7F6E": "Delivery settings",
+  "\u8BBF\u95EE\u8BBE\u7F6E": "Access settings",
+  "\u67E5\u770B\u8BBF\u95EE\u6743\u9650\u8BF4\u660E": "View access permission details",
+  "\u5141\u8BB8\u6240\u6709\u7528\u6237": "Allow all users",
+  "\u4EC5\u767D\u540D\u5355\u7528\u6237": "Allowlisted users only",
+  "\u9ED8\u8BA4\u547D\u4EE4\u6743\u9650": "Default command permission",
+  "\u547D\u4EE4\u6743\u9650": "Command permission",
+  "\u53EF\u4EE5\u6267\u884C\u547D\u4EE4": "Can run commands",
+  "\u4E0D\u53EF\u4EE5\u6267\u884C\u547D\u4EE4": "Cannot run commands",
+  "\u767D\u540D\u5355\u7528\u6237": "Allowlisted users",
+  "\u67E5\u770B\u767D\u540D\u5355\u8BF4\u660E": "View allowlist details",
+  "\u547D\u4EE4\u6743\u9650\u4F8B\u5916": "Command permission exceptions",
+  "\u5F53\u524D\u6CA1\u6709\u767D\u540D\u5355\u7528\u6237\uFF0C\u4FDD\u5B58\u540E\u666E\u901A\u7528\u6237\u5C06\u65E0\u6CD5\u4F7F\u7528\u673A\u5668\u4EBA\u3002": "There are currently no allowlisted users. After saving, regular users will not be able to use the bot.",
+  "\u65B0\u589E\u7528\u6237": "Add user",
+  "\u5C1A\u672A\u6DFB\u52A0\u7528\u6237": "No users added",
+  "\u5F53\u524D\u6E20\u9053\u4E0D\u652F\u6301\u7FA4\u804A": "Group chat is not supported by this channel",
+  "\u539F\u6240\u6709\u8005\u6216\u626B\u7801\u63A5\u5165\u8005\u59CB\u7EC8\u53EF\u4EE5\u8BBF\u95EE\u5E76\u6267\u884C\u547D\u4EE4\uFF1B\u4EE5\u4E0B\u8BBE\u7F6E\u4EC5\u7EA6\u675F\u5176\u4ED6\u7528\u6237\u3002": "The original owner or QR-code operator can always access the bot and run commands; the settings below apply only to other users.",
+  "\u6B64\u533A\u57DF\u65E0\u9700\u914D\u7F6E\uFF0C\u4FDD\u5B58\u79C1\u804A\u8BBE\u7F6E\u65F6\u4F1A\u4FDD\u7559\u73B0\u6709\u7FA4\u804A\u7B56\u7565\u3002": "No setup is needed here. Saving direct-message settings keeps the existing group policy.",
+  "\u8BBF\u95EE\u8BBE\u7F6E\u5DF2\u4FDD\u5B58\u3002": "Access settings saved.",
+  "\u8BBF\u95EE\u8BBE\u7F6E\u6682\u4E0D\u53EF\u7528\u3002": "Access settings are currently unavailable.",
+  "\u8BBF\u95EE\u8BBE\u7F6E\u4FDD\u5B58\u5931\u8D25\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002": "Could not save access settings. Try again later.",
+  "\u670D\u52A1\u6CA1\u6709\u8FD4\u56DE\u5DF2\u4FDD\u5B58\u7684\u8BBF\u95EE\u7B56\u7565\uFF0C\u8BF7\u5237\u65B0\u540E\u91CD\u8BD5\u3002": "The service did not return the saved access policy. Refresh and try again.",
+  "\u8BBF\u95EE\u7B56\u7565\u5C1A\u672A\u5C31\u7EEA\uFF0C\u8BF7\u8FD4\u56DE\u673A\u5668\u4EBA\u5217\u8868\u5237\u65B0\u540E\u91CD\u8BD5\u3002": "The access policy is not ready. Return to the bot list, refresh, and try again.",
+  "\u5F53\u524D\u6E20\u9053\u6682\u4E0D\u652F\u6301\u8BBF\u95EE\u8BBE\u7F6E\u3002": "Access settings are not supported by this channel yet.",
+  "\u7528\u6237\u6807\u8BC6\u65E0\u6548\u3002": "The user ID is invalid.",
+  "\u7528\u6237\u6807\u8BC6\u5FC5\u987B\u662F\u5B57\u7B26\u4E32\u3002": "The user ID must be a string.",
+  "\u7528\u6237\u6807\u8BC6\u4E0D\u80FD\u4E3A\u7A7A\u3001\u5305\u542B\u63A7\u5236\u5B57\u7B26\u6216\u8D85\u8FC7 256 \u4E2A\u5B57\u7B26\u3002": "The user ID cannot be empty, contain control characters, or exceed 256 characters.",
+  "\u7528\u6237\u6761\u76EE\u5FC5\u987B\u5305\u542B\u7528\u6237\u6807\u8BC6\u548C\u547D\u4EE4\u6743\u9650\u3002": "Each user entry must include a user ID and command permission.",
+  "\u547D\u4EE4\u6743\u9650\u5FC5\u987B\u662F\u5E03\u5C14\u503C\u3002": "Command permission must be a boolean.",
+  "\u8BBF\u95EE\u6A21\u5F0F\u53EA\u80FD\u662F open \u6216 allowlist\u3002": "Access mode must be open or allowlist.",
+  "\u5F00\u653E\u6A21\u5F0F\u8BBE\u7F6E\u5FC5\u987B\u5B8C\u6574\u3002": "Open-mode settings must be complete.",
+  "\u5F00\u653E\u6A21\u5F0F\u9ED8\u8BA4\u547D\u4EE4\u6743\u9650\u5FC5\u987B\u662F\u5E03\u5C14\u503C\u3002": "The open-mode default command permission must be a boolean.",
+  "\u5F00\u653E\u6A21\u5F0F\u547D\u4EE4\u6743\u9650\u8986\u76D6\u7528\u6237\u5FC5\u987B\u662F\u6570\u7EC4\u3002": "Open-mode command permission overrides must be an array.",
+  "\u5F00\u653E\u6A21\u5F0F\u547D\u4EE4\u6743\u9650\u8986\u76D6\u7528\u6237\u4E0D\u80FD\u5305\u542B\u91CD\u590D\u7684\u7528\u6237\u6807\u8BC6\u3002": "Open-mode command permission overrides cannot contain duplicate user IDs.",
+  "\u767D\u540D\u5355\u6A21\u5F0F\u8BBE\u7F6E\u5FC5\u987B\u5B8C\u6574\u3002": "Allowlist-mode settings must be complete.",
+  "\u767D\u540D\u5355\u6A21\u5F0F\u7528\u6237\u5FC5\u987B\u662F\u6570\u7EC4\u3002": "Allowlist-mode users must be an array.",
+  "\u767D\u540D\u5355\u6A21\u5F0F\u7528\u6237\u4E0D\u80FD\u5305\u542B\u91CD\u590D\u7684\u7528\u6237\u6807\u8BC6\u3002": "Allowlist-mode users cannot contain duplicate user IDs.",
+  "\u8BBF\u95EE\u573A\u666F\u8BBE\u7F6E\u5FC5\u987B\u540C\u65F6\u5305\u542B\u6A21\u5F0F\u3001\u5F00\u653E\u6A21\u5F0F\u8BBE\u7F6E\u548C\u767D\u540D\u5355\u6A21\u5F0F\u8BBE\u7F6E\u3002": "Each access context must include its mode, open-mode settings, and allowlist-mode settings.",
+  "\u8BF7\u540C\u65F6\u63D0\u4EA4\u5B8C\u6574\u7684\u79C1\u804A\u548C\u7FA4\u804A\u8BBF\u95EE\u8BBE\u7F6E\u3002": "Submit complete direct-message and group access settings together.",
+  "\u586B\u5199\u5FAE\u4FE1\u7528\u6237 ID": "Enter a WeChat user ID",
+  "\u98DE\u4E66 Open ID": "Feishu Open ID",
+  "\u7FA4\u6210\u5458 Open ID": "Group member Open ID",
+  "\u9489\u9489\u7528\u6237 ID": "DingTalk user ID",
+  "\u586B\u5199 senderStaffId \u6216 senderId": "Enter senderStaffId or senderId",
+  "\u7FA4\u6210\u5458\u7528\u6237 ID": "Group member user ID",
+  "\u4F01\u4E1A\u5FAE\u4FE1\u7528\u6237 ID": "WeCom user ID",
+  "\u586B\u5199 userid": "Enter userid",
+  "\u586B\u5199 member_openid": "Enter member_openid",
+  "QQ User Open ID": "QQ User Open ID",
+  "\u7FA4\u6210\u5458 User ID": "Group member User ID",
+  "\u586B\u5199\u6570\u5B57 User ID": "Enter a numeric user ID",
+  "WhatsApp \u7535\u8BDD\u53F7\u7801\u6216 JID": "WhatsApp phone number or JID",
+  "\u7FA4\u6210\u5458\u7535\u8BDD\u53F7\u7801\u6216 JID": "Group member phone number or JID",
+  "8613800000000 \u6216\u5B8C\u6574 JID": "8613800000000 or a full JID",
   "IM \u6E20\u9053": "IM channels",
   "\u8BA9 DeepSeek Harness \u89E6\u624B\u53EF\u53CA": "Connecting DeepSeek Harness",
   "\u5F53\u524D\u7248\u672C": "Current version",
@@ -1355,7 +1411,6 @@ var EN = Object.freeze({
   "\u5148\u901A\u8FC7 @BotFather \u83B7\u53D6 Bot Token\uFF0C\u518D\u5728\u8FD9\u91CC\u5B8C\u6210\u63A5\u5165\u3002": "Get a Bot Token from @BotFather, then connect it here.",
   "\u586B\u5199 @BotFather \u751F\u6210\u7684 Bot Token": "Enter the Bot Token from @BotFather",
   "\u8BBF\u95EE\u6A21\u5F0F": "Access mode",
-  "\u8BBF\u95EE\u8BBE\u7F6E": "Access settings",
   "Telegram \u8BBF\u95EE\u6A21\u5F0F": "Telegram access mode",
   "\u67E5\u770B Telegram \u8BBF\u95EE\u6A21\u5F0F\u8BF4\u660E": "View Telegram access mode details",
   "\u7FA4\u804A\u5168\u90E8\u5FFD\u7565\uFF0C\u79C1\u804A\u4EC5\u5141\u8BB8\u767D\u540D\u5355\u7528\u6237\u3002": "All group messages are ignored; only allowlisted users may send DMs.",
@@ -1885,6 +1940,135 @@ function normalizeLastMessageError(value) {
   return code && reason && message && referenceId && at !== null ? { code, reason, message, referenceId, at } : null;
 }
 
+// src/channels/shared/access-policy.mjs
+var ACCESS_POLICY_MODES = Object.freeze(["open", "allowlist"]);
+var ACCESS_POLICY_CONVERSATION_TYPES = Object.freeze(["direct", "group"]);
+var ACCESS_POLICY_USER_ID_MAX_LENGTH = 256;
+var POLICY_KEYS = ["direct", "group"];
+var SCOPE_KEYS = ["mode", "open", "allowlist"];
+var OPEN_KEYS = ["defaultCanExecuteCommands", "commandPermissionOverrides"];
+var ALLOWLIST_KEYS = ["users"];
+var USER_KEYS = ["id", "canExecuteCommands"];
+var CONTROL_CHARACTERS = /[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/;
+function invalidAccessPolicy(message) {
+  const error = new TypeError(message);
+  error.code = "access-policy-invalid";
+  return error;
+}
+function hasExactKeys(input, keys) {
+  return input && typeof input === "object" && !Array.isArray(input) && [Object.prototype, null].includes(Object.getPrototypeOf(input)) && Reflect.ownKeys(input).length === keys.length && keys.every((key) => Object.hasOwn(input, key));
+}
+function normalizeAccessPolicyUserId(value) {
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw invalidAccessPolicy("\u7528\u6237\u6807\u8BC6\u65E0\u6548\u3002");
+    value = String(value);
+  } else if (typeof value === "bigint") {
+    value = String(value);
+  }
+  if (typeof value !== "string") throw invalidAccessPolicy("\u7528\u6237\u6807\u8BC6\u5FC5\u987B\u662F\u5B57\u7B26\u4E32\u3002");
+  const id5 = value.trim();
+  if (!id5 || id5.length > ACCESS_POLICY_USER_ID_MAX_LENGTH || CONTROL_CHARACTERS.test(id5)) {
+    throw invalidAccessPolicy(`\u7528\u6237\u6807\u8BC6\u4E0D\u80FD\u4E3A\u7A7A\u3001\u5305\u542B\u63A7\u5236\u5B57\u7B26\u6216\u8D85\u8FC7 ${ACCESS_POLICY_USER_ID_MAX_LENGTH} \u4E2A\u5B57\u7B26\u3002`);
+  }
+  return id5;
+}
+function validateAccessPolicyUser(input) {
+  if (!hasExactKeys(input, USER_KEYS)) {
+    throw invalidAccessPolicy("\u7528\u6237\u6761\u76EE\u5FC5\u987B\u5305\u542B\u7528\u6237\u6807\u8BC6\u548C\u547D\u4EE4\u6743\u9650\u3002");
+  }
+  if (typeof input.canExecuteCommands !== "boolean") {
+    throw invalidAccessPolicy("\u547D\u4EE4\u6743\u9650\u5FC5\u987B\u662F\u5E03\u5C14\u503C\u3002");
+  }
+  return Object.freeze({
+    id: normalizeAccessPolicyUserId(input.id),
+    canExecuteCommands: input.canExecuteCommands
+  });
+}
+function validateUsers(input, { listMessage, duplicateMessage }) {
+  if (!Array.isArray(input)) throw invalidAccessPolicy(listMessage);
+  const users = input.map(validateAccessPolicyUser);
+  if (new Set(users.map(({ id: id5 }) => id5)).size !== users.length) {
+    throw invalidAccessPolicy(duplicateMessage);
+  }
+  return Object.freeze(users);
+}
+function validateOpenSettings(input) {
+  if (!hasExactKeys(input, OPEN_KEYS)) {
+    throw invalidAccessPolicy("\u5F00\u653E\u6A21\u5F0F\u8BBE\u7F6E\u5FC5\u987B\u5B8C\u6574\u3002");
+  }
+  if (typeof input.defaultCanExecuteCommands !== "boolean") {
+    throw invalidAccessPolicy("\u5F00\u653E\u6A21\u5F0F\u9ED8\u8BA4\u547D\u4EE4\u6743\u9650\u5FC5\u987B\u662F\u5E03\u5C14\u503C\u3002");
+  }
+  return Object.freeze({
+    defaultCanExecuteCommands: input.defaultCanExecuteCommands,
+    commandPermissionOverrides: validateUsers(input.commandPermissionOverrides, {
+      listMessage: "\u5F00\u653E\u6A21\u5F0F\u547D\u4EE4\u6743\u9650\u8986\u76D6\u7528\u6237\u5FC5\u987B\u662F\u6570\u7EC4\u3002",
+      duplicateMessage: "\u5F00\u653E\u6A21\u5F0F\u547D\u4EE4\u6743\u9650\u8986\u76D6\u7528\u6237\u4E0D\u80FD\u5305\u542B\u91CD\u590D\u7684\u7528\u6237\u6807\u8BC6\u3002"
+    })
+  });
+}
+function validateAllowlistSettings(input) {
+  if (!hasExactKeys(input, ALLOWLIST_KEYS)) {
+    throw invalidAccessPolicy("\u767D\u540D\u5355\u6A21\u5F0F\u8BBE\u7F6E\u5FC5\u987B\u5B8C\u6574\u3002");
+  }
+  return Object.freeze({
+    users: validateUsers(input.users, {
+      listMessage: "\u767D\u540D\u5355\u6A21\u5F0F\u7528\u6237\u5FC5\u987B\u662F\u6570\u7EC4\u3002",
+      duplicateMessage: "\u767D\u540D\u5355\u6A21\u5F0F\u7528\u6237\u4E0D\u80FD\u5305\u542B\u91CD\u590D\u7684\u7528\u6237\u6807\u8BC6\u3002"
+    })
+  });
+}
+function validateAccessPolicyScope(input) {
+  if (!hasExactKeys(input, SCOPE_KEYS)) {
+    throw invalidAccessPolicy("\u8BBF\u95EE\u573A\u666F\u8BBE\u7F6E\u5FC5\u987B\u540C\u65F6\u5305\u542B\u6A21\u5F0F\u3001\u5F00\u653E\u6A21\u5F0F\u8BBE\u7F6E\u548C\u767D\u540D\u5355\u6A21\u5F0F\u8BBE\u7F6E\u3002");
+  }
+  if (!ACCESS_POLICY_MODES.includes(input.mode)) {
+    throw invalidAccessPolicy("\u8BBF\u95EE\u6A21\u5F0F\u53EA\u80FD\u662F open \u6216 allowlist\u3002");
+  }
+  return Object.freeze({
+    mode: input.mode,
+    open: validateOpenSettings(input.open),
+    allowlist: validateAllowlistSettings(input.allowlist)
+  });
+}
+function validateAccessPolicy(input) {
+  if (!hasExactKeys(input, POLICY_KEYS)) {
+    throw invalidAccessPolicy("\u8BF7\u540C\u65F6\u63D0\u4EA4\u5B8C\u6574\u7684\u79C1\u804A\u548C\u7FA4\u804A\u8BBF\u95EE\u8BBE\u7F6E\u3002");
+  }
+  return Object.freeze({
+    direct: validateAccessPolicyScope(input.direct),
+    group: validateAccessPolicyScope(input.group)
+  });
+}
+function normalizeAccessPolicy(input) {
+  try {
+    return validateAccessPolicy(input);
+  } catch {
+    return null;
+  }
+}
+function createAccessPolicyScope(options) {
+  return validateAccessPolicyScope(options === void 0 ? {
+    mode: "allowlist",
+    open: {
+      defaultCanExecuteCommands: false,
+      commandPermissionOverrides: []
+    },
+    allowlist: { users: [] }
+  } : options);
+}
+var DENY_SCOPE = createAccessPolicyScope();
+var DEFAULT_ACCESS_POLICY = Object.freeze({
+  direct: DENY_SCOPE,
+  group: DENY_SCOPE
+});
+var ALLOWED = Object.freeze({ allowed: true, reason: "allowed" });
+var POLICY_UNAVAILABLE = Object.freeze({ allowed: false, reason: "policy-unavailable" });
+var INVALID_CONTEXT = Object.freeze({ allowed: false, reason: "invalid-context" });
+var SENDER_UNAVAILABLE = Object.freeze({ allowed: false, reason: "sender-unavailable" });
+var SENDER_NOT_ALLOWED = Object.freeze({ allowed: false, reason: "sender-not-allowed" });
+var COMMAND_NOT_ALLOWED = Object.freeze({ allowed: false, reason: "command-not-allowed" });
+
 // src/channels/shared/context-enhancement.mjs
 var CONTEXT_ENHANCEMENT_FIELDS = Object.freeze([
   "channel",
@@ -1911,18 +2095,18 @@ var DEFAULT_CONTEXT_ENHANCEMENT_CONFIG = Object.freeze({
   })
 });
 var CONFIG_KEYS = ["group", "direct"];
-var SCOPE_KEYS = ["enabled", "fields", "guidance"];
+var SCOPE_KEYS2 = ["enabled", "fields", "guidance"];
 var LEGACY_CONFIG_KEYS = ["groupEnabled", "directEnabled", "fields", "guidance"];
 function invalidConfig(message) {
   const error = new TypeError(message);
   error.code = "context-enhancement-invalid";
   return error;
 }
-function hasExactKeys(input, keys) {
+function hasExactKeys2(input, keys) {
   return input && typeof input === "object" && !Array.isArray(input) && [Object.prototype, null].includes(Object.getPrototypeOf(input)) && Reflect.ownKeys(input).length === keys.length && keys.every((key) => Object.hasOwn(input, key));
 }
 function validateContextEnhancementScope(input) {
-  if (!hasExactKeys(input, SCOPE_KEYS)) {
+  if (!hasExactKeys2(input, SCOPE_KEYS2)) {
     throw invalidConfig("\u8BF7\u63D0\u4EA4\u5B8C\u6574\u7684\u4E0A\u4E0B\u6587\u589E\u5F3A\u8BBE\u7F6E\u3002");
   }
   const { enabled, fields, guidance } = input;
@@ -1942,7 +2126,7 @@ function validateContextEnhancementScope(input) {
   });
 }
 function validateContextEnhancementConfig(input) {
-  if (!hasExactKeys(input, CONFIG_KEYS)) {
+  if (!hasExactKeys2(input, CONFIG_KEYS)) {
     throw invalidConfig("\u8BF7\u63D0\u4EA4\u5B8C\u6574\u7684\u4E0A\u4E0B\u6587\u589E\u5F3A\u8BBE\u7F6E\u3002");
   }
   return Object.freeze({
@@ -1951,7 +2135,7 @@ function validateContextEnhancementConfig(input) {
   });
 }
 function migrateLegacyContextEnhancementConfig(input) {
-  if (!hasExactKeys(input, LEGACY_CONFIG_KEYS)) {
+  if (!hasExactKeys2(input, LEGACY_CONFIG_KEYS)) {
     throw invalidConfig("\u8BF7\u63D0\u4EA4\u5B8C\u6574\u7684\u4E0A\u4E0B\u6587\u589E\u5F3A\u8BBE\u7F6E\u3002");
   }
   return validateContextEnhancementConfig({
@@ -1991,7 +2175,8 @@ var DINGTALK_ENDPOINTS = Object.freeze({
   deleteBot: "bot.delete",
   setWorkspace: "bot.workspace.set",
   setAgentPreset: SET_AGENT_PRESET_ENDPOINT,
-  setContextEnhancement: "bot.context-enhancement.set"
+  setContextEnhancement: "bot.context-enhancement.set",
+  setAccessPolicy: "bot.access-policy.set"
 });
 var ACCOUNT_STATES = /* @__PURE__ */ new Set(["connected", "connecting", "offline", "error"]);
 var SNAPSHOT_STATES = /* @__PURE__ */ new Set(["disconnected", "offline", "provisioning", "connected", "degraded"]);
@@ -2121,6 +2306,7 @@ function normalizeBot(value) {
     workspace: optionalString(value.workspace, 4096) ?? "",
     agentPreset: normalizeAgentPresetId(value.agentPreset),
     contextEnhancement: normalizeContextEnhancementConfig(value.contextEnhancement),
+    ...Object.hasOwn(value, "accessPolicy") ? { accessPolicy: normalizeAccessPolicy(value.accessPolicy) } : {},
     bot: {
       name: optionalString(bot.name, 100) ?? "\u9489\u9489\u673A\u5668\u4EBA",
       clientIdMasked: optionalString(bot.clientIdMasked, 140) ?? "\u5DF2\u5B89\u5168\u4FDD\u5B58"
@@ -3230,7 +3416,7 @@ function SettingsGlyph() {
     h2("path", { d: "M19.4 15a1.7 1.7 0 0 0 .34 1.88l.06.06-2.83 2.83-.06-.06a1.7 1.7 0 0 0-1.88-.34 1.7 1.7 0 0 0-1.03 1.55V21h-4v-.08A1.7 1.7 0 0 0 8.97 19.4a1.7 1.7 0 0 0-1.88.34l-.06.06-2.83-2.83.06-.06A1.7 1.7 0 0 0 4.6 15a1.7 1.7 0 0 0-1.52-1.03H3v-4h.08A1.7 1.7 0 0 0 4.6 8.97a1.7 1.7 0 0 0-.34-1.88l-.06-.06L7.03 4.2l.06.06a1.7 1.7 0 0 0 1.88.34A1.7 1.7 0 0 0 10 3.08V3h4v.08a1.7 1.7 0 0 0 1.03 1.52 1.7 1.7 0 0 0 1.88-.34l.06-.06 2.83 2.83-.06.06a1.7 1.7 0 0 0-.34 1.88A1.7 1.7 0 0 0 20.92 10H21v4h-.08A1.7 1.7 0 0 0 19.4 15Z" })
   );
 }
-function BotSettingsButton({ channel: channel4, botId, botName, connected }) {
+function BotSettingsButton({ channel: channel4, botId, botName, connected, accessPolicy }) {
   const { openBotSettings } = React9.useContext(BotSettingsContext);
   const tooltipId = React9.useId();
   return h2(
@@ -3246,7 +3432,8 @@ function BotSettingsButton({ channel: channel4, botId, botName, connected }) {
         channel: channel4,
         botId,
         botName,
-        connected: Boolean(connected)
+        connected: Boolean(connected),
+        accessPolicy
       })
     }, h2(SettingsGlyph)),
     h2("span", {
@@ -3809,7 +3996,8 @@ function AccountCard({
             channel: "dingtalk",
             botId: account.botId,
             botName: account.bot.name,
-            connected: account.connected
+            connected: account.connected,
+            accessPolicy: account.accessPolicy
           })
         )
       ),
@@ -4464,12 +4652,13 @@ var TOKEN_BOT_ENDPOINTS = Object.freeze({
   deleteBot: "bot.delete",
   setWorkspace: "bot.workspace.set",
   setAgentPreset: SET_AGENT_PRESET_ENDPOINT,
-  setContextEnhancement: "bot.context-enhancement.set"
+  setContextEnhancement: "bot.context-enhancement.set",
+  setAccessPolicy: "bot.access-policy.set"
 });
 function createTokenChannelApi(channel4, connectionSummary, {
   normalizeBotExtension = () => ({})
 } = {}) {
-  const unwrapRpcResult11 = (result) => {
+  const unwrapRpcResult12 = (result) => {
     if (!isRecord2(result) || typeof result.ok !== "boolean") {
       throw new Error(`${channel4} \u670D\u52A1\u8FD4\u56DE\u4E86\u65E0\u6CD5\u8BC6\u522B\u7684\u54CD\u5E94`);
     }
@@ -4492,6 +4681,7 @@ function createTokenChannelApi(channel4, connectionSummary, {
       workspace: text2(value.workspace, "", 4096),
       agentPreset: normalizeAgentPresetId(value.agentPreset),
       contextEnhancement: normalizeContextEnhancementConfig(value.contextEnhancement),
+      ...Object.hasOwn(value, "accessPolicy") ? { accessPolicy: normalizeAccessPolicy(value.accessPolicy) } : {},
       bot: {
         name: text2(value.bot?.name, `${channel4}\u673A\u5668\u4EBA`, 100),
         username: text2(value.bot?.username, "", 100),
@@ -4529,7 +4719,7 @@ function createTokenChannelApi(channel4, connectionSummary, {
     code: text2(error?.code, `${channel4.toUpperCase()}_ERROR`, 80),
     message: text2(error?.message, `${channel4}\u64CD\u4F5C\u5931\u8D25\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5`)
   });
-  return Object.freeze({ unwrapRpcResult: unwrapRpcResult11, normalizeSnapshot: normalizeSnapshot9, presentError: presentError12 });
+  return Object.freeze({ unwrapRpcResult: unwrapRpcResult12, normalizeSnapshot: normalizeSnapshot9, presentError: presentError12 });
 }
 
 // plugin-src/client/channels/discord/api.js
@@ -4639,7 +4829,8 @@ function createTokenChannelSettings(definition) {
               channel: channel4.toLowerCase(),
               botId: account.botId,
               botName: account.bot.name,
-              connected: account.connected
+              connected: account.connected,
+              accessPolicy: account.accessPolicy
             })
           )
         ),
@@ -5075,6 +5266,7 @@ var FEISHU_ENDPOINTS = Object.freeze({
   setWorkspace: "bot.workspace.set",
   setAgentPreset: "bot.preset.set",
   setContextEnhancement: "bot.context-enhancement.set",
+  setAccessPolicy: "bot.access-policy.set",
   setGroupResponseMode: "bot.group-response-mode.set",
   // Kept for rolling upgrades. The multi-bot UI never calls these endpoints.
   testConnection: "connection.test",
@@ -5224,6 +5416,7 @@ function normalizeBotConnection(value, fallbackBotId) {
     workspace: optionalString2(value.workspace)?.slice(0, 4096) ?? "",
     agentPreset: normalizeAgentPresetId(value.agentPreset),
     contextEnhancement: normalizeContextEnhancementConfig(value.contextEnhancement),
+    ...Object.hasOwn(value, "accessPolicy") ? { accessPolicy: normalizeAccessPolicy(value.accessPolicy) } : {},
     groupResponseMode: normalizeGroupResponseMode(value.groupResponseMode),
     groupMessagePermissionGranted: value.groupMessagePermissionGranted === true,
     bot: normalizeBot2(value.bot),
@@ -5957,7 +6150,8 @@ function BotCard({
             channel: "feishu",
             botId: connection.botId,
             botName: bot.name,
-            connected
+            connected,
+            accessPolicy: connection.accessPolicy
           })
         )
       ),
@@ -7430,7 +7624,8 @@ var QQ_ENDPOINTS = Object.freeze({
   deleteBot: "bot.delete",
   setWorkspace: "bot.workspace.set",
   setAgentPreset: SET_AGENT_PRESET_ENDPOINT,
-  setContextEnhancement: "bot.context-enhancement.set"
+  setContextEnhancement: "bot.context-enhancement.set",
+  setAccessPolicy: "bot.access-policy.set"
 });
 var PROVISION_STATES2 = /* @__PURE__ */ new Set(["starting", "pending", "refreshing", "connecting", "connected", "failed", "cancelled"]);
 var ACCOUNT_STATES3 = /* @__PURE__ */ new Set(["connected", "connecting", "offline", "error"]);
@@ -7496,6 +7691,7 @@ function normalizeBot3(value) {
     workspace: text3(value.workspace, "", 4096),
     agentPreset: normalizeAgentPresetId(value.agentPreset),
     contextEnhancement: normalizeContextEnhancementConfig(value.contextEnhancement),
+    ...Object.hasOwn(value, "accessPolicy") ? { accessPolicy: normalizeAccessPolicy(value.accessPolicy) } : {},
     bot: {
       name: text3(value.bot?.name, "QQ\u673A\u5668\u4EBA", 100),
       appIdMasked: text3(value.bot?.appIdMasked, "\u5E94\u7528\u6807\u8BC6\u5DF2\u5B89\u5168\u4FDD\u5B58", 140)
@@ -7836,7 +8032,8 @@ function AccountCard2({
             channel: "qq",
             botId: account.botId,
             botName: account.bot.name,
-            connected: account.connected
+            connected: account.connected,
+            accessPolicy: account.accessPolicy
           })
         )
       ),
@@ -8773,59 +8970,18 @@ var SlackAccountCard = channel2.AccountCard;
 
 // plugin-src/client/channels/telegram/api.js
 var TELEGRAM_RPC_CHANNEL = "/telegram";
-var TELEGRAM_ENDPOINTS = Object.freeze({
-  ...TOKEN_BOT_ENDPOINTS,
-  setAccessPolicy: "bot.access-policy.set"
-});
-var api3 = createTokenChannelApi("Telegram", " Bot API \u957F\u8F6E\u8BE2", {
-  normalizeBotExtension: (value) => {
-    const source = value?.accessPolicy;
-    const accessMode = source?.accessMode === "private-allowlist" ? "private-allowlist" : "compatible";
-    const allowedUsers = Array.isArray(source?.allowedUsers) ? [...new Set(source.allowedUsers.filter((entry) => typeof entry === "string" && /^[1-9]\d{0,15}$/.test(entry)))] : [];
-    return { accessPolicy: { accessMode, allowedUsers } };
-  }
-});
+var TELEGRAM_ENDPOINTS = TOKEN_BOT_ENDPOINTS;
+var api3 = createTokenChannelApi("Telegram", " Bot API \u957F\u8F6E\u8BE2");
 var unwrapRpcResult6 = api3.unwrapRpcResult;
 var normalizeSnapshot5 = api3.normalizeSnapshot;
 var presentError6 = api3.presentError;
 
-// plugin-src/client/channels/telegram/index.js
-var React17 = __toESM(require("react"), 1);
-
 // plugin-src/client/channels/telegram/styles.js
 var TELEGRAM_STYLE_ID = "xmanrui-dsh-im-telegram-settings";
 var CSS7 = String.raw`
 .dtg-page { --ddt-accent: #229ed9; --ddt-accent-deep: #1687bd; --ddt-accent-wash: #eaf7fd; }
 .dtg-avatar { color: #fff; background: #229ed9; }
 .dtg-avatar svg { display: block; }
-.dtg-access { min-width: 0; width: 100%; max-width: 100%; display: grid; gap: 10px; padding: 12px; border: 1px solid var(--dsw-alias-border-l2, #dfe1e5); border-radius: 10px; background: var(--dsw-alias-bg-layer-2, #f7f8fa); }
-.dtg-accessHeading { position: relative; min-width: 0; max-width: 100%; display: flex; align-items: center; justify-content: space-between; flex-wrap: wrap; gap: 8px 12px; }
-.dtg-accessHeading > strong { min-width: 0; font-size: 13px; overflow-wrap: anywhere; }
-.dtg-accessStatus { min-width: 0; max-width: 100%; flex: 0 1 auto; display: inline-flex; align-items: center; justify-content: flex-end; flex-wrap: wrap; gap: 6px; }
-.dtg-accessBadge { min-width: 0; max-width: 100%; flex: 0 1 auto; padding: 3px 8px; border-radius: 999px; color: #1687bd; background: #eaf7fd; font-size: 11px; font-weight: 700; overflow-wrap: anywhere; text-align: center; }
-.dtg-accessBadge[data-mode="private-allowlist"] { color: #a15c00; background: #fff3d6; }
-.dtg-accessHelp { position: static; display: inline-flex; flex: none; }
-.dtg-accessHelpButton { width: 20px; height: 20px; display: grid; place-items: center; padding: 0; border: 1px solid color-mix(in srgb, #229ed9 28%, var(--dsw-alias-border-l2, #dfe1e5)); border-radius: 50%; color: #1687bd; background: var(--dsw-alias-bg-layer-1, #fff); font: inherit; font-size: 12px; line-height: 1; font-weight: 750; cursor: help; transition: border-color .15s ease, color .15s ease, background .15s ease, box-shadow .15s ease; }
-.dtg-accessHelpButton:hover { border-color: #229ed9; color: #1178a8; background: #eaf7fd; }
-.dtg-accessHelpButton:focus-visible { outline: none; border-color: #229ed9; box-shadow: 0 0 0 3px color-mix(in srgb, #229ed9 18%, transparent); }
-.dtg-accessTooltip { position: absolute; top: calc(100% + 8px); right: 0; z-index: 30; width: min(300px, 100%); max-width: 100%; display: grid; gap: 8px; padding: 10px 11px; border: 1px solid var(--dsw-alias-border-l2, #dfe1e5); border-radius: 9px; color: var(--dsw-alias-label-primary, #1f2329); background: var(--dsw-alias-bg-layer-3, #fff); box-shadow: 0 10px 28px rgb(31 35 41 / 16%); opacity: 0; visibility: hidden; transform: translateY(-3px); pointer-events: none; transition: opacity .15s ease, transform .15s ease, visibility .15s ease; }
-.dtg-accessTooltipItem { display: grid; gap: 2px; }
-.dtg-accessTooltipItem + .dtg-accessTooltipItem { padding-top: 8px; border-top: 1px solid var(--dsw-alias-border-l2, #eef0f3); }
-.dtg-accessTooltipItem strong { color: var(--dsw-alias-label-primary, #1f2329); font-size: 12px; line-height: 17px; font-weight: 700; }
-.dtg-accessTooltipItem > span { color: var(--dsw-alias-label-secondary, #646a73); font-size: 11px; line-height: 16px; font-weight: 400; }
-.dtg-accessHelp:hover .dtg-accessTooltip, .dtg-accessHelp:focus-within .dtg-accessTooltip { opacity: 1; visibility: visible; transform: translateY(0); }
-.dtg-accessField { min-width: 0; max-width: 100%; display: grid; gap: 5px; color: var(--dsw-alias-label-primary, #1f2329); font-size: 12px; font-weight: 600; }
-.dtg-accessField select, .dtg-accessField textarea { min-width: 0; width: 100%; max-width: 100%; box-sizing: border-box; border: 1px solid var(--dsw-alias-border-l1, #c9cdd4); border-radius: 7px; color: inherit; background: var(--dsw-alias-bg-layer-1, #fff); font: inherit; font-weight: 400; }
-.dtg-accessField select { height: 34px; padding: 0 9px; }
-.dtg-accessField textarea { min-height: 68px; padding: 8px 9px; resize: vertical; font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
-.dtg-accessField textarea:disabled { color: var(--dsw-alias-label-tertiary, #8f959e); background: var(--dsw-alias-bg-module-platform, #f2f3f5); cursor: not-allowed; resize: none; opacity: 1; }
-.dtg-accessField > span, .dtg-accessField small { overflow-wrap: anywhere; }
-.dtg-accessField small { color: var(--dsw-alias-label-secondary, #646a73); font-weight: 400; }
-.dtg-accessWarning, .dtg-accessError { margin: 0; font-size: 12px; line-height: 1.5; }
-.dtg-accessWarning { color: #a15c00; }
-.dtg-accessError { color: var(--dsw-alias-state-error-primary, #d83931); }
-.dtg-accessActions { min-width: 0; max-width: 100%; display: flex; justify-content: flex-end; flex-wrap: wrap; }
-.dtg-accessActions .ddt-button { max-width: 100%; white-space: normal; }
 `;
 function installTelegramStyles() {
   if (typeof document === "undefined") return () => {
@@ -8842,146 +8998,6 @@ function installTelegramStyles() {
 }
 
 // plugin-src/client/channels/telegram/index.js
-function policyFor(account) {
-  return {
-    accessMode: account?.accessPolicy?.accessMode === "private-allowlist" ? "private-allowlist" : "compatible",
-    allowedUsers: Array.isArray(account?.accessPolicy?.allowedUsers) ? account.accessPolicy.allowedUsers : []
-  };
-}
-function allowedUsersFromText(value) {
-  const entries = value.split(/\r?\n/).map((entry) => entry.trim()).filter(Boolean);
-  if (entries.some((entry) => !/^[1-9]\d{0,15}$/.test(entry))) {
-    throw new TypeError("User ID \u5FC5\u987B\u662F 1\u201316 \u4F4D\u6B63\u6574\u6570\uFF0C\u6BCF\u884C\u4E00\u4E2A\u3002");
-  }
-  return [...new Set(entries)];
-}
-function TelegramAccessSettings({ account, busy = false, onSave }) {
-  const policy = policyFor(account);
-  const sourceUsers = policy.allowedUsers.join("\n");
-  const accessHelpId = React17.useId();
-  const [accessMode, setAccessMode] = React17.useState(policy.accessMode);
-  const [allowedUsers, setAllowedUsers] = React17.useState(sourceUsers);
-  const [error, setError] = React17.useState(null);
-  React17.useEffect(() => {
-    setAccessMode(policy.accessMode);
-    setAllowedUsers(sourceUsers);
-    setError(null);
-  }, [policy.accessMode, sourceUsers]);
-  const save = async (event) => {
-    event.preventDefault();
-    setError(null);
-    try {
-      const normalized = allowedUsersFromText(allowedUsers);
-      if (typeof onSave !== "function") throw new Error("Telegram \u8BBF\u95EE\u8BBE\u7F6E\u6682\u4E0D\u53EF\u7528\u3002");
-      await onSave({ accessMode, allowedUsers: normalized });
-    } catch (caught) {
-      setError(caught?.message ?? "Telegram \u8BBF\u95EE\u8BBE\u7F6E\u4FDD\u5B58\u5931\u8D25\u3002");
-    }
-  };
-  const privateAllowlist = accessMode === "private-allowlist";
-  const savedPrivateAllowlist = policy.accessMode === "private-allowlist";
-  const emptyAllowlist = privateAllowlist && allowedUsers.trim() === "";
-  return h2(
-    "form",
-    { className: "dtg-access", onSubmit: save },
-    h2(
-      "div",
-      { className: "dtg-accessHeading" },
-      h2("strong", null, "\u8BBF\u95EE\u8BBE\u7F6E"),
-      h2(
-        "span",
-        { className: "dtg-accessStatus" },
-        h2(
-          "span",
-          { className: "dtg-accessBadge", "data-mode": policy.accessMode },
-          savedPrivateAllowlist ? "\u5DF2\u751F\u6548\uFF1A\u5B89\u5168\u6A21\u5F0F" : "\u5DF2\u751F\u6548\uFF1A\u517C\u5BB9\u6A21\u5F0F"
-        ),
-        h2(
-          "span",
-          { className: "dtg-accessHelp" },
-          h2("button", {
-            type: "button",
-            className: "dtg-accessHelpButton",
-            "aria-label": "\u67E5\u770B Telegram \u8BBF\u95EE\u6A21\u5F0F\u8BF4\u660E",
-            "aria-describedby": accessHelpId
-          }, h2("span", { "aria-hidden": "true" }, "?")),
-          h2(
-            "span",
-            {
-              id: accessHelpId,
-              className: "dtg-accessTooltip",
-              role: "tooltip"
-            },
-            h2(
-              "span",
-              { className: "dtg-accessTooltipItem" },
-              h2("strong", null, "\u517C\u5BB9\u6A21\u5F0F"),
-              h2("span", null, "\u4FDD\u6301\u539F\u6709\u884C\u4E3A\uFF1A\u79C1\u804A\u76F4\u63A5\u54CD\u5E94\uFF0C\u7FA4\u804A\u5728\u88AB\u63D0\u53CA\u6216\u56DE\u590D\u65F6\u54CD\u5E94\u3002")
-            ),
-            h2(
-              "span",
-              { className: "dtg-accessTooltipItem" },
-              h2("strong", null, "\u5B89\u5168\u6A21\u5F0F"),
-              h2("span", null, "\u7FA4\u804A\u5168\u90E8\u5FFD\u7565\uFF0C\u79C1\u804A\u4EC5\u5141\u8BB8\u767D\u540D\u5355\u7528\u6237\u3002")
-            )
-          )
-        )
-      )
-    ),
-    h2(
-      "label",
-      { className: "dtg-accessField" },
-      h2("span", null, "\u6A21\u5F0F"),
-      h2(
-        "select",
-        {
-          value: accessMode,
-          disabled: busy,
-          "aria-label": "Telegram \u8BBF\u95EE\u6A21\u5F0F",
-          onChange: (event) => {
-            setAccessMode(event.target.value);
-            setError(null);
-          }
-        },
-        h2("option", { value: "compatible" }, "\u517C\u5BB9\u6A21\u5F0F\uFF08\u9ED8\u8BA4\uFF09"),
-        h2("option", { value: "private-allowlist" }, "\u5B89\u5168\u6A21\u5F0F\uFF08\u79C1\u804A\u767D\u540D\u5355\uFF09")
-      )
-    ),
-    h2(
-      "label",
-      { className: "dtg-accessField" },
-      h2("span", null, "\u5141\u8BB8\u79C1\u804A\u7684 Telegram User ID"),
-      h2("textarea", {
-        value: allowedUsers,
-        disabled: busy || !privateAllowlist,
-        rows: 3,
-        placeholder: "\u6BCF\u884C\u4E00\u4E2A\u6570\u5B57 User ID",
-        "aria-label": "\u5141\u8BB8\u79C1\u804A\u7684 Telegram User ID",
-        onChange: (event) => {
-          setAllowedUsers(event.target.value);
-          setError(null);
-        }
-      }),
-      h2("small", null, privateAllowlist ? "\u767D\u540D\u5355\u4EC5\u5C5E\u4E8E\u5F53\u524D\u673A\u5668\u4EBA\u3002" : "\u517C\u5BB9\u6A21\u5F0F\u4E0B\u6682\u4E0D\u4F7F\u7528\u767D\u540D\u5355\uFF0C\u5207\u6362\u6A21\u5F0F\u65F6\u4F1A\u4FDD\u7559\u3002")
-    ),
-    emptyAllowlist ? h2(
-      "p",
-      { className: "dtg-accessWarning", role: "status" },
-      "\u767D\u540D\u5355\u4E3A\u7A7A\uFF1B\u4FDD\u5B58\u540E\u8BE5\u673A\u5668\u4EBA\u4F1A\u62D2\u7EDD\u6240\u6709\u5165\u7AD9\u6D88\u606F\u3002"
-    ) : null,
-    error ? h2("p", { className: "dtg-accessError", role: "alert" }, error) : null,
-    h2(
-      "div",
-      { className: "dtg-accessActions" },
-      h2("button", {
-        type: "submit",
-        className: "ddt-button",
-        "data-kind": "secondary",
-        disabled: busy
-      }, busy ? "\u6B63\u5728\u4FDD\u5B58\u2026" : "\u4FDD\u5B58\u8BBF\u95EE\u8BBE\u7F6E")
-    )
-  );
-}
 var channel3 = createTokenChannelSettings({
   channel: "Telegram",
   endpoints: TELEGRAM_ENDPOINTS,
@@ -8994,9 +9010,7 @@ var channel3 = createTokenChannelSettings({
   tokenPlaceholder: "\u586B\u5199 @BotFather \u751F\u6210\u7684 Bot Token",
   emptyTitle: "\u63A5\u5165 Telegram \u673A\u5668\u4EBA",
   emptyDescription: "\u5148\u901A\u8FC7 @BotFather \u83B7\u53D6 Bot Token\uFF0C\u518D\u5728\u8FD9\u91CC\u5B8C\u6210\u63A5\u5165\u3002",
-  platformLabel: "Telegram",
-  AccountSettings: TelegramAccessSettings,
-  accountSettingsEndpoint: TELEGRAM_ENDPOINTS.setAccessPolicy
+  platformLabel: "Telegram"
 });
 var TelegramSettingsTab = channel3.SettingsTab;
 var TelegramAccountCard = channel3.AccountCard;
@@ -9013,7 +9027,8 @@ var WECOM_ENDPOINTS = Object.freeze({
   deleteBot: "bot.delete",
   setWorkspace: "bot.workspace.set",
   setAgentPreset: SET_AGENT_PRESET_ENDPOINT,
-  setContextEnhancement: "bot.context-enhancement.set"
+  setContextEnhancement: "bot.context-enhancement.set",
+  setAccessPolicy: "bot.access-policy.set"
 });
 var PROVISION_STATES3 = /* @__PURE__ */ new Set(["starting", "pending", "refreshing", "connecting", "connected", "failed", "cancelled"]);
 var ACCOUNT_STATES4 = /* @__PURE__ */ new Set(["connected", "connecting", "offline", "error"]);
@@ -9085,6 +9100,7 @@ function normalizeBot4(value) {
     workspace: text4(value.workspace, "", 4096),
     agentPreset: normalizeAgentPresetId(value.agentPreset),
     contextEnhancement: normalizeContextEnhancementConfig(value.contextEnhancement),
+    ...Object.hasOwn(value, "accessPolicy") ? { accessPolicy: normalizeAccessPolicy(value.accessPolicy) } : {},
     bot: {
       name: text4(value.bot?.name, "\u4F01\u4E1A\u5FAE\u4FE1\u673A\u5668\u4EBA", 100),
       appIdMasked: text4(value.bot?.appIdMasked, "\u5E94\u7528\u6807\u8BC6\u5DF2\u5B89\u5168\u4FDD\u5B58", 140)
@@ -9125,7 +9141,7 @@ function formatRemaining4(milliseconds) {
 }
 
 // plugin-src/client/channels/wecom/index.js
-var React18 = __toESM(require("react"), 1);
+var React17 = __toESM(require("react"), 1);
 
 // plugin-src/client/channels/wecom/styles.js
 var WECOM_STYLE_ID = "xmanrui-dsh-im-wecom-settings";
@@ -9150,7 +9166,7 @@ function installWecomStyles() {
 
 // plugin-src/client/channels/wecom/index.js
 var ACTIVE_STATES2 = /* @__PURE__ */ new Set(["pending", "refreshing", "connecting"]);
-var Button10 = React18.forwardRef(function Button11({ children, kind = "secondary", className = "", ...props }, ref) {
+var Button10 = React17.forwardRef(function Button11({ children, kind = "secondary", className = "", ...props }, ref) {
   return h2("button", {
     ...props,
     ref,
@@ -9408,7 +9424,8 @@ function AccountCard3({
             channel: "wecom",
             botId: account.botId,
             botName: account.bot.name,
-            connected: account.connected
+            connected: account.connected,
+            accessPolicy: account.accessPolicy
           })
         )
       ),
@@ -9461,27 +9478,27 @@ function AccountCard3({
   );
 }
 function WecomSettingsTab({ rpcCall }) {
-  const [model, setModel] = React18.useState({
+  const [model, setModel] = React17.useState({
     phase: "loading",
     bots: [],
     totals: { configured: 0, connected: 0 },
     error: null,
     agentPresetCatalog: EMPTY_AGENT_PRESET_CATALOG
   });
-  const [provision, setProvision] = React18.useState(null);
-  const [busy, setBusy] = React18.useState(false);
-  const [busyByBot, setBusyByBot] = React18.useState({});
-  const [feedbackByBot, setFeedbackByBot] = React18.useState({});
-  const [removeTarget, setRemoveTarget] = React18.useState(null);
-  const [credentialOpen, setCredentialOpen] = React18.useState(false);
-  const [credentialError, setCredentialError] = React18.useState(null);
-  const [notice, setNotice] = React18.useState("");
-  const [now, setNow] = React18.useState(Date.now());
-  const mounted = React18.useRef(true);
+  const [provision, setProvision] = React17.useState(null);
+  const [busy, setBusy] = React17.useState(false);
+  const [busyByBot, setBusyByBot] = React17.useState({});
+  const [feedbackByBot, setFeedbackByBot] = React17.useState({});
+  const [removeTarget, setRemoveTarget] = React17.useState(null);
+  const [credentialOpen, setCredentialOpen] = React17.useState(false);
+  const [credentialError, setCredentialError] = React17.useState(null);
+  const [notice, setNotice] = React17.useState("");
+  const [now, setNow] = React17.useState(Date.now());
+  const mounted = React17.useRef(true);
   const workspaceFence = useWorkspaceSnapshotFence();
-  const addButtonRef = React18.useRef(null);
-  const noticeFrameRef = React18.useRef(null);
-  const announce = React18.useCallback((message) => {
+  const addButtonRef = React17.useRef(null);
+  const noticeFrameRef = React17.useRef(null);
+  const announce = React17.useCallback((message) => {
     if (!mounted.current) return;
     if (noticeFrameRef.current !== null) {
       window.cancelAnimationFrame(noticeFrameRef.current);
@@ -9495,7 +9512,7 @@ function WecomSettingsTab({ rpcCall }) {
       });
     }
   }, []);
-  React18.useEffect(() => {
+  React17.useEffect(() => {
     const disposeDingtalk = installDingtalkStyles();
     const disposeWecom = installWecomStyles();
     mounted.current = true;
@@ -9509,11 +9526,11 @@ function WecomSettingsTab({ rpcCall }) {
       disposeDingtalk();
     };
   }, []);
-  const invoke = React18.useCallback(async (endpoint, payload = {}, signal) => {
+  const invoke = React17.useCallback(async (endpoint, payload = {}, signal) => {
     if (typeof rpcCall !== "function") throw new TypeError("\u4F01\u4E1A\u5FAE\u4FE1\u8BBE\u7F6E\u9875\u7F3A\u5C11 RPC \u8FDE\u63A5");
     return unwrapRpcResult7(await rpcCall(endpoint, payload, signal));
   }, [rpcCall]);
-  const loadStatus = React18.useCallback(async ({ signal, silent = false, restore = false } = {}) => {
+  const loadStatus = React17.useCallback(async ({ signal, silent = false, restore = false } = {}) => {
     const workspaceVersion = workspaceFence.beginStatus();
     if (workspaceVersion === null) return void 0;
     if (!silent && mounted.current) setModel((current) => ({ ...current, phase: "loading", error: null }));
@@ -9539,12 +9556,12 @@ function WecomSettingsTab({ rpcCall }) {
       return void 0;
     }
   }, [invoke, workspaceFence]);
-  React18.useEffect(() => {
+  React17.useEffect(() => {
     const controller = new AbortController();
     void loadStatus({ signal: controller.signal, restore: true });
     return () => controller.abort();
   }, [loadStatus]);
-  React18.useEffect(() => {
+  React17.useEffect(() => {
     if (model.phase !== "ready") return void 0;
     const controller = new AbortController();
     const timer = window.setInterval(() => void loadStatus({ signal: controller.signal, silent: true }), 15e3);
@@ -9553,12 +9570,12 @@ function WecomSettingsTab({ rpcCall }) {
       window.clearInterval(timer);
     };
   }, [loadStatus, model.phase]);
-  React18.useEffect(() => {
+  React17.useEffect(() => {
     if (!provision || !ACTIVE_STATES2.has(provision.status)) return void 0;
     const timer = window.setInterval(() => mounted.current && setNow(Date.now()), 1e3);
     return () => window.clearInterval(timer);
   }, [provision?.attemptId, provision?.status]);
-  const startProvisioning = React18.useCallback(async (replace = false) => {
+  const startProvisioning = React17.useCallback(async (replace = false) => {
     setCredentialOpen(false);
     setCredentialError(null);
     setBusy(true);
@@ -9576,7 +9593,7 @@ function WecomSettingsTab({ rpcCall }) {
       if (mounted.current) setBusy(false);
     }
   }, [invoke, provision?.attemptId]);
-  const bindCredentials = React18.useCallback(async ({ identity, secret }) => {
+  const bindCredentials = React17.useCallback(async ({ identity, secret }) => {
     const snapshotVersion = workspaceFence.beginMutation();
     setBusy(true);
     setCredentialError(null);
@@ -9604,7 +9621,7 @@ function WecomSettingsTab({ rpcCall }) {
       if (mounted.current) setBusy(false);
     }
   }, [invoke, loadStatus, workspaceFence]);
-  const closeProvision = React18.useCallback(async () => {
+  const closeProvision = React17.useCallback(async () => {
     setBusy(true);
     try {
       if (provision?.attemptId && ACTIVE_STATES2.has(provision.status)) {
@@ -9615,7 +9632,7 @@ function WecomSettingsTab({ rpcCall }) {
       if (mounted.current) setBusy(false);
     }
   }, [invoke, provision?.attemptId, provision?.status]);
-  React18.useEffect(() => {
+  React17.useEffect(() => {
     const attemptId = provision?.attemptId;
     if (!attemptId || !ACTIVE_STATES2.has(provision.status)) return void 0;
     const controller = new AbortController();
@@ -9645,7 +9662,7 @@ function WecomSettingsTab({ rpcCall }) {
       window.clearTimeout(timer);
     };
   }, [invoke, loadStatus, provision?.attemptId, provision?.pollIntervalMs, provision?.status]);
-  const botAction = React18.useCallback(async (account, operation, endpoint, payload) => {
+  const botAction = React17.useCallback(async (account, operation, endpoint, payload) => {
     const snapshotVersion = workspaceFence.beginMutation();
     setBusyByBot((current) => ({ ...current, [account.botId]: operation }));
     try {
@@ -9670,7 +9687,7 @@ function WecomSettingsTab({ rpcCall }) {
       });
     }
   }, [invoke, loadStatus, workspaceFence]);
-  const reconnect = React18.useCallback(async (account) => {
+  const reconnect = React17.useCallback(async (account) => {
     setFeedbackByBot((current) => {
       const next = { ...current };
       delete next[account.botId];
@@ -9797,7 +9814,7 @@ function WecomSettingsTab({ rpcCall }) {
     }),
     h2("div", { className: "ddt-visuallyHidden", role: "status", "aria-live": "polite" }, notice),
     model.phase === "loading" ? h2(LoadingView4) : model.phase === "error" ? h2("div", { className: "ddt-card dim-surfaceCard" }, h2("div", { className: "ddt-inlineError dim-inlineError" }, h2("h3", null, "\u65E0\u6CD5\u8BFB\u53D6\u4F01\u4E1A\u5FAE\u4FE1\u673A\u5668\u4EBA\u72B6\u6001"), h2("p", null, model.error?.message), h2(Button10, { onClick: () => void loadStatus() }, "\u91CD\u65B0\u8BFB\u53D6"))) : h2(
-      React18.Fragment,
+      React17.Fragment,
       null,
       credentialView,
       provisionView,
@@ -9808,7 +9825,7 @@ function WecomSettingsTab({ rpcCall }) {
 }
 
 // plugin-src/client/channels/weixin/index.js
-var React19 = __toESM(require("react"), 1);
+var React18 = __toESM(require("react"), 1);
 
 // plugin-src/client/channels/weixin/api.js
 var WEIXIN_RPC_CHANNEL = "/weixin";
@@ -9822,7 +9839,8 @@ var WEIXIN_ENDPOINTS = Object.freeze({
   deleteBot: "bot.delete",
   setWorkspace: "bot.workspace.set",
   setAgentPreset: SET_AGENT_PRESET_ENDPOINT,
-  setContextEnhancement: "bot.context-enhancement.set"
+  setContextEnhancement: "bot.context-enhancement.set",
+  setAccessPolicy: "bot.access-policy.set"
 });
 var ACCOUNT_STATES5 = /* @__PURE__ */ new Set(["connected", "connecting", "offline", "error"]);
 var PROVISION_STATES4 = /* @__PURE__ */ new Set([
@@ -9914,6 +9932,7 @@ function normalizeBot5(value) {
     workspace: string(value.workspace).slice(0, 4096),
     agentPreset: normalizeAgentPresetId(value.agentPreset),
     contextEnhancement: normalizeContextEnhancementConfig(value.contextEnhancement),
+    ...Object.hasOwn(value, "accessPolicy") ? { accessPolicy: normalizeAccessPolicy(value.accessPolicy) } : {},
     bot: {
       name: string(value.bot.name, "\u5FAE\u4FE1\u673A\u5668\u4EBA"),
       accountIdMasked: string(value.bot.accountIdMasked, "\u5DF2\u5B89\u5168\u4FDD\u5B58")
@@ -9965,7 +9984,7 @@ function formatRemaining5(milliseconds) {
 }
 
 // plugin-src/client/channels/weixin/index.js
-var Button12 = React19.forwardRef(function Button13({ children, kind = "secondary", className = "", ...props }, ref) {
+var Button12 = React18.forwardRef(function Button13({ children, kind = "secondary", className = "", ...props }, ref) {
   return h2("button", {
     ...props,
     ref,
@@ -10038,14 +10057,14 @@ function EmptyView5({ onStart, busy }) {
   );
 }
 function QrPanel4({ provision, now, busy, onRefresh, onCancel }) {
-  const [imageFailed, setImageFailed] = React19.useState(false);
+  const [imageFailed, setImageFailed] = React18.useState(false);
   const source = safeQrSource5(provision.qrCodeDataUrl);
   const href = safeVerificationUrl(provision.verificationUrl);
   const remaining = Math.max(0, provision.expiresAt - now);
   const expired = remaining === 0 || provision.status === "expired";
   const duration = Math.max(1, provision.durationMs ?? 5 * 6e4);
   const progress = Math.round(Math.min(1, remaining / duration) * 100);
-  React19.useEffect(() => setImageFailed(false), [source]);
+  React18.useEffect(() => setImageFailed(false), [source]);
   return h2(
     "div",
     { className: "dxw-card dim-surfaceCard" },
@@ -10112,9 +10131,9 @@ function QrPanel4({ provision, now, busy, onRefresh, onCancel }) {
   );
 }
 function VerificationPanel({ provision, busy, onSubmit, onCancel }) {
-  const [code, setCode] = React19.useState("");
+  const [code, setCode] = React18.useState("");
   const valid = /^\d{4,8}$/.test(code);
-  React19.useEffect(() => setCode(""), [provision.attemptId]);
+  React18.useEffect(() => setCode(""), [provision.attemptId]);
   return h2(
     "div",
     { className: "dxw-card dim-surfaceCard" },
@@ -10251,7 +10270,8 @@ function AccountCard4({
             channel: "weixin",
             botId: account.botId,
             botName: account.bot.name,
-            connected: account.connected
+            connected: account.connected,
+            accessPolicy: account.accessPolicy
           })
         )
       ),
@@ -10357,7 +10377,7 @@ function mergeWeixinProvisioningSnapshot(current, incoming, { restoreProvisionin
   };
 }
 function WeixinSettingsTab({ rpcCall }) {
-  const [model, setModel] = React19.useState({
+  const [model, setModel] = React18.useState({
     phase: "loading",
     bots: [],
     totals: EMPTY_TOTALS3,
@@ -10365,33 +10385,33 @@ function WeixinSettingsTab({ rpcCall }) {
     error: null,
     agentPresetCatalog: EMPTY_AGENT_PRESET_CATALOG
   });
-  const [provision, setProvision] = React19.useState(null);
-  const [busy, setBusy] = React19.useState(false);
-  const [busyByBot, setBusyByBot] = React19.useState({});
-  const [feedbackByBot, setFeedbackByBot] = React19.useState({});
-  const [removeTarget, setRemoveTarget] = React19.useState(null);
-  const [notice, setNotice] = React19.useState("");
-  const [now, setNow] = React19.useState(() => Date.now());
-  const addButtonRef = React19.useRef(null);
-  const mountedRef = React19.useRef(true);
+  const [provision, setProvision] = React18.useState(null);
+  const [busy, setBusy] = React18.useState(false);
+  const [busyByBot, setBusyByBot] = React18.useState({});
+  const [feedbackByBot, setFeedbackByBot] = React18.useState({});
+  const [removeTarget, setRemoveTarget] = React18.useState(null);
+  const [notice, setNotice] = React18.useState("");
+  const [now, setNow] = React18.useState(() => Date.now());
+  const addButtonRef = React18.useRef(null);
+  const mountedRef = React18.useRef(true);
   const workspaceFence = useWorkspaceSnapshotFence();
   const scheduleAnimationFrame = useAnimationFrameScheduler();
-  React19.useEffect(() => {
+  React18.useEffect(() => {
     mountedRef.current = true;
     return () => {
       mountedRef.current = false;
     };
   }, []);
-  const announce = React19.useCallback((value) => {
+  const announce = React18.useCallback((value) => {
     setNotice("");
     scheduleAnimationFrame(() => {
       if (value) setNotice(value);
     }, "announcement");
   }, [scheduleAnimationFrame]);
-  const invoke = React19.useCallback(async (endpoint, payload = {}, signal) => {
+  const invoke = React18.useCallback(async (endpoint, payload = {}, signal) => {
     return unwrapRpcResult8(await rpcCall(endpoint, payload, signal));
   }, [rpcCall]);
-  const loadStatus = React19.useCallback(async ({
+  const loadStatus = React18.useCallback(async ({
     signal,
     silent = false,
     restoreProvisioning = false
@@ -10428,12 +10448,12 @@ function WeixinSettingsTab({ rpcCall }) {
       return void 0;
     }
   }, [invoke, workspaceFence]);
-  React19.useEffect(() => {
+  React18.useEffect(() => {
     const controller = new AbortController();
     void loadStatus({ signal: controller.signal, restoreProvisioning: true });
     return () => controller.abort();
   }, [loadStatus]);
-  React19.useEffect(() => {
+  React18.useEffect(() => {
     if (model.phase !== "ready") return void 0;
     const controller = new AbortController();
     let running = false;
@@ -10452,12 +10472,12 @@ function WeixinSettingsTab({ rpcCall }) {
       window.clearInterval(timer);
     };
   }, [loadStatus, model.phase]);
-  React19.useEffect(() => {
+  React18.useEffect(() => {
     if (!provision || !["pending", "scanned"].includes(provision.status)) return void 0;
     const timer = window.setInterval(() => setNow(Date.now()), 1e3);
     return () => window.clearInterval(timer);
   }, [provision?.attemptId, provision?.status]);
-  const startProvisioning = React19.useCallback(async ({ replace = false } = {}) => {
+  const startProvisioning = React18.useCallback(async ({ replace = false } = {}) => {
     setBusy(true);
     try {
       if (replace && provision?.attemptId) {
@@ -10478,7 +10498,7 @@ function WeixinSettingsTab({ rpcCall }) {
       setBusy(false);
     }
   }, [announce, invoke, provision?.attemptId]);
-  const cancelProvisioning = React19.useCallback(async () => {
+  const cancelProvisioning = React18.useCallback(async () => {
     setBusy(true);
     try {
       if (provision?.attemptId && !["failed", "expired", "cancelled"].includes(provision.status)) {
@@ -10493,7 +10513,7 @@ function WeixinSettingsTab({ rpcCall }) {
       setBusy(false);
     }
   }, [announce, invoke, provision?.attemptId, provision?.status, scheduleAnimationFrame]);
-  const submitVerification = React19.useCallback(async (verifyCode) => {
+  const submitVerification = React18.useCallback(async (verifyCode) => {
     if (!provision?.attemptId) return;
     setBusy(true);
     try {
@@ -10509,7 +10529,7 @@ function WeixinSettingsTab({ rpcCall }) {
       setBusy(false);
     }
   }, [announce, invoke, provision?.attemptId]);
-  React19.useEffect(() => {
+  React18.useEffect(() => {
     const attemptId = provision?.attemptId;
     if (!attemptId || !["pending", "scanned", "connecting"].includes(provision.status)) return void 0;
     const controller = new AbortController();
@@ -10557,7 +10577,7 @@ function WeixinSettingsTab({ rpcCall }) {
       controller.abort();
     };
   }, [announce, invoke, loadStatus, provision?.attemptId, provision?.status, provision?.pollIntervalMs]);
-  const setBotBusy = React19.useCallback((botId, value) => {
+  const setBotBusy = React18.useCallback((botId, value) => {
     setBusyByBot((current) => {
       const next = { ...current };
       if (value) next[botId] = value;
@@ -10565,7 +10585,7 @@ function WeixinSettingsTab({ rpcCall }) {
       return next;
     });
   }, []);
-  const reconnect = React19.useCallback(async (account) => {
+  const reconnect = React18.useCallback(async (account) => {
     const snapshotVersion = workspaceFence.beginMutation();
     setBotBusy(account.botId, "reconnect");
     setFeedbackByBot((current) => {
@@ -10616,7 +10636,7 @@ function WeixinSettingsTab({ rpcCall }) {
       setBotBusy(account.botId, null);
     }
   }, [announce, invoke, loadStatus, setBotBusy, workspaceFence]);
-  const saveWorkspace = React19.useCallback(async (account, workspace) => {
+  const saveWorkspace = React18.useCallback(async (account, workspace) => {
     const workspaceVersion = workspaceFence.beginMutation();
     setBotBusy(account.botId, "workspace");
     try {
@@ -10640,7 +10660,7 @@ function WeixinSettingsTab({ rpcCall }) {
       if (mountedRef.current) setBotBusy(account.botId, null);
     }
   }, [invoke, loadStatus, setBotBusy, workspaceFence]);
-  const saveBotSetting = React19.useCallback(async (account, operation, endpoint, payload) => {
+  const saveBotSetting = React18.useCallback(async (account, operation, endpoint, payload) => {
     const snapshotVersion = workspaceFence.beginMutation();
     setBotBusy(account.botId, operation);
     try {
@@ -10664,7 +10684,7 @@ function WeixinSettingsTab({ rpcCall }) {
       if (mountedRef.current) setBotBusy(account.botId, null);
     }
   }, [invoke, loadStatus, setBotBusy, workspaceFence]);
-  const remove = React19.useCallback(async (account) => {
+  const remove = React18.useCallback(async (account) => {
     const snapshotVersion = workspaceFence.beginMutation();
     setBotBusy(account.botId, "delete");
     try {
@@ -10748,7 +10768,7 @@ function WeixinSettingsTab({ rpcCall }) {
         h2(Button12, { onClick: () => void loadStatus() }, "\u91CD\u65B0\u8BFB\u53D6")
       )
     ) : h2(
-      React19.Fragment,
+      React18.Fragment,
       null,
       provisionView,
       model.bots.length === 0 && !provision ? h2(EmptyView5, { onStart: () => void startProvisioning(), busy }) : null,
@@ -10975,12 +10995,7 @@ function normalizeBot6(value) {
     workspace: text5(value.workspace, "", 4096),
     agentPreset: normalizeAgentPresetId(value.agentPreset),
     contextEnhancement: normalizeContextEnhancementConfig(value.contextEnhancement),
-    accessPolicy: {
-      accessMode: ["self-only", "private-allowlist", "open"].includes(
-        value.accessPolicy?.accessMode
-      ) ? value.accessPolicy.accessMode : "self-only",
-      allowedNumbers: Array.isArray(value.accessPolicy?.allowedNumbers) ? [...new Set(value.accessPolicy.allowedNumbers.filter((entry) => typeof entry === "string" && /^[1-9]\d{4,14}$/.test(entry)))] : []
-    },
+    ...Object.hasOwn(value, "accessPolicy") ? { accessPolicy: normalizeAccessPolicy(value.accessPolicy) } : {},
     bot: {
       name: text5(value.bot?.name, "WhatsApp\u673A\u5668\u4EBA", 100),
       idMasked: text5(value.bot?.idMasked, "WhatsApp\u8D26\u53F7", 140)
@@ -11022,7 +11037,7 @@ function formatRemaining6(milliseconds) {
 }
 
 // plugin-src/client/channels/whatsapp/index.js
-var React20 = __toESM(require("react"), 1);
+var React19 = __toESM(require("react"), 1);
 
 // plugin-src/client/channels/whatsapp/styles.js
 var WHATSAPP_STYLE_ID = "xmanrui-dsh-im-whatsapp-settings";
@@ -11030,31 +11045,6 @@ var CSS10 = String.raw`
 .dwa-page { --ddt-accent: #25d366; --ddt-accent-deep: #128c7e; --ddt-accent-wash: #eafbf0; }
 .dwa-avatar { color: #fff; background: #25d366; }
 .dwa-avatar svg { display: block; }
-.dwa-access { display: grid; gap: 10px; padding: 12px; border: 1px solid var(--dsw-alias-border-l2, #dfe1e5); border-radius: 10px; background: var(--dsw-alias-bg-layer-2, #f7f8fa); }
-.dwa-accessHeading { display: flex; align-items: center; justify-content: space-between; gap: 12px; }
-.dwa-accessHeading > strong { font-size: 13px; }
-.dwa-accessStatus { min-width: 0; display: inline-flex; align-items: center; justify-content: flex-end; gap: 6px; }
-.dwa-accessBadge { flex: none; padding: 3px 8px; border-radius: 999px; color: #08785f; background: #eafbf0; font-size: 11px; font-weight: 700; }
-.dwa-accessBadge[data-mode="private-allowlist"] { color: #0f6f8f; background: #eaf7fd; }
-.dwa-accessBadge[data-mode="open"] { color: #a15c00; background: #fff3d6; }
-.dwa-accessHelp { position: relative; display: inline-flex; flex: none; }
-.dwa-accessHelpButton { width: 20px; height: 20px; display: grid; place-items: center; padding: 0; border: 1px solid color-mix(in srgb, #25d366 34%, var(--dsw-alias-border-l2, #dfe1e5)); border-radius: 50%; color: #128c7e; background: var(--dsw-alias-bg-layer-1, #fff); font: inherit; font-size: 12px; line-height: 1; font-weight: 750; cursor: help; }
-.dwa-accessTooltip { position: absolute; top: calc(100% + 8px); right: 0; z-index: 30; width: 270px; max-width: min(290px, calc(100vw - 48px)); display: grid; gap: 8px; padding: 10px 11px; border: 1px solid var(--dsw-alias-border-l2, #dfe1e5); border-radius: 9px; color: var(--dsw-alias-label-primary, #1f2329); background: var(--dsw-alias-bg-layer-3, #fff); box-shadow: 0 10px 28px rgb(31 35 41 / 16%); opacity: 0; visibility: hidden; transform: translateY(-3px); pointer-events: none; transition: opacity .15s ease, transform .15s ease, visibility .15s ease; }
-.dwa-accessTooltipItem { display: grid; gap: 2px; }
-.dwa-accessTooltipItem + .dwa-accessTooltipItem { padding-top: 8px; border-top: 1px solid var(--dsw-alias-border-l2, #eef0f3); }
-.dwa-accessTooltipItem strong { font-size: 12px; line-height: 17px; }
-.dwa-accessTooltipItem > span { color: var(--dsw-alias-label-secondary, #646a73); font-size: 11px; line-height: 16px; }
-.dwa-accessHelp:hover .dwa-accessTooltip, .dwa-accessHelp:focus-within .dwa-accessTooltip { opacity: 1; visibility: visible; transform: translateY(0); }
-.dwa-accessField { display: grid; gap: 5px; color: var(--dsw-alias-label-primary, #1f2329); font-size: 12px; font-weight: 600; }
-.dwa-accessField select, .dwa-accessField textarea { width: 100%; box-sizing: border-box; border: 1px solid var(--dsw-alias-border-l1, #c9cdd4); border-radius: 7px; color: inherit; background: var(--dsw-alias-bg-layer-1, #fff); font: inherit; font-weight: 400; }
-.dwa-accessField select { height: 34px; padding: 0 9px; }
-.dwa-accessField textarea { min-height: 68px; padding: 8px 9px; resize: vertical; font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
-.dwa-accessField textarea:disabled { color: var(--dsw-alias-label-tertiary, #8f959e); background: var(--dsw-alias-bg-module-platform, #f2f3f5); cursor: not-allowed; resize: none; opacity: 1; }
-.dwa-accessField small { color: var(--dsw-alias-label-secondary, #646a73); font-weight: 400; }
-.dwa-accessWarning, .dwa-accessError { margin: 0; font-size: 12px; line-height: 1.5; }
-.dwa-accessWarning { color: #a15c00; }
-.dwa-accessError { color: var(--dsw-alias-state-error-primary, #d83931); }
-.dwa-accessActions { display: flex; justify-content: flex-end; }
 `;
 function installWhatsappStyles() {
   if (typeof document === "undefined") return () => {
@@ -11072,193 +11062,43 @@ function installWhatsappStyles() {
 
 // plugin-src/client/channels/whatsapp/index.js
 var ACTIVE_STATES3 = /* @__PURE__ */ new Set(["pending", "connecting"]);
-function accessPolicyFor(account) {
-  const accessMode = ["self-only", "private-allowlist", "open"].includes(
-    account?.accessPolicy?.accessMode
-  ) ? account.accessPolicy.accessMode : "self-only";
-  return {
-    accessMode,
-    allowedNumbers: Array.isArray(account?.accessPolicy?.allowedNumbers) ? account.accessPolicy.allowedNumbers : []
-  };
+var Button14 = React19.forwardRef(function Button15({ children, kind = "secondary", className = "", ...props }, ref) {
+  return h2("button", {
+    ...props,
+    ref,
+    type: "button",
+    className: `ddt-button ${className}`.trim(),
+    "data-kind": kind
+  }, children);
+});
+function checkedTime6(value) {
+  if (!value) return "\u5C1A\u672A\u68C0\u67E5";
+  try {
+    return new Intl.DateTimeFormat("zh-CN", {
+      hour: "2-digit",
+      minute: "2-digit",
+      second: "2-digit"
+    }).format(new Date(value));
+  } catch {
+    return "\u521A\u521A";
+  }
 }
-function allowedNumbersFromText(value) {
-  const entries = value.split(/\r?\n/).map((entry) => entry.trim()).filter(Boolean);
-  const normalized = entries.map((entry) => entry.replace(/^\+/, ""));
-  if (normalized.some((entry) => !/^[1-9]\d{4,14}$/.test(entry))) {
-    throw new TypeError("\u7535\u8BDD\u53F7\u7801\u5FC5\u987B\u5305\u542B\u56FD\u5BB6\u6216\u5730\u533A\u4EE3\u7801\uFF0C\u6BCF\u884C\u4E00\u4E2A\u3002");
+function connectionTestNotice3(value) {
+  if (value?.testMessage?.sent === true) {
+    return "\u6D4B\u8BD5\u6D88\u606F\u5DF2\u53D1\u9001\uFF0C\u8BF7\u5230 WhatsApp \u81EA\u804A\u4F1A\u8BDD\u4E2D\u786E\u8BA4\u3002";
   }
-  return [...new Set(normalized)];
-}
-function WhatsappAccessSettings({ account, busy = false, onSave }) {
-  const policy = accessPolicyFor(account);
-  const sourceNumbers = policy.allowedNumbers.join("\n");
-  const helpId = React20.useId();
-  const [accessMode, setAccessMode] = React20.useState(policy.accessMode);
-  const [allowedNumbers, setAllowedNumbers] = React20.useState(sourceNumbers);
-  const [error, setError] = React20.useState(null);
-  React20.useEffect(() => {
-    setAccessMode(policy.accessMode);
-    setAllowedNumbers(sourceNumbers);
-    setError(null);
-  }, [policy.accessMode, sourceNumbers]);
-  const save = async (event) => {
-    event.preventDefault();
-    setError(null);
-    try {
-      const normalized = allowedNumbersFromText(allowedNumbers);
-      if (typeof onSave !== "function") throw new Error("WhatsApp \u8BBF\u95EE\u8BBE\u7F6E\u6682\u4E0D\u53EF\u7528\u3002");
-      await onSave({ accessMode, allowedNumbers: normalized });
-    } catch (caught) {
-      setError(caught?.message ?? "WhatsApp \u8BBF\u95EE\u8BBE\u7F6E\u4FDD\u5B58\u5931\u8D25\u3002");
-    }
-  };
-  const allowlistEnabled = accessMode === "private-allowlist";
-  const labels = {
-    "self-only": "\u4EC5\u81EA\u5DF1\u6A21\u5F0F",
-    "private-allowlist": "\u6307\u5B9A\u8054\u7CFB\u4EBA\u6A21\u5F0F",
-    open: "\u5F00\u653E\u54CD\u5E94\u6A21\u5F0F"
-  };
+  if (value?.testMessage?.code === "test-target-unavailable") {
+    return "\u8FDE\u63A5\u68C0\u67E5\u5B8C\u6210\uFF0C\u4F46\u5F53\u524D\u6CA1\u6709\u53EF\u7528\u7684 WhatsApp \u81EA\u804A\u76EE\u6807\u3002";
+  }
+  return value?.testMessage ? "\u8FDE\u63A5\u68C0\u67E5\u5B8C\u6210\uFF0C\u4F46\u6D4B\u8BD5\u6D88\u606F\u53D1\u9001\u5931\u8D25\u3002" : null;
+}
+function Heading6({ totals, busy, onAdd, addButtonRef }) {
   return h2(
-    "form",
-    { className: "dwa-access", onSubmit: save },
+    "div",
+    { className: "ddt-heading" },
     h2(
       "div",
-      { className: "dwa-accessHeading" },
-      h2("strong", null, "\u8BBF\u95EE\u8BBE\u7F6E"),
-      h2(
-        "span",
-        { className: "dwa-accessStatus" },
-        h2(
-          "span",
-          { className: "dwa-accessBadge", "data-mode": policy.accessMode },
-          ["\u5DF2\u751F\u6548\uFF1A", labels[policy.accessMode]]
-        ),
-        h2(
-          "span",
-          { className: "dwa-accessHelp" },
-          h2("button", {
-            type: "button",
-            className: "dwa-accessHelpButton",
-            "aria-label": "\u67E5\u770B WhatsApp \u8BBF\u95EE\u6A21\u5F0F\u8BF4\u660E",
-            "aria-describedby": helpId
-          }, h2("span", { "aria-hidden": "true" }, "?")),
-          h2(
-            "span",
-            { id: helpId, className: "dwa-accessTooltip", role: "tooltip" },
-            h2(
-              "span",
-              { className: "dwa-accessTooltipItem" },
-              h2("strong", null, "\u4EC5\u81EA\u5DF1\u6A21\u5F0F"),
-              h2("span", null, "\u53EA\u54CD\u5E94\u5DF2\u7ED1\u5B9A WhatsApp \u8D26\u53F7\u7684\u81EA\u804A\u6D88\u606F\u3002")
-            ),
-            h2(
-              "span",
-              { className: "dwa-accessTooltipItem" },
-              h2("strong", null, "\u6307\u5B9A\u8054\u7CFB\u4EBA\u6A21\u5F0F"),
-              h2("span", null, "\u54CD\u5E94\u81EA\u804A\u548C\u767D\u540D\u5355\u8054\u7CFB\u4EBA\u7684\u79C1\u804A\uFF0C\u5FFD\u7565\u7FA4\u804A\u3002")
-            ),
-            h2(
-              "span",
-              { className: "dwa-accessTooltipItem" },
-              h2("strong", null, "\u5F00\u653E\u54CD\u5E94\u6A21\u5F0F"),
-              h2("span", null, "\u54CD\u5E94\u6240\u6709\u79C1\u804A\u3001\u5DF2\u7ED1\u5B9A\u8D26\u53F7\u81EA\u5DF1\u53D1\u51FA\u7684\u7FA4\u804A\u6D88\u606F\uFF0C\u4EE5\u53CA\u5176\u4ED6\u7FA4\u6210\u5458\u7684\u63D0\u53CA\u6216\u56DE\u590D\u3002")
-            )
-          )
-        )
-      )
-    ),
-    h2(
-      "label",
-      { className: "dwa-accessField" },
-      h2("span", null, "\u6A21\u5F0F"),
-      h2(
-        "select",
-        {
-          value: accessMode,
-          disabled: busy,
-          "aria-label": "WhatsApp \u8BBF\u95EE\u6A21\u5F0F",
-          onChange: (event) => {
-            setAccessMode(event.target.value);
-            setError(null);
-          }
-        },
-        h2("option", { value: "self-only" }, "\u4EC5\u81EA\u5DF1\u6A21\u5F0F\uFF08\u9ED8\u8BA4\uFF09"),
-        h2("option", { value: "private-allowlist" }, "\u6307\u5B9A\u8054\u7CFB\u4EBA\u6A21\u5F0F"),
-        h2("option", { value: "open" }, "\u5F00\u653E\u54CD\u5E94\u6A21\u5F0F")
-      )
-    ),
-    allowlistEnabled ? h2(
-      "label",
-      { className: "dwa-accessField" },
-      h2("span", null, "\u5141\u8BB8\u79C1\u804A\u7684 WhatsApp \u7535\u8BDD\u53F7\u7801"),
-      h2("textarea", {
-        value: allowedNumbers,
-        disabled: busy,
-        rows: 3,
-        placeholder: "\u6BCF\u884C\u4E00\u4E2A\u542B\u56FD\u5BB6\u6216\u5730\u533A\u4EE3\u7801\u7684\u53F7\u7801",
-        "aria-label": "\u5141\u8BB8\u79C1\u804A\u7684 WhatsApp \u7535\u8BDD\u53F7\u7801",
-        onChange: (event) => {
-          setAllowedNumbers(event.target.value);
-          setError(null);
-        }
-      }),
-      h2("small", null, "\u53EF\u4EE5\u5305\u542B\u5F00\u5934\u7684 +\uFF0C\u4FDD\u5B58\u65F6\u4F1A\u81EA\u52A8\u79FB\u9664\u3002")
-    ) : null,
-    allowlistEnabled && allowedNumbers.trim() === "" ? h2(
-      "p",
-      { className: "dwa-accessWarning", role: "status" },
-      "\u767D\u540D\u5355\u4E3A\u7A7A\uFF1B\u4FDD\u5B58\u540E\u5C06\u53EA\u63A5\u53D7\u81EA\u804A\u6D88\u606F\u3002"
-    ) : null,
-    error ? h2("p", { className: "dwa-accessError", role: "alert" }, error) : null,
-    h2(
-      "div",
-      { className: "dwa-accessActions" },
-      h2("button", {
-        type: "submit",
-        className: "ddt-button",
-        "data-kind": "secondary",
-        disabled: busy
-      }, busy ? "\u6B63\u5728\u4FDD\u5B58\u2026" : "\u4FDD\u5B58\u8BBF\u95EE\u8BBE\u7F6E")
-    )
-  );
-}
-var Button14 = React20.forwardRef(function Button15({ children, kind = "secondary", className = "", ...props }, ref) {
-  return h2("button", {
-    ...props,
-    ref,
-    type: "button",
-    className: `ddt-button ${className}`.trim(),
-    "data-kind": kind
-  }, children);
-});
-function checkedTime6(value) {
-  if (!value) return "\u5C1A\u672A\u68C0\u67E5";
-  try {
-    return new Intl.DateTimeFormat("zh-CN", {
-      hour: "2-digit",
-      minute: "2-digit",
-      second: "2-digit"
-    }).format(new Date(value));
-  } catch {
-    return "\u521A\u521A";
-  }
-}
-function connectionTestNotice3(value) {
-  if (value?.testMessage?.sent === true) {
-    return "\u6D4B\u8BD5\u6D88\u606F\u5DF2\u53D1\u9001\uFF0C\u8BF7\u5230 WhatsApp \u81EA\u804A\u4F1A\u8BDD\u4E2D\u786E\u8BA4\u3002";
-  }
-  if (value?.testMessage?.code === "test-target-unavailable") {
-    return "\u8FDE\u63A5\u68C0\u67E5\u5B8C\u6210\uFF0C\u4F46\u5F53\u524D\u6CA1\u6709\u53EF\u7528\u7684 WhatsApp \u81EA\u804A\u76EE\u6807\u3002";
-  }
-  return value?.testMessage ? "\u8FDE\u63A5\u68C0\u67E5\u5B8C\u6210\uFF0C\u4F46\u6D4B\u8BD5\u6D88\u606F\u53D1\u9001\u5931\u8D25\u3002" : null;
-}
-function Heading6({ totals, busy, onAdd, addButtonRef }) {
-  return h2(
-    "div",
-    { className: "ddt-heading" },
-    h2(
-      "div",
-      { className: "ddt-tools" },
+      { className: "ddt-tools" },
       h2(
         "div",
         { className: "dim-bindActions" },
@@ -11446,7 +11286,6 @@ function WhatsappAccountCard({
   onWorkspaceSave,
   onAgentPresetSave,
   onContextEnhancementSave,
-  onAccessPolicySave,
   onRequestRemove,
   onConfirmRemove,
   onCancelRemove
@@ -11493,7 +11332,8 @@ function WhatsappAccountCard({
             channel: "whatsapp",
             botId: account.botId,
             botName: account.bot.name,
-            connected: account.connected
+            connected: account.connected,
+            accessPolicy: account.accessPolicy
           })
         )
       ),
@@ -11512,11 +11352,6 @@ function WhatsappAccountCard({
         disabled: Boolean(busy),
         onSave: onContextEnhancementSave
       }),
-      h2(WhatsappAccessSettings, {
-        account,
-        busy: Boolean(busy),
-        onSave: onAccessPolicySave
-      }),
       h2(
         "div",
         { className: "ddt-accountFooter dim-cardFooter" },
@@ -11559,23 +11394,23 @@ function WhatsappAccountCard({
   );
 }
 function WhatsappSettingsTab({ rpcCall }) {
-  const [model, setModel] = React20.useState({
+  const [model, setModel] = React19.useState({
     phase: "loading",
     bots: [],
     totals: { configured: 0, connected: 0 },
     error: null,
     agentPresetCatalog: EMPTY_AGENT_PRESET_CATALOG
   });
-  const [provision, setProvision] = React20.useState(null);
-  const [busy, setBusy] = React20.useState(false);
-  const [busyByBot, setBusyByBot] = React20.useState({});
-  const [testNoticeByBot, setTestNoticeByBot] = React20.useState({});
-  const [removeTarget, setRemoveTarget] = React20.useState(null);
-  const [now, setNow] = React20.useState(Date.now());
-  const mounted = React20.useRef(true);
+  const [provision, setProvision] = React19.useState(null);
+  const [busy, setBusy] = React19.useState(false);
+  const [busyByBot, setBusyByBot] = React19.useState({});
+  const [testNoticeByBot, setTestNoticeByBot] = React19.useState({});
+  const [removeTarget, setRemoveTarget] = React19.useState(null);
+  const [now, setNow] = React19.useState(Date.now());
+  const mounted = React19.useRef(true);
   const workspaceFence = useWorkspaceSnapshotFence();
-  const addButtonRef = React20.useRef(null);
-  React20.useEffect(() => {
+  const addButtonRef = React19.useRef(null);
+  React19.useEffect(() => {
     const disposeDingtalk = installDingtalkStyles();
     const disposeWhatsapp = installWhatsappStyles();
     mounted.current = true;
@@ -11585,11 +11420,11 @@ function WhatsappSettingsTab({ rpcCall }) {
       disposeDingtalk();
     };
   }, []);
-  const invoke = React20.useCallback(async (endpoint, payload = {}, signal) => {
+  const invoke = React19.useCallback(async (endpoint, payload = {}, signal) => {
     if (typeof rpcCall !== "function") throw new TypeError("WhatsApp \u8BBE\u7F6E\u9875\u7F3A\u5C11 RPC \u8FDE\u63A5");
     return unwrapRpcResult9(await rpcCall(endpoint, payload, signal));
   }, [rpcCall]);
-  const loadStatus = React20.useCallback(async ({ signal, silent = false, restore = false } = {}) => {
+  const loadStatus = React19.useCallback(async ({ signal, silent = false, restore = false } = {}) => {
     const workspaceVersion = workspaceFence.beginStatus();
     if (workspaceVersion === null) return void 0;
     if (!silent && mounted.current) setModel((current) => ({ ...current, phase: "loading", error: null }));
@@ -11619,12 +11454,12 @@ function WhatsappSettingsTab({ rpcCall }) {
       return void 0;
     }
   }, [invoke, workspaceFence]);
-  React20.useEffect(() => {
+  React19.useEffect(() => {
     const controller = new AbortController();
     void loadStatus({ signal: controller.signal, restore: true });
     return () => controller.abort();
   }, [loadStatus]);
-  React20.useEffect(() => {
+  React19.useEffect(() => {
     if (model.phase !== "ready") return void 0;
     const controller = new AbortController();
     const timer = window.setInterval(
@@ -11636,12 +11471,12 @@ function WhatsappSettingsTab({ rpcCall }) {
       window.clearInterval(timer);
     };
   }, [loadStatus, model.phase]);
-  React20.useEffect(() => {
+  React19.useEffect(() => {
     if (!provision || !ACTIVE_STATES3.has(provision.status)) return void 0;
     const timer = window.setInterval(() => mounted.current && setNow(Date.now()), 1e3);
     return () => window.clearInterval(timer);
   }, [provision?.attemptId, provision?.status]);
-  const startProvisioning = React20.useCallback(async (replace = false) => {
+  const startProvisioning = React19.useCallback(async (replace = false) => {
     setBusy(true);
     try {
       if (replace && provision?.attemptId) {
@@ -11659,7 +11494,7 @@ function WhatsappSettingsTab({ rpcCall }) {
       if (mounted.current) setBusy(false);
     }
   }, [invoke, provision?.attemptId]);
-  const closeProvision = React20.useCallback(async () => {
+  const closeProvision = React19.useCallback(async () => {
     setBusy(true);
     try {
       if (provision?.attemptId && ACTIVE_STATES3.has(provision.status)) {
@@ -11670,7 +11505,7 @@ function WhatsappSettingsTab({ rpcCall }) {
       if (mounted.current) setBusy(false);
     }
   }, [invoke, provision?.attemptId, provision?.status]);
-  React20.useEffect(() => {
+  React19.useEffect(() => {
     const attemptId = provision?.attemptId;
     if (!attemptId || !ACTIVE_STATES3.has(provision.status)) return void 0;
     const controller = new AbortController();
@@ -11711,7 +11546,7 @@ function WhatsappSettingsTab({ rpcCall }) {
       if (timer) window.clearTimeout(timer);
     };
   }, [invoke, loadStatus, provision?.attemptId, provision?.status]);
-  const botAction = React20.useCallback(async (account, operation, endpoint, payload) => {
+  const botAction = React19.useCallback(async (account, operation, endpoint, payload) => {
     const snapshotVersion = workspaceFence.beginMutation();
     setBusyByBot((current) => ({ ...current, [account.botId]: operation }));
     if (operation === "reconnect") {
@@ -11794,12 +11629,6 @@ function WhatsappSettingsTab({ rpcCall }) {
         WHATSAPP_ENDPOINTS.setContextEnhancement,
         { botId: account.botId, config }
       ),
-      onAccessPolicySave: (accessPolicy) => botAction(
-        account,
-        "access",
-        WHATSAPP_ENDPOINTS.setAccessPolicy,
-        { botId: account.botId, ...accessPolicy }
-      ),
       onRequestRemove: () => setRemoveTarget(account.botId),
       onCancelRemove: () => setRemoveTarget(null),
       onConfirmRemove: async () => {
@@ -11836,7 +11665,7 @@ function WhatsappSettingsTab({ rpcCall }) {
         h2(Button14, { onClick: () => void loadStatus() }, "\u91CD\u65B0\u8BFB\u53D6")
       )
     ) : h2(
-      React20.Fragment,
+      React19.Fragment,
       null,
       provision?.status === "pending" ? h2(QrPanel5, {
         provision,
@@ -11857,6 +11686,404 @@ function WhatsappSettingsTab({ rpcCall }) {
 
 // plugin-src/client/delivery-settings.js
 var React21 = __toESM(require("react"), 1);
+
+// plugin-src/client/access-policy-settings.js
+var React20 = __toESM(require("react"), 1);
+var ACCESS_POLICY_ENDPOINT = "bot.access-policy.set";
+var ACCESS_CHANNEL_DEFINITIONS = Object.freeze({
+  weixin: Object.freeze({
+    directUserLabel: "\u5FAE\u4FE1\u7528\u6237 ID",
+    directPlaceholder: "\u586B\u5199\u5FAE\u4FE1\u7528\u6237 ID",
+    groupSupported: false
+  }),
+  feishu: Object.freeze({
+    directUserLabel: "\u98DE\u4E66 Open ID",
+    directPlaceholder: "ou_xxx",
+    groupUserLabel: "\u7FA4\u6210\u5458 Open ID",
+    groupPlaceholder: "ou_xxx"
+  }),
+  dingtalk: Object.freeze({
+    directUserLabel: "\u9489\u9489\u7528\u6237 ID",
+    directPlaceholder: "\u586B\u5199 senderStaffId \u6216 senderId",
+    groupUserLabel: "\u7FA4\u6210\u5458\u7528\u6237 ID",
+    groupPlaceholder: "\u586B\u5199 senderStaffId \u6216 senderId"
+  }),
+  wecom: Object.freeze({
+    directUserLabel: "\u4F01\u4E1A\u5FAE\u4FE1\u7528\u6237 ID",
+    directPlaceholder: "\u586B\u5199 userid",
+    groupUserLabel: "\u7FA4\u6210\u5458\u7528\u6237 ID",
+    groupPlaceholder: "\u586B\u5199 userid"
+  }),
+  qq: Object.freeze({
+    directUserLabel: "QQ User Open ID",
+    directPlaceholder: "\u586B\u5199 user_openid",
+    groupUserLabel: "\u7FA4\u6210\u5458 Open ID",
+    groupPlaceholder: "\u586B\u5199 member_openid"
+  }),
+  slack: Object.freeze({
+    directUserLabel: "Slack User ID",
+    directPlaceholder: "U0123456789",
+    groupUserLabel: "\u7FA4\u6210\u5458 User ID",
+    groupPlaceholder: "U0123456789"
+  }),
+  telegram: Object.freeze({
+    directUserLabel: "Telegram User ID",
+    directPlaceholder: "\u586B\u5199\u6570\u5B57 User ID",
+    groupUserLabel: "\u7FA4\u6210\u5458 User ID",
+    groupPlaceholder: "\u586B\u5199\u6570\u5B57 User ID"
+  }),
+  discord: Object.freeze({
+    directUserLabel: "Discord User ID",
+    directPlaceholder: "\u586B\u5199\u6570\u5B57 User ID",
+    groupUserLabel: "\u7FA4\u6210\u5458 User ID",
+    groupPlaceholder: "\u586B\u5199\u6570\u5B57 User ID"
+  }),
+  whatsapp: Object.freeze({
+    directUserLabel: "WhatsApp \u7535\u8BDD\u53F7\u7801\u6216 JID",
+    directPlaceholder: "8613800000000 \u6216\u5B8C\u6574 JID",
+    groupUserLabel: "\u7FA4\u6210\u5458\u7535\u8BDD\u53F7\u7801\u6216 JID",
+    groupPlaceholder: "8613800000000 \u6216\u5B8C\u6574 JID"
+  })
+});
+function clonePolicy(policy) {
+  const cloneScope = (scope) => ({
+    mode: scope.mode,
+    open: {
+      defaultCanExecuteCommands: scope.open.defaultCanExecuteCommands,
+      commandPermissionOverrides: scope.open.commandPermissionOverrides.map((user) => ({
+        ...user
+      }))
+    },
+    allowlist: {
+      users: scope.allowlist.users.map((user) => ({ ...user }))
+    }
+  });
+  return {
+    direct: cloneScope(policy.direct),
+    group: cloneScope(policy.group)
+  };
+}
+function unwrapRpcResult10(result) {
+  if (result?.ok === true) return result.value;
+  if (result?.ok === false) {
+    const error = new Error(result.error?.message || "\u8BBF\u95EE\u8BBE\u7F6E\u4FDD\u5B58\u5931\u8D25\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002");
+    error.code = result.error?.code;
+    throw error;
+  }
+  return result;
+}
+function policyFromSnapshot(value, botId) {
+  const source = value?.snapshot ?? value;
+  const bot = Array.isArray(source?.bots) ? source.bots.find((entry) => entry?.botId === botId) : null;
+  return normalizeAccessPolicy(bot?.accessPolicy ?? source?.accessPolicy ?? source?.policy);
+}
+function commandValue(value) {
+  return value === "allow";
+}
+function ScenePolicyEditor({
+  scene,
+  title,
+  policy,
+  userLabel,
+  placeholder,
+  disabled = false,
+  unsupported = false,
+  onChange
+}) {
+  const ownerHelpId = React20.useId();
+  const emptyAllowlistHelpId = React20.useId();
+  const allowlist = policy.mode === "allowlist";
+  const collectionKey = allowlist ? "users" : "commandPermissionOverrides";
+  const branchKey = allowlist ? "allowlist" : "open";
+  const users = policy[branchKey][collectionKey];
+  const emptyAllowlist = allowlist && users.length === 0;
+  const updateUsers = (nextUsers) => onChange({
+    ...policy,
+    [branchKey]: {
+      ...policy[branchKey],
+      [collectionKey]: nextUsers
+    }
+  });
+  const updateUser = (index, patch) => updateUsers(users.map((user, userIndex) => userIndex === index ? { ...user, ...patch } : user));
+  return h2(
+    "fieldset",
+    {
+      className: "dim-accessScene",
+      disabled,
+      "data-scene": scene,
+      "aria-label": localizeText(title)
+    },
+    h2(
+      "legend",
+      null,
+      h2(
+        "span",
+        { className: "dim-accessLegendContent" },
+        h2("span", null, title),
+        h2(
+          "span",
+          { className: "dim-channelHelp dim-accessLegendHelp" },
+          h2("button", {
+            type: "button",
+            className: "dim-channelHelpButton",
+            "aria-label": [localizeText(title), localizeText("\u67E5\u770B\u8BBF\u95EE\u6743\u9650\u8BF4\u660E")].join(" "),
+            "aria-describedby": ownerHelpId
+          }, h2("span", { "aria-hidden": true }, "?")),
+          h2("span", {
+            id: ownerHelpId,
+            className: "dim-channelTooltip dim-accessHelpTooltip",
+            role: "tooltip"
+          }, "\u539F\u6240\u6709\u8005\u6216\u626B\u7801\u63A5\u5165\u8005\u59CB\u7EC8\u53EF\u4EE5\u8BBF\u95EE\u5E76\u6267\u884C\u547D\u4EE4\uFF1B\u4EE5\u4E0B\u8BBE\u7F6E\u4EC5\u7EA6\u675F\u5176\u4ED6\u7528\u6237\u3002")
+        )
+      )
+    ),
+    unsupported ? h2(
+      "div",
+      { className: "dim-accessUnsupported", role: "note" },
+      h2("strong", null, "\u5F53\u524D\u6E20\u9053\u4E0D\u652F\u6301\u7FA4\u804A"),
+      h2("p", null, "\u6B64\u533A\u57DF\u65E0\u9700\u914D\u7F6E\uFF0C\u4FDD\u5B58\u79C1\u804A\u8BBE\u7F6E\u65F6\u4F1A\u4FDD\u7559\u73B0\u6709\u7FA4\u804A\u7B56\u7565\u3002")
+    ) : h2(
+      React20.Fragment,
+      null,
+      h2(
+        "div",
+        { className: "dim-accessControls", "data-mode": policy.mode },
+        h2(
+          "label",
+          { className: "dim-accessField" },
+          h2("span", null, "\u8BBF\u95EE\u6A21\u5F0F"),
+          h2(
+            "select",
+            {
+              value: policy.mode,
+              "aria-label": [localizeText(title), localizeText("\u8BBF\u95EE\u6A21\u5F0F")].join(" "),
+              onChange: (event) => onChange({ ...policy, mode: event.target.value })
+            },
+            h2("option", { value: "open" }, "\u5141\u8BB8\u6240\u6709\u7528\u6237"),
+            h2("option", { value: "allowlist" }, "\u4EC5\u767D\u540D\u5355\u7528\u6237")
+          )
+        ),
+        allowlist ? null : h2(
+          "label",
+          { className: "dim-accessField" },
+          h2("span", null, "\u9ED8\u8BA4\u547D\u4EE4\u6743\u9650"),
+          h2(
+            "select",
+            {
+              value: policy.open.defaultCanExecuteCommands ? "allow" : "deny",
+              "aria-label": [localizeText(title), localizeText("\u9ED8\u8BA4\u547D\u4EE4\u6743\u9650")].join(" "),
+              onChange: (event) => onChange({
+                ...policy,
+                open: {
+                  ...policy.open,
+                  defaultCanExecuteCommands: commandValue(event.target.value)
+                }
+              })
+            },
+            h2("option", { value: "allow" }, "\u53EF\u4EE5\u6267\u884C\u547D\u4EE4"),
+            h2("option", { value: "deny" }, "\u4E0D\u53EF\u4EE5\u6267\u884C\u547D\u4EE4")
+          )
+        )
+      ),
+      h2(
+        "div",
+        { className: "dim-accessUsers" },
+        h2(
+          "div",
+          { className: "dim-accessUsersHeading" },
+          h2(
+            "div",
+            { className: "dim-accessUsersTitle" },
+            h2("strong", null, allowlist ? "\u767D\u540D\u5355\u7528\u6237" : "\u547D\u4EE4\u6743\u9650\u4F8B\u5916"),
+            emptyAllowlist ? h2(
+              "span",
+              { className: "dim-channelHelp dim-accessUsersHelp" },
+              h2("button", {
+                type: "button",
+                className: "dim-channelHelpButton",
+                "aria-label": [localizeText(title), localizeText("\u67E5\u770B\u767D\u540D\u5355\u8BF4\u660E")].join(" "),
+                "aria-describedby": emptyAllowlistHelpId
+              }, h2("span", { "aria-hidden": true }, "?")),
+              h2("span", {
+                id: emptyAllowlistHelpId,
+                className: "dim-channelTooltip dim-accessEmptyAllowlistTooltip",
+                role: "tooltip"
+              }, "\u5F53\u524D\u6CA1\u6709\u767D\u540D\u5355\u7528\u6237\uFF0C\u4FDD\u5B58\u540E\u666E\u901A\u7528\u6237\u5C06\u65E0\u6CD5\u4F7F\u7528\u673A\u5668\u4EBA\u3002")
+            ) : null
+          ),
+          h2("button", {
+            type: "button",
+            className: "dim-deliveryButton dim-accessAddUser",
+            "aria-label": [localizeText(title), localizeText("\u65B0\u589E\u7528\u6237")].join(" "),
+            title: localizeText("\u65B0\u589E\u7528\u6237"),
+            onClick: () => updateUsers([...users, {
+              id: "",
+              canExecuteCommands: allowlist ? false : !policy.open.defaultCanExecuteCommands
+            }])
+          }, h2("span", { "aria-hidden": true }, "+"))
+        ),
+        users.length === 0 ? h2("div", { className: "dim-accessUsersEmpty" }, "\u5C1A\u672A\u6DFB\u52A0\u7528\u6237") : h2("ul", { className: "dim-accessUserList" }, users.map((user, index) => h2(
+          "li",
+          { key: `${scene}-${policy.mode}-${index}`, className: "dim-accessUserRow" },
+          h2(
+            "label",
+            { className: "dim-accessField dim-accessUserId" },
+            h2("span", null, userLabel),
+            h2("input", {
+              value: user.id,
+              maxLength: 256,
+              required: true,
+              autoCapitalize: "none",
+              autoCorrect: "off",
+              spellCheck: false,
+              placeholder,
+              "aria-label": [localizeText(title), localizeText(userLabel), index + 1].join(" "),
+              onChange: (event) => updateUser(index, { id: event.target.value })
+            })
+          ),
+          h2(
+            "label",
+            { className: "dim-accessField dim-accessUserCommand" },
+            h2("span", null, "\u547D\u4EE4\u6743\u9650"),
+            h2(
+              "select",
+              {
+                value: user.canExecuteCommands ? "allow" : "deny",
+                "aria-label": [
+                  localizeText(title),
+                  localizeText("\u7528\u6237"),
+                  index + 1,
+                  localizeText("\u547D\u4EE4\u6743\u9650")
+                ].join(" "),
+                onChange: (event) => updateUser(index, {
+                  canExecuteCommands: commandValue(event.target.value)
+                })
+              },
+              h2("option", { value: "allow" }, "\u53EF\u4EE5\u6267\u884C\u547D\u4EE4"),
+              h2("option", { value: "deny" }, "\u4E0D\u53EF\u4EE5\u6267\u884C\u547D\u4EE4")
+            )
+          ),
+          h2("button", {
+            type: "button",
+            className: "dim-deliveryButton dim-accessDeleteUser",
+            "data-kind": "danger",
+            "aria-label": [
+              localizeText(title),
+              localizeText("\u5220\u9664"),
+              localizeText("\u7528\u6237"),
+              index + 1
+            ].join(" "),
+            onClick: () => updateUsers(users.filter((_, userIndex) => userIndex !== index))
+          }, "\u5220\u9664")
+        )))
+      )
+    )
+  );
+}
+function AccessPolicySettingsPage({ channel: channel4, account, rpcCall, onSaved }) {
+  const definition = ACCESS_CHANNEL_DEFINITIONS[channel4];
+  const initialPolicy = normalizeAccessPolicy(account?.accessPolicy);
+  const initialKey = JSON.stringify(initialPolicy);
+  const [draft, setDraft] = React20.useState(() => clonePolicy(
+    initialPolicy ?? DEFAULT_ACCESS_POLICY
+  ));
+  const [saving, setSaving] = React20.useState(false);
+  const [feedback, setFeedback] = React20.useState(null);
+  React20.useEffect(() => {
+    const next = normalizeAccessPolicy(account?.accessPolicy);
+    setDraft(clonePolicy(next ?? DEFAULT_ACCESS_POLICY));
+  }, [account?.botId, initialKey]);
+  React20.useEffect(() => {
+    setFeedback(null);
+  }, [account?.botId]);
+  if (!definition) {
+    return h2(
+      "div",
+      { className: "dim-accessState", role: "alert" },
+      "\u5F53\u524D\u6E20\u9053\u6682\u4E0D\u652F\u6301\u8BBF\u95EE\u8BBE\u7F6E\u3002"
+    );
+  }
+  const save = async (event) => {
+    event.preventDefault();
+    setFeedback(null);
+    setSaving(true);
+    try {
+      const policy = validateAccessPolicy(draft);
+      if (typeof rpcCall !== "function") throw new Error("\u8BBF\u95EE\u8BBE\u7F6E\u6682\u4E0D\u53EF\u7528\u3002");
+      const value = unwrapRpcResult10(await rpcCall(ACCESS_POLICY_ENDPOINT, {
+        botId: account.botId,
+        policy
+      }));
+      const saved = policyFromSnapshot(value, account.botId);
+      if (!saved) throw new Error("\u670D\u52A1\u6CA1\u6709\u8FD4\u56DE\u5DF2\u4FDD\u5B58\u7684\u8BBF\u95EE\u7B56\u7565\uFF0C\u8BF7\u5237\u65B0\u540E\u91CD\u8BD5\u3002");
+      setDraft(clonePolicy(saved));
+      onSaved?.(saved);
+      setFeedback({ tone: "success", message: "\u8BBF\u95EE\u8BBE\u7F6E\u5DF2\u4FDD\u5B58\u3002" });
+    } catch (error) {
+      setFeedback({
+        tone: "error",
+        message: error?.message || "\u8BBF\u95EE\u8BBE\u7F6E\u4FDD\u5B58\u5931\u8D25\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002"
+      });
+    } finally {
+      setSaving(false);
+    }
+  };
+  return h2(
+    "form",
+    {
+      className: "dim-accessPage",
+      onSubmit: (event) => void save(event)
+    },
+    initialPolicy ? null : h2(
+      "div",
+      { className: "dim-accessState", role: "alert" },
+      "\u8BBF\u95EE\u7B56\u7565\u5C1A\u672A\u5C31\u7EEA\uFF0C\u8BF7\u8FD4\u56DE\u673A\u5668\u4EBA\u5217\u8868\u5237\u65B0\u540E\u91CD\u8BD5\u3002"
+    ),
+    h2(ScenePolicyEditor, {
+      scene: "direct",
+      title: "\u79C1\u804A",
+      policy: draft.direct,
+      userLabel: definition.directUserLabel,
+      placeholder: definition.directPlaceholder,
+      disabled: saving,
+      onChange: (direct) => {
+        setDraft((current) => ({ ...current, direct }));
+        setFeedback(null);
+      }
+    }),
+    h2(ScenePolicyEditor, {
+      scene: "group",
+      title: "\u7FA4\u804A",
+      policy: draft.group,
+      userLabel: definition.groupUserLabel ?? definition.directUserLabel,
+      placeholder: definition.groupPlaceholder ?? definition.directPlaceholder,
+      disabled: saving || definition.groupSupported === false,
+      unsupported: definition.groupSupported === false,
+      onChange: (group) => {
+        setDraft((current) => ({ ...current, group }));
+        setFeedback(null);
+      }
+    }),
+    feedback ? h2("p", {
+      className: "dim-accessFeedback",
+      "data-tone": feedback.tone,
+      role: feedback.tone === "error" ? "alert" : "status",
+      "aria-live": "polite"
+    }, feedback.message) : null,
+    h2(
+      "div",
+      { className: "dim-accessActions" },
+      h2("button", {
+        type: "submit",
+        className: "dim-deliveryButton",
+        "data-kind": "primary",
+        disabled: saving || !initialPolicy
+      }, saving ? "\u6B63\u5728\u4FDD\u5B58\u2026" : "\u4FDD\u5B58\u8BBF\u95EE\u8BBE\u7F6E")
+    )
+  );
+}
+
+// plugin-src/client/delivery-settings.js
 var DELIVERY_RPC_CHANNEL = "/dsh-im-delivery";
 var DELIVERY_DOCS_URL = Object.freeze({
   zh: "https://github.com/xmanrui/dsh-im/blob/main/PROACTIVE_DELIVERY.md",
@@ -11870,6 +12097,10 @@ var DELIVERY_ENDPOINTS = Object.freeze({
   delete: "target.delete",
   test: "target.test"
 });
+var BOT_SETTINGS_TABS = Object.freeze([
+  Object.freeze({ id: "delivery", label: "\u6295\u9012\u8BBE\u7F6E" }),
+  Object.freeze({ id: "access", label: "\u8BBF\u95EE\u8BBE\u7F6E" })
+]);
 var CHANNEL_DEFINITIONS = Object.freeze({
   weixin: {
     label: "\u5FAE\u4FE1",
@@ -11947,7 +12178,7 @@ var CHANNEL_DEFINITIONS = Object.freeze({
 function presentError10(error, fallback) {
   return error?.message || fallback;
 }
-function unwrapRpcResult10(result) {
+function unwrapRpcResult11(result) {
   if (result?.ok === true) return result.value;
   if (result?.ok === false) {
     const error = new Error(result.error?.message || "\u8BF7\u6C42\u5931\u8D25\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002");
@@ -12405,8 +12636,15 @@ function TargetRow({ definition, target, botId, connected, rpcCall, onChanged, o
     ) : null
   );
 }
-function DeliveryTargetSettingsPage({ channel: channel4, account, rpcCall, onBack }) {
+function DeliveryTargetSettingsPage({
+  channel: channel4,
+  account,
+  rpcCall,
+  accessRpcCall,
+  onBack
+}) {
   const definition = CHANNEL_DEFINITIONS[channel4];
+  const [activeTabId, setActiveTabId] = React21.useState(BOT_SETTINGS_TABS[0].id);
   const [phase, setPhase] = React21.useState("loading");
   const [targets, setTargets] = React21.useState([]);
   const [suggestionPhase, setSuggestionPhase] = React21.useState("idle");
@@ -12416,10 +12654,14 @@ function DeliveryTargetSettingsPage({ channel: channel4, account, rpcCall, onBac
   const [editor, setEditor] = React21.useState(null);
   const [saving, setSaving] = React21.useState(false);
   const [botCopyState, setBotCopyState] = React21.useState(null);
+  const [accessPolicy, setAccessPolicy] = React21.useState(account.accessPolicy);
   const mounted = React21.useRef(true);
+  React21.useEffect(() => {
+    setAccessPolicy(account.accessPolicy);
+  }, [account.botId, account.accessPolicy]);
   const invoke = React21.useCallback(async (endpoint, payload = {}, signal) => {
     if (typeof rpcCall !== "function") throw new Error("\u6295\u9012\u76EE\u6807\u8BBE\u7F6E\u6682\u4E0D\u53EF\u7528\u3002");
-    return unwrapRpcResult10(await rpcCall(endpoint, payload, signal));
+    return unwrapRpcResult11(await rpcCall(endpoint, payload, signal));
   }, [rpcCall]);
   const loadTargets = React21.useCallback(async ({ signal, silent = false } = {}) => {
     if (!silent) setPhase("loading");
@@ -12520,6 +12762,9 @@ function DeliveryTargetSettingsPage({ channel: channel4, account, rpcCall, onBac
       setBotCopyState(presentError10(caught, "\u590D\u5236\u5931\u8D25\u3002"));
     }
   };
+  const activeTab = BOT_SETTINGS_TABS.find((tab) => tab.id === activeTabId) ?? BOT_SETTINGS_TABS[0];
+  const activeTabDomId = `dim-bot-settings-${activeTab.id}-tab`;
+  const activePanelId = `dim-bot-settings-${activeTab.id}-panel`;
   return h2(
     "section",
     {
@@ -12529,114 +12774,147 @@ function DeliveryTargetSettingsPage({ channel: channel4, account, rpcCall, onBac
     h2(
       "header",
       { className: "dim-deliveryHeader" },
-      h2(DeliveryButton, { className: "dim-deliveryBack", onClick: onBack }, "\u2190 \u8FD4\u56DE\u673A\u5668\u4EBA\u5217\u8868"),
-      h2(
-        "div",
-        { className: "dim-deliveryHeaderMeta" },
-        h2(
-          "a",
-          {
-            className: "dim-deliveryDocsLink",
-            href: isEnglish() ? DELIVERY_DOCS_URL.en : DELIVERY_DOCS_URL.zh,
-            target: "_blank",
-            rel: "noopener noreferrer",
-            "aria-label": "\u6253\u5F00\u4E3B\u52A8\u6295\u9012\u4F7F\u7528\u6587\u6863"
-          },
-          h2("span", null, "\u4F7F\u7528\u6587\u6863"),
-          h2("span", { "aria-hidden": "true" }, "\u2197")
-        )
-      )
+      h2(DeliveryButton, { className: "dim-deliveryBack", onClick: onBack }, "\u2190 \u8FD4\u56DE\u673A\u5668\u4EBA\u5217\u8868")
     ),
     h2(
-      "section",
-      { className: "dim-deliveryIdentity", "aria-labelledby": "dim-delivery-bot-title" },
-      h2(
-        "div",
-        null,
-        h2(
-          "h2",
-          { id: "dim-delivery-bot-title", className: "dim-deliveryBotName" },
-          account.botName || "\u673A\u5668\u4EBA\u8BBE\u7F6E"
-        )
-      ),
-      h2(
-        "div",
-        { className: "dim-deliveryBotId" },
-        h2("span", null, "Bot ID"),
-        h2("code", { title: account.botId }, account.botId),
-        h2(DeliveryButton, { onClick: () => void copyBotId() }, "\u590D\u5236")
-      ),
-      botCopyState ? h2("p", { className: "dim-targetFeedback", role: "status" }, botCopyState) : null
+      "div",
+      { className: "dim-botSettingsTabsBar" },
+      h2("nav", {
+        className: "dim-botSettingsTabs",
+        role: "tablist",
+        "aria-label": "\u673A\u5668\u4EBA\u8BBE\u7F6E\u9875\u7B7E"
+      }, BOT_SETTINGS_TABS.map((tab) => h2("button", {
+        key: tab.id,
+        id: `dim-bot-settings-${tab.id}-tab`,
+        type: "button",
+        role: "tab",
+        className: "dim-botSettingsTab",
+        "aria-selected": tab.id === activeTab.id,
+        "aria-controls": `dim-bot-settings-${tab.id}-panel`,
+        tabIndex: tab.id === activeTab.id ? 0 : -1,
+        onClick: () => setActiveTabId(tab.id)
+      }, tab.label)))
     ),
     h2(
-      "section",
-      { className: "dim-deliveryTargets", "aria-labelledby": "dim-delivery-targets-title" },
-      h2(
-        "div",
-        { className: "dim-deliverySectionHeading" },
+      "div",
+      {
+        id: activePanelId,
+        className: "dim-botSettingsTabPanel",
+        role: "tabpanel",
+        "aria-labelledby": activeTabDomId
+      },
+      activeTab.id === "access" ? h2(AccessPolicySettingsPage, {
+        channel: channel4,
+        account: { ...account, accessPolicy },
+        rpcCall: accessRpcCall,
+        onSaved: setAccessPolicy
+      }) : h2(
+        React21.Fragment,
+        null,
         h2(
-          "div",
-          null,
-          h2("h3", { id: "dim-delivery-targets-title" }, "\u6295\u9012\u76EE\u6807"),
-          account.connected ? null : h2("p", null, "\u673A\u5668\u4EBA\u5F53\u524D\u79BB\u7EBF\uFF1B\u4ECD\u53EF\u914D\u7F6E\u76EE\u6807\uFF0C\u6062\u590D\u8FDE\u63A5\u540E\u518D\u6D4B\u8BD5\u3002")
+          "section",
+          { className: "dim-deliveryIdentity", "aria-labelledby": "dim-delivery-bot-title" },
+          h2(
+            "div",
+            { className: "dim-deliveryIdentityHeading" },
+            h2(
+              "h2",
+              { id: "dim-delivery-bot-title", className: "dim-deliveryBotName" },
+              account.botName || "\u673A\u5668\u4EBA\u8BBE\u7F6E"
+            ),
+            h2(
+              "a",
+              {
+                className: "dim-deliveryDocsLink",
+                href: isEnglish() ? DELIVERY_DOCS_URL.en : DELIVERY_DOCS_URL.zh,
+                target: "_blank",
+                rel: "noopener noreferrer",
+                "aria-label": "\u6253\u5F00\u4E3B\u52A8\u6295\u9012\u4F7F\u7528\u6587\u6863"
+              },
+              h2("span", null, "\u4F7F\u7528\u6587\u6863"),
+              h2("span", { "aria-hidden": "true" }, "\u2197")
+            )
+          ),
+          h2(
+            "div",
+            { className: "dim-deliveryBotId" },
+            h2("span", null, "Bot ID"),
+            h2("code", { title: account.botId }, account.botId),
+            h2(DeliveryButton, { onClick: () => void copyBotId() }, "\u590D\u5236")
+          ),
+          botCopyState ? h2("p", { className: "dim-targetFeedback", role: "status" }, botCopyState) : null
         ),
-        h2(DeliveryButton, {
-          kind: "primary",
-          onClick: openSuggestionPicker,
-          disabled: Boolean(editor) || phase !== "ready",
-          title: phase === "ready" ? void 0 : "\u8BF7\u5148\u5B8C\u6210\u6295\u9012\u76EE\u6807\u8BFB\u53D6"
-        }, "\u65B0\u5EFA\u76EE\u6807")
-      ),
-      editor?.mode === "suggestions" ? h2(TargetSuggestionPicker, {
-        definition,
-        phase: suggestionPhase,
-        suggestions,
-        error: suggestionError,
-        targets,
-        onRefresh: loadSuggestions,
-        onSelect: selectSuggestion,
-        onManual: () => setEditor({
-          mode: "create",
-          source: "manual",
-          draftKey: "manual",
-          initialValue: { targetId: randomTargetId(targets) }
-        }),
-        onCancel: () => setEditor(null)
-      }) : editor ? h2(TargetForm, {
-        key: editor.mode === "edit" ? editor.target.targetId : editor.draftKey,
-        definition,
-        mode: editor.mode,
-        initialValue: editor.mode === "edit" ? editor.target : editor.initialValue,
-        source: editor.source,
-        busy: saving,
-        connected: account.connected,
-        onCancel: () => setEditor(editor.source === "suggestion" ? { mode: "suggestions" } : null),
-        onSave: saveTarget,
-        onTest: (target) => invoke(DELIVERY_ENDPOINTS.test, {
-          botId: account.botId,
-          target
-        })
-      }) : null,
-      phase === "loading" ? h2("div", { className: "dim-deliveryState", "aria-busy": "true" }, "\u6B63\u5728\u8BFB\u53D6\u6295\u9012\u76EE\u6807\u2026") : phase === "error" ? h2(
-        "div",
-        { className: "dim-deliveryState", role: "alert" },
-        h2("p", null, error),
-        h2(DeliveryButton, { onClick: () => void loadTargets() }, "\u91CD\u65B0\u8BFB\u53D6")
-      ) : targets.length === 0 ? h2(
-        "div",
-        { className: "dim-deliveryState dim-deliveryEmpty" },
-        h2("strong", null, "\u5C1A\u672A\u914D\u7F6E\u6295\u9012\u76EE\u6807"),
-        h2("p", null, "\u70B9\u51FB\u201C\u65B0\u5EFA\u76EE\u6807\u201D\u53EF\u4ECE\u5DF2\u804A\u8FC7\u7684\u4F1A\u8BDD\u9009\u62E9\uFF0C\u4E5F\u53EF\u624B\u52A8\u586B\u5199\u3002")
-      ) : h2("ul", { className: "dim-targetList" }, targets.map((target) => h2(TargetRow, {
-        key: target.targetId,
-        definition,
-        target,
-        botId: account.botId,
-        connected: account.connected,
-        rpcCall: invoke,
-        onChanged: () => loadTargets({ silent: true }),
-        onEdit: () => setEditor({ mode: "edit", target, source: "edit" })
-      })))
+        h2(
+          "section",
+          { className: "dim-deliveryTargets", "aria-labelledby": "dim-delivery-targets-title" },
+          h2(
+            "div",
+            { className: "dim-deliverySectionHeading" },
+            h2(
+              "div",
+              null,
+              h2("h3", { id: "dim-delivery-targets-title" }, "\u6295\u9012\u76EE\u6807"),
+              account.connected ? null : h2("p", null, "\u673A\u5668\u4EBA\u5F53\u524D\u79BB\u7EBF\uFF1B\u4ECD\u53EF\u914D\u7F6E\u76EE\u6807\uFF0C\u6062\u590D\u8FDE\u63A5\u540E\u518D\u6D4B\u8BD5\u3002")
+            ),
+            h2(DeliveryButton, {
+              kind: "primary",
+              onClick: openSuggestionPicker,
+              disabled: Boolean(editor) || phase !== "ready",
+              title: phase === "ready" ? void 0 : "\u8BF7\u5148\u5B8C\u6210\u6295\u9012\u76EE\u6807\u8BFB\u53D6"
+            }, "\u65B0\u5EFA\u76EE\u6807")
+          ),
+          editor?.mode === "suggestions" ? h2(TargetSuggestionPicker, {
+            definition,
+            phase: suggestionPhase,
+            suggestions,
+            error: suggestionError,
+            targets,
+            onRefresh: loadSuggestions,
+            onSelect: selectSuggestion,
+            onManual: () => setEditor({
+              mode: "create",
+              source: "manual",
+              draftKey: "manual",
+              initialValue: { targetId: randomTargetId(targets) }
+            }),
+            onCancel: () => setEditor(null)
+          }) : editor ? h2(TargetForm, {
+            key: editor.mode === "edit" ? editor.target.targetId : editor.draftKey,
+            definition,
+            mode: editor.mode,
+            initialValue: editor.mode === "edit" ? editor.target : editor.initialValue,
+            source: editor.source,
+            busy: saving,
+            connected: account.connected,
+            onCancel: () => setEditor(editor.source === "suggestion" ? { mode: "suggestions" } : null),
+            onSave: saveTarget,
+            onTest: (target) => invoke(DELIVERY_ENDPOINTS.test, {
+              botId: account.botId,
+              target
+            })
+          }) : null,
+          phase === "loading" ? h2("div", { className: "dim-deliveryState", "aria-busy": "true" }, "\u6B63\u5728\u8BFB\u53D6\u6295\u9012\u76EE\u6807\u2026") : phase === "error" ? h2(
+            "div",
+            { className: "dim-deliveryState", role: "alert" },
+            h2("p", null, error),
+            h2(DeliveryButton, { onClick: () => void loadTargets() }, "\u91CD\u65B0\u8BFB\u53D6")
+          ) : targets.length === 0 ? h2(
+            "div",
+            { className: "dim-deliveryState dim-deliveryEmpty" },
+            h2("strong", null, "\u5C1A\u672A\u914D\u7F6E\u6295\u9012\u76EE\u6807"),
+            h2("p", null, "\u70B9\u51FB\u201C\u65B0\u5EFA\u76EE\u6807\u201D\u53EF\u4ECE\u5DF2\u804A\u8FC7\u7684\u4F1A\u8BDD\u9009\u62E9\uFF0C\u4E5F\u53EF\u624B\u52A8\u586B\u5199\u3002")
+          ) : h2("ul", { className: "dim-targetList" }, targets.map((target) => h2(TargetRow, {
+            key: target.targetId,
+            definition,
+            target,
+            botId: account.botId,
+            connected: account.connected,
+            rpcCall: invoke,
+            onChanged: () => loadTargets({ silent: true }),
+            onEdit: () => setEditor({ mode: "edit", target, source: "edit" })
+          })))
+        )
+      )
     )
   );
 }
@@ -13067,9 +13345,18 @@ var CSS11 = String.raw`
 .dim-botSettingsButton:focus-visible { outline: 2px solid var(--dsw-alias-state-business-primary, #3370ff); outline-offset: 2px; }
 .dim-botSettingsTooltip { position: absolute; top: calc(100% + 6px); right: 0; z-index: 30; width: max-content; padding: 6px 9px; border: 1px solid var(--dsw-alias-border-l2, #dfe1e5); border-radius: 7px; color: var(--dsw-alias-label-primary, #1f2329); background: var(--dsw-alias-bg-layer-3, #fff); box-shadow: 0 8px 24px rgb(31 35 41 / 14%); font-size: 11px; line-height: 16px; opacity: 0; visibility: hidden; transform: translateY(-3px); pointer-events: none; transition: opacity .15s ease, transform .15s ease, visibility .15s ease; }
 .dim-botSettingsAction:hover .dim-botSettingsTooltip, .dim-botSettingsAction:focus-within .dim-botSettingsTooltip { opacity: 1; visibility: visible; transform: translateY(0); }
-.dim-deliveryPage { min-width: 0; display: grid; gap: 14px; }
+.dim-deliveryPage { min-width: 0; display: grid; }
 .dim-deliveryHeader { min-width: 0; display: flex; align-items: center; justify-content: space-between; gap: 16px; }
-.dim-deliveryHeaderMeta { min-width: 0; display: flex; align-items: center; justify-content: flex-end; gap: 10px; text-align: right; }
+.dim-botSettingsTabsBar { min-width: 0; margin-top: 10px; border-bottom: 1px solid var(--dsw-alias-border-l2, #dfe1e5); }
+.dim-botSettingsTabs { min-width: 0; display: flex; align-items: flex-end; gap: 24px; overflow-x: auto; scrollbar-width: none; }
+.dim-botSettingsTabs::-webkit-scrollbar { display: none; }
+.dim-botSettingsTab { position: relative; min-height: 38px; flex: none; display: inline-flex; align-items: center; justify-content: center; padding: 6px 2px 9px; border: 0; color: var(--dsw-alias-label-secondary, #646a73); background: transparent; font: inherit; font-size: 13px; line-height: 20px; font-weight: 560; white-space: nowrap; cursor: pointer; transition: color .15s ease; }
+.dim-botSettingsTab::after { content: ''; position: absolute; right: 0; bottom: -1px; left: 0; height: 2px; border-radius: 2px 2px 0 0; background: transparent; transform: scaleX(.45); transition: background .15s ease, transform .15s ease; }
+.dim-botSettingsTab:hover:not([aria-selected="true"]) { color: var(--dsw-alias-label-primary, #1f2329); }
+.dim-botSettingsTab[aria-selected="true"] { color: var(--dsw-alias-state-business-primary, #3370ff); font-weight: 650; }
+.dim-botSettingsTab[aria-selected="true"]::after { background: var(--dsw-alias-state-business-primary, #3370ff); transform: scaleX(1); }
+.dim-botSettingsTab:focus-visible { outline: 2px solid var(--dsw-alias-state-business-primary, #3370ff); outline-offset: -2px; border-radius: 5px; }
+.dim-botSettingsTabPanel { min-width: 0; display: grid; gap: 14px; padding-top: 14px; }
 .dim-deliveryDocsLink { min-height: 30px; flex: none; display: inline-flex; align-items: center; gap: 4px; padding: 5px 8px; border-radius: 7px; color: var(--dsw-alias-state-business-primary, #3370ff); font-size: 12px; line-height: 18px; text-decoration: none; white-space: nowrap; }
 .dim-deliveryDocsLink:hover { background: color-mix(in srgb, var(--dsw-alias-state-business-primary, #3370ff) 8%, transparent); }
 .dim-deliveryDocsLink:focus-visible { outline: 2px solid var(--dsw-alias-state-business-primary, #3370ff); outline-offset: 2px; }
@@ -13081,6 +13368,7 @@ var CSS11 = String.raw`
 .dim-deliveryButton[data-kind="danger"] { color: var(--dsw-alias-state-error-primary, #d54941); }
 .dim-deliveryBack { flex: none; border-color: transparent; background: transparent; }
 .dim-deliveryIdentity, .dim-deliveryTargets { min-width: 0; padding: 16px; border: 1px solid var(--dsw-alias-border-l2, #dfe1e5); border-radius: 12px; background: var(--dsw-alias-bg-layer-3, #fff); }
+.dim-deliveryIdentityHeading { min-width: 0; display: flex; align-items: center; justify-content: space-between; gap: 12px; }
 .dim-deliveryBotName, .dim-deliverySectionHeading h3 { min-width: 0; overflow: hidden; margin: 0; font-size: 15px; line-height: 22px; font-weight: 650; text-overflow: ellipsis; white-space: nowrap; }
 .dim-deliveryIdentity > div:first-child p, .dim-deliverySectionHeading p { margin: 2px 0 0; color: var(--dsw-alias-label-secondary, #646a73); font-size: 12px; line-height: 18px; }
 .dim-deliveryBotId { min-width: 0; display: grid; grid-template-columns: max-content minmax(0, 1fr) max-content; align-items: center; gap: 10px; margin-top: 12px; padding: 10px 12px; border-radius: 9px; background: var(--dsw-alias-bg-module-platform, #f7f8fa); }
@@ -13123,6 +13411,38 @@ var CSS11 = String.raw`
 .dim-targetField input[readonly] { color: var(--dsw-alias-label-secondary, #646a73); background: var(--dsw-alias-bg-module-platform, #f7f8fa); }
 .dim-targetFormError { margin: 10px 0 0; font-size: 12px; line-height: 18px; }
 .dim-targetFormActions { display: flex; justify-content: flex-end; gap: 7px; margin-top: 12px; }
+.dim-accessPage { min-width: 0; display: grid; gap: 14px; }
+.dim-accessScene { position: relative; min-width: 0; margin: 0; padding: 16px; border: 1px solid var(--dsw-alias-border-l2, #dfe1e5); border-radius: 12px; background: var(--dsw-alias-bg-layer-3, #fff); }
+.dim-accessScene > legend { padding: 0 6px; color: var(--dsw-alias-label-primary, #1f2329); font-size: 15px; line-height: 22px; font-weight: 650; }
+.dim-accessLegendContent { display: inline-flex; align-items: center; gap: 6px; }
+.dim-panel .dim-accessLegendHelp { position: static; }
+.dim-accessLegendHelp .dim-channelTooltip { top: 20px; right: auto; left: 16px; width: min(320px, calc(100% - 32px)); max-width: none; }
+.dim-accessControls { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 12px; }
+.dim-accessControls[data-mode="allowlist"] { grid-template-columns: minmax(0, 1fr); }
+.dim-accessField { min-width: 0; display: grid; align-content: start; gap: 5px; color: var(--dsw-alias-label-secondary, #646a73); font-size: 11px; line-height: 16px; }
+.dim-accessField input, .dim-accessField select { width: 100%; min-width: 0; height: 36px; padding: 0 9px; border: 1px solid var(--dsw-alias-border-l2, #dfe1e5); border-radius: 7px; color: var(--dsw-alias-label-primary, #1f2329); background: var(--dsw-alias-bg-layer-1, #fff); font: inherit; font-size: 12px; }
+.dim-accessField input:focus, .dim-accessField select:focus { outline: 2px solid color-mix(in srgb, var(--dsw-alias-state-business-primary, #3370ff) 28%, transparent); border-color: var(--dsw-alias-state-business-primary, #3370ff); }
+.dim-accessUsers { min-width: 0; margin-top: 14px; padding-top: 14px; border-top: 1px solid var(--dsw-alias-border-l1, #eef0f3); }
+.dim-accessUsersHeading { position: relative; min-width: 0; display: flex; align-items: flex-start; justify-content: space-between; gap: 12px; }
+.dim-accessUsersHeading > div { min-width: 0; }
+.dim-accessUsersTitle { display: inline-flex; align-items: center; gap: 6px; }
+.dim-accessUsersHeading strong { color: var(--dsw-alias-label-primary, #1f2329); font-size: 13px; line-height: 20px; font-weight: 620; }
+.dim-accessUsersHeading p { margin: 2px 0 0; color: var(--dsw-alias-label-secondary, #646a73); font-size: 11px; line-height: 17px; }
+.dim-panel .dim-accessUsersHelp { position: static; }
+.dim-accessUsersHelp .dim-channelTooltip { top: calc(100% + 7px); right: auto; left: 0; width: min(320px, 100%); max-width: none; }
+.dim-accessAddUser { width: 32px; height: 32px; min-height: 32px; flex: 0 0 32px; padding: 0; font-size: 20px; line-height: 1; }
+.dim-accessUsersEmpty { margin-top: 10px; padding: 15px 12px; border: 1px dashed var(--dsw-alias-border-l2, #dfe1e5); border-radius: 8px; color: var(--dsw-alias-label-tertiary, #8f959e); font-size: 12px; line-height: 18px; text-align: center; }
+.dim-accessUserList { display: grid; gap: 9px; margin: 10px 0 0; padding: 0; list-style: none; }
+.dim-accessUserRow { min-width: 0; display: grid; grid-template-columns: minmax(0, 1fr) minmax(145px, 180px) max-content; align-items: end; gap: 10px; padding: 11px; border: 1px solid var(--dsw-alias-border-l1, #eef0f3); border-radius: 9px; background: var(--dsw-alias-bg-module-platform, #f7f8fa); }
+.dim-accessDeleteUser { margin-bottom: 1px; }
+.dim-accessUnsupported { padding: 18px 14px; border: 1px dashed var(--dsw-alias-border-l2, #dfe1e5); border-radius: 9px; color: var(--dsw-alias-label-secondary, #646a73); background: var(--dsw-alias-bg-module-platform, #f7f8fa); text-align: center; }
+.dim-accessUnsupported strong { color: var(--dsw-alias-label-primary, #1f2329); font-size: 13px; line-height: 20px; }
+.dim-accessUnsupported p { margin: 4px 0 0; font-size: 12px; line-height: 18px; }
+.dim-accessState { padding: 11px 13px; border: 1px solid color-mix(in srgb, var(--dsw-alias-state-warn-primary, #d97706) 24%, var(--dsw-alias-border-l2, #dfe1e5)); border-radius: 9px; color: var(--dsw-alias-state-warn-primary, #d97706); background: color-mix(in srgb, var(--dsw-alias-state-warn-primary, #d97706) 7%, var(--dsw-alias-bg-layer-1, #fff)); font-size: 12px; line-height: 18px; }
+.dim-accessFeedback { margin: 0; padding: 10px 12px; border-radius: 8px; color: var(--dsw-alias-label-secondary, #646a73); background: var(--dsw-alias-bg-module-platform, #f7f8fa); font-size: 12px; line-height: 18px; }
+.dim-accessFeedback[data-tone="success"] { color: var(--dsw-alias-state-success-primary, #20a162); }
+.dim-accessFeedback[data-tone="error"] { color: var(--dsw-alias-state-error-primary, #d54941); }
+.dim-accessActions { display: flex; justify-content: flex-end; }
 .dim-panel .dim-botCard .dim-cardFooter { margin-top: 0; }
 .dim-panel .ddt-headingCopy { display: none; }
 .dim-panel .ddt-qrFrame, .dim-panel .ddt-countdown { width: min(270px, 100%); }
@@ -13146,6 +13466,9 @@ var CSS11 = String.raw`
   .dim-targetActions { justify-content: flex-start; }
   .dim-targetFormGrid { grid-template-columns: minmax(0, 1fr); }
   .dim-targetSuggestionHeading { align-items: stretch; flex-direction: column; }
+  .dim-accessControls { grid-template-columns: minmax(0, 1fr); }
+  .dim-accessUserRow { grid-template-columns: minmax(0, 1fr); }
+  .dim-accessDeleteUser { justify-self: start; }
 }
 @media (max-width: 840px) {
   .dim-title { align-items: flex-start; }
@@ -13169,11 +13492,12 @@ var CSS11 = String.raw`
   .dim-rail { grid-template-columns: minmax(0, 1fr); }
   .dim-loopbackRecovery { align-items: stretch; flex-direction: column; gap: 12px; }
   .dim-loopbackRecoveryAction { width: 100%; }
-  .dim-deliveryHeader, .dim-deliverySectionHeading { align-items: stretch; flex-direction: column; }
-  .dim-deliveryHeaderMeta { justify-content: space-between; text-align: left; }
+  .dim-deliverySectionHeading { align-items: stretch; flex-direction: column; }
+  .dim-botSettingsTabs { gap: 18px; }
   .dim-deliveryBotId { grid-template-columns: minmax(0, 1fr) max-content; }
   .dim-deliveryBotId > span { grid-column: 1 / -1; }
   .dim-targetActions .dim-deliveryButton { flex: 1 1 auto; }
+  .dim-accessActions .dim-deliveryButton { width: 100%; }
   .dim-directoryPickerBackdrop { padding: 10px; }
   .dim-directoryPicker { height: calc(100vh - 20px); min-height: 0; border-radius: 14px; }
   .dim-directoryPickerHeader { padding: 18px 17px 14px; }
@@ -13985,6 +14309,7 @@ function IMSettingsTab({
               channel: active.id,
               account: deliverySettings,
               rpcCall: rpcCalls.deliveryRpcCall,
+              accessRpcCall: rpcCalls[`${active.id}RpcCall`],
               onBack: () => setDeliverySettings(null)
             }) : active.id === "weixin" ? h2(WeixinSettingsTab, { rpcCall: rpcCalls.weixinRpcCall }) : active.id === "feishu" ? h2(FeishuSettingsTab, { rpcCall: rpcCalls.feishuRpcCall }) : active.id === "dingtalk" ? h2(DingtalkSettingsTab, { rpcCall: rpcCalls.dingtalkRpcCall }) : active.id === "wecom" ? h2(WecomSettingsTab, { rpcCall: rpcCalls.wecomRpcCall }) : active.id === "qq" ? h2(QqSettingsTab, { rpcCall: rpcCalls.qqRpcCall }) : active.id === "slack" ? h2(SlackSettingsTab, { rpcCall: rpcCalls.slackRpcCall }) : active.id === "telegram" ? h2(TelegramSettingsTab, { rpcCall: rpcCalls.telegramRpcCall }) : active.id === "discord" ? h2(DiscordSettingsTab, { rpcCall: rpcCalls.discordRpcCall }) : active.id === "whatsapp" ? h2(WhatsappSettingsTab, { rpcCall: rpcCalls.whatsappRpcCall }) : h2(OfficeSettingsTab, { rpcCall: rpcCalls.officeRpcCall })
           )