agim-cli 1.2.159 → 1.3.1

package/dist/core/admin-allowlist.js

@@ -1,233 +1,267 @@
-// Admin allowlist — gates service-management commands (`/restart`, `/stop`,
-// natural-language "重启服务", web /api/service/* mutating endpoints).
+// IM admin registry — single source of truth for:
+//   1) Who can run admin-only IM commands (/restart, /stop, ...)
+//   2) Which IM identities have talked to agim (for Web settings selection)
 //
-// Source: IMHUB_ADMIN_USERS env, comma-separated `platform:userId` pairs.
-// Examples:
-//   IMHUB_ADMIN_USERS=wechat-ilink:wxid_abc123,telegram:456789
-//   IMHUB_ADMIN_USERS=feishu:ou_xxx
+// v2 model:
+//   - No IM admin bootstrap token
+//   - No IMHUB_ADMIN_USERS runtime dependency
+//   - Web admin token operators manage IM admins in Settings → Admins
 //
-// Platform matching is case-insensitive (telegram == Telegram). userId is
-// case-sensitive (most IMs use case-sensitive ids).
-//
-// Default policy when the env is unset: DENY. The previous "open access"
-// default was fine for a console at 127.0.0.1, but service-control commands
-// can take the bot offline — small users opening their bot to friends would
-// otherwise expose `/restart` to anyone. Operators get a clear error message
-// telling them how to enable themselves.
+// Back-compat:
+//   - If legacy IMHUB_ADMIN_USERS is present, we import it once into the
+//     file store on first load, then continue using the file as source of truth.
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { AGIM_HOME } from './agim-paths.js';
 import { logger as rootLogger } from './logger.js';
 const log = rootLogger.child({ component: 'admin-allowlist' });
-let cachedEntries = null;
-let cachedRaw = '';
-/** Runtime-added admins (from `/setup admin <token>` or web UI). Survives
- *  this process but not restart — `promoteAdmin()` ALSO writes to the env
- *  file so a restart picks them up. */
-const runtimeEntries = [];
-/** Read IMHUB_ADMIN_USERS directly from ~/.agim/env, bypassing systemd's
- *  EnvironmentFile parser. systemd's parser is strict about quoting +
- *  silently drops lines it can't make sense of, so when an operator adds
- *  an admin via /setup admin the env-file write may succeed but the
- *  next service restart loads a partial value (observed 2026-05-25:
- *  env file has wechat,telegram but process.env only sees wechat).
- *  This file-direct fallback runs once per process and merges any
- *  entries the systemd-passed value missed. Returns '' when the file
- *  is missing, unreadable, or has no ADMIN_USERS line. */
-let cachedFileRaw = null;
-function readFileAdminUsers() {
-    if (cachedFileRaw !== null)
-        return cachedFileRaw;
-    cachedFileRaw = '';
-    // Test opt-out: IMHUB_ENV_FILE_PATH='' disables file fallback entirely
-    // so unit tests aren't polluted by the operator's real allowlist. A
-    // non-empty value overrides the default path.
-    const overridePath = process.env.IMHUB_ENV_FILE_PATH;
-    if (overridePath === '')
-        return cachedFileRaw;
-    try {
-        // Lazy import so unit tests that don't touch admin code don't pay
-        // the disk lookup. ENV_FILE is the same path systemd reads.
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const fs = require('node:fs');
-        const { ENV_FILE } = require('../cli-ui/env-file.js');
-        const filePath = overridePath && overridePath.length > 0 ? overridePath : ENV_FILE;
-        if (!fs.existsSync(filePath))
-            return cachedFileRaw;
-        const raw = fs.readFileSync(filePath, 'utf-8');
-        // Take the LAST IMHUB_ADMIN_USERS= line (matches systemd's
-        // last-wins semantics + agim's own readEnvFile object overwrite).
-        const lines = raw.split('\n');
-        for (let i = lines.length - 1; i >= 0; i--) {
-            const line = lines[i].trim();
-            if (line.startsWith('IMHUB_ADMIN_USERS=')) {
-                cachedFileRaw = line.slice('IMHUB_ADMIN_USERS='.length).trim();
-                // Strip surrounding quotes if present (systemd-style).
-                if ((cachedFileRaw.startsWith('"') && cachedFileRaw.endsWith('"'))
-                    || (cachedFileRaw.startsWith("'") && cachedFileRaw.endsWith("'"))) {
-                    cachedFileRaw = cachedFileRaw.slice(1, -1);
-                }
-                break;
-            }
+function storeFilePath() {
+    return join(process.env.AGIM_HOME || process.env.IMHUB_HOME || AGIM_HOME, 'im-admins.json');
+}
+function emptyStore() {
+    return { version: 1, admins: [], knownUsers: [] };
+}
+let cachedStore = null;
+let loggedOnce = false;
+function normalizeEntry(platform, userId) {
+    const p = platform.trim().toLowerCase();
+    const u = (userId ?? '').trim();
+    if (!p || !u)
+        return null;
+    return { platform: p, userId: u };
+}
+function keyOf(entry) {
+    return `${entry.platform}:${entry.userId}`;
+}
+function dedupeEntries(entries) {
+    const m = new Map();
+    for (const e of entries)
+        m.set(keyOf(e), e);
+    return [...m.values()].sort((a, b) => keyOf(a).localeCompare(keyOf(b)));
+}
+function dedupeKnownUsers(rows) {
+    const m = new Map();
+    for (const row of rows) {
+        const norm = normalizeEntry(row.platform, row.userId);
+        if (!norm)
+            continue;
+        const existing = m.get(keyOf(norm));
+        if (!existing || existing.lastSeenAt < row.lastSeenAt) {
+            m.set(keyOf(norm), {
+                platform: norm.platform,
+                userId: norm.userId,
+                firstSeenAt: row.firstSeenAt || row.lastSeenAt,
+                lastSeenAt: row.lastSeenAt || row.firstSeenAt,
+                lastChannelId: row.lastChannelId,
+                lastThreadId: row.lastThreadId,
+            });
         }
     }
-    catch { /* best-effort */ }
-    return cachedFileRaw;
+    return [...m.values()].sort((a, b) => b.lastSeenAt.localeCompare(a.lastSeenAt));
 }
-function parseEnv(raw) {
+function parseLegacyAdminEnv(raw) {
     const out = [];
     for (const pair of raw.split(',')) {
         const trimmed = pair.trim();
         if (!trimmed)
             continue;
         const idx = trimmed.indexOf(':');
-        if (idx <= 0 || idx === trimmed.length - 1) {
-            log.warn({ event: 'admin.allowlist.malformed_entry', entry: trimmed }, 'IMHUB_ADMIN_USERS entry must be platform:userId — skipping');
+        if (idx <= 0 || idx === trimmed.length - 1)
             continue;
-        }
-        out.push({
-            platform: trimmed.slice(0, idx).toLowerCase(),
-            userId: trimmed.slice(idx + 1),
-        });
+        const norm = normalizeEntry(trimmed.slice(0, idx), trimmed.slice(idx + 1));
+        if (norm)
+            out.push(norm);
     }
-    return out;
-}
-function getEntries() {
-    // Two sources of truth, both consulted: process.env (systemd's parse
-    // of EnvironmentFile + any Environment= override) and the env file
-    // read directly via Node fs (sidesteps systemd parser quirks). We
-    // dedupe by (platform, userId) so a value present in both doesn't
-    // double-count. Runtime entries from promoteAdmin() are layered on
-    // top so an in-session add is visible even if the file write race'd.
-    const envRaw = process.env.IMHUB_ADMIN_USERS ?? '';
-    const fileRaw = readFileAdminUsers();
-    // Cache invalidation: re-parse when the env value (process or file)
-    // changes. File contents don't change without a restart of this
-    // process so cachedFileRaw is one-shot; only process.env can shift
-    // (admin-allowlist itself mutates process.env? — no, it doesn't.
-    // updateEnvFile DOES touch process.env elsewhere, so be defensive).
-    const composite = `${envRaw}
${fileRaw}`;
-    if (composite !== cachedRaw) {
-        cachedRaw = composite;
-        const dedup = new Map();
-        for (const e of [...parseEnv(envRaw), ...parseEnv(fileRaw)]) {
-            dedup.set(`${e.platform}:${e.userId}`, e);
+    return dedupeEntries(out);
+}
+function normalizeStore(store) {
+    return {
+        version: 1,
+        admins: dedupeEntries((store?.admins ?? [])
+            .map((e) => normalizeEntry(e.platform, e.userId))
+            .filter((e) => e !== null)),
+        knownUsers: dedupeKnownUsers(store?.knownUsers ?? []),
+    };
+}
+function readStoreFromDisk() {
+    const storeFile = storeFilePath();
+    if (!existsSync(storeFile))
+        return emptyStore();
+    try {
+        const raw = JSON.parse(readFileSync(storeFile, 'utf-8'));
+        return normalizeStore(raw);
+    }
+    catch (err) {
+        log.warn({
+            event: 'admin.allowlist.read_failed',
+            err: err instanceof Error ? err.message : String(err),
+        }, 'failed to read admin store; using empty state');
+        return emptyStore();
+    }
+}
+function writeStoreToDisk(store) {
+    const storeFile = storeFilePath();
+    mkdirSync(dirname(storeFile), { recursive: true });
+    writeFileSync(storeFile, JSON.stringify(store, null, 2), 'utf-8');
+    try {
+        chmodSync(storeFile, 0o600);
+    }
+    catch { /* ignore */ }
+}
+function ensureStoreLoaded() {
+    if (cachedStore)
+        return cachedStore;
+    const loaded = readStoreFromDisk();
+    const legacy = parseLegacyAdminEnv(process.env.IMHUB_ADMIN_USERS ?? '');
+    if (legacy.length > 0) {
+        const before = loaded.admins.length;
+        loaded.admins = dedupeEntries([...loaded.admins, ...legacy]);
+        if (loaded.admins.length !== before) {
+            writeStoreToDisk(loaded);
+            log.warn({
+                event: 'admin.allowlist.legacy_env_migrated',
+                fromEnvCount: legacy.length,
+                mergedCount: loaded.admins.length,
+            }, 'migrated IMHUB_ADMIN_USERS into im-admins.json; env value is now legacy-only');
         }
-        cachedEntries = [...dedup.values()];
     }
-    return [...(cachedEntries ?? []), ...runtimeEntries];
+    cachedStore = loaded;
+    return cachedStore;
+}
+function commitStore(next) {
+    const normalized = normalizeStore(next);
+    cachedStore = normalized;
+    writeStoreToDisk(normalized);
 }
-/** Returns `true` iff there is at least one admin entry, whether from env
- *  or runtime-added via `/setup admin`. When false, the system has no
- *  admin and service-control commands are blanket denied. */
+/** Returns true iff at least one IM admin is configured. */
 export function isAllowlistConfigured() {
-    return getEntries().length > 0;
+    return ensureStoreLoaded().admins.length > 0;
 }
-/** Returns `true` iff (platform, userId) appears in the combined env +
- *  runtime allowlist. */
+/** Returns true iff the caller is in IM admin list. */
 export function isAdmin(platform, userId) {
-    if (!userId)
+    const norm = normalizeEntry(platform, userId);
+    if (!norm)
         return false;
-    const p = platform.toLowerCase();
-    return getEntries().some((e) => e.platform === p && e.userId === userId);
+    return ensureStoreLoaded().admins.some((e) => e.platform === norm.platform && e.userId === norm.userId);
 }
-/** Return a copy of the current admin list (env + runtime). For UI display. */
+/** List configured IM admins. */
 export function listAdmins() {
-    return getEntries().map((e) => ({ platform: e.platform, userId: e.userId }));
+    return ensureStoreLoaded().admins.map((e) => ({ platform: e.platform, userId: e.userId }));
 }
-/** Add an admin at runtime: in-memory immediately + persist to env file so
- *  the next restart still has them. Idempotent — duplicates are skipped.
- *  Returns true if added, false if already present. */
+/** List known IM users discovered from real inbound messages. */
+export function listKnownImUsers() {
+    return ensureStoreLoaded().knownUsers.map((u) => ({ ...u }));
+}
+/** Record that an IM user has interacted with agim. */
+export function recordSeenImUser(platform, userId, meta) {
+    const norm = normalizeEntry(platform, userId);
+    if (!norm)
+        return false;
+    const store = ensureStoreLoaded();
+    const now = new Date().toISOString();
+    const idx = store.knownUsers.findIndex((u) => u.platform === norm.platform && u.userId === norm.userId);
+    if (idx >= 0) {
+        const row = store.knownUsers[idx];
+        const changed = row.lastSeenAt !== now
+            || row.lastChannelId !== meta?.channelId
+            || row.lastThreadId !== meta?.threadId;
+        row.lastSeenAt = now;
+        if (meta?.channelId)
+            row.lastChannelId = meta.channelId;
+        if (meta?.threadId)
+            row.lastThreadId = meta.threadId;
+        if (changed)
+            commitStore(store);
+        return changed;
+    }
+    store.knownUsers.push({
+        platform: norm.platform,
+        userId: norm.userId,
+        firstSeenAt: now,
+        lastSeenAt: now,
+        ...(meta?.channelId ? { lastChannelId: meta.channelId } : {}),
+        ...(meta?.threadId ? { lastThreadId: meta.threadId } : {}),
+    });
+    commitStore(store);
+    return true;
+}
+/** Promote an IM identity to admin (idempotent). */
 export async function promoteAdmin(platform, userId, opts) {
-    if (!userId)
-        throw new Error('userId required');
-    const p = platform.toLowerCase();
-    if (getEntries().some((e) => e.platform === p && e.userId === userId))
+    const norm = normalizeEntry(platform, userId);
+    if (!norm)
+        throw new Error('platform and userId required');
+    const store = ensureStoreLoaded();
+    if (store.admins.some((e) => e.platform === norm.platform && e.userId === norm.userId))
         return false;
-    runtimeEntries.push({ platform: p, userId });
-    // Persist to ~/.agim/env (combined env-string of every current entry).
+    store.admins.push(norm);
+    // Ensure admin target always appears in known list.
+    recordSeenImUser(norm.platform, norm.userId);
+    commitStore(store);
     try {
-        const { updateEnvFile } = await import('../cli-ui/env-file.js');
-        const combined = getEntries().map((e) => `${e.platform}:${e.userId}`).join(',');
-        updateEnvFile({ IMHUB_ADMIN_USERS: combined });
-        log.info({
-            event: 'admin.allowlist.promoted',
-            platform: p,
-            userId,
-            total: getEntries().length,
-        }, 'admin promoted at runtime + persisted to env file');
-    }
-    catch (err) {
-        log.warn({
-            event: 'admin.allowlist.persist_failed',
-            err: err instanceof Error ? err.message : String(err),
-        }, 'in-memory admin add succeeded but env-file write failed; will be lost on restart');
+        const { logAuditEvent } = await import('./audit-log.js');
+        logAuditEvent({
+            traceId: opts?.traceId,
+            eventType: 'admin.elevate',
+            actor: opts?.actor ?? 'system',
+            target: `${norm.platform}:${norm.userId}`,
+            outcome: 'ok',
+            details: { total: store.admins.length },
+        });
     }
-    // R12 ⑤ — persistent audit row. Tracks who got admin'd, by whom, when.
+    catch { /* best-effort */ }
+    return true;
+}
+/** Revoke admin permission from an IM identity (idempotent false on missing). */
+export async function revokeAdmin(platform, userId, opts) {
+    const norm = normalizeEntry(platform, userId);
+    if (!norm)
+        throw new Error('platform and userId required');
+    const store = ensureStoreLoaded();
+    const before = store.admins.length;
+    store.admins = store.admins.filter((e) => !(e.platform === norm.platform && e.userId === norm.userId));
+    if (store.admins.length === before)
+        return false;
+    commitStore(store);
     try {
         const { logAuditEvent } = await import('./audit-log.js');
         logAuditEvent({
             traceId: opts?.traceId,
-            eventType: 'admin.elevate',
+            eventType: 'admin.revoke',
             actor: opts?.actor ?? 'system',
-            target: `${p}:${userId}`,
+            target: `${norm.platform}:${norm.userId}`,
             outcome: 'ok',
-            details: { total: getEntries().length },
+            details: { total: store.admins.length },
         });
     }
-    catch { /* audit best-effort */ }
+    catch { /* best-effort */ }
     return true;
 }
-/** Localized denial message. Three cases:
- *    A. No admins at all → "首次部署"，引导查 setup token
- *    B. Admins exist, you're not one → 礼貌拒绝，建议联系部署者
- *    C. (handled in setup-command path) bootstrap token consumable → A 已覆盖
- */
 export function denialMessage(platform, userId) {
+    const me = `${platform.toLowerCase()}:${userId ?? '<unknown>'}`;
     if (!isAllowlistConfigured()) {
-        // Case A — no admin yet. Most likely the operator hasn't onboarded
-        // themselves. Tell them where to find the bootstrap token.
-        return ('🛑 这个 bot 还没配置管理员。\n' +
-            '\n' +
-            '   如果你是部署者：\n' +
-            '   1. 在服务器终端运行 `journalctl -u agim | grep "setup admin"` 查看一次性 token\n' +
-            '      （或 `cat ~/.agim/admin-bootstrap-token`）\n' +
-            '   2. 在 IM 里发：  /setup admin <token>\n' +
-            '   即可把当前账号 (' + platform.toLowerCase() + ':' + (userId ?? '<your-id>') + ') 设为管理员。\n' +
-            '\n' +
-            '   如果你不是部署者，请联系部署本 bot 的人。');
+        return ('🛑 这个 bot 还没有配置任何 IM 管理员。\n' +
+            '   请让 Web 后台管理员在“设置 → 管理员”把你加入管理员名单。\n' +
+            `   你的账号：${me}`);
     }
-    // Case B — bot has admins, you're not one. Don't reveal current admin
-    // list / internal id format.
     return ('🛑 你没有权限执行此操作。\n' +
-        '   如果你是这个 bot 的管理员，请用同一个 IM 账号重试；否则请联系部署者。');
+        '   如果你认为应当有权限，请联系 Web 后台管理员把你的 IM 账号加入管理员名单。');
 }
-/** One-shot startup log: how many admins agim resolved from env vs file
- *  vs runtime. Call from cli boot once messengers / web are up so the
- *  line lands in journal with a recognisable event tag. Idempotent. */
-let loggedOnce = false;
+/** Startup diagnostics. */
 export function logStartupResolution() {
     if (loggedOnce)
         return;
     loggedOnce = true;
-    const envRaw = process.env.IMHUB_ADMIN_USERS ?? '';
-    const fileRaw = readFileAdminUsers();
-    const envCount = parseEnv(envRaw).length;
-    const fileCount = parseEnv(fileRaw).length;
-    const finalCount = getEntries().length;
+    const store = ensureStoreLoaded();
     log.info({
         event: 'admin.allowlist.loaded',
-        fromProcessEnv: envCount,
-        fromEnvFile: fileCount,
-        merged: finalCount,
-        fileFallbackActive: fileCount > envCount,
-    }, fileCount > envCount
-        ? `admin allowlist: process.env had ${envCount}, env file had ${fileCount} — file-fallback recovered ${fileCount - envCount} entries lost by systemd's EnvironmentFile parser`
-        : `admin allowlist: ${finalCount} entries loaded`);
-}
-/** Test-only — reset all state so tests can fully isolate. */
+        admins: store.admins.length,
+        knownUsers: store.knownUsers.length,
+        store: storeFilePath(),
+    }, `admin registry loaded: ${store.admins.length} admin(s), ${store.knownUsers.length} known IM user(s)`);
+}
+/** Test-only reset. */
 export function _resetCache() {
-    cachedEntries = null;
-    cachedRaw = '';
-    cachedFileRaw = null;
+    cachedStore = null;
     loggedOnce = false;
-    runtimeEntries.length = 0;
 }
 //# sourceMappingURL=admin-allowlist.js.map

package/dist/core/admin-allowlist.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-allowlist.js","sourceRoot":"","sources":["../../src/core/admin-allowlist.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,mEAAmE;AACnE,EAAE;AACF,0EAA0E;AAC1E,YAAY;AACZ,+DAA+D;AAC/D,oCAAoC;AACpC,EAAE;AACF,0EAA0E;AAC1E,oDAAoD;AACpD,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,yCAAyC;AAEzC,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,aAAa,CAAA;AAElD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAA;AAO9D,IAAI,aAAa,GAAmB,IAAI,CAAA;AACxC,IAAI,SAAS,GAAG,EAAE,CAAA;AAClB;;uCAEuC;AACvC,MAAM,cAAc,GAAY,EAAE,CAAA;AAElC;;;;;;;;0DAQ0D;AAC1D,IAAI,aAAa,GAAkB,IAAI,CAAA;AACvC,SAAS,kBAAkB;IACzB,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,aAAa,CAAA;IAChD,aAAa,GAAG,EAAE,CAAA;IAClB,uEAAuE;IACvE,oEAAoE;IACpE,8CAA8C;IAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAA;IACpD,IAAI,YAAY,KAAK,EAAE;QAAE,OAAO,aAAa,CAAA;IAC7C,IAAI,CAAC;QACH,kEAAkE;QAClE,4DAA4D;QAC5D,iEAAiE;QACjE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAA6B,CAAA;QACzD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,uBAAuB,CAAyB,CAAA;QAC7E,MAAM,QAAQ,GAAG,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAA;QAClF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,aAAa,CAAA;QAClD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC9C,2DAA2D;QAC3D,kEAAkE;QAClE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC7B,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAC5B,IAAI,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC1C,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;gBAC9D,uDAAuD;gBACvD,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;uBAC3D,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBACtE,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC5C,CAAC;gBACD,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC7B,OAAO,aAAa,CAAA;AACtB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,GAAG,GAAY,EAAE,CAAA;IACvB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,KAAK,EAAE,OAAO,EAAE,EACnE,4DAA4D,CAAC,CAAA;YAC/D,SAAQ;QACV,CAAC;QACD,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE;YAC7C,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;SAC/B,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,UAAU;IACjB,qEAAqE;IACrE,mEAAmE;IACnE,kEAAkE;IAClE,kEAAkE;IAClE,mEAAmE;IACnE,qEAAqE;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAA;IAClD,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAA;IACpC,oEAAoE;IACpE,gEAAgE;IAChE,mEAAmE;IACnE,iEAAiE;IACjE,oEAAoE;IACpE,MAAM,SAAS,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAA;IACxC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,SAAS,GAAG,SAAS,CAAA;QACrB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiB,CAAA;QACtC,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC5D,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;QAC3C,CAAC;QACD,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,GAAG,cAAc,CAAC,CAAA;AACtD,CAAC;AAED;;6DAE6D;AAC7D,MAAM,UAAU,qBAAqB;IACnC,OAAO,UAAU,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAChC,CAAC;AAED;yBACyB;AACzB,MAAM,UAAU,OAAO,CAAC,QAAgB,EAAE,MAA0B;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IAChC,OAAO,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;AAC1E,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,UAAU;IACxB,OAAO,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;AAC9E,CAAC;AAED;;uDAEuD;AACvD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,MAAc,EAAE,IAA2C;IAC9G,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;IAC/C,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IAChC,IAAI,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAEnF,cAAc,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;IAE5C,uEAAuE;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAA;QAC/D,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC/E,aAAa,CAAC,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC9C,GAAG,CAAC,IAAI,CAAC;YACP,KAAK,EAAE,0BAA0B;YACjC,QAAQ,EAAE,CAAC;YACX,MAAM;YACN,KAAK,EAAE,UAAU,EAAE,CAAC,MAAM;SAC3B,EAAE,mDAAmD,CAAC,CAAA;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC;YACP,KAAK,EAAE,gCAAgC;YACvC,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACtD,EAAE,kFAAkF,CAAC,CAAA;IACxF,CAAC;IACD,uEAAuE;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAA;QACxD,aAAa,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,OAAO;YACtB,SAAS,EAAE,eAAe;YAC1B,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,QAAQ;YAC9B,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE;YACxB,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE;SACxC,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;IACnC,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,MAA0B;IACxE,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,mEAAmE;QACnE,2DAA2D;QAC3D,OAAO,CACL,sBAAsB;YACtB,IAAI;YACJ,eAAe;YACf,wEAAwE;YACxE,iDAAiD;YACjD,wCAAwC;YACxC,cAAc,GAAG,QAAQ,CAAC,WAAW,EAAE,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,WAAW,CAAC,GAAG,YAAY;YACtF,IAAI;YACJ,4BAA4B,CAC7B,CAAA;IACH,CAAC;IACD,sEAAsE;IACtE,6BAA6B;IAC7B,OAAO,CACL,kBAAkB;QAClB,4CAA4C,CAC7C,CAAA;AACH,CAAC;AAED;;uEAEuE;AACvE,IAAI,UAAU,GAAG,KAAK,CAAA;AACtB,MAAM,UAAU,oBAAoB;IAClC,IAAI,UAAU;QAAE,OAAM;IACtB,UAAU,GAAG,IAAI,CAAA;IACjB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAA;IAClD,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAA;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,CAAA;IACxC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAA;IAC1C,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC,MAAM,CAAA;IACtC,GAAG,CAAC,IAAI,CAAC;QACP,KAAK,EAAE,wBAAwB;QAC/B,cAAc,EAAE,QAAQ;QACxB,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,UAAU;QAClB,kBAAkB,EAAE,SAAS,GAAG,QAAQ;KACzC,EAAE,SAAS,GAAG,QAAQ;QACrB,CAAC,CAAC,oCAAoC,QAAQ,kBAAkB,SAAS,8BAA8B,SAAS,GAAG,QAAQ,mDAAmD;QAC9K,CAAC,CAAC,oBAAoB,UAAU,iBAAiB,CAAC,CAAA;AACtD,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,WAAW;IACzB,aAAa,GAAG,IAAI,CAAA;IACpB,SAAS,GAAG,EAAE,CAAA;IACd,aAAa,GAAG,IAAI,CAAA;IACpB,UAAU,GAAG,KAAK,CAAA;IAClB,cAAc,CAAC,MAAM,GAAG,CAAC,CAAA;AAC3B,CAAC"}
+{"version":3,"file":"admin-allowlist.js","sourceRoot":"","sources":["../../src/core/admin-allowlist.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,iEAAiE;AACjE,4EAA4E;AAC5E,EAAE;AACF,YAAY;AACZ,kCAAkC;AAClC,8CAA8C;AAC9C,sEAAsE;AACtE,EAAE;AACF,eAAe;AACf,yEAAyE;AACzE,iFAAiF;AAEjF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACvF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,aAAa,CAAA;AAElD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAA;AAE9D,SAAS,aAAa;IACpB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS,EAAE,gBAAgB,CAAC,CAAA;AAC7F,CAAC;AAsBD,SAAS,UAAU;IACjB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;AACnD,CAAC;AAED,IAAI,WAAW,GAAiB,IAAI,CAAA;AACpC,IAAI,UAAU,GAAG,KAAK,CAAA;AAEtB,SAAS,cAAc,CAAC,QAAgB,EAAE,MAA0B;IAClE,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACvC,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACzB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;AACnC,CAAC;AAED,SAAS,KAAK,CAAC,KAAY;IACzB,OAAO,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,CAAA;AAC5C,CAAC;AAED,SAAS,aAAa,CAAC,OAAgB;IACrC,MAAM,CAAC,GAAG,IAAI,GAAG,EAAiB,CAAA;IAClC,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAC3C,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACzE,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAmB;IAC3C,MAAM,CAAC,GAAG,IAAI,GAAG,EAAuB,CAAA;IACxC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QACrD,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QACnC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;YACtD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU;gBAC9C,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,WAAW;gBAC7C,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,YAAY,EAAE,GAAG,CAAC,YAAY;aAC/B,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;AACjF,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,MAAM,GAAG,GAAY,EAAE,CAAA;IACvB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,SAAQ;QACpD,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QAC1E,IAAI,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;IACD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;AAC3B,CAAC;AAED,SAAS,cAAc,CAAC,KAAwC;IAC9D,OAAO;QACL,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,aAAa,CAAC,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC;aACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;aAChD,MAAM,CAAC,CAAC,CAAC,EAAc,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QACzC,UAAU,EAAE,gBAAgB,CAAC,KAAK,EAAE,UAAU,IAAI,EAAE,CAAC;KACtD,CAAA;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,SAAS,GAAG,aAAa,EAAE,CAAA;IACjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,UAAU,EAAE,CAAA;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAmB,CAAA;QAC1E,OAAO,cAAc,CAAC,GAAG,CAAC,CAAA;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC;YACP,KAAK,EAAE,6BAA6B;YACpC,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACtD,EAAE,+CAA+C,CAAC,CAAA;QACnD,OAAO,UAAU,EAAE,CAAA;IACrB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAY;IACpC,MAAM,SAAS,GAAG,aAAa,EAAE,CAAA;IACjC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IACjE,IAAI,CAAC;QAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,WAAW;QAAE,OAAO,WAAW,CAAA;IACnC,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAA;IAClC,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAA;IACvE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAA;QACnC,MAAM,CAAC,MAAM,GAAG,aAAa,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAA;QAC5D,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACpC,gBAAgB,CAAC,MAAM,CAAC,CAAA;YACxB,GAAG,CAAC,IAAI,CAAC;gBACP,KAAK,EAAE,qCAAqC;gBAC5C,YAAY,EAAE,MAAM,CAAC,MAAM;gBAC3B,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;aAClC,EAAE,8EAA8E,CAAC,CAAA;QACpF,CAAC;IACH,CAAC;IACD,WAAW,GAAG,MAAM,CAAA;IACpB,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,IAAW;IAC9B,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACvC,WAAW,GAAG,UAAU,CAAA;IACxB,gBAAgB,CAAC,UAAU,CAAC,CAAA;AAC9B,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,qBAAqB;IACnC,OAAO,iBAAiB,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;AAC9C,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,OAAO,CAAC,QAAgB,EAAE,MAA0B;IAClE,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,OAAO,iBAAiB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,CAAA;AACzG,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,UAAU;IACxB,OAAO,iBAAiB,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;AAC5F,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,gBAAgB;IAC9B,OAAO,iBAAiB,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,MAA0B,EAC1B,IAAgD;IAEhD,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAA;IACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpC,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,CAAA;IACvG,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAE,CAAA;QAClC,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,KAAK,GAAG;eACjC,GAAG,CAAC,aAAa,KAAK,IAAI,EAAE,SAAS;eACrC,GAAG,CAAC,YAAY,KAAK,IAAI,EAAE,QAAQ,CAAA;QACxC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;QACpB,IAAI,IAAI,EAAE,SAAS;YAAE,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,SAAS,CAAA;QACvD,IAAI,IAAI,EAAE,QAAQ;YAAE,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAA;QACpD,IAAI,OAAO;YAAE,WAAW,CAAC,KAAK,CAAC,CAAA;QAC/B,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QACpB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,GAAG;QAChB,UAAU,EAAE,GAAG;QACf,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAA;IACF,WAAW,CAAC,KAAK,CAAC,CAAA;IAClB,OAAO,IAAI,CAAA;AACb,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,MAAc,EACd,IAA2C;IAE3C,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IAC1D,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAA;IACjC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IACpG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvB,oDAAoD;IACpD,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAC5C,WAAW,CAAC,KAAK,CAAC,CAAA;IAClB,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAA;QACxD,aAAa,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,OAAO;YACtB,SAAS,EAAE,eAAe;YAC1B,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,QAAQ;YAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE;YACzC,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;SACxC,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAA;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,MAAc,EACd,IAA2C;IAE3C,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IAC1D,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAA;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAA;IAClC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IACtG,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA;IAChD,WAAW,CAAC,KAAK,CAAC,CAAA;IAClB,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAA;QACxD,aAAa,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,OAAO;YACtB,SAAS,EAAE,cAAc;YACzB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,QAAQ;YAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE;YACzC,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;SACxC,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,MAA0B;IACxE,MAAM,EAAE,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,IAAI,MAAM,IAAI,WAAW,EAAE,CAAA;IAC/D,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,OAAO,CACL,6BAA6B;YAC7B,wCAAwC;YACxC,WAAW,EAAE,EAAE,CAChB,CAAA;IACH,CAAC;IACD,OAAO,CACL,kBAAkB;QAClB,8CAA8C,CAC/C,CAAA;AACH,CAAC;AAED,2BAA2B;AAC3B,MAAM,UAAU,oBAAoB;IAClC,IAAI,UAAU;QAAE,OAAM;IACtB,UAAU,GAAG,IAAI,CAAA;IACjB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAA;IACjC,GAAG,CAAC,IAAI,CAAC;QACP,KAAK,EAAE,wBAAwB;QAC/B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;QAC3B,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;QACnC,KAAK,EAAE,aAAa,EAAE;KACvB,EAAE,0BAA0B,KAAK,CAAC,MAAM,CAAC,MAAM,cAAc,KAAK,CAAC,UAAU,CAAC,MAAM,mBAAmB,CAAC,CAAA;AAC3G,CAAC;AAED,uBAAuB;AACvB,MAAM,UAAU,WAAW;IACzB,WAAW,GAAG,IAAI,CAAA;IAClB,UAAU,GAAG,KAAK,CAAA;AACpB,CAAC"}

package/dist/core/approval-router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval-router.d.ts","sourceRoot":"","sources":["../../src/core/approval-router.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,gBAAgB,EAIjB,MAAM,YAAY,CAAA;AACnB,OAAO,EAIL,KAAK,oBAAoB,EACzB,KAAK,QAAQ,EAGd,MAAM,mBAAmB,CAAA;AA+B1B;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAehE;AA6JD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,oBAAoB,GAAG,MAAM,CAqBpE;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,MAAM,WAAW,cAAc;IAC7B,gBAAgB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,gBAAgB,GAAG,SAAS,CAAA;IACpE;;;uEAGmE;IACnE,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAA;CACnC;AAeD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAiHlD;AAED,wBAAgB,SAAS,IAAI,IAAI,CAQhC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAMnE;AAqCD;;;;;;;;;;;;;;;;GAgBG;AACH;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAqCzE;AAuID;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;CAAE,GAAG,IAAI,CAUjG;AAkDD,6CAA6C;AAC7C,wBAAgB,YAAY,IAAI,OAAO,CAA8B"}
+{"version":3,"file":"approval-router.d.ts","sourceRoot":"","sources":["../../src/core/approval-router.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,gBAAgB,EAIjB,MAAM,YAAY,CAAA;AACnB,OAAO,EAIL,KAAK,oBAAoB,EACzB,KAAK,QAAQ,EAGd,MAAM,mBAAmB,CAAA;AA+B1B;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAehE;AA6JD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,oBAAoB,GAAG,MAAM,CAqBpE;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,MAAM,WAAW,cAAc;IAC7B,gBAAgB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,gBAAgB,GAAG,SAAS,CAAA;IACpE;;;uEAGmE;IACnE,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAA;CACnC;AAeD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAiHlD;AAED,wBAAgB,SAAS,IAAI,IAAI,CAQhC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAMnE;AAqCD;;;;;;;;;;;;;;;;GAgBG;AACH;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAqCzE;AA2JD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;CAAE,GAAG,IAAI,CAUjG;AAkDD,6CAA6C;AAC7C,wBAAgB,YAAY,IAAI,OAAO,CAA8B"}

package/dist/core/approval-router.js

@@ -554,6 +554,29 @@ async function handleButtonCallback(platform, cb) {
     catch (err) {
         log.warn({ event: 'approval.router.recovery_dispatch_failed', err: String(err) });
     }
+    // ask_user choice cards currently share the same messenger callback
+    // channel as approvals. Route `ask:<reqId>:<index>` here so ask and
+    // approval cards can coexist on Telegram without callback-handler
+    // overwrites between routers.
+    if (cb.data?.startsWith('ask:')) {
+        try {
+            const { tryResolvePendingAskByButton } = await import('./ask-user-rpc.js');
+            const resolved = tryResolvePendingAskByButton(cb.data);
+            await cb.ack(resolved ? '✓' : '已失效');
+            log.info({
+                event: resolved ? 'approval.router.ask_button_resolved' : 'approval.router.ask_button_unmatched',
+                platform, data: cb.data,
+            });
+        }
+        catch (err) {
+            log.warn({ event: 'approval.router.ask_button_failed', err: String(err) });
+            try {
+                await cb.ack('处理失败');
+            }
+            catch { /* best-effort */ }
+        }
+        return;
+    }
     const parsed = parseCallbackData(cb.data);
     if (!parsed) {
         await cb.ack('未识别的按钮');