@zzzpyyy/dsh-bot-feishu 0.0.0-stage → 0.2.0

package/feishu.js

@@ -0,0 +1,925 @@
+import { r as InfoFlowBridge, t as bridgeDomain } from "./domain-OHZklmI3.js";
+import { createRequire } from "node:module";
+import { createHash, randomUUID } from "node:crypto";
+import Schema from "@deepseek-ai/schemastery";
+import { brandString } from "@deepseek-ai/dsh-brand";
+import { z } from "zod";
+import { defineDomain } from "@deepseek-ai/dsh-storage-domain";
+import { credentialRef } from "@deepseek-ai/dsh-credentials";
+//#region lib/types/feishu/settings.js
+/** Native versioned settings store; secret values belong to DSH credentials. */
+const botId = z.string().transform(brandString);
+const settingsDomain = defineDomain({
+	name: "bot_feishu_settings",
+	version: 1,
+	tables: {},
+	global: {
+		schema: z.object({
+			bindings: z.array(z.object({
+				botId,
+				appId: z.string(),
+				botOpenId: z.string(),
+				robotName: z.string(),
+				brand: z.enum(["feishu", "lark"]),
+				enabled: z.boolean(),
+				secretRef: z.string(),
+				allowUsers: z.array(z.string()),
+				allowGroups: z.array(z.string()),
+				admins: z.array(z.string())
+			})),
+			groups: z.array(z.object({
+				requestId: z.string(),
+				title: z.string(),
+				botIds: z.array(botId),
+				creatorBot: botId,
+				owner: z.string(),
+				createdAt: z.number(),
+				chatId: z.string().nullable(),
+				roomId: z.string().transform(brandString).nullable(),
+				status: z.enum([
+					"creating",
+					"uncertain",
+					"failed",
+					"linking",
+					"ready"
+				]),
+				error: z.string().nullable()
+			})).default([]),
+			registrations: z.array(z.object({
+				botId,
+				attemptId: z.string(),
+				status: z.enum([
+					"starting",
+					"waiting",
+					"saving",
+					"complete",
+					"canceled",
+					"expired",
+					"error",
+					"interrupted"
+				]),
+				message: z.string().nullable()
+			}))
+		}),
+		initial: {
+			bindings: [],
+			registrations: [],
+			groups: []
+		}
+	}
+});
+//#endregion
+//#region lib/types/feishu/sdk.js
+/** Pinned official Feishu SDK, with lifecycle and wire validation at this seam. */
+const logger = {
+	error() {},
+	warn() {},
+	info() {},
+	debug() {},
+	trace() {}
+};
+const domain = (brand) => brand === "lark" ? "https://open.larksuite.com" : "https://open.feishu.cn";
+function loadSdk(timeoutMs) {
+	const require = createRequire(import.meta.url);
+	const metadata = require("@larksuiteoapi/node-sdk/package.json");
+	if (typeof metadata !== "object" || !metadata || !("version" in metadata) || metadata.version !== "1.75.0") throw new Error("Install @larksuiteoapi/node-sdk@1.75.0 in the Feishu companion");
+	const sdk = require("@larksuiteoapi/node-sdk");
+	if (typeof sdk !== "object" || !sdk || !("registerApp" in sdk) || typeof sdk.registerApp !== "function") throw new Error("Feishu SDK registration support is missing");
+	const loaded = sdk;
+	if (!loaded.defaultHttpInstance) throw new Error("Feishu SDK HTTP client is missing");
+	loaded.defaultHttpInstance.defaults.timeout = timeoutMs;
+	return loaded;
+}
+const record = z.looseObject({});
+function object(value) {
+	return record.safeParse(value).data ?? {};
+}
+function text(value) {
+	return typeof value === "string" ? value : "";
+}
+function checked(value) {
+	const result = object(value);
+	if (result.code !== 0) throw new Error("飞书接口未成功，请检查机器人权限、发布状态和网络");
+	return result;
+}
+async function identity(sdk, appId, appSecret, brand, timeoutMs) {
+	const result = checked(await new sdk.Client({
+		appId,
+		appSecret,
+		domain: domain(brand),
+		logger
+	}).request({
+		method: "GET",
+		url: "/open-apis/bot/v3/info",
+		timeout: timeoutMs
+	}));
+	const bot = object(result.bot ?? object(result.data).bot);
+	const openId = text(bot.open_id), name = text(bot.app_name);
+	if (!/^ou_[\w-]+$/.test(openId)) throw new Error("未查询到应用机器人，请在飞书启用机器人能力并发布应用");
+	return {
+		openId,
+		name: name || appId
+	};
+}
+/** Safe, classified errors let the manager distinguish API rejection from an unknown outcome. */
+var GroupCreateError = class extends Error {};
+/** Create a private group; Feishu deduplicates the same uuid + owner for ten hours. */
+async function createGroup(sdk, appId, appSecret, brand, timeoutMs, options) {
+	const client = new sdk.Client({
+		appId,
+		appSecret,
+		domain: domain(brand),
+		logger
+	});
+	let response;
+	try {
+		response = await client.request({
+			method: "POST",
+			url: "/open-apis/im/v1/chats",
+			timeout: timeoutMs,
+			params: {
+				user_id_type: "open_id",
+				set_bot_manager: false,
+				uuid: options.requestId
+			},
+			data: {
+				name: options.title,
+				owner_id: options.owner,
+				user_id_list: [options.owner],
+				bot_id_list: options.botAppIds,
+				chat_mode: "group",
+				chat_type: "private"
+			}
+		});
+	} catch (cause) {
+		const wire = object(object(cause).response);
+		if (typeof object(wire.data).code !== "number") throw new Error("建群结果待确认，请使用同一请求继续，勿重复新建");
+		response = wire.data;
+	}
+	const result = object(response);
+	if (typeof result.code === "number" && result.code !== 0) {
+		if (result.code === 99991672) throw new GroupCreateError("建群机器人缺少 im:chat:create 权限，请在飞书开放平台开通后继续");
+		throw new GroupCreateError(`飞书拒绝建群（错误码 ${result.code}），请检查群主、机器人是否在同一企业及应用可用范围`);
+	}
+	const chatId = text(object(result.data).chat_id);
+	if (result.code !== 0 || !/^oc_[\w-]+$/.test(chatId)) throw new Error("未取得群 ID，请使用同一请求继续，勿重复新建");
+	return chatId;
+}
+/** Official user-confirmed registration with messaging and group-creation permissions. */
+function register(sdk, options) {
+	return sdk.registerApp({
+		signal: options.signal,
+		source: "dsh-bot",
+		createOnly: true,
+		onQRCodeReady: options.qr,
+		appPreset: {
+			name: options.name,
+			desc: "DSH Bot 独立 AI 助手"
+		},
+		addons: {
+			preset: false,
+			scopes: { tenant: [
+				"im:message.p2p_msg:readonly",
+				"im:message.group_at_msg:readonly",
+				"im:message:send_as_bot",
+				"im:chat:create"
+			] },
+			events: { items: { tenant: ["im.message.receive_v1"] } }
+		}
+	});
+}
+async function qrImage(url) {
+	const parsed = new URL(url);
+	if (parsed.protocol !== "https:" || !["feishu.cn", "larksuite.com"].some((host) => parsed.hostname === host || parsed.hostname.endsWith(`.${host}`))) throw new Error("飞书返回了无法识别的授权地址");
+	return createRequire(import.meta.url)("qrcode").toDataURL(url, {
+		width: 280,
+		margin: 2,
+		errorCorrectionLevel: "M"
+	});
+}
+/** Text-only ingress, explicit human sender and exact bot mentions. */
+function decodeMessage(event, appId, botOpenId) {
+	const body = object(event), sender = object(body.sender), msg = object(body.message);
+	const senderId = text(object(sender.sender_id).open_id), messageId = text(msg.message_id), chatId = text(msg.chat_id);
+	if (sender.sender_type !== "user" || !senderId || senderId === botOpenId || !messageId || !chatId || msg.message_type !== "text") return null;
+	if (msg.chat_type !== "p2p" && msg.chat_type !== "group") return null;
+	const mentions = Array.isArray(msg.mentions) ? msg.mentions.map(object) : [];
+	const ownMentions = mentions.filter((mention) => object(mention.id).open_id === botOpenId);
+	if (msg.chat_type === "group" && !ownMentions.length) return null;
+	let content;
+	try {
+		content = text(object(JSON.parse(text(msg.content))).text);
+	} catch {
+		return null;
+	}
+	for (const mention of msg.chat_type === "group" ? mentions : ownMentions) {
+		const key = text(mention.key);
+		if (key) content = content.split(key).join("");
+	}
+	content = content.trim();
+	if (!content) return null;
+	return {
+		conversation: {
+			provider: "feishu",
+			accountId: appId,
+			kind: msg.chat_type === "p2p" ? "private" : "group",
+			id: chatId
+		},
+		message: {
+			id: messageId,
+			sender: {
+				id: senderId,
+				name: senderId
+			}
+		},
+		text: content
+	};
+}
+var FeishuTransport = class {
+	config;
+	report;
+	client;
+	socket;
+	stopped = false;
+	connection;
+	handlers = /* @__PURE__ */ new Set();
+	constructor(sdk, config, receive, status, report) {
+		this.config = config;
+		this.report = report;
+		const common = {
+			appId: config.appId,
+			appSecret: config.appSecret,
+			domain: domain(config.brand),
+			logger
+		};
+		this.client = new sdk.Client(common);
+		this.socket = new sdk.WSClient({
+			...common,
+			handshakeTimeoutMs: config.timeoutMs,
+			onReady: () => {
+				if (!this.stopped) status("connected");
+			},
+			onReconnected: () => {
+				if (!this.stopped) status("connected");
+			},
+			onReconnecting: () => {
+				if (!this.stopped) status("connecting");
+			},
+			onError: () => {
+				if (!this.stopped) status("error");
+			}
+		});
+		const dispatcher = new sdk.EventDispatcher({ logger }).register({ "im.message.receive_v1": async (event) => {
+			if (this.stopped) return;
+			const input = decodeMessage(event, config.appId, config.botOpenId);
+			if (!input) return;
+			const task = receive(input).then(() => {}, () => {
+				this.report();
+				throw new Error("DSH could not persist this message");
+			});
+			this.handlers.add(task);
+			try {
+				await task;
+			} finally {
+				this.handlers.delete(task);
+			}
+		} });
+		this.begin = () => {
+			this.connection = this.socket.start({ eventDispatcher: dispatcher }).catch(() => {
+				if (!this.stopped) {
+					status("error");
+					this.report();
+				}
+			}).finally(() => {
+				if (this.stopped) this.socket.close({ force: true });
+			});
+		};
+	}
+	begin;
+	start() {
+		if (!this.stopped && !this.connection) this.begin();
+	}
+	async send(delivery) {
+		if (this.stopped) throw new Error("Feishu is stopping");
+		checked(await this.client.request({
+			method: "POST",
+			url: "/open-apis/im/v1/messages",
+			params: { receive_id_type: "chat_id" },
+			timeout: this.config.timeoutMs,
+			data: {
+				receive_id: delivery.conversation.id,
+				msg_type: "text",
+				content: JSON.stringify({ text: delivery.text }),
+				uuid: createHash("sha256").update(delivery.id).digest("hex").slice(0, 48)
+			}
+		}));
+	}
+	async close() {
+		this.stopped = true;
+		this.socket.close({ force: true });
+		await this.connection;
+		await Promise.allSettled(this.handlers);
+	}
+};
+//#endregion
+//#region lib/types/feishu/manager.js
+/** Per-Bot ownership and user-confirmed registration; no platform credentials reach the UI. */
+const active = (status) => [
+	"starting",
+	"waiting",
+	"saving"
+].includes(status);
+function ids(values, prefix) {
+	const result = [...new Set(values.map((value) => value.trim()).filter(Boolean))];
+	if (result.length > 1e3 || result.some((value) => !new RegExp(`^${prefix}[a-zA-Z0-9_-]+$`).test(value))) throw new Error(`请填写 ${prefix} 开头的飞书 ID，用逗号分隔`);
+	return result;
+}
+function appId(value) {
+	const id = value.trim();
+	if (!/^cli_[a-zA-Z0-9_-]+$/.test(id)) throw new Error("请填写 cli_ 开头的 App ID");
+	return id;
+}
+var FeishuManager = class {
+	store;
+	runtime;
+	state;
+	tail = Promise.resolve();
+	closed = false;
+	jobs = /* @__PURE__ */ new Map();
+	statuses = /* @__PURE__ */ new Map();
+	constructor(store, runtime) {
+		this.store = store;
+		this.runtime = runtime;
+		this.state = structuredClone(store.get());
+	}
+	exclusive(action) {
+		const next = this.tail.then(action);
+		this.tail = next.catch(() => {});
+		return next;
+	}
+	async change(action) {
+		const draft = structuredClone(this.state);
+		action(draft);
+		await this.store.set(draft);
+		this.state = draft;
+	}
+	ensureOpen() {
+		if (this.closed) throw new Error("飞书管理器正在关闭");
+	}
+	get(botId) {
+		const item = this.state.bindings.find((value) => value.botId === botId);
+		if (!item) throw new Error("请先绑定这个 Bot 的飞书机器人");
+		return item;
+	}
+	view(binding) {
+		const { secretRef, ...rest } = binding;
+		return {
+			...rest,
+			allowUsers: [...binding.allowUsers],
+			allowGroups: [...binding.allowGroups],
+			admins: [...binding.admins],
+			credentialsConfigured: !!secretRef,
+			...this.statuses.get(binding.botId) ?? {
+				status: binding.enabled ? "connecting" : "disabled",
+				error: null
+			}
+		};
+	}
+	registration(record) {
+		return structuredClone(this.jobs.get(record.attemptId)?.view ?? {
+			...record,
+			url: null,
+			qrDataUrl: null,
+			expiresAt: null
+		});
+	}
+	snapshot() {
+		return {
+			available: true,
+			bindings: this.state.bindings.map((binding) => this.view(binding)),
+			registrations: this.state.registrations.map((record) => this.registration(record)),
+			groups: structuredClone(this.state.groups)
+		};
+	}
+	connection(botId, status, error = null) {
+		this.statuses.set(botId, {
+			status,
+			error
+		});
+	}
+	unique(id, botId) {
+		if (this.state.bindings.some((binding) => binding.botId !== botId && binding.appId === id)) throw new Error("这个飞书应用已绑定到其他 Bot");
+	}
+	async secret(binding) {
+		const secret = await this.runtime.resolve(binding.secretRef);
+		if (!secret) throw new Error("请恢复机器人凭据或重新填写 App Secret");
+		return secret;
+	}
+	async checked(binding, secret) {
+		try {
+			const identity = await this.runtime.identity(binding.appId, secret, binding.brand);
+			return {
+				...binding,
+				botOpenId: identity.openId,
+				robotName: identity.name
+			};
+		} catch {
+			throw new Error("验证失败，请检查凭据、机器人能力、应用发布状态和网络");
+		}
+	}
+	async activate(binding) {
+		this.connection(binding.botId, "connecting");
+		try {
+			await this.runtime.start(binding);
+		} catch {
+			this.connection(binding.botId, "error", "连接启动失败，请验证机器人并重新启用");
+		}
+	}
+	async init() {
+		if (this.state.registrations.some((record) => active(record.status))) await this.change((state) => {
+			for (const record of state.registrations) if (active(record.status)) {
+				record.status = "interrupted";
+				record.message = "服务重启中断了授权。请先检查飞书后台是否已经创建应用，再决定绑定已有应用或重新扫码。";
+			}
+		});
+		if (this.state.groups.some((group) => group.status === "creating")) await this.change((state) => {
+			for (const group of state.groups) if (group.status === "creating") {
+				group.status = "uncertain";
+				group.error = "服务重启中断了建群，请继续同一次请求";
+			}
+		});
+		for (const group of this.state.groups) if (group.chatId) {
+			const bindings = group.botIds.map((id) => this.get(id));
+			const room = await this.runtime.linkGroup(group, bindings);
+			if (group.roomId !== room.id) await this.change((state) => {
+				state.groups.find((item) => item.requestId === group.requestId).roomId = room.id;
+			});
+		}
+		for (const binding of this.state.bindings) if (binding.enabled) await this.activate(binding);
+	}
+	createGroup(request) {
+		return this.exclusive(async () => {
+			this.ensureOpen();
+			const title = request.title.trim(), botIds = [...new Set(request.botIds)].sort();
+			if (!/^[a-zA-Z0-9_-]{8,50}$/.test(request.requestId) || !title || title.length > 120) throw new Error("请填写有效群名和建群请求 ID");
+			if (!botIds.length || botIds.length > 6 || !botIds.includes(request.creatorBot)) throw new Error("请选择 1–6 个机器人，并指定其中一个建群");
+			const previous = this.state.groups.find((group) => group.requestId === request.requestId);
+			const creator = this.get(request.creatorBot);
+			const owner = request.owner?.trim() || previous?.owner || creator.admins[0] || creator.allowUsers[0] || "";
+			if (!/^ou_[a-zA-Z0-9_-]+$/.test(owner)) throw new Error("请填写建群机器人所属应用下的群主 Open ID，或先配置该机器人的管理员");
+			if (previous) {
+				if (previous.title !== title || previous.creatorBot !== request.creatorBot || previous.owner !== owner || JSON.stringify(previous.botIds) !== JSON.stringify(botIds)) throw new Error("已提交的建群请求不能修改，请继续原请求");
+				return this.finishGroup(previous);
+			}
+			const group = {
+				requestId: request.requestId,
+				title,
+				botIds,
+				creatorBot: request.creatorBot,
+				owner,
+				createdAt: Date.now(),
+				chatId: null,
+				roomId: null,
+				status: "creating",
+				error: null
+			};
+			this.groupBindings(group);
+			await this.change((state) => {
+				state.groups.push(group);
+			});
+			return this.finishGroup(group, true);
+		});
+	}
+	resumeGroup(requestId) {
+		return this.exclusive(async () => {
+			this.ensureOpen();
+			const group = this.state.groups.find((item) => item.requestId === requestId);
+			if (!group) throw new Error("建群请求不存在");
+			return this.finishGroup(group);
+		});
+	}
+	groupBindings(group) {
+		const bindings = group.botIds.map((id) => {
+			if (!this.runtime.bots().some((bot) => bot.id === id)) throw new Error(`Bot ${id} 不存在`);
+			const binding = this.get(id);
+			if (!binding.enabled) throw new Error(`请先启用 ${id} 的飞书连接`);
+			return binding;
+		});
+		if (new Set(bindings.map((binding) => binding.brand)).size !== 1) throw new Error("飞书与 Lark 机器人不能混合建群");
+		return bindings;
+	}
+	async finishGroup(saved, firstSubmission = false) {
+		const group = structuredClone(saved);
+		const bindings = this.groupBindings(group), creator = this.get(group.creatorBot);
+		if (group.status === "ready" && group.chatId) return this.runtime.linkGroup(group, bindings);
+		const persist = async () => {
+			await this.change((state) => {
+				state.groups = state.groups.map((item) => item.requestId === group.requestId ? structuredClone(group) : item);
+			});
+		};
+		if (!group.chatId) {
+			const priorUnconfirmed = !firstSubmission && (group.status === "uncertain" || group.status === "creating");
+			if (Date.now() - group.createdAt >= 540 * 60 * 1e3) throw new Error("请求去重时限已过，请先在飞书确认建群结果；已有群可通过群 ID 手动接入");
+			group.status = "creating";
+			group.error = null;
+			await persist();
+			try {
+				group.chatId = await this.runtime.createGroup(creator, await this.secret(creator), {
+					requestId: group.requestId,
+					title: group.title,
+					owner: group.owner,
+					botAppIds: bindings.filter((binding) => binding.botId !== creator.botId).map((binding) => binding.appId)
+				});
+			} catch (cause) {
+				group.status = cause instanceof GroupCreateError && !priorUnconfirmed ? "failed" : "uncertain";
+				group.error = cause instanceof GroupCreateError ? cause.message : "建群结果待确认，请继续同一次请求；不要重复新建";
+				await persist();
+				throw new Error(group.error);
+			}
+			group.status = "linking";
+			await persist();
+		}
+		try {
+			const chatId = group.chatId;
+			await this.change((state) => {
+				for (const binding of state.bindings) if (group.botIds.includes(binding.botId) && !binding.allowGroups.includes(chatId)) binding.allowGroups.push(chatId);
+			});
+			const room = await this.runtime.linkGroup(group, bindings);
+			for (const id of group.botIds) {
+				await this.runtime.stop(id);
+				await this.activate(this.get(id));
+			}
+			if (group.botIds.some((id) => this.statuses.get(id)?.status === "error")) throw new Error("连接启动失败");
+			group.roomId = room.id;
+			group.status = "ready";
+			group.error = null;
+			await persist();
+			return room;
+		} catch {
+			group.status = "linking";
+			group.error = "飞书群已创建，接入尚未完成。点击继续完成，不会重复建群。";
+			await persist();
+			throw new Error(group.error);
+		}
+	}
+	save(request) {
+		return this.exclusive(async () => {
+			this.ensureOpen();
+			if (!this.runtime.bots().some((bot) => bot.id === request.botId)) throw new Error("Bot 不存在");
+			if ([...this.jobs.values()].some((job) => job.view.botId === request.botId && !job.done)) throw new Error("请先完成或取消正在进行的扫码授权");
+			const previous = this.state.bindings.find((binding) => binding.botId === request.botId);
+			const id = appId(request.appId);
+			this.unique(id, request.botId);
+			if (previous && (previous.appId !== id || previous.brand !== request.brand)) throw new Error("已绑定 Bot 不能直接更换应用；请为新应用创建一个新的 DSH Bot");
+			const secret = request.appSecret?.trim() || (previous ? await this.secret(previous) : "");
+			if (!secret) throw new Error("首次绑定需要 App Secret");
+			const base = {
+				botId: request.botId,
+				appId: id,
+				brand: request.brand,
+				botOpenId: "",
+				robotName: id,
+				enabled: previous?.enabled ?? false,
+				secretRef: `DSH_FEISHU_${randomUUID().replaceAll("-", "").toUpperCase()}_SECRET`,
+				allowUsers: ids(request.allowUsers, "ou_"),
+				allowGroups: ids(request.allowGroups, "oc_"),
+				admins: ids(request.admins, "ou_")
+			};
+			const binding = await this.checked(base, secret);
+			await this.runtime.set(binding.secretRef, secret);
+			await this.change((state) => {
+				state.bindings = [...state.bindings.filter((item) => item.botId !== request.botId), binding];
+			});
+			await this.runtime.stop(binding.botId);
+			if (binding.enabled) await this.activate(binding);
+			else this.connection(binding.botId, "disabled");
+			return this.view(binding);
+		});
+	}
+	verify(botId) {
+		return this.exclusive(async () => {
+			this.ensureOpen();
+			const current = this.get(botId), verified = await this.checked(current, await this.secret(current));
+			await this.change((state) => {
+				state.bindings = state.bindings.map((item) => item.botId === botId ? verified : item);
+			});
+			return this.view(verified);
+		});
+	}
+	toggle(request) {
+		return this.exclusive(async () => {
+			this.ensureOpen();
+			let binding = {
+				...this.get(request.botId),
+				enabled: request.enabled
+			};
+			if (binding.enabled) binding = await this.checked(binding, await this.secret(binding));
+			await this.change((state) => {
+				state.bindings = state.bindings.map((item) => item.botId === binding.botId ? binding : item);
+			});
+			await this.runtime.stop(binding.botId);
+			if (binding.enabled) await this.activate(binding);
+			else this.connection(binding.botId, "disabled");
+			return this.view(binding);
+		});
+	}
+	register(botId) {
+		return this.exclusive(async () => {
+			this.ensureOpen();
+			const bot = this.runtime.bots().find((item) => item.id === botId);
+			if (!bot) throw new Error("Bot 不存在");
+			const inFlight = [...this.jobs.values()].find((job) => job.view.botId === botId && !job.done);
+			if (inFlight) return structuredClone(inFlight.view);
+			for (const [key, job] of this.jobs) if (job.view.botId === botId && job.done) this.jobs.delete(key);
+			const pending = this.state.registrations.find((record) => record.botId === botId && active(record.status));
+			if (pending) return this.registration(pending);
+			if (this.state.bindings.some((binding) => binding.botId === botId)) throw new Error("这个 Bot 已绑定机器人，不能重复创建");
+			const attemptId = randomUUID();
+			const record = {
+				botId,
+				attemptId,
+				status: "starting",
+				message: null
+			};
+			await this.change((state) => {
+				state.registrations = [...state.registrations.filter((item) => item.botId !== botId), record];
+			});
+			const job = {
+				done: false,
+				controller: new AbortController(),
+				view: {
+					...record,
+					url: null,
+					qrDataUrl: null,
+					expiresAt: null
+				}
+			};
+			this.jobs.set(attemptId, job);
+			job.task = this.runRegistration(job, bot.name).finally(() => {
+				job.done = true;
+			});
+			return this.registration(record);
+		});
+	}
+	async settle(job, status, message) {
+		await this.change((state) => {
+			const record = state.registrations.find((item) => item.attemptId === job.view.attemptId);
+			if (record) {
+				record.status = status;
+				record.message = message;
+			}
+		});
+		job.view = {
+			...job.view,
+			status,
+			message,
+			url: null,
+			qrDataUrl: null,
+			expiresAt: null
+		};
+	}
+	async runRegistration(job, name) {
+		try {
+			const result = await this.runtime.register({
+				name,
+				signal: job.controller.signal,
+				qr: (info) => {
+					if (job.controller.signal.aborted || job.view.status !== "starting") return;
+					job.view = {
+						...job.view,
+						status: "waiting",
+						url: null,
+						qrDataUrl: null,
+						expiresAt: Date.now() + info.expireIn * 1e3
+					};
+					this.runtime.qrImage(info.url).then((qrDataUrl) => {
+						if (job.view.status === "waiting" && !job.controller.signal.aborted) job.view = {
+							...job.view,
+							url: info.url,
+							qrDataUrl
+						};
+					}).catch(() => {
+						job.controller.abort();
+					});
+				}
+			});
+			await this.exclusive(async () => {
+				job.view = {
+					...job.view,
+					status: "saving",
+					url: null,
+					qrDataUrl: null
+				};
+				const id = appId(result.client_id);
+				this.unique(id, job.view.botId);
+				if (!result.client_secret) throw new Error("No application credentials returned");
+				const owner = result.user_info?.open_id;
+				const allowUsers = owner && /^ou_[\w-]+$/.test(owner) ? [owner] : [];
+				const binding = {
+					botId: job.view.botId,
+					appId: id,
+					botOpenId: "",
+					robotName: name,
+					brand: result.user_info?.tenant_brand === "lark" ? "lark" : "feishu",
+					enabled: false,
+					secretRef: `DSH_FEISHU_${createHash("sha256").update(job.view.attemptId).digest("hex").toUpperCase()}_SECRET`,
+					allowUsers,
+					admins: [...allowUsers],
+					allowGroups: []
+				};
+				await this.runtime.set(binding.secretRef, result.client_secret);
+				await this.change((state) => {
+					state.bindings.push(binding);
+				});
+				let notice = "机器人已创建并绑定。请核对授权页的权限范围，然后启用连接。";
+				try {
+					const verified = await this.checked(binding, result.client_secret);
+					await this.change((state) => {
+						state.bindings = state.bindings.map((item) => item.botId === binding.botId ? verified : item);
+					});
+				} catch {
+					notice = "凭据已安全保存，但机器人暂未就绪。请检查飞书应用发布状态，再点击验证机器人；无需再次创建。";
+				}
+				await this.settle(job, "complete", notice);
+			});
+		} catch {
+			await this.exclusive(async () => {
+				if (job.view.status === "complete" || job.view.status === "canceled") return;
+				const expired = job.view.expiresAt !== null && Date.now() >= job.view.expiresAt;
+				await this.settle(job, this.closed ? "interrupted" : expired ? "expired" : job.controller.signal.aborted ? "canceled" : "error", this.closed ? "服务已停止，请先检查飞书后台是否已经创建应用。" : expired ? "二维码已过期，可以重新发起扫码。" : job.controller.signal.aborted ? "已取消等待。若已在飞书确认创建，请使用已有应用绑定。" : "创建或保存未完成，请先检查飞书后台；不要重复创建已有应用。");
+			}).catch(() => {
+				job.view = {
+					...job.view,
+					status: "error",
+					message: "无法保存授权结果，请检查 DSH 存储和飞书后台。",
+					url: null,
+					qrDataUrl: null
+				};
+			});
+		}
+	}
+	cancel(attemptId) {
+		return this.exclusive(async () => {
+			this.ensureOpen();
+			const job = this.jobs.get(attemptId);
+			if (!job || !active(job.view.status)) return;
+			if (job.view.status === "saving") throw new Error("凭据正在保存，请稍候");
+			job.controller.abort();
+			await this.settle(job, "canceled", "已取消等待。若已在飞书确认创建，请使用已有应用绑定。");
+		});
+	}
+	async close() {
+		this.closed = true;
+		for (const job of this.jobs.values()) job.controller.abort();
+		await Promise.allSettled([...this.jobs.values()].map((job) => job.task));
+		await this.tail;
+	}
+};
+//#endregion
+//#region lib/types/feishu.js
+/** Optional Feishu companion, with one independently owned robot per DSH Bot. */
+const name = "bot-feishu";
+const inject = [
+	"botMode",
+	"storageDomain",
+	"credentials"
+];
+const Config = Schema.object({
+	maxPending: Schema.natural().min(1).default(200),
+	maxQueuePerRoom: Schema.natural().min(1).default(20),
+	maxConcurrentRooms: Schema.natural().min(1).default(4),
+	maxReceipts: Schema.natural().min(1).default(1e5),
+	maxOutbox: Schema.natural().min(20).default(1e4),
+	chunkSize: Schema.natural().min(100).max(3e3).default(3e3),
+	retryMs: Schema.natural().min(100).default(5e3),
+	maxRetryMs: Schema.natural().min(100).default(12e4),
+	endpointTimeoutMs: Schema.natural().min(1e3).default(15e3),
+	pollMs: Schema.natural().min(100).default(1e3)
+});
+async function apply(ctx, config) {
+	const settings = await ctx.storageDomain.open(settingsDomain);
+	const connections = /* @__PURE__ */ new Map();
+	const stop = async (botId) => {
+		const current = connections.get(botId);
+		if (current) {
+			connections.delete(botId);
+			await current.close();
+		}
+	};
+	const report = () => {
+		ctx.logger.warn("Feishu operation failed; check connection status and retained work");
+	};
+	const resolve = async (ref) => (await ctx.credentials.resolve(credentialRef(ref)))?.value;
+	const manager = new FeishuManager(settings.global, {
+		bots: () => ctx.botMode.snapshot().bots,
+		createGroup: (binding, secret, options) => createGroup(loadSdk(config.endpointTimeoutMs), binding.appId, secret, binding.brand, config.endpointTimeoutMs, options),
+		linkGroup: async (group, bindings) => {
+			if (!group.chatId) throw new Error("Created chat ID required");
+			return ctx.botMode.ensureExternalRoom({
+				conversation: {
+					provider: "feishu",
+					accountId: `group:${group.chatId}`,
+					kind: "group",
+					id: group.chatId
+				},
+				title: group.title,
+				botIds: bindings.map((binding) => binding.botId),
+				defaultBot: group.creatorBot
+			});
+		},
+		resolve,
+		set: (ref, value) => ctx.credentials.set(credentialRef(ref), value),
+		stop,
+		identity: (appId, secret, brand) => identity(loadSdk(config.endpointTimeoutMs), appId, secret, brand, config.endpointTimeoutMs),
+		register: (options) => register(loadSdk(config.endpointTimeoutMs), options),
+		qrImage,
+		start: async (binding) => {
+			const appSecret = await resolve(binding.secretRef);
+			if (!appSecret || !binding.botOpenId) throw new Error("Robot identity and credentials required");
+			for (const chatId of binding.allowGroups) await ctx.botMode.ensureExternalRoom({
+				conversation: {
+					provider: "feishu",
+					accountId: binding.appId,
+					kind: "group",
+					id: chatId
+				},
+				title: `飞书 · ${chatId}`,
+				botIds: [binding.botId],
+				defaultBot: binding.botId
+			});
+			const queue = await ctx.storageDomain.open(bridgeDomain(`bot_fs_${createHash("sha256").update(`${binding.botId}:${binding.appId}`).digest("hex").slice(0, 28)}`));
+			let bridge, transport;
+			try {
+				transport = new FeishuTransport(loadSdk(config.endpointTimeoutMs), {
+					...binding,
+					appSecret,
+					timeoutMs: config.endpointTimeoutMs
+				}, (input) => bridge.receive({
+					...input,
+					targets: [binding.botId]
+				}), (status) => {
+					manager.connection(binding.botId, status, status === "error" ? "长连接异常，请检查事件订阅、应用发布状态和网络后重新启用" : null);
+				}, report);
+				bridge = new InfoFlowBridge(ctx.botMode, queue.global, transport, {
+					...config,
+					provider: "feishu",
+					accountId: binding.appId,
+					botIds: [binding.botId],
+					defaultBot: binding.botId,
+					allowUsers: binding.allowUsers,
+					allowGroups: binding.allowGroups,
+					admins: binding.admins
+				}, report);
+				const currentBridge = bridge, currentTransport = transport;
+				connections.set(binding.botId, {
+					bridge,
+					close: async () => {
+						await currentTransport.close();
+						await currentBridge.close();
+						await queue.close();
+					}
+				});
+				transport.start();
+			} catch (cause) {
+				await transport?.close();
+				await bridge?.close();
+				await queue.close();
+				throw cause;
+			}
+		}
+	});
+	const abort = new AbortController();
+	const wake = async () => {
+		await Promise.all([...connections.values()].map((item) => item.bridge.wake()));
+	};
+	let feed, timer;
+	const detach = ctx.botMode.attachFeishu(manager);
+	ctx.effect(() => async () => {
+		detach();
+		abort.abort();
+		if (timer) clearInterval(timer);
+		await manager.close();
+		await Promise.all([...connections.keys()].map(stop));
+		await feed;
+		await settings.close();
+	}, "feishu: cancel registration, drain handlers and close native queues");
+	await manager.init();
+	ctx.on("session/event", (session, event) => {
+		if (event.type === "approval/asked") for (const { bridge } of connections.values()) bridge.attention(session.id, `approval:${event.data.id}`).catch(report);
+	});
+	ctx.on("user-questions/request", async (request, next) => {
+		if (request.agent) for (const { bridge } of connections.values()) bridge.attention(request.agent.session.id, `question:${createHash("sha256").update(JSON.stringify(request.questions)).digest("hex")}`).catch(report);
+		return next();
+	}, { prepend: true });
+	feed = (async () => {
+		for await (const _frame of ctx.botMode.follow(abort.signal)) await wake();
+	})().catch(() => {
+		if (!abort.signal.aborted) report();
+	});
+	timer = setInterval(() => {
+		wake().catch(report);
+	}, config.pollMs);
+	timer.unref();
+}
+//#endregion
+export { Config, apply, inject, name };