aitable-workflow-cli 0.1.23 → 0.1.24

package/templates/support-qa/workflows/config-sync/recipes/config_sync.recipe.ts

@@ -1,668 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import path from "node:path";
-import { z } from "zod";
-import { DwsClient, normalizeByType, tableRefConfigSchema, globalVarRefPath, mapWithConcurrency, resolveContactsByUserIds, type CommandRunner, type RecipeDefinition, type RecipeContext, type RecipeResult } from "aitable-workflow-core";
-import { normalizeModuleOwners, type ModuleOwners } from "../../../lib/owner-resolver.js";
-
-/**
- * dws 命令统一走 core 的 DwsClient（而非自建 execFile）：拿到退避重试（消化 dws 后端
- * 偶发 TIMEOUT / 伪 AUTH_PERMISSION_DENIED）与连续失败升级告警，并让 success=false /
- * degraded=true 的响应直接抛错 —— 本 recipe 的三个拉取块都包在 try/catch 里降级为
- * 「保留旧值」，比静默同步一份空快照安全。
- */
-const dws = new DwsClient({ bin: "dws", timeoutMs: 30_000 });
-
-const dwsRunner: CommandRunner = async (_bin, args, opts) => {
-  try {
-    const result = await dws.runJson(args, { timeoutMs: opts?.timeoutMs });
-    return { exitCode: 0, stdout: JSON.stringify(result), stderr: "" };
-  } catch (e: any) {
-    return { exitCode: e?.exitCode ?? 1, stdout: "", stderr: e?.message ?? String(e) };
-  }
-};
-
-/** 从配置取 globalVar key：接受 "${globalVar.x}" 引用（解析出 x）或裸 key；空则回退默认。 */
-function varKey(raw: unknown, fallback: string): string {
-  const s = String(raw ?? "").trim();
-  return globalVarRefPath(s) ?? (s || fallback);
-}
-
-type Cells = Record<string, unknown>;
-type Rec = { recordId: string; cells: Cells };
-export type GroupConfig = {
-  groupId: string;
-  groupName?: string;
-  corpId?: string;
-  inbound?: string;
-  outbound?: string;
-  webhookUrl?: string;
-  webhookSecret?: string;
-  appKey?: string;
-  appSecret?: string;
-  /** config-sync 合成：outbound=webhook → groupId（webhook_creds 键），否则 → appKey（robot_creds 键）。
-   *  凭据本体在同期发布的两份凭据 map 里，下游（reply/stream）按本字段回查。 */
-  credRef?: string;
-  botNick?: string;
-  troubleshootingEnabled: boolean;
-};
-export type AdminConfig = { userId: string; nick: string; openDingTalkId: string };
-type FetchResult<T> = { ok: true; data: T } | { ok: false; error: string };
-
-async function dwsJson(args: string[], timeoutMs = 30_000): Promise<{ records: Rec[] }> {
-  const parsed = await dws.runJson(args, { timeoutMs });
-  return { records: extractRecords(parsed) };
-}
-
-/** dws record query/list 返回 `{ data: { records: [...] } }`，需 unwrap */
-function extractRecords(raw: unknown): Rec[] {
-  if (!raw || typeof raw !== "object") return [];
-  const rec = raw as Record<string, unknown>;
-  const payload = (rec.data ?? rec) as Record<string, unknown> | undefined;
-  if (!payload || typeof payload !== "object") return [];
-  const records = payload.records;
-  return Array.isArray(records) ? (records as Rec[]) : [];
-}
-
-function cellText(v: unknown, fieldType?: string): string {
-  const normalized = normalizeByType(v, fieldType);
-  if (typeof normalized === "string") return normalized.trim();
-  if (typeof normalized === "number") return String(normalized);
-  return "";
-}
-
-/** 群配置开关：仅明确的真值开启；缺失、空值或未知格式一律关闭。 */
-export function cellBoolean(v: unknown): boolean {
-  if (typeof v === "boolean") return v;
-  if (typeof v === "number") return v === 1;
-  if (typeof v === "string") {
-    return ["true", "1", "yes", "on", "是", "开启", "启用", "已勾选"].includes(v.trim().toLowerCase());
-  }
-  if (Array.isArray(v)) return v.some(cellBoolean);
-  const record = asRecord(v);
-  if (!record) return false;
-  if ("value" in record) return cellBoolean(record.value);
-  if ("name" in record) return cellBoolean(record.name);
-  return false;
-}
-
-function asRecord(value: unknown): Record<string, unknown> | null {
-  return value !== null && typeof value === "object" && !Array.isArray(value)
-    ? value as Record<string, unknown>
-    : null;
-}
-
-/** 将快照标准化，避免 DWS 返回顺序或 JSON 格式变化造成伪更新。 */
-export function normalizeGroupConfigs(raw: unknown): GroupConfig[] {
-  if (!Array.isArray(raw)) return [];
-  return raw.flatMap((value): GroupConfig[] => {
-    const record = asRecord(value);
-    const groupId = cellText(record?.groupId);
-    if (!groupId) return [];
-    const groupName = cellText(record?.groupName);
-    const corpId = cellText(record?.corpId);
-    const inbound = cellText(record?.inbound);
-    const outbound = cellText(record?.outbound);
-    const webhookUrl = cellText(record?.webhookUrl);
-    const webhookSecret = cellText(record?.webhookSecret);
-    const appKey = cellText(record?.appKey);
-    const appSecret = cellText(record?.appSecret);
-    const botNick = cellText(record?.botNick);
-    const troubleshootingEnabled = cellBoolean(record?.troubleshootingEnabled);
-
-    const normalized: GroupConfig = { groupId, troubleshootingEnabled };
-    if (groupName) normalized.groupName = groupName;
-    if (corpId) normalized.corpId = corpId;
-    if (inbound) normalized.inbound = inbound;
-    if (outbound) normalized.outbound = outbound;
-    if (webhookUrl) normalized.webhookUrl = webhookUrl;
-    if (webhookSecret) normalized.webhookSecret = webhookSecret;
-    if (appKey) normalized.appKey = appKey;
-    if (appSecret) normalized.appSecret = appSecret;
-    if (botNick) normalized.botNick = botNick;
-    // credRef 合成（凭据引用列已废，凭据本体在表内四列）：webhook 出站以 groupId 作
-    // webhook_creds 键；session 出站以 appKey 作 robot_creds 键。两消费分支互斥
-    // （reply 只在 webhook 分支读、conversation_handler 只在非 webhook 分支读），单值无冲突；
-    // 对已发布快照二次标准化时按同样规则重算，结果幂等。
-    const credRef = outbound === "webhook" ? groupId : appKey;
-    if (credRef) normalized.credRef = credRef;
-    return [normalized];
-  }).sort((left, right) => (
-    left.groupId.localeCompare(right.groupId)
-    || JSON.stringify(left).localeCompare(JSON.stringify(right))
-  ));
-}
-
-/**
- * 群配置凭据校验：按入站/出站方式检查表内凭据列，返回问题清单（空 = 通过）。
- * 有问题的群不得发布（否则运行期发送时才炸且难定位），由调用方剔除并显式报错。
- */
-export function groupConfigIssues(group: GroupConfig): string[] {
-  const label = group.groupName ?? group.groupId;
-  const issues: string[] = [];
-  if (group.outbound === "webhook" && (!group.webhookUrl || !group.webhookSecret)) {
-    issues.push(`群 ${label}: 出站方式=webhook 但 webhookUrl/webhookSecret 为空，请在群配置表补全`);
-  }
-  if ((group.inbound === "stream" || group.outbound === "session") && (!group.appKey || !group.appSecret)) {
-    issues.push(`群 ${label}: 入站方式=stream 或出站方式=session 但 appKey/appSecret 为空，请在群配置表补全`);
-  }
-  return issues;
-}
-
-/**
- * appKey 冲突检测：robot_creds 以 appKey 为键，同 appKey 不同 appSecret 时
- * 后者会静默覆盖前者（部分群出站凭据错配且难定位）。同 appKey 同 secret 视为
- * 同一机器人的合法复用；不一致时报错后群（normalize 按 groupId 排序，「先出现」
- * 确定），该群跳过发布。
- */
-export function appKeyConflicts(groups: GroupConfig[]): { issues: string[]; excluded: Set<string> } {
-  const firstSeen = new Map<string, { secret: string; label: string }>();
-  const issues: string[] = [];
-  const excluded = new Set<string>();
-  for (const g of groups) {
-    if (!g.appKey || !g.appSecret) continue;
-    const label = g.groupName ?? g.groupId;
-    const prev = firstSeen.get(g.appKey);
-    if (!prev) {
-      firstSeen.set(g.appKey, { secret: g.appSecret, label });
-      continue;
-    }
-    if (prev.secret !== g.appSecret) {
-      excluded.add(g.groupId);
-      issues.push(`群 ${label}: appKey="${g.appKey}" 的 appSecret 与群 ${prev.label} 不一致，本群跳过发布（防 robot_creds 静默覆盖），请核对群配置表`);
-    }
-  }
-  return { issues, excluded };
-}
-
-/** webhook 出站凭据 map（groupId → {url, secret}）：messaging 按 credRef(=groupId) 回查；键排序保证快照稳定 */
-export function buildWebhookCreds(groups: GroupConfig[]): Record<string, { url: string; secret: string }> {
-  const map: Record<string, { url: string; secret: string }> = {};
-  for (const g of [...groups].sort((a, b) => a.groupId.localeCompare(b.groupId))) {
-    if (g.outbound === "webhook" && g.webhookUrl && g.webhookSecret) {
-      map[g.groupId] = { url: g.webhookUrl, secret: g.webhookSecret };
-    }
-  }
-  return map;
-}
-
-/** 企业机器人凭据 map（appKey → {client_id, client_secret}）：stream 入站建连与 session 出站共读，按 appKey 天然去重 */
-export function buildRobotCreds(groups: GroupConfig[]): Record<string, { client_id: string; client_secret: string }> {
-  const map: Record<string, { client_id: string; client_secret: string }> = {};
-  for (const g of [...groups].sort((a, b) => (a.appKey ?? "").localeCompare(b.appKey ?? ""))) {
-    if ((g.inbound === "stream" || g.outbound === "session") && g.appKey && g.appSecret) {
-      map[g.appKey] = { client_id: g.appKey, client_secret: g.appSecret };
-    }
-  }
-  return map;
-}
-
-export function normalizeAdminConfigs(raw: unknown): AdminConfig[] {
-  if (!Array.isArray(raw)) return [];
-  return raw.flatMap((value): AdminConfig[] => {
-    const record = asRecord(value);
-    const userId = cellText(record?.userId);
-    const nick = cellText(record?.nick);
-    const openDingTalkId = cellText(record?.openDingTalkId);
-    return userId && nick && openDingTalkId ? [{ userId, nick, openDingTalkId }] : [];
-  }).sort((left, right) => (
-    left.userId.localeCompare(right.userId)
-    || JSON.stringify(left).localeCompare(JSON.stringify(right))
-  ));
-}
-
-/**
- * 物化 workspaces/support/owner-map.json（模块 → 花名数组）：answer Agent 的 AGENTS.md
- * 以本目录 owner-map.json 作为 module 闭集与「已 @ Owner」判定依据；快照发布后同步刷新，
- * 写盘失败只留痕不影响 globalVar 快照（运行期 Owner 解析走快照，不依赖本文件）。
- */
-function materializeOwnerMap(configDir: string, moduleOwners: ModuleOwners[], log: (msg: string) => void): void {
-  try {
-    const file = path.resolve(configDir, "workspaces", "support", "owner-map.json");
-    const content = `${JSON.stringify(
-      Object.fromEntries(moduleOwners.map((m) => [m.module, m.owners.map((o) => o.nick)])),
-      null,
-      2,
-    )}\n`;
-    const prev = existsSync(file) ? readFileSync(file, "utf8") : null;
-    if (prev === content) return;
-    mkdirSync(path.dirname(file), { recursive: true });
-    writeFileSync(file, content, "utf8");
-    log("workspaces/support/owner-map.json 已按功能模块人员配置表刷新");
-  } catch (e) {
-    log(`owner-map.json 写盘失败(不影响快照发布): ${e instanceof Error ? e.message : String(e)}`);
-  }
-}
-
-/** 空快照门禁的计数游标（按目标 globalVar 派生，避免多份快照互相干扰）。 */
-export function emptyStreakKey(key: string): string {
-  return `${key}__empty_streak`;
-}
-
-/**
- * 空快照发布门禁：远端读到空且旧值非空时，不立刻清空，先累计"连续读到空"轮数，
- * 达到 rounds 轮才认定为真实清空。防的是"读成功但结果为空"这类抖动（表查询瞬时
- * 返回 0 条、字段解析不到 userId 等）被当成"远端已清空"，把管理员/群名单误清 ——
- * 管理员被清会让真人同事消息退化成普通用户提问；pull 名单被清会让机器人整群失聪。
- * 旧值本来就是空，或本轮非空时，直接放行并复位计数。
- */
-export function gateEmptySnapshot(
-  ctx: RecipeContext,
-  key: string,
-  nextCount: number,
-  rounds: number,
-): { allow: boolean; streak: number; rounds: number } {
-  const required = Math.max(1, Math.trunc(rounds) || 1);
-  const streakKey = emptyStreakKey(key);
-  const rawStreak = Math.trunc(Number(ctx.getGlobalVar(streakKey) ?? 0));
-  const prevStreak = Number.isFinite(rawStreak) && rawStreak > 0 ? rawStreak : 0;
-  const currentValue = ctx.getGlobalVar(key);
-  const currentCount = Array.isArray(currentValue) ? currentValue.length : 0;
-
-  if (nextCount > 0 || currentCount === 0) {
-    if (prevStreak !== 0) ctx.setGlobalVar(streakKey, 0);
-    return { allow: true, streak: 0, rounds: required };
-  }
-
-  const streak = prevStreak + 1;
-  ctx.setGlobalVar(streakKey, streak >= required ? 0 : streak);
-  return { allow: streak >= required, streak, rounds: required };
-}
-
-/** 快照计数留痕文案：暂缓清空时显式带上门禁轮次，便于 trace 上直接看出"被拦下"而非"真为 0"。 */
-function snapshotCountLabel(result: FetchResult<unknown[]>, gate?: { allow: boolean; streak: number; rounds: number }): string {
-  if (!result.ok) return "读取失败";
-  if (gate && !gate.allow) return `0(暂缓清空 ${gate.streak}/${gate.rounds})`;
-  return String(result.data.length);
-}
-
-/** 内容变化时发布到 globalVar；返回是否实际更新（用于留痕判定）。 */
-export function publishIfChanged<T>(
-  ctx: RecipeContext,
-  key: string,
-  nextRaw: unknown,
-  normalize: (raw: unknown) => T[],
-): boolean {
-  const next = normalize(nextRaw);
-  const current = normalize(ctx.getGlobalVar(key) ?? []);
-  if (JSON.stringify(current) === JSON.stringify(next)) return false;
-  ctx.setGlobalVar(key, next);
-  return true;
-}
-
-/** publishIfChanged 的 map 版（凭据 map 非数组）；调用方需保证键序稳定以免伪更新。 */
-function publishMapIfChanged(ctx: RecipeContext, key: string, next: Record<string, unknown>): boolean {
-  const current = ctx.getGlobalVar(key) ?? {};
-  if (JSON.stringify(current) === JSON.stringify(next)) return false;
-  ctx.setGlobalVar(key, next);
-  return true;
-}
-
-
-
-/** 从 dws field get 结果中提取字段名→字段ID 映射（兼容数组或 { data: { fields: [...] } } 嵌套） */
-interface FieldMeta { fieldId: string; type: string; }
-function extractFieldMap(raw: unknown): Map<string, FieldMeta> {
-  let arr: unknown[] = [];
-  if (Array.isArray(raw)) arr = raw;
-  else if (raw && typeof raw === "object") {
-    const rec = raw as Record<string, unknown>;
-    if (Array.isArray(rec.fields)) arr = rec.fields;
-    else if (Array.isArray(rec.result)) arr = rec.result;
-    else if (rec.data && typeof rec.data === "object") {
-      const data = rec.data as Record<string, unknown>;
-      if (Array.isArray(data.fields)) arr = data.fields;
-      else if (Array.isArray(data.result)) arr = data.result;
-    }
-  }
-  const map = new Map<string, FieldMeta>();
-  for (const field of arr) {
-    if (!field || typeof field !== "object") continue;
-    const rec = field as Record<string, unknown>;
-    const id = typeof rec.fieldId === "string" ? rec.fieldId : typeof rec.id === "string" ? rec.id : null;
-    const name = typeof rec.fieldName === "string" ? rec.fieldName : typeof rec.name === "string" ? rec.name : null;
-    const type = typeof rec.type === "string" ? rec.type : "text";
-    if (id && name) map.set(name, { fieldId: id, type });
-  }
-  return map;
-}
-
-async function fetchFieldMap(baseId: string, tableId: string): Promise<Map<string, FieldMeta>> {
-  const raw = await dws.runJson(["aitable", "field", "get", "--base-id", baseId, "--table-id", tableId, "--format", "json"]);
-  return extractFieldMap(raw);
-}
-
-/** 从 fieldMap 解析字段 ID（查不到则回退原值） */
-function resolveFieldKey(nameOrId: string, fieldMap: Map<string, FieldMeta>): string {
-  return fieldMap.get(nameOrId)?.fieldId ?? nameOrId;
-}
-/** 从 fieldMap 获取字段类型（查不到则 undefined，走 normalizeByType 默认） */
-function fieldType(nameOrId: string, fieldMap: Map<string, FieldMeta>): string | undefined {
-  return fieldMap.get(nameOrId)?.type;
-}
-
-const recipe: RecipeDefinition = {
-  meta: {
-    id: "config_sync",
-    name: "拉取并固化群/管理员/模块人员配置",
-    role: "config-syncer",
-    description: "dws 拉群配置表 + 管理员表 + 功能模块人员表 + contact 解析 → 发布到 globalVar(group_configs/group_pull_list/admins/module_owners)",
-    version: "1.0.0",
-    requiresAgent: false,
-    timeoutMs: 120_000,
-    config: z.object({
-      group_table: tableRefConfigSchema({
-        label: "群配置表",
-        description: "群配置表（读取群ID、群名称、群归属企业corpId、入站方式、出站方式、webhookUrl/webhookSecret/appKey/appSecret、机器人昵称、是否排查问题）",
-        access: "read",
-        ownership: "owned",
-        autoCreate: true,
-        defaultBase: "workflow.tracker.base_id",
-        setupSchema: {
-          fields: [
-            { name: "群ID", type: "text" },
-            { name: "群名称", type: "text" },
-            // 群类型文本列（内部群/外部群）：控制台加群流程写入、view 页回读展示，
-            // 与首页「类型」列一一映射；留空=未知。config-sync 目前不消费该列。
-            { name: "群类型", type: "text" },
-            // 可选。Webhook @人解析时作为 dws --profile 使用，确保查询到群归属企业下的 userId；
-            // 留空时继续使用 DWS 当前 profile，兼容已有配置。
-            { name: "群归属企业corpId", type: "text" },
-            // 入站/出站双轴正交:
-            // 入站方式=dws(个人号轮询,进 pull 名单)/stream(企业机器人 WebSocket,@机器人触发);
-            // 出站方式=session(会话内 @提问者,依赖 stream 登记的 sessionWebhook)/webhook(命名 webhook 降级)。
-            // 用单选杜绝手填写错。象限约束:出站=session 依赖入站=stream(sessionWebhook 只由 stream 登记);
-            // dws+session 物理不可能,运行期降级 webhook。
-            { name: "入站方式", type: "singleSelect", options: ["dws", "stream"] },
-            { name: "出站方式", type: "singleSelect", options: ["session", "webhook"] },
-            // 凭据本体直接落在表内四列（取代旧「凭据引用」+ env 凭据集）：加群只改表、不碰 env。
-            // 校验规则：出站=webhook 要求 webhookUrl+webhookSecret 齐全；入站=stream 或出站=session
-            // 要求 appKey+appSecret 齐全；缺失的群在配置同步结果里显式报错并跳过发布。
-            { name: "webhookUrl", type: "text" },
-            { name: "webhookSecret", type: "text" },
-            { name: "appKey", type: "text" },
-            { name: "appSecret", type: "text" },
-            { name: "机器人昵称", type: "text" },
-            { name: "是否排查问题", type: "checkbox" },
-          ],
-        },
-      }),
-      admin_table: tableRefConfigSchema({
-        label: "管理员配置表",
-        description: "管理员配置表（读取管理员名单）",
-        access: "read",
-        ownership: "owned",
-        autoCreate: true,
-        defaultBase: "workflow.tracker.base_id",
-        setupSchema: {
-          fields: [
-            { name: "管理员", type: "user" },
-          ],
-        },
-      }),
-      owner_table: tableRefConfigSchema({
-        label: "功能模块人员配置表",
-        description: "功能模块人员配置表（读取模块→负责人映射，供 bug/feature/kb_gap 升级时 @ 模块 Owner）",
-        access: "read",
-        ownership: "owned",
-        autoCreate: true,
-        defaultBase: "workflow.tracker.base_id",
-        setupSchema: {
-          fields: [
-            { name: "模块", type: "text" },
-            { name: "人员", type: "user" },
-          ],
-        },
-      }),
-      group_var: z.string().default("${globalVar.group_configs}").describe("发布群配置的目标 globalVar"),
-      pull_list_var: z.string().default("${globalVar.group_pull_list}").describe("发布 dws 轮询群列表的目标 globalVar"),
-      stream_var: z.string().default("${globalVar.stream_robot_refs}").describe("发布 stream 入站机器人 credRef 名单的目标 globalVar"),
-      webhook_creds_var: z.string().default("${globalVar.webhook_creds}").describe("发布 webhook 出站凭据(groupId → {url, secret})的目标 globalVar；messaging toolkit 活读"),
-      robot_creds_var: z.string().default("${globalVar.robot_creds}").describe("发布企业机器人凭据(appKey → {client_id, client_secret})的目标 globalVar；stream 入站与 session 出站共读"),
-      admin_var: z.string().default("${globalVar.admins}").describe("发布管理员名单的目标 globalVar"),
-      owner_var: z.string().default("${globalVar.module_owners}").describe("发布功能模块人员配置的目标 globalVar"),
-      empty_confirm_rounds: z.coerce.number().int().min(1).default(2)
-        .describe("空快照发布门禁轮数：远端读到空且旧值非空时，需连续读到空达到该轮数才真正清空；未达轮数保留旧值并留痕（防读空抖动误清群/管理员名单）。设 1 即恢复旧的即时清空行为"),
-      contact_concurrency: z.coerce.number().int().min(1).default(5)
-        .describe("resolveContactsByUserIds 并发数：单轮 userId→openDingTalkId 解析的最大并行请求数"),
-    }),
-  },
-
-  async execute(ctx: RecipeContext): Promise<RecipeResult> {
-    const { config, log } = ctx;
-    const gt = config.group_table as { baseId: string; tableId: string };
-    const at = config.admin_table as { baseId: string; tableId: string };
-    const ot = config.owner_table as { baseId: string; tableId: string };
-    const groupVar = varKey(config.group_var, "group_configs");
-    const pullListVar = varKey(config.pull_list_var, "group_pull_list");
-    const streamVar = varKey(config.stream_var, "stream_robot_refs");
-    const webhookCredsVar = varKey(config.webhook_creds_var, "webhook_creds");
-    const robotCredsVar = varKey(config.robot_creds_var, "robot_creds");
-    const adminVar = varKey(config.admin_var, "admins");
-    const ownerVar = varKey(config.owner_var, "module_owners");
-    const emptyConfirmRounds = Math.max(1, Math.trunc(Number(config.empty_confirm_rounds ?? 2)) || 1);
-    const contactConcurrency = Math.max(1, Math.trunc(Number(config.contact_concurrency ?? 5)) || 5);
-
-    // 表自建后字段名固定，通过 field get 解析为字段ID再读取 cells
-    const GROUP_FIELDS = {
-      groupId: "群ID",
-      groupName: "群名称",
-      corpId: "群归属企业corpId",
-      inbound: "入站方式",
-      outbound: "出站方式",
-      webhookUrl: "webhookUrl",
-      webhookSecret: "webhookSecret",
-      appKey: "appKey",
-      appSecret: "appSecret",
-      botNick: "机器人昵称",
-      troubleshootingEnabled: "是否排查问题",
-    };
-    const ADMIN_FIELDS = { user: "管理员" };
-    const OWNER_FIELDS = { module: "模块", user: "人员" };
-
-    // 1) 群配置
-    let groupResult: FetchResult<GroupConfig[]>;
-    try {
-      const groupFieldMap = await fetchFieldMap(gt.baseId, gt.tableId);
-      const groupIdKey = resolveFieldKey(GROUP_FIELDS.groupId, groupFieldMap);
-      const groupNameKey = resolveFieldKey(GROUP_FIELDS.groupName, groupFieldMap);
-      const corpIdKey = resolveFieldKey(GROUP_FIELDS.corpId, groupFieldMap);
-      const inboundKey = resolveFieldKey(GROUP_FIELDS.inbound, groupFieldMap);
-      const outboundKey = resolveFieldKey(GROUP_FIELDS.outbound, groupFieldMap);
-      const webhookUrlKey = resolveFieldKey(GROUP_FIELDS.webhookUrl, groupFieldMap);
-      const webhookSecretKey = resolveFieldKey(GROUP_FIELDS.webhookSecret, groupFieldMap);
-      const appKeyKey = resolveFieldKey(GROUP_FIELDS.appKey, groupFieldMap);
-      const appSecretKey = resolveFieldKey(GROUP_FIELDS.appSecret, groupFieldMap);
-      const botNickKey = resolveFieldKey(GROUP_FIELDS.botNick, groupFieldMap);
-      const troubleshootingEnabledKey = resolveFieldKey(GROUP_FIELDS.troubleshootingEnabled, groupFieldMap);
-      const inboundType = fieldType(GROUP_FIELDS.inbound, groupFieldMap);
-      const outboundType = fieldType(GROUP_FIELDS.outbound, groupFieldMap);
-      const { records } = await dwsJson(["aitable", "record", "query", "--base-id", gt.baseId, "--table-id", gt.tableId, "--all", "--format", "json"]);
-      const groups = normalizeGroupConfigs(records.map((r) => ({
-        groupId: cellText(r.cells[groupIdKey], fieldType(GROUP_FIELDS.groupId, groupFieldMap)),
-        groupName: cellText(r.cells[groupNameKey], fieldType(GROUP_FIELDS.groupName, groupFieldMap)) || undefined,
-        corpId: cellText(r.cells[corpIdKey], fieldType(GROUP_FIELDS.corpId, groupFieldMap)) || undefined,
-        inbound: cellText(r.cells[inboundKey], inboundType) || undefined,
-        outbound: cellText(r.cells[outboundKey], outboundType) || undefined,
-        webhookUrl: cellText(r.cells[webhookUrlKey], fieldType(GROUP_FIELDS.webhookUrl, groupFieldMap)) || undefined,
-        webhookSecret: cellText(r.cells[webhookSecretKey], fieldType(GROUP_FIELDS.webhookSecret, groupFieldMap)) || undefined,
-        appKey: cellText(r.cells[appKeyKey], fieldType(GROUP_FIELDS.appKey, groupFieldMap)) || undefined,
-        appSecret: cellText(r.cells[appSecretKey], fieldType(GROUP_FIELDS.appSecret, groupFieldMap)) || undefined,
-        botNick: cellText(r.cells[botNickKey], fieldType(GROUP_FIELDS.botNick, groupFieldMap)) || undefined,
-        troubleshootingEnabled: cellBoolean(r.cells[troubleshootingEnabledKey]),
-      })));
-      groupResult = { ok: true, data: groups };
-    } catch (e) {
-      const error = e instanceof Error ? e.message : String(e);
-      log(`群配置拉取失败,保留旧值: ${error}`);
-      groupResult = { ok: false, error };
-    }
-
-    // 2) 管理员 userId → nick/openId(contact 链式)。每个 userId 内部 get→search 需串行,
-    //    但不同 userId 之间用有界并发处理,避免 N 较大时串行阻塞过久。
-    let adminResult: FetchResult<AdminConfig[]>;
-    try {
-      const adminFieldMap = await fetchFieldMap(at.baseId, at.tableId);
-      const userKey = resolveFieldKey(ADMIN_FIELDS.user, adminFieldMap);
-      const { records } = await dwsJson(["aitable", "record", "list", "--base-id", at.baseId, "--table-id", at.tableId, "--all", "--format", "json"]);
-      const userIds = [...new Set(records.flatMap((r) => Array.isArray(r.cells[userKey]) ? (r.cells[userKey] as { userId?: string }[]).map((u) => u?.userId ?? "").filter(Boolean) : []))];
-      const { contacts, errors: resolutionErrors } = await resolveContactsByUserIds(userIds, { log, concurrency: contactConcurrency, runner: dwsRunner });
-      // 部分成功策略（评审反馈）：个别 contact 解析失败（离职/数据损坏）只剔除该人并 warn 留痕，
-      // 其余管理员正常更新，避免一个坏记录在 5 分钟轮询下持续阻塞整组；
-      // 失败过半（含全部失败）视为 contact 服务级故障，仍整组保留旧值，防止把名单误清空/误收窄。
-      if (resolutionErrors.length > 0 && resolutionErrors.length * 2 >= userIds.length) {
-        throw new Error(`${resolutionErrors.length}/${userIds.length} 名管理员解析失败(过半，疑似 contact 故障): ${resolutionErrors.sort().join("; ")}`);
-      }
-      if (resolutionErrors.length > 0) {
-        log(`部分管理员解析失败(${resolutionErrors.length}/${userIds.length})，剔除后继续更新其余: ${resolutionErrors.sort().join("; ")}`);
-      }
-      const admins = normalizeAdminConfigs(userIds.map((uid) => contacts.get(uid)).filter(Boolean));
-      adminResult = { ok: true, data: admins };
-    } catch (e) {
-      const error = e instanceof Error ? e.message : String(e);
-      log(`管理员拉取失败,保留旧值: ${error}`);
-      adminResult = { ok: false, error };
-    }
-
-    // 3) 功能模块人员配置（模块-文本 + 人员-人员字段）：同一套 contact 链式解析，
-    //    发布 [{module, owners:[{userId, nick, openDingTalkId}]}] 供 on-action 运行期 @ 模块 Owner。
-    let ownerResult: FetchResult<ModuleOwners[]>;
-    try {
-      const ownerFieldMap = await fetchFieldMap(ot.baseId, ot.tableId);
-      const moduleKey = resolveFieldKey(OWNER_FIELDS.module, ownerFieldMap);
-      const ownerUserKey = resolveFieldKey(OWNER_FIELDS.user, ownerFieldMap);
-      const { records } = await dwsJson(["aitable", "record", "list", "--base-id", ot.baseId, "--table-id", ot.tableId, "--all", "--format", "json"]);
-      // 同模块多行合并（保留首次出现顺序：数组即「主负责人 + 备选」优先级）
-      const moduleUserIds = new Map<string, string[]>();
-      for (const r of records) {
-        const module = cellText(r.cells[moduleKey], fieldType(OWNER_FIELDS.module, ownerFieldMap));
-        if (!module) continue;
-        const uids = Array.isArray(r.cells[ownerUserKey]) ? (r.cells[ownerUserKey] as { userId?: string }[]).map((u) => u?.userId ?? "").filter(Boolean) : [];
-        if (uids.length === 0) continue;
-        const existing = moduleUserIds.get(module) ?? [];
-        moduleUserIds.set(module, [...new Set([...existing, ...uids])]);
-      }
-      const uniqueUserIds = [...new Set([...moduleUserIds.values()].flat())];
-      const { contacts, errors: resolutionErrors } = await resolveContactsByUserIds(uniqueUserIds, { log, concurrency: contactConcurrency, runner: dwsRunner });
-      // 与管理员同源的部分成功策略：个别失败剔除该人，过半失败整组保留旧值。
-      if (resolutionErrors.length > 0 && resolutionErrors.length * 2 >= uniqueUserIds.length) {
-        throw new Error(`${resolutionErrors.length}/${uniqueUserIds.length} 名模块人员解析失败(过半，疑似 contact 故障): ${resolutionErrors.sort().join("; ")}`);
-      }
-      if (resolutionErrors.length > 0) {
-        log(`部分模块人员解析失败(${resolutionErrors.length}/${uniqueUserIds.length})，剔除后继续更新其余: ${resolutionErrors.sort().join("; ")}`);
-      }
-      const moduleOwners = normalizeModuleOwners([...moduleUserIds.entries()].map(([module, uids]) => ({
-        module,
-        owners: uids.map((uid) => contacts.get(uid)).filter(Boolean),
-      })));
-      ownerResult = { ok: true, data: moduleOwners };
-    } catch (e) {
-      const error = e instanceof Error ? e.message : String(e);
-      log(`功能模块人员拉取失败,保留旧值: ${error}`);
-      ownerResult = { ok: false, error };
-    }
-
-    // 4) 仅发布变化的成功快照到 globalVar。失败保留旧值；"成功但为空"需经 empty_confirm_rounds
-    //    门禁连续确认后才真正清空（单次读空视为抖动，保留旧值并留痕）。
-    const changed: string[] = [];
-    const failures: string[] = [];
-    const withheld: string[] = [];
-    let groupGate: { allow: boolean; streak: number; rounds: number } | undefined;
-    let adminGate: { allow: boolean; streak: number; rounds: number } | undefined;
-    let ownerGate: { allow: boolean; streak: number; rounds: number } | undefined;
-    if (groupResult.ok) {
-      groupGate = gateEmptySnapshot(ctx, groupVar, groupResult.data.length, emptyConfirmRounds);
-      if (!groupGate.allow) {
-        // 群配置是 pull/stream 名单的唯一来源，暂缓时三份派生快照必须一起不动，
-        // 否则会出现"群配置保旧、pull 名单被清空"的半清空态（机器人静默失聪）。
-        withheld.push(`群配置(读到空 ${groupGate.streak}/${groupGate.rounds} 轮，暂缓清空)`);
-        log(`群配置读到空但旧值非空，暂缓清空(第 ${groupGate.streak}/${groupGate.rounds} 轮)：群配置/pull 名单/stream 名单一并保留旧值`);
-      } else {
-        // 凭据校验:缺凭据/同 appKey 异 secret 的群不发布(否则运行期发送时才炸且难定位),
-        // 并在同步结果显式报错驱动补表。单遍收集 issues 与 validGroups（评审建议）。
-        const conflicts = appKeyConflicts(groupResult.data);
-        const issues: string[] = [...conflicts.issues];
-        const validGroups: GroupConfig[] = [];
-        for (const g of groupResult.data) {
-          const groupIssues = groupConfigIssues(g);
-          if (groupIssues.length > 0) issues.push(...groupIssues);
-          else if (!conflicts.excluded.has(g.groupId)) validGroups.push(g);
-        }
-        if (issues.length > 0) {
-          const issueText = issues.sort().join("; ");
-          failures.push(`群配置校验: ${issueText}`);
-          log(`群配置校验失败(${issues.length} 项),相关群本轮跳过发布: ${issueText}`);
-        }
-        // 象限校验:出站=session 依赖入站=stream(sessionWebhook 只由 stream 登记),dws+session 物理不可能,告警(运行期降级 webhook)。
-        for (const g of validGroups) {
-          if (g.outbound === "session" && g.inbound !== "stream") {
-            log(`群配置象限告警 ${g.groupName ?? g.groupId}: 出站=session 依赖入站=stream,当前入站=${g.inbound ?? "空"},运行期将降级 webhook`);
-          }
-        }
-        if (publishIfChanged(ctx, groupVar, validGroups, normalizeGroupConfigs)) changed.push("群配置");
-        // 派生 pull 名单:只把入站=dws 的群写入(dws 轮询源监听),入站=stream 群走机器人 WebSocket 不入名单。
-        const pullIds = validGroups.filter((g) => g.inbound === "dws").map((g) => g.groupId);
-        if (publishIfChanged(ctx, pullListVar, pullIds, (v) => Array.isArray(v) ? v as string[] : [])) changed.push("pull 名单");
-        // 派生 stream 机器人名单:只把入站=stream 的群的 appKey 去重写入(stream 源据此维护连接池)。
-        const streamRefs = [...new Set(
-          validGroups.filter((g) => g.inbound === "stream" && g.appKey).map((g) => g.appKey!),
-        )];
-        if (publishIfChanged(ctx, streamVar, streamRefs, (v) => Array.isArray(v) ? v as string[] : [])) changed.push("stream 名单");
-        // 派生凭据 map:webhook 出站以 groupId 为键、机器人以 appKey 为键;profile 两个 ${globalVar.*} 引用活读。
-        if (publishMapIfChanged(ctx, webhookCredsVar, buildWebhookCreds(validGroups))) changed.push("webhook 凭据");
-        if (publishMapIfChanged(ctx, robotCredsVar, buildRobotCreds(validGroups))) changed.push("机器人凭据");
-      }
-    } else {
-      failures.push(`群配置: ${groupResult.error}`);
-    }
-    if (adminResult.ok) {
-      adminGate = gateEmptySnapshot(ctx, adminVar, adminResult.data.length, emptyConfirmRounds);
-      if (!adminGate.allow) {
-        withheld.push(`管理员配置(读到空 ${adminGate.streak}/${adminGate.rounds} 轮，暂缓清空)`);
-        log(`管理员名单读到空但旧值非空，暂缓清空(第 ${adminGate.streak}/${adminGate.rounds} 轮)：保留旧名单，避免真人同事发言被误判为用户提问`);
-      } else if (publishIfChanged(ctx, adminVar, adminResult.data, normalizeAdminConfigs)) {
-        changed.push("管理员配置");
-      }
-    } else {
-      failures.push(`管理员配置: ${adminResult.error}`);
-    }
-    if (ownerResult.ok) {
-      ownerGate = gateEmptySnapshot(ctx, ownerVar, ownerResult.data.length, emptyConfirmRounds);
-      if (!ownerGate.allow) {
-        withheld.push(`模块人员配置(读到空 ${ownerGate.streak}/${ownerGate.rounds} 轮，暂缓清空)`);
-        log(`模块人员配置读到空但旧值非空，暂缓清空(第 ${ownerGate.streak}/${ownerGate.rounds} 轮)：保留旧快照与 owner-map.json，避免 bug/feature 升级找不到 Owner`);
-      } else {
-        if (publishIfChanged(ctx, ownerVar, ownerResult.data, normalizeModuleOwners)) changed.push("模块人员配置");
-        // 快照成功后物化 owner-map.json（answer Agent 的 module 闭集提示依据），内容不变不写盘
-        materializeOwnerMap(ctx.configDir, ownerResult.data, log);
-      }
-    } else {
-      failures.push(`模块人员配置: ${ownerResult.error}`);
-    }
-
-    const shouldTrack = changed.length > 0 || failures.length > 0 || withheld.length > 0;
-    const syncResult = [
-      changed.length > 0 ? `已更新 ${changed.join("、")}` : "",
-      withheld.length > 0 ? `暂缓清空: ${withheld.join("；")}` : "",
-      failures.length > 0 ? `同步异常: ${failures.join("；")}` : "",
-    ].filter(Boolean).join("；") || "无变化";
-    const groupCount = snapshotCountLabel(groupResult, groupGate);
-    const adminCount = snapshotCountLabel(adminResult, adminGate);
-    const ownerCount = snapshotCountLabel(ownerResult, ownerGate);
-    log(`配置同步完成:${syncResult};群 ${groupCount}、管理员 ${adminCount}、模块 ${ownerCount}${shouldTrack ? "" : "(不留痕)"}`);
-    return {
-      status: "success",
-      output: { sync_result: syncResult, group_count: groupCount, admin_count: adminCount, owner_count: ownerCount },
-      // 三份成功快照均无变化 → on_demand 模式下不建行；失败/暂缓清空仍留痕，便于发现同步异常。
-      ...(shouldTrack ? {} : { tracker: false }),
-      logs: [
-        `群 ${groupCount}`,
-        `管理员 ${adminCount}`,
-        `模块 ${ownerCount}`,
-        ...(changed.length > 0 ? [`变更: ${changed.join("、")}`] : []),
-        ...withheld.map((item) => `暂缓: ${item}`),
-        ...failures.map((failure) => `失败: ${failure}`),
-      ],
-    };
-  },
-};
-export default recipe;