@zhin.js/host-http 1.2.1 → 1.3.0

package/lib/console-rpc-extended/contracts.d.ts

@@ -1,3 +1,4 @@
+import type { ConsoleAdapterLoginDeclaration, ConsoleLoginFlow, ConsoleLoginOutcome } from '@zhin.js/console-protocol';
 interface LoginEndpointIdentity {
     readonly canonicalId: string;
     readonly instanceId: string;
@@ -20,27 +21,37 @@ export interface ConsoleRpcExtendedCtx {
     };
     /** Narrow generation-bound persistent-job port; null when Assistant is disabled. */
     resolveScheduleEngine?: () => ConsoleScheduleEngine | null | undefined;
-    /** LoginAssist list/submit/cancel（刷新后仍可消费扫码/滑块待办）。 */
-    loginAssist?: {
-        listPending(): readonly {
-            id: string;
-            adapter: string;
-            endpointKey: string;
-            endpointIdentity?: LoginEndpointIdentity;
-            type: string;
-            payload: Record<string, unknown>;
-            createdAt: number;
-            expiresAt?: number;
-        }[];
-        submit(id: string, value: string | Record<string, unknown>, endpointIdentity?: LoginEndpointIdentity): boolean;
-        cancel(id: string, reason?: string, endpointIdentity?: LoginEndpointIdentity): boolean;
-    };
+    /**
+     * Resolves a persistent job's delivery target (#1250): `{ resolved, display?, reason? }`, where
+     * `resolved: false` means the job's results cannot be delivered (no target / unknown account).
+     */
+    describeScheduleTarget?: (notify: unknown) => ConsoleScheduleTarget;
+    /** LoginAssist list/submit/cancel（刷新后仍可消费扫码/滑块待办）；ADR 0058 flow methods are optional. */
+    loginAssist?: ConsoleLoginAssistPort;
+    /** ADR 0058: the Endpoint's login declaration and lease-scoped login control (`null` = unknown Endpoint). */
+    withEndpointLogin?: <T>(adapter: string, endpointKey: string, run: (login: ConsoleEndpointLoginAccess) => T | Promise<T>) => Promise<T | null>;
     /** Authenticated Root adapter; mutation DTOs deliberately contain no principal/decision fields. */
     workroomProfileControl?: ConsoleWorkroomProfileControlPort;
     /** Authenticated HTTP principal; never accepted from the RPC body. */
     authenticatedPrincipal?: Readonly<{
         principalId: string;
     }>;
+    /**
+     * The Endpoint the caller was authorized for when its grant covers this call only at an adapter /
+     * endpoint scope (never set for global grants, owners or in-process callers). Handlers that act on
+     * login tasks or flows restrict themselves to it; set by the dispatcher, never read from the body.
+     */
+    authorizedEndpoint?: Readonly<{
+        adapter: string;
+        endpointKey: string;
+    }>;
+    /**
+     * Whether the caller holds `endpoint.operate` on one Endpoint (set by the dispatcher from the
+     * authenticated principal, never read from the body). Login read RPCs return live challenge
+     * material (QR image, sensitive blocks, verification links, legacy `payload.image` / `url`) only
+     * when it says yes; absent (in-process callers without a principal) = trusted.
+     */
+    canOperateEndpoint?: (adapter: string, endpointKey: string) => boolean;
     workroomKnowledgeControl?: ConsoleWorkroomKnowledgeControlPort;
 }
 export interface ConsoleWorkroomProfileControlPort {
@@ -118,15 +129,74 @@ export interface ConsoleScheduleEngine {
     resumeJob(id: string): Promise<boolean>;
     listJobs(): Promise<Record<string, unknown>[]>;
 }
+/** `data` next to `error` carries a machine-readable code (e.g. `{ code: 'unsupported' }`). */
 export type ExtendedRpcResult = {
     data: unknown;
 } | {
     error: string;
+    data?: unknown;
 };
+/** Structural LoginAssist port (host/http must not import `@zhin.js/core`). */
+export interface ConsoleLoginAssistPort {
+    listPending(): readonly {
+        id: string;
+        adapter: string;
+        endpointKey: string;
+        endpointIdentity?: LoginEndpointIdentity;
+        type: string;
+        payload: Record<string, unknown>;
+        createdAt: number;
+        expiresAt?: number;
+        flowId?: string;
+        challengeId?: string;
+    }[];
+    submit(id: string, value: string | Record<string, unknown>, endpointIdentity?: LoginEndpointIdentity): boolean;
+    cancel(id: string, reason?: string, endpointIdentity?: LoginEndpointIdentity): boolean;
+    /** ADR 0058 */
+    listFlows?(): readonly ConsoleLoginFlow[];
+    getFlow?(adapter: string, endpointKey: string): ConsoleLoginFlow | undefined;
+    getFlowById?(id: string): ConsoleLoginFlow | undefined;
+    /**
+     * Event-safe copy of a flow (core `withoutLoginMedia`): no QR image, sensitive blocks redacted,
+     * verification links dropped. Returned to readers without `endpoint.operate` on the flow's
+     * Endpoint; without it the host strips every challenge's media and blocks.
+     */
+    eventSafeFlow?(flow: ConsoleLoginFlow): ConsoleLoginFlow;
+    submitAndWait?(id: string, value: string | Record<string, unknown>, options?: {
+        endpointIdentity?: LoginEndpointIdentity;
+        timeoutMs?: number;
+    }): Promise<{
+        accepted: boolean;
+        outcome?: ConsoleLoginOutcome;
+        pending?: boolean;
+        flow?: ConsoleLoginFlow;
+    }>;
+}
+export interface ConsoleEndpointLoginAccess {
+    readonly declaration?: ConsoleAdapterLoginDeclaration;
+    readonly control?: {
+        relogin?(request: {
+            signal?: AbortSignal;
+        }): Promise<void>;
+        refreshChallenge?(request: {
+            signal?: AbortSignal;
+        }): Promise<void>;
+    };
+}
 export interface ScheduleJobRow {
     id: string;
     cron: string;
     description?: string;
+    /** Host display metadata (`ScheduleJobDisplay` in `@zhin.js/plugin-runtime`). */
+    title?: string;
+    titleI18n?: Readonly<Partial<Record<string, string>>>;
+    kind?: 'plugin-internal' | 'user-task';
+    lastRun?: {
+        startedAt: number;
+        finishedAt: number;
+        status: 'succeeded' | 'failed';
+        error?: string;
+    };
 }
 export interface InboxSelection {
     where(query: Record<string, unknown>): InboxSelection;
@@ -209,4 +279,11 @@ export interface EndpointManagementPort {
     setGroupAdmin?(request: EndpointAdminCommand): Promise<void>;
     deleteFriend?(request: EndpointUserCommand): Promise<void>;
 }
+/** `target` of a `schedule:list` persistent row (#1250). */
+export interface ConsoleScheduleTarget {
+    readonly resolved: boolean;
+    readonly display?: string;
+    /** `missing_target` | `incomplete_target` | `endpoint_not_found` */
+    readonly reason?: string;
+}
 export {};

package/lib/console-rpc-extended/dispatcher.js

@@ -1,6 +1,6 @@
 import { addCron, listSchedule, mutateCron, validateCron } from './schedule-rpc.js';
 import { actOnRequest, listInbox, listInboxMessages, listPendingRequests, listRecentInboxMessages, mapNoticeRow, mapRequestRow, markInboxConsumed, TABLE_NOTICE, TABLE_REQUEST, } from './inbox-rpc.js';
-import { cancelLogin, listLoginPending, submitLogin } from './login-rpc.js';
+import { cancelLogin, controlLogin, getLoginFlow, listLoginFlows, listLoginPending, submitLogin } from './login-rpc.js';
 import { deleteFriend, groupWriteOp, listChannels, listFriends, listGroupMembers, listGroups, } from './endpoint-rpc.js';
 import { mutateWorkroomKnowledge, mutateWorkroomProfile } from './workroom-rpc.js';
 export async function dispatchExtendedConsoleRpc(type, data, ctx) {
@@ -9,7 +9,7 @@ export async function dispatchExtendedConsoleRpc(type, data, ctx) {
     switch (type) {
         case 'schedule:list':
         case 'cron:list':
-            return listSchedule(ctx);
+            return listSchedule(ctx, d);
         case 'cron:validate':
             return validateCron(d);
         case 'cron:add':
@@ -32,11 +32,18 @@ export async function dispatchExtendedConsoleRpc(type, data, ctx) {
         case 'request.reject':
             return actOnRequest(type, d, ctx);
         case 'login.list':
-            return listLoginPending(ctx);
+            return listLoginPending(d, ctx);
         case 'login.submit':
             return submitLogin(d, ctx);
         case 'login.cancel':
             return cancelLogin(d, ctx);
+        case 'login.flow.list':
+            return listLoginFlows(d, ctx);
+        case 'login.flow.get':
+            return getLoginFlow(d, ctx);
+        case 'login.relogin':
+        case 'login.refresh':
+            return controlLogin(type, d, ctx);
         case 'request.consumed':
             return markInboxConsumed(d, ctx, TABLE_REQUEST);
         case 'notice.consumed':

package/lib/console-rpc-extended/endpoint-rpc.js

@@ -8,7 +8,7 @@ export async function listFriends(d, ctx) {
             const friends = [...await management.listFriends()];
             return { data: { friends, count: friends.length } };
         }
-        return { error: `当前适配器（${endpoint.adapter}）不支持好友列表` };
+        return unsupportedList('friends', 'listFriends', endpoint.adapter, '好友列表');
     });
 }
 export async function listGroups(d, ctx) {
@@ -20,7 +20,7 @@ export async function listGroups(d, ctx) {
             const groups = [...await management.listGroups()];
             return { data: { groups, count: groups.length } };
         }
-        return { error: `当前适配器（${endpoint.adapter}）不支持群列表` };
+        return unsupportedList('groups', 'listGroups', endpoint.adapter, '群列表');
     });
 }
 export async function listChannels(d, ctx) {
@@ -32,7 +32,7 @@ export async function listChannels(d, ctx) {
             const channels = [...await management.listChannels()];
             return { data: { channels, count: channels.length } };
         }
-        return { error: `当前适配器（${endpoint.adapter}）不支持频道列表` };
+        return unsupportedList('channels', 'listChannels', endpoint.adapter, '频道列表');
     });
 }
 export async function listGroupMembers(d, ctx) {
@@ -45,12 +45,29 @@ export async function listGroupMembers(d, ctx) {
     return withLiveEndpoint(ctx, adapter, endpointKey, async (management) => {
         const method = management.listGroupMembers;
         if (!method) {
-            return { error: `当前适配器（${adapter}）不支持群成员列表` };
+            return unsupportedList('members', 'listGroupMembers', adapter, '群成员列表');
         }
         const members = [...await method.call(management, { groupId })];
         return { data: { members, count: members.length } };
     });
 }
+/**
+ * A read the Adapter does not declare is not a failure (#1250): reply with an empty list plus
+ * `status: 'unsupported'` (`ConsoleEndpointCapabilityUnsupported`) instead of `{ error }`, so the
+ * Console can render "该平台不提供" rather than a red read error. Older clients still see an empty
+ * list with `count: 0`.
+ */
+function unsupportedList(key, capability, adapter, label) {
+    return {
+        data: {
+            [key]: [],
+            count: 0,
+            status: 'unsupported',
+            capability,
+            message: `当前适配器（${adapter}）不支持${label}`,
+        },
+    };
+}
 export async function groupWriteOp(d, ctx, spec) {
     const adapter = strField(d, 'adapter');
     const endpointKey = strField(d, 'endpointKey');

package/lib/console-rpc-extended/index.d.ts

@@ -1,2 +1,3 @@
-export type { ConsoleRpcExtendedCtx, ConsoleScheduleEngine, ConsoleWorkroomKnowledgeControlPort, ConsoleWorkroomProfileControlPort, ExtendedRpcResult, } from './contracts.js';
+export type { ConsoleRpcExtendedCtx, ConsoleScheduleEngine, ConsoleScheduleTarget, ConsoleWorkroomKnowledgeControlPort, ConsoleWorkroomProfileControlPort, ExtendedRpcResult, ConsoleLoginAssistPort, ConsoleEndpointLoginAccess, } from './contracts.js';
+export { loginAuditDetail, LOGIN_SUBMIT_WAIT_MS } from './login-rpc.js';
 export { dispatchExtendedConsoleRpc } from './dispatcher.js';

package/lib/console-rpc-extended/index.js

@@ -1 +1,2 @@
+export { loginAuditDetail, LOGIN_SUBMIT_WAIT_MS } from './login-rpc.js';
 export { dispatchExtendedConsoleRpc } from './dispatcher.js';

package/lib/console-rpc-extended/login-rpc.d.ts

@@ -1,4 +1,27 @@
+import { LOGIN_RPC } from '@zhin.js/console-protocol';
 import type { ConsoleRpcExtendedCtx, ExtendedRpcResult } from './contracts.js';
-export declare function listLoginPending(ctx: ConsoleRpcExtendedCtx): ExtendedRpcResult;
-export declare function submitLogin(d: Record<string, unknown>, ctx: ConsoleRpcExtendedCtx): ExtendedRpcResult;
+/** `login.submit` with `wait: true` waits at most this long for the login result. */
+export declare const LOGIN_SUBMIT_WAIT_MS = 15000;
+export declare function listLoginPending(d: Record<string, unknown>, ctx: ConsoleRpcExtendedCtx): ExtendedRpcResult;
+/**
+ * `login.submit { taskId, value, endpointIdentity?, adapter?, endpointKey?, wait? }`.
+ * `value` is a string (legacy) or `{ action, values }`. With `wait: true` the reply carries the login
+ * result (`{ accepted, outcome, flow }`) or `{ accepted, pending: true }` after 15 s; without it the
+ * legacy `{ success: true }` reply is unchanged.
+ */
+export declare function submitLogin(d: Record<string, unknown>, ctx: ConsoleRpcExtendedCtx): Promise<ExtendedRpcResult>;
 export declare function cancelLogin(d: Record<string, unknown>, ctx: ConsoleRpcExtendedCtx): ExtendedRpcResult;
+/**
+ * `login.flow.list { adapter?, endpointKey? }`: latest flow per Endpoint. Live challenge material
+ * only for Endpoints the caller may operate; the event-safe form otherwise (ADR 0058 §8).
+ */
+export declare function listLoginFlows(d: Record<string, unknown>, ctx: ConsoleRpcExtendedCtx): ExtendedRpcResult;
+/** `login.flow.get { flowId } | { adapter, endpointKey }` → `{ flow: … | null }`. */
+export declare function getLoginFlow(d: Record<string, unknown>, ctx: ConsoleRpcExtendedCtx): ExtendedRpcResult;
+/** `login.relogin` / `login.refresh { adapter, endpointKey }` through the Endpoint's login port. */
+export declare function controlLogin(type: typeof LOGIN_RPC.RELOGIN | typeof LOGIN_RPC.REFRESH, d: Record<string, unknown>, ctx: ConsoleRpcExtendedCtx): Promise<ExtendedRpcResult>;
+/**
+ * Audit detail of a login RPC reply: the result category only (never values, never messages).
+ * `undefined` for other RPCs.
+ */
+export declare function loginAuditDetail(type: unknown, data: unknown): Readonly<Record<string, string>> | undefined;

package/lib/console-rpc-extended/login-rpc.js

@@ -1,43 +1,80 @@
+import { CONSOLE_LOGIN_UNSUPPORTED, LOGIN_RPC } from '@zhin.js/console-protocol';
 import { strField } from './rpc-values.js';
-export function listLoginPending(ctx) {
+const NOT_WIRED = '登录辅助未接线（LoginAssist 未挂载）';
+/** `login.submit` with `wait: true` waits at most this long for the login result. */
+export const LOGIN_SUBMIT_WAIT_MS = 15_000;
+export function listLoginPending(d, ctx) {
     const assist = ctx.loginAssist;
     if (!assist)
-        return { error: '登录辅助未接线（LoginAssist 未挂载）' };
-    const tasks = assist.listPending().map((task) => ({
+        return { error: NOT_WIRED };
+    const scope = loginScope(d, ctx);
+    if ('error' in scope)
+        return scope;
+    const tasks = assist.listPending().filter((task) => inScope(scope, task)).map((task) => ({
         id: task.id,
         adapter: task.adapter,
         endpointKey: task.endpointKey,
         ...(task.endpointIdentity ? { endpointIdentity: task.endpointIdentity } : {}),
         type: task.type,
-        payload: task.payload,
+        payload: canOperate(ctx, task) ? task.payload : eventSafeLoginPayload(task.payload),
         createdAt: task.createdAt,
         expiresAt: task.expiresAt,
+        ...(task.flowId ? { flowId: task.flowId } : {}),
+        ...(task.challengeId ? { challengeId: task.challengeId } : {}),
     }));
     return { data: { tasks, count: tasks.length } };
 }
-export function submitLogin(d, ctx) {
+/**
+ * `login.submit { taskId, value, endpointIdentity?, adapter?, endpointKey?, wait? }`.
+ * `value` is a string (legacy) or `{ action, values }`. With `wait: true` the reply carries the login
+ * result (`{ accepted, outcome, flow }`) or `{ accepted, pending: true }` after 15 s; without it the
+ * legacy `{ success: true }` reply is unchanged.
+ */
+export async function submitLogin(d, ctx) {
     const assist = ctx.loginAssist;
     if (!assist)
-        return { error: '登录辅助未接线（LoginAssist 未挂载）' };
+        return { error: NOT_WIRED };
     const id = strField(d, 'taskId');
     if (!id)
         return { error: 'taskId is required' };
-    const raw = d.value ?? '';
-    const value = typeof raw === 'string' || (raw && typeof raw === 'object')
-        ? raw
-        : String(raw ?? '');
+    const value = readSubmitValue(d.value);
+    if (value === false)
+        return { error: 'value must be a string or { action, values }' };
     const identity = readEndpointIdentity(d.endpointIdentity);
     if (identity === false)
         return { error: 'Invalid login Endpoint identity' };
-    const ok = identity ? assist.submit(id, value, identity) : assist.submit(id, value);
-    if (!ok)
-        return { error: `login task not found: ${id}` };
-    return { data: { success: true } };
+    const target = checkTaskTarget(d, ctx, id);
+    if (target)
+        return target;
+    try {
+        if (d.wait === true && assist.submitAndWait) {
+            const result = await assist.submitAndWait(id, value, {
+                ...(identity ? { endpointIdentity: identity } : {}),
+                timeoutMs: LOGIN_SUBMIT_WAIT_MS,
+            });
+            if (!result.accepted)
+                return { error: `login task not found: ${id}` };
+            if (result.outcome)
+                return { data: { accepted: true, outcome: result.outcome, ...(result.flow ? { flow: result.flow } : {}) } };
+            return { data: { accepted: true, pending: true, ...(result.flow ? { flow: result.flow } : {}) } };
+        }
+        const ok = identity ? assist.submit(id, value, identity) : assist.submit(id, value);
+        if (!ok)
+            return { error: `login task not found: ${id}` };
+        return { data: { success: true } };
+    }
+    catch (error) {
+        // LoginSubmissionError: the challenge stays open; its message never contains the value.
+        if (error instanceof Error && error.name === 'LoginSubmissionError') {
+            return { error: error.message, data: { code: error.code ?? 'input_invalid' } };
+        }
+        throw error;
+    }
 }
 export function cancelLogin(d, ctx) {
     const assist = ctx.loginAssist;
     if (!assist)
-        return { error: '登录辅助未接线（LoginAssist 未挂载）' };
+        return { error: NOT_WIRED };
     const id = strField(d, 'taskId');
     if (!id)
         return { error: 'taskId is required' };
@@ -45,12 +82,235 @@ export function cancelLogin(d, ctx) {
     const identity = readEndpointIdentity(d.endpointIdentity);
     if (identity === false)
         return { error: 'Invalid login Endpoint identity' };
+    const target = checkTaskTarget(d, ctx, id);
+    if (target)
+        return target;
     const ok = identity ? assist.cancel(id, reason, identity) : assist.cancel(id, reason);
     if (!ok)
         return { error: `login task not found: ${id}` };
     return { data: { success: true } };
 }
-// ---------------------------------------------------------------- 社交读取
+/**
+ * `login.flow.list { adapter?, endpointKey? }`: latest flow per Endpoint. Live challenge material
+ * only for Endpoints the caller may operate; the event-safe form otherwise (ADR 0058 §8).
+ */
+export function listLoginFlows(d, ctx) {
+    const assist = ctx.loginAssist;
+    if (!assist)
+        return { error: NOT_WIRED };
+    if (!assist.listFlows)
+        return unsupported('login flows');
+    const scope = loginScope(d, ctx);
+    if ('error' in scope)
+        return scope;
+    const flows = assist.listFlows().filter((flow) => inScope(scope, flow)).map((flow) => visibleFlow(assist, ctx, flow));
+    return { data: { flows, count: flows.length } };
+}
+/** `login.flow.get { flowId } | { adapter, endpointKey }` → `{ flow: … | null }`. */
+export function getLoginFlow(d, ctx) {
+    const assist = ctx.loginAssist;
+    if (!assist)
+        return { error: NOT_WIRED };
+    if (!assist.getFlow || !assist.getFlowById)
+        return unsupported('login flows');
+    const flowId = strField(d, 'flowId');
+    const scope = loginScope(d, ctx);
+    if ('error' in scope)
+        return scope;
+    if (flowId) {
+        const flow = assist.getFlowById(flowId);
+        // A flow id names one Endpoint; a scoped caller cannot read another Endpoint's flow by id.
+        return { data: { flow: flow && inScope(scope, flow) ? visibleFlow(assist, ctx, flow) : null } };
+    }
+    if (!scope.adapter || !scope.endpointKey)
+        return { error: 'flowId or adapter and endpointKey are required' };
+    const flow = assist.getFlow(scope.adapter, scope.endpointKey);
+    return { data: { flow: flow ? visibleFlow(assist, ctx, flow) : null } };
+}
+/** `login.relogin` / `login.refresh { adapter, endpointKey }` through the Endpoint's login port. */
+export async function controlLogin(type, d, ctx) {
+    const scope = loginScope(d, ctx);
+    if ('error' in scope)
+        return scope;
+    const { adapter, endpointKey } = scope;
+    if (!adapter || !endpointKey)
+        return { error: 'adapter and endpointKey are required' };
+    const relogin = type === LOGIN_RPC.RELOGIN;
+    const label = relogin ? 'relogin' : 'refresh challenge';
+    if (!ctx.withEndpointLogin)
+        return unsupported(label);
+    const result = await ctx.withEndpointLogin(adapter, endpointKey, async (login) => {
+        const declared = relogin ? login.declaration?.relogin === true : login.declaration?.refreshQr === true;
+        const run = relogin ? login.control?.relogin : login.control?.refreshChallenge;
+        if (!declared || !run)
+            return unsupported(label, adapter);
+        await run.call(login.control, {});
+        return { data: { accepted: true } };
+    });
+    return result ?? { error: `Endpoint not found: ${adapter}/${endpointKey}` };
+}
+/**
+ * Audit detail of a login RPC reply: the result category only (never values, never messages).
+ * `undefined` for other RPCs.
+ */
+export function loginAuditDetail(type, data) {
+    if (type !== LOGIN_RPC.SUBMIT && type !== LOGIN_RPC.CANCEL && type !== LOGIN_RPC.RELOGIN && type !== LOGIN_RPC.REFRESH)
+        return undefined;
+    if (!data || typeof data !== 'object')
+        return undefined;
+    const record = data;
+    if (typeof record.code === 'string')
+        return Object.freeze({ result: record.code });
+    if (record.outcome && typeof record.outcome.result === 'string') {
+        return Object.freeze({ result: record.outcome.result, ...(typeof record.outcome.code === 'string' ? { code: record.outcome.code } : {}) });
+    }
+    if (record.pending === true)
+        return Object.freeze({ result: 'pending' });
+    if (record.accepted === true || record.success === true)
+        return Object.freeze({ result: 'accepted' });
+    return undefined;
+}
+// ---------------------------------------------------------------- helpers
+function unsupported(what, adapter) {
+    return {
+        error: `${CONSOLE_LOGIN_UNSUPPORTED}: ${adapter ? `${adapter} does not support ${what}` : `${what} not available on this host`}`,
+        data: { code: CONSOLE_LOGIN_UNSUPPORTED },
+    };
+}
+/**
+ * The Endpoint a login RPC is about: `adapter` / `endpointKey` read from `data` and the top level,
+ * exactly the fields the authorization map reads (ADR 0049). Sources that disagree, or a value that
+ * is not a string, are rejected. When the dispatcher admitted the caller only through an adapter /
+ * endpoint-scoped grant (`ctx.authorizedEndpoint`), the scope is that Endpoint and any other named
+ * target is rejected; global callers may omit it (`''` = no filter).
+ */
+function loginScope(d, ctx) {
+    const sources = d.data && typeof d.data === 'object' && !Array.isArray(d.data)
+        ? [d.data, d]
+        : [d];
+    const read = (key) => {
+        let found = '';
+        for (const source of sources) {
+            const value = source[key];
+            if (value === undefined || value === null || value === '')
+                continue;
+            if (typeof value !== 'string')
+                return false;
+            const text = value.trim();
+            if (!text)
+                continue;
+            if (found && found !== text)
+                return false;
+            found = text;
+        }
+        return found;
+    };
+    const adapter = read('adapter');
+    const endpointKey = read('endpointKey');
+    if (adapter === false || endpointKey === false)
+        return { error: 'Conflicting login target (adapter / endpointKey)' };
+    const authorized = ctx.authorizedEndpoint;
+    if (!authorized)
+        return { adapter, endpointKey };
+    if ((adapter && adapter !== authorized.adapter) || (endpointKey && endpointKey !== authorized.endpointKey)) {
+        return { error: 'Login target outside the authorized Endpoint' };
+    }
+    return { adapter: authorized.adapter, endpointKey: authorized.endpointKey };
+}
+/** The caller may handle this Endpoint's challenge (`endpoint.operate` there); no principal = trusted. */
+function canOperate(ctx, item) {
+    return ctx.canOperateEndpoint ? ctx.canOperateEndpoint(item.adapter, item.endpointKey) : true;
+}
+/**
+ * A flow as this caller may see it: live for operators, otherwise the event-safe form (no QR image,
+ * sensitive blocks redacted, verification links dropped). A port without `eventSafeFlow` falls back
+ * to removing every challenge's media and blocks.
+ */
+function visibleFlow(assist, ctx, flow) {
+    if (canOperate(ctx, flow))
+        return flow;
+    return assist.eventSafeFlow ? assist.eventSafeFlow(flow) : withoutChallengeMaterial(flow);
+}
+function withoutChallengeMaterial(flow) {
+    if (!flow.steps.some((step) => step.challenge?.media || step.challenge?.blocks))
+        return flow;
+    return Object.freeze({
+        ...flow,
+        steps: Object.freeze(flow.steps.map((step) => {
+            if (!step.challenge || (!step.challenge.media && !step.challenge.blocks))
+                return step;
+            const { media, blocks: _blocks, ...challenge } = step.challenge;
+            return Object.freeze({
+                ...step,
+                challenge: Object.freeze({
+                    ...challenge,
+                    media: Object.freeze({
+                        ...(media?.expiresAt !== undefined ? { expiresAt: media.expiresAt } : {}),
+                        ...(media?.refreshable !== undefined ? { refreshable: media.refreshable } : {}),
+                        ...(media?.qrImage ? { qrImageOmitted: true } : {}),
+                        ...(media?.link || media?.captcha ? { linkOmitted: true } : {}),
+                    }),
+                }),
+            });
+        })),
+    });
+}
+/**
+ * Legacy task payload without the QR image (`image`) and verification link (`url`, may carry a
+ * session id), marked `imageOmitted` / `urlOmitted` like the `endpoint.login.*` events.
+ */
+function eventSafeLoginPayload(payload) {
+    // Allow-list: only the message survives; legacy adapters may put sid / ticket / device anywhere.
+    const safe = {};
+    if (typeof payload.message === 'string')
+        safe.message = payload.message;
+    if (payload.image !== undefined)
+        safe.imageOmitted = true;
+    if (payload.url !== undefined)
+        safe.urlOmitted = true;
+    if (Object.keys(payload).some((key) => key !== 'message' && key !== 'image' && key !== 'url'))
+        safe.fieldsOmitted = true;
+    return safe;
+}
+function inScope(scope, item) {
+    return (!scope.adapter || item.adapter === scope.adapter) && (!scope.endpointKey || item.endpointKey === scope.endpointKey);
+}
+/** When the caller names an Endpoint, or was authorized for one, the task must belong to it. */
+function checkTaskTarget(d, ctx, id) {
+    const scope = loginScope(d, ctx);
+    if ('error' in scope)
+        return scope;
+    if (!scope.adapter && !scope.endpointKey)
+        return undefined;
+    const task = ctx.loginAssist?.listPending().find((item) => item.id === id);
+    if (!task || !inScope(scope, task))
+        return { error: `login task not found: ${id}` };
+    return undefined;
+}
+function readSubmitValue(raw) {
+    if (raw === undefined || raw === null)
+        return '';
+    if (typeof raw === 'string')
+        return raw;
+    if (typeof raw === 'number' || typeof raw === 'boolean')
+        return String(raw);
+    if (typeof raw !== 'object' || Array.isArray(raw))
+        return false;
+    const record = raw;
+    if (record.action === undefined)
+        return record;
+    if (typeof record.action !== 'string' || !record.action || record.action.length > 64)
+        return false;
+    if (record.values !== undefined && (!record.values || typeof record.values !== 'object' || Array.isArray(record.values)))
+        return false;
+    const values = {};
+    for (const [key, item] of Object.entries((record.values ?? {}))) {
+        if (typeof item !== 'string' && typeof item !== 'number')
+            return false;
+        values[key] = String(item);
+    }
+    return { action: record.action, values };
+}
 function readEndpointIdentity(value) {
     if (value === undefined)
         return undefined;

package/lib/console-rpc-extended/schedule-rpc.d.ts

@@ -1,5 +1,5 @@
 import type { ConsoleRpcExtendedCtx, ExtendedRpcResult } from './contracts.js';
-export declare function listSchedule(ctx: ConsoleScheduleListCtx): Promise<ExtendedRpcResult> | ExtendedRpcResult;
+export declare function listSchedule(ctx: ConsoleScheduleListCtx, d?: Record<string, unknown>): Promise<ExtendedRpcResult> | ExtendedRpcResult;
 type ConsoleScheduleListCtx = ConsoleRpcExtendedCtx;
 export declare function addCron(d: Record<string, unknown>, ctx: ConsoleRpcExtendedCtx): Promise<ExtendedRpcResult>;
 export declare function mutateCron(type: 'cron:remove' | 'cron:pause' | 'cron:resume', d: Record<string, unknown>, ctx: ConsoleRpcExtendedCtx): Promise<ExtendedRpcResult>;