botmux 2.111.0 → 2.112.0

package/dist/workflows/v3/daemon-ipc-auth.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Workflow v3 daemon-mutation IPC authentication.
+ *
+ * This protocol deliberately has its own domain and headers.  The historical
+ * dashboard CLI HMAC signs only `ts:nonce`; accepting it here would let a
+ * credential captured for another local route be replayed against workflow
+ * start/retry/grant/cancel.  A v1 credential is instead bound to the exact
+ * request bytes and one daemon boot:
+ *
+ *   [domain, ts, nonce, METHOD, raw req.url, sha256(body), appId, port, bootId]
+ *
+ * The JSON-array encoding is unambiguous even if a future field contains a
+ * newline.  `bootInstanceId` is public audience data, not a secret; including
+ * it makes every credential invalid immediately after a daemon restart even
+ * when the process reuses the same port and the nonce cache starts empty.
+ * The HMAC key remains the established 0600 `.dashboard-secret`: putting a
+ * per-boot key in the public discovery descriptor would hand the capability to
+ * the exact port-only local process this boundary is intended to reject.
+ */
+import type { IncomingMessage } from 'node:http';
+export declare const WORKFLOW_DAEMON_IPC_DOMAIN = "botmux-workflow-daemon-ipc/v1";
+export declare const WORKFLOW_DAEMON_IPC_RESPONSE_DOMAIN = "botmux-workflow-daemon-ipc/v1/response";
+/** Dedicated namespace unknown to pre-v1 daemons; never reuse legacy mutation paths. */
+export declare const WORKFLOW_DAEMON_IPC_ROUTE_PREFIX = "/__workflow-ipc/v1/runs";
+export declare const WORKFLOW_DAEMON_IPC_TS_WINDOW_MS = 60000;
+export declare const WORKFLOW_DAEMON_IPC_NONCE_TTL_MS: number;
+export declare const WORKFLOW_DAEMON_IPC_BODY_LIMIT_BYTES: number;
+export declare const WORKFLOW_DAEMON_IPC_BODY_READ_TIMEOUT_MS = 5000;
+export declare const WORKFLOW_DAEMON_IPC_HEADERS: {
+    readonly timestamp: "x-botmux-workflow-ipc-ts";
+    readonly nonce: "x-botmux-workflow-ipc-nonce";
+    readonly signature: "x-botmux-workflow-ipc-signature";
+    readonly responseSignature: "x-botmux-workflow-ipc-response-signature";
+};
+export interface WorkflowDaemonIpcTarget {
+    larkAppId: string;
+    ipcPort: number;
+    bootInstanceId: string;
+}
+export interface WorkflowDaemonIpcClock {
+    now(): number;
+}
+export interface WorkflowDaemonIpcNonceStore {
+    has(nonce: string): boolean;
+    add(nonce: string, expiresAt: number): void;
+    size(): number;
+}
+export type WorkflowDaemonIpcVerifyReason = 'remote_not_loopback' | 'missing_or_malformed_header' | 'timestamp_out_of_window' | 'target_identity_unavailable' | 'body_too_large' | 'body_length_mismatch' | 'body_read_timeout' | 'body_read_failed' | 'body_not_utf8' | 'signature_mismatch' | 'replay';
+export type WorkflowDaemonIpcVerifyResult = {
+    ok: true;
+    bodyRaw: string;
+    nonce: string;
+    target: WorkflowDaemonIpcTarget;
+} | {
+    ok: false;
+    reason: WorkflowDaemonIpcVerifyReason;
+    httpStatus: number;
+};
+export interface WorkflowDaemonIpcSignInput {
+    secret: string;
+    timestamp: string;
+    nonce: string;
+    method: string;
+    pathWithQuery: string;
+    body: string | Uint8Array;
+    target: WorkflowDaemonIpcTarget;
+}
+export interface WorkflowDaemonIpcResponseSignInput {
+    secret: string;
+    requestNonce: string;
+    method: string;
+    pathWithQuery: string;
+    status: number;
+    body: string | Uint8Array;
+    target: WorkflowDaemonIpcTarget;
+}
+export interface WorkflowDaemonIpcVerifyOptions {
+    secret: string;
+    target: Omit<WorkflowDaemonIpcTarget, 'ipcPort'>;
+    nonceStore: WorkflowDaemonIpcNonceStore;
+    clock?: WorkflowDaemonIpcClock;
+    maxBodyBytes?: number;
+    bodyReadTimeoutMs?: number;
+}
+export declare const workflowDaemonIpcRealClock: WorkflowDaemonIpcClock;
+/** Canonical bytes covered by the v1 HMAC. Exported for golden tests/audits. */
+export declare function canonicalWorkflowDaemonIpcMaterial(input: Omit<WorkflowDaemonIpcSignInput, 'secret'>): string;
+export declare function signWorkflowDaemonIpcRequest(input: WorkflowDaemonIpcSignInput): string;
+export declare function canonicalWorkflowDaemonIpcResponseMaterial(input: Omit<WorkflowDaemonIpcResponseSignInput, 'secret'>): string;
+export declare function signWorkflowDaemonIpcResponse(input: WorkflowDaemonIpcResponseSignInput): string;
+export declare function verifyWorkflowDaemonIpcResponse(input: WorkflowDaemonIpcResponseSignInput & {
+    signature: string | null | undefined;
+}): boolean;
+export declare function createWorkflowDaemonIpcNonceStore(clock?: WorkflowDaemonIpcClock): WorkflowDaemonIpcNonceStore;
+/**
+ * Authenticate one inbound Workflow daemon mutation. The request body is read
+ * exactly once here and returned to the route; handlers must never read `req`.
+ */
+export declare function verifyWorkflowDaemonIpcRequest(req: IncomingMessage, options: WorkflowDaemonIpcVerifyOptions): Promise<WorkflowDaemonIpcVerifyResult>;
+export declare function generateWorkflowDaemonBootInstanceId(): string;
+export declare function generateWorkflowDaemonIpcNonce(): string;
+export declare function defaultWorkflowDaemonIpcSecretPath(): string;
+export declare function loadWorkflowDaemonIpcSecret(secretPath?: string): string;
+export declare function workflowDaemonIpcHeaders(input: {
+    secret: string;
+    method: string;
+    pathWithQuery: string;
+    bodyRaw: string;
+    target: WorkflowDaemonIpcTarget;
+    timestamp?: string;
+    nonce?: string;
+}): Record<string, string>;
+//# sourceMappingURL=daemon-ipc-auth.d.ts.map

package/dist/workflows/v3/daemon-ipc-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-ipc-auth.d.ts","sourceRoot":"","sources":["../../../src/workflows/v3/daemon-ipc-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAKjD,eAAO,MAAM,0BAA0B,kCAAkC,CAAC;AAC1E,eAAO,MAAM,mCAAmC,2CAA2C,CAAC;AAC5F,wFAAwF;AACxF,eAAO,MAAM,gCAAgC,4BAA4B,CAAC;AAC1E,eAAO,MAAM,gCAAgC,QAAS,CAAC;AACvD,eAAO,MAAM,gCAAgC,QAAc,CAAC;AAC5D,eAAO,MAAM,oCAAoC,QAAY,CAAC;AAC9D,eAAO,MAAM,wCAAwC,OAAQ,CAAC;AAE9D,eAAO,MAAM,2BAA2B;;;;;CAK9B,CAAC;AAKX,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,IAAI,MAAM,CAAC;CACf;AAED,MAAM,WAAW,2BAA2B;IAC1C,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5B,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,IAAI,IAAI,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,6BAA6B,GACrC,qBAAqB,GACrB,6BAA6B,GAC7B,yBAAyB,GACzB,6BAA6B,GAC7B,gBAAgB,GAChB,sBAAsB,GACtB,mBAAmB,GACnB,kBAAkB,GAClB,eAAe,GACf,oBAAoB,GACpB,QAAQ,CAAC;AAEb,MAAM,MAAM,6BAA6B,GACrC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GAC7E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,6BAA6B,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;IAC1B,MAAM,EAAE,uBAAuB,CAAC;CACjC;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;IAC1B,MAAM,EAAE,uBAAuB,CAAC;CACjC;AAED,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,IAAI,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC;IACjD,UAAU,EAAE,2BAA2B,CAAC;IACxC,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,0BAA0B,EAAE,sBAAkD,CAAC;AAe5F,gFAAgF;AAChF,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,IAAI,CAAC,0BAA0B,EAAE,QAAQ,CAAC,GAChD,MAAM,CAcR;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,0BAA0B,GAAG,MAAM,CAKtF;AAED,wBAAgB,0CAA0C,CACxD,KAAK,EAAE,IAAI,CAAC,kCAAkC,EAAE,QAAQ,CAAC,GACxD,MAAM,CAaR;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,kCAAkC,GAAG,MAAM,CAY/F;AAED,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,kCAAkC,GAAG;IAC1F,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACtC,GAAG,OAAO,CAIV;AAED,wBAAgB,iCAAiC,CAC/C,KAAK,GAAE,sBAAmD,GACzD,2BAA2B,CAqB7B;AAyED;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,6BAA6B,CAAC,CAmExC;AAED,wBAAgB,oCAAoC,IAAI,MAAM,CAE7D;AAED,wBAAgB,8BAA8B,IAAI,MAAM,CAEvD;AAED,wBAAgB,kCAAkC,IAAI,MAAM,CAE3D;AAED,wBAAgB,2BAA2B,CAAC,UAAU,SAAuC,GAAG,MAAM,CAMrG;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,uBAAuB,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBzB"}

package/dist/workflows/v3/daemon-ipc-auth.js

@@ -0,0 +1,294 @@
+/**
+ * Workflow v3 daemon-mutation IPC authentication.
+ *
+ * This protocol deliberately has its own domain and headers.  The historical
+ * dashboard CLI HMAC signs only `ts:nonce`; accepting it here would let a
+ * credential captured for another local route be replayed against workflow
+ * start/retry/grant/cancel.  A v1 credential is instead bound to the exact
+ * request bytes and one daemon boot:
+ *
+ *   [domain, ts, nonce, METHOD, raw req.url, sha256(body), appId, port, bootId]
+ *
+ * The JSON-array encoding is unambiguous even if a future field contains a
+ * newline.  `bootInstanceId` is public audience data, not a secret; including
+ * it makes every credential invalid immediately after a daemon restart even
+ * when the process reuses the same port and the nonce cache starts empty.
+ * The HMAC key remains the established 0600 `.dashboard-secret`: putting a
+ * per-boot key in the public discovery descriptor would hand the capability to
+ * the exact port-only local process this boundary is intended to reject.
+ */
+import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { dashboardSecretPath } from '../../core/dashboard-secret.js';
+import { loadDashboardSecret } from '../../dashboard/auth.js';
+export const WORKFLOW_DAEMON_IPC_DOMAIN = 'botmux-workflow-daemon-ipc/v1';
+export const WORKFLOW_DAEMON_IPC_RESPONSE_DOMAIN = 'botmux-workflow-daemon-ipc/v1/response';
+/** Dedicated namespace unknown to pre-v1 daemons; never reuse legacy mutation paths. */
+export const WORKFLOW_DAEMON_IPC_ROUTE_PREFIX = '/__workflow-ipc/v1/runs';
+export const WORKFLOW_DAEMON_IPC_TS_WINDOW_MS = 60_000;
+export const WORKFLOW_DAEMON_IPC_NONCE_TTL_MS = 10 * 60_000;
+export const WORKFLOW_DAEMON_IPC_BODY_LIMIT_BYTES = 16 * 1024;
+export const WORKFLOW_DAEMON_IPC_BODY_READ_TIMEOUT_MS = 5_000;
+export const WORKFLOW_DAEMON_IPC_HEADERS = {
+    timestamp: 'x-botmux-workflow-ipc-ts',
+    nonce: 'x-botmux-workflow-ipc-nonce',
+    signature: 'x-botmux-workflow-ipc-signature',
+    responseSignature: 'x-botmux-workflow-ipc-response-signature',
+};
+const B64URL_32_BYTES_RE = /^[A-Za-z0-9_-]{43}$/;
+const CANONICAL_EPOCH_MS_RE = /^(?:0|[1-9][0-9]{0,15})$/;
+export const workflowDaemonIpcRealClock = { now: () => Date.now() };
+function bodyBytes(body) {
+    return typeof body === 'string' ? Buffer.from(body, 'utf8') : Buffer.from(body);
+}
+function isValidTarget(target) {
+    return Boolean(target.larkAppId) &&
+        !/[\r\n\0]/.test(target.larkAppId) &&
+        Number.isInteger(target.ipcPort) &&
+        target.ipcPort >= 1 &&
+        target.ipcPort <= 65_535 &&
+        B64URL_32_BYTES_RE.test(target.bootInstanceId);
+}
+/** Canonical bytes covered by the v1 HMAC. Exported for golden tests/audits. */
+export function canonicalWorkflowDaemonIpcMaterial(input) {
+    const bytes = bodyBytes(input.body);
+    const bodySha256 = createHash('sha256').update(bytes).digest('hex');
+    return JSON.stringify([
+        WORKFLOW_DAEMON_IPC_DOMAIN,
+        input.timestamp,
+        input.nonce,
+        input.method.toUpperCase(),
+        input.pathWithQuery,
+        bodySha256,
+        input.target.larkAppId,
+        String(input.target.ipcPort),
+        input.target.bootInstanceId,
+    ]);
+}
+export function signWorkflowDaemonIpcRequest(input) {
+    if (!input.secret)
+        throw new Error('workflow daemon IPC secret is empty');
+    if (!isValidTarget(input.target))
+        throw new Error('workflow daemon IPC target descriptor is invalid');
+    const material = canonicalWorkflowDaemonIpcMaterial(input);
+    return createHmac('sha256', input.secret).update(material, 'utf8').digest('base64url');
+}
+export function canonicalWorkflowDaemonIpcResponseMaterial(input) {
+    const responseSha256 = createHash('sha256').update(bodyBytes(input.body)).digest('hex');
+    return JSON.stringify([
+        WORKFLOW_DAEMON_IPC_RESPONSE_DOMAIN,
+        input.requestNonce,
+        input.method.toUpperCase(),
+        input.pathWithQuery,
+        String(input.status),
+        responseSha256,
+        input.target.larkAppId,
+        String(input.target.ipcPort),
+        input.target.bootInstanceId,
+    ]);
+}
+export function signWorkflowDaemonIpcResponse(input) {
+    if (!input.secret)
+        throw new Error('workflow daemon IPC secret is empty');
+    if (!B64URL_32_BYTES_RE.test(input.requestNonce)) {
+        throw new Error('workflow daemon IPC request nonce is invalid');
+    }
+    if (!Number.isInteger(input.status) || input.status < 100 || input.status > 599) {
+        throw new Error('workflow daemon IPC response status is invalid');
+    }
+    if (!isValidTarget(input.target))
+        throw new Error('workflow daemon IPC target descriptor is invalid');
+    return createHmac('sha256', input.secret)
+        .update(canonicalWorkflowDaemonIpcResponseMaterial(input), 'utf8')
+        .digest('base64url');
+}
+export function verifyWorkflowDaemonIpcResponse(input) {
+    if (!input.signature)
+        return false;
+    const expected = signWorkflowDaemonIpcResponse(input);
+    return timingSafeWireEqual(input.signature, expected);
+}
+export function createWorkflowDaemonIpcNonceStore(clock = workflowDaemonIpcRealClock) {
+    const entries = new Map();
+    const gc = () => {
+        const now = clock.now();
+        for (const [nonce, expiresAt] of entries) {
+            if (expiresAt <= now)
+                entries.delete(nonce);
+        }
+    };
+    return {
+        has(nonce) {
+            gc();
+            return entries.has(nonce);
+        },
+        add(nonce, expiresAt) {
+            entries.set(nonce, expiresAt);
+        },
+        size() {
+            gc();
+            return entries.size;
+        },
+    };
+}
+function headerString(req, name) {
+    const value = req.headers[name];
+    return typeof value === 'string' ? value : undefined;
+}
+function isLoopback(address) {
+    return address === '127.0.0.1' || address === '::1' || Boolean(address?.endsWith('::ffff:127.0.0.1'));
+}
+async function readBoundedBody(req, maxBytes, timeoutMs) {
+    const contentLength = headerString(req, 'content-length');
+    const transferEncoding = headerString(req, 'transfer-encoding');
+    if (contentLength !== undefined && transferEncoding !== undefined) {
+        return { ok: false, reason: 'body_length_mismatch' };
+    }
+    let declaredLength;
+    if (contentLength !== undefined) {
+        if (!/^(?:0|[1-9][0-9]*)$/.test(contentLength)) {
+            return { ok: false, reason: 'body_length_mismatch' };
+        }
+        declaredLength = Number(contentLength);
+        if (declaredLength > maxBytes)
+            return { ok: false, reason: 'body_too_large' };
+    }
+    const chunks = [];
+    let total = 0;
+    let timedOut = false;
+    const timer = setTimeout(() => {
+        timedOut = true;
+        req.destroy(new Error('workflow daemon IPC body read timeout'));
+    }, timeoutMs);
+    timer.unref?.();
+    try {
+        for await (const chunk of req) {
+            const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            total += bytes.length;
+            if (total > maxBytes)
+                return { ok: false, reason: 'body_too_large' };
+            chunks.push(bytes);
+        }
+    }
+    catch {
+        return { ok: false, reason: timedOut ? 'body_read_timeout' : 'body_read_failed' };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (declaredLength !== undefined && declaredLength !== total) {
+        return { ok: false, reason: 'body_length_mismatch' };
+    }
+    return { ok: true, bytes: Buffer.concat(chunks, total) };
+}
+function decodeUtf8Strict(bytes) {
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch {
+        return null;
+    }
+}
+function timingSafeWireEqual(wire, expectedWire) {
+    if (!B64URL_32_BYTES_RE.test(wire) || !B64URL_32_BYTES_RE.test(expectedWire))
+        return false;
+    const provided = Buffer.from(wire, 'base64url');
+    const expected = Buffer.from(expectedWire, 'base64url');
+    return provided.length === expected.length && timingSafeEqual(provided, expected);
+}
+/**
+ * Authenticate one inbound Workflow daemon mutation. The request body is read
+ * exactly once here and returned to the route; handlers must never read `req`.
+ */
+export async function verifyWorkflowDaemonIpcRequest(req, options) {
+    if (!isLoopback(req.socket?.remoteAddress)) {
+        return { ok: false, reason: 'remote_not_loopback', httpStatus: 403 };
+    }
+    const timestamp = headerString(req, WORKFLOW_DAEMON_IPC_HEADERS.timestamp);
+    const nonce = headerString(req, WORKFLOW_DAEMON_IPC_HEADERS.nonce);
+    const signature = headerString(req, WORKFLOW_DAEMON_IPC_HEADERS.signature);
+    if (!timestamp || !CANONICAL_EPOCH_MS_RE.test(timestamp) || String(Number(timestamp)) !== timestamp ||
+        !nonce || !B64URL_32_BYTES_RE.test(nonce) ||
+        !signature || !B64URL_32_BYTES_RE.test(signature)) {
+        return { ok: false, reason: 'missing_or_malformed_header', httpStatus: 401 };
+    }
+    const clock = options.clock ?? workflowDaemonIpcRealClock;
+    const timestampMs = Number(timestamp);
+    if (Math.abs(clock.now() - timestampMs) > WORKFLOW_DAEMON_IPC_TS_WINDOW_MS) {
+        return { ok: false, reason: 'timestamp_out_of_window', httpStatus: 401 };
+    }
+    const localPort = req.socket?.localPort;
+    const target = {
+        ...options.target,
+        ipcPort: typeof localPort === 'number' ? localPort : 0,
+    };
+    if (!isValidTarget(target)) {
+        return { ok: false, reason: 'target_identity_unavailable', httpStatus: 503 };
+    }
+    const read = await readBoundedBody(req, options.maxBodyBytes ?? WORKFLOW_DAEMON_IPC_BODY_LIMIT_BYTES, options.bodyReadTimeoutMs ?? WORKFLOW_DAEMON_IPC_BODY_READ_TIMEOUT_MS);
+    if (!read.ok) {
+        return {
+            ok: false,
+            reason: read.reason,
+            httpStatus: read.reason === 'body_too_large'
+                ? 413
+                : read.reason === 'body_read_timeout' ? 408 : 400,
+        };
+    }
+    const bodyRaw = decodeUtf8Strict(read.bytes);
+    if (bodyRaw === null)
+        return { ok: false, reason: 'body_not_utf8', httpStatus: 400 };
+    // No await may occur between nonce lookup and insert. Concurrent requests
+    // with the same nonce therefore have exactly one winner in this process.
+    if (options.nonceStore.has(nonce)) {
+        return { ok: false, reason: 'replay', httpStatus: 401 };
+    }
+    const expected = signWorkflowDaemonIpcRequest({
+        secret: options.secret,
+        timestamp,
+        nonce,
+        method: req.method ?? 'GET',
+        pathWithQuery: req.url ?? '/',
+        body: read.bytes,
+        target,
+    });
+    if (!timingSafeWireEqual(signature, expected)) {
+        return { ok: false, reason: 'signature_mismatch', httpStatus: 401 };
+    }
+    options.nonceStore.add(nonce, clock.now() + WORKFLOW_DAEMON_IPC_NONCE_TTL_MS);
+    return { ok: true, bodyRaw, nonce, target };
+}
+export function generateWorkflowDaemonBootInstanceId() {
+    return randomBytes(32).toString('base64url');
+}
+export function generateWorkflowDaemonIpcNonce() {
+    return randomBytes(32).toString('base64url');
+}
+export function defaultWorkflowDaemonIpcSecretPath() {
+    return dashboardSecretPath();
+}
+export function loadWorkflowDaemonIpcSecret(secretPath = defaultWorkflowDaemonIpcSecretPath()) {
+    const secret = loadDashboardSecret(secretPath);
+    if (!secret) {
+        throw new Error('缺少 .dashboard-secret；请协调重启全部 botmux daemon 与 dashboard 后重试');
+    }
+    return secret;
+}
+export function workflowDaemonIpcHeaders(input) {
+    const timestamp = input.timestamp ?? String(Date.now());
+    const nonce = input.nonce ?? generateWorkflowDaemonIpcNonce();
+    const signature = signWorkflowDaemonIpcRequest({
+        secret: input.secret,
+        timestamp,
+        nonce,
+        method: input.method,
+        pathWithQuery: input.pathWithQuery,
+        body: input.bodyRaw,
+        target: input.target,
+    });
+    return {
+        'X-Botmux-Workflow-Ipc-Ts': timestamp,
+        'X-Botmux-Workflow-Ipc-Nonce': nonce,
+        'X-Botmux-Workflow-Ipc-Signature': signature,
+    };
+}
+//# sourceMappingURL=daemon-ipc-auth.js.map

package/dist/workflows/v3/daemon-ipc-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-ipc-auth.js","sourceRoot":"","sources":["../../../src/workflows/v3/daemon-ipc-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,MAAM,CAAC,MAAM,0BAA0B,GAAG,+BAA+B,CAAC;AAC1E,MAAM,CAAC,MAAM,mCAAmC,GAAG,wCAAwC,CAAC;AAC5F,wFAAwF;AACxF,MAAM,CAAC,MAAM,gCAAgC,GAAG,yBAAyB,CAAC;AAC1E,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC;AACvD,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,GAAG,MAAM,CAAC;AAC5D,MAAM,CAAC,MAAM,oCAAoC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9D,MAAM,CAAC,MAAM,wCAAwC,GAAG,KAAK,CAAC;AAE9D,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,SAAS,EAAE,0BAA0B;IACrC,KAAK,EAAE,6BAA6B;IACpC,SAAS,EAAE,iCAAiC;IAC5C,iBAAiB,EAAE,0CAA0C;CACrD,CAAC;AAEX,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AACjD,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAgEzD,MAAM,CAAC,MAAM,0BAA0B,GAA2B,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAE5F,SAAS,SAAS,CAAC,IAAyB;IAC1C,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,aAAa,CAAC,MAA+B;IACpD,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAC9B,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAClC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;QAChC,MAAM,CAAC,OAAO,IAAI,CAAC;QACnB,MAAM,CAAC,OAAO,IAAI,MAAM;QACxB,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AACnD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kCAAkC,CAChD,KAAiD;IAEjD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,0BAA0B;QAC1B,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;QAC1B,KAAK,CAAC,aAAa;QACnB,UAAU;QACV,KAAK,CAAC,MAAM,CAAC,SAAS;QACtB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;QAC5B,KAAK,CAAC,MAAM,CAAC,cAAc;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAiC;IAC5E,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC1E,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtG,MAAM,QAAQ,GAAG,kCAAkC,CAAC,KAAK,CAAC,CAAC;IAC3D,OAAO,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,0CAA0C,CACxD,KAAyD;IAEzD,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,mCAAmC;QACnC,KAAK,CAAC,YAAY;QAClB,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;QAC1B,KAAK,CAAC,aAAa;QACnB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QACpB,cAAc;QACd,KAAK,CAAC,MAAM,CAAC,SAAS;QACtB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;QAC5B,KAAK,CAAC,MAAM,CAAC,cAAc;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAyC;IACrF,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC1E,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtG,OAAO,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;SACtC,MAAM,CAAC,0CAA0C,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;SACjE,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAE/C;IACC,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,QAAQ,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACtD,OAAO,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,QAAgC,0BAA0B;IAE1D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,EAAE,GAAG,GAAS,EAAE;QACpB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,OAAO,EAAE,CAAC;YACzC,IAAI,SAAS,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,GAAG,CAAC,KAAa;YACf,EAAE,EAAE,CAAC;YACL,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,GAAG,CAAC,KAAa,EAAE,SAAiB;YAClC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAChC,CAAC;QACD,IAAI;YACF,EAAE,EAAE,CAAC;YACL,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAoB,EAAE,IAAY;IACtD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,OAA2B;IAC7C,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;AACxG,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,GAAoB,EACpB,QAAgB,EAChB,SAAiB;IAKjB,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC1D,MAAM,gBAAgB,GAAG,YAAY,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAChE,IAAI,aAAa,KAAK,SAAS,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,cAAkC,CAAC;IACvC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QACvD,CAAC;QACD,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QACvC,IAAI,cAAc,GAAG,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,QAAQ,GAAG,IAAI,CAAC;QAChB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;IAClE,CAAC,EAAE,SAAS,CAAC,CAAC;IACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;YAChF,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,KAAK,GAAG,QAAQ;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;YACrE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;IACpF,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,KAAK,EAAE,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,YAAoB;IAC7D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3F,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACxD,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACpF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,GAAoB,EACpB,OAAuC;IAEvC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAC3E,IACE,CAAC,SAAS,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,SAAS;QAC/F,CAAC,KAAK,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QACzC,CAAC,SAAS,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EACjD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,0BAA0B,CAAC;IAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,GAAG,gCAAgC,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC;IACxC,MAAM,MAAM,GAA4B;QACtC,GAAG,OAAO,CAAC,MAAM;QACjB,OAAO,EAAE,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;KACvD,CAAC;IACF,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,eAAe,CAChC,GAAG,EACH,OAAO,CAAC,YAAY,IAAI,oCAAoC,EAC5D,OAAO,CAAC,iBAAiB,IAAI,wCAAwC,CACtE,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,MAAM,KAAK,gBAAgB;gBAC1C,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;SACpD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAErF,0EAA0E;IAC1E,yEAAyE;IACzE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS;QACT,KAAK;QACL,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;QAC3B,aAAa,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG;QAC7B,IAAI,EAAE,IAAI,CAAC,KAAK;QAChB,MAAM;KACP,CAAC,CAAC;IACH,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACtE,CAAC;IACD,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,gCAAgC,CAAC,CAAC;IAC9E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,oCAAoC;IAClD,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,8BAA8B;IAC5C,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,kCAAkC;IAChD,OAAO,mBAAmB,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,UAAU,GAAG,kCAAkC,EAAE;IAC3F,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAQxC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,8BAA8B,EAAE,CAAC;IAC9D,MAAM,SAAS,GAAG,4BAA4B,CAAC;QAC7C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS;QACT,KAAK;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,IAAI,EAAE,KAAK,CAAC,OAAO;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,OAAO;QACL,0BAA0B,EAAE,SAAS;QACrC,6BAA6B,EAAE,KAAK;QACpC,iCAAiC,EAAE,SAAS;KAC7C,CAAC;AACJ,CAAC"}

package/dist/workflows/v3/daemon-ipc-body.d.ts

@@ -0,0 +1,30 @@
+/** Strict JSON schemas for the four authenticated Workflow daemon mutations. */
+import type { WorkflowDaemonMutation } from './daemon-ipc-client.js';
+export type WorkflowDaemonMutationBody = {
+    mutation: 'start';
+    value: Record<string, never>;
+} | {
+    mutation: 'cancel';
+    value: {
+        reason?: string;
+    };
+} | {
+    mutation: 'retry';
+    value: {
+        nodeId?: string;
+    };
+} | {
+    mutation: 'grant';
+    value: {
+        loopId?: string;
+    };
+};
+export type WorkflowDaemonMutationBodyResult = {
+    ok: true;
+    body: WorkflowDaemonMutationBody;
+} | {
+    ok: false;
+    error: 'bad_json' | 'bad_body' | 'bad_reason' | 'bad_node_id' | 'bad_loop_id';
+};
+export declare function parseWorkflowDaemonMutationBody(mutation: WorkflowDaemonMutation, bodyRaw: string): WorkflowDaemonMutationBodyResult;
+//# sourceMappingURL=daemon-ipc-body.d.ts.map

package/dist/workflows/v3/daemon-ipc-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-ipc-body.d.ts","sourceRoot":"","sources":["../../../src/workflows/v3/daemon-ipc-body.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAEhF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAKrE,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;CAAE,GACnD;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAClD;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACjD;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEtD,MAAM,MAAM,gCAAgC,GACxC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,0BAA0B,CAAA;CAAE,GAC9C;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,aAAa,GAAG,aAAa,CAAC;CAC/E,CAAC;AAWN,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,sBAAsB,EAChC,OAAO,EAAE,MAAM,GACd,gCAAgC,CAgDlC"}

package/dist/workflows/v3/daemon-ipc-body.js

@@ -0,0 +1,65 @@
+/** Strict JSON schemas for the four authenticated Workflow daemon mutations. */
+import { V3_DAG_SEGMENT_RE } from './dag.js';
+const CANCEL_REASON_MAX = 500;
+function plainJsonObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) &&
+        (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+}
+function exactKeys(value, allowed) {
+    return Object.keys(value).every((key) => allowed.includes(key));
+}
+export function parseWorkflowDaemonMutationBody(mutation, bodyRaw) {
+    let parsed;
+    if (bodyRaw === '')
+        return { ok: false, error: 'bad_json' };
+    try {
+        parsed = JSON.parse(bodyRaw);
+    }
+    catch {
+        return { ok: false, error: 'bad_json' };
+    }
+    // Clients sign one canonical JSON serialization. Requiring that same form
+    // rejects duplicate keys (JSON.parse would otherwise silently keep the last
+    // one), whitespace variants, and parse→re-stringify ambiguity.
+    if (JSON.stringify(parsed) !== bodyRaw)
+        return { ok: false, error: 'bad_json' };
+    if (!plainJsonObject(parsed))
+        return { ok: false, error: 'bad_body' };
+    if (mutation === 'start') {
+        if (!exactKeys(parsed, []))
+            return { ok: false, error: 'bad_body' };
+        return { ok: true, body: { mutation, value: {} } };
+    }
+    if (mutation === 'cancel') {
+        if (!exactKeys(parsed, ['reason']))
+            return { ok: false, error: 'bad_body' };
+        if (parsed.reason === undefined)
+            return { ok: true, body: { mutation, value: {} } };
+        if (typeof parsed.reason !== 'string' ||
+            !parsed.reason.trim() ||
+            parsed.reason.trim().length > CANCEL_REASON_MAX ||
+            /\0/.test(parsed.reason)) {
+            return { ok: false, error: 'bad_reason' };
+        }
+        return { ok: true, body: { mutation, value: { reason: parsed.reason.trim() } } };
+    }
+    if (mutation === 'retry') {
+        if (!exactKeys(parsed, ['nodeId']))
+            return { ok: false, error: 'bad_body' };
+        if (parsed.nodeId === undefined)
+            return { ok: true, body: { mutation, value: {} } };
+        if (typeof parsed.nodeId !== 'string' || !V3_DAG_SEGMENT_RE.test(parsed.nodeId)) {
+            return { ok: false, error: 'bad_node_id' };
+        }
+        return { ok: true, body: { mutation, value: { nodeId: parsed.nodeId } } };
+    }
+    if (!exactKeys(parsed, ['loopId']))
+        return { ok: false, error: 'bad_body' };
+    if (parsed.loopId === undefined)
+        return { ok: true, body: { mutation, value: {} } };
+    if (typeof parsed.loopId !== 'string' || !V3_DAG_SEGMENT_RE.test(parsed.loopId)) {
+        return { ok: false, error: 'bad_loop_id' };
+    }
+    return { ok: true, body: { mutation, value: { loopId: parsed.loopId } } };
+}
+//# sourceMappingURL=daemon-ipc-body.js.map

package/dist/workflows/v3/daemon-ipc-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-ipc-body.js","sourceRoot":"","sources":["../../../src/workflows/v3/daemon-ipc-body.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAGhF,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAe9B,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,OAA0B;IAC3E,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,QAAgC,EAChC,OAAe;IAEf,IAAI,MAAe,CAAC;IACpB,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,+DAA+D;IAC/D,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAChF,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAEtE,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC;QACpF,IACE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YACjC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,iBAAiB;YAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EACxB,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QAC5C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC;IACnF,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC;QACpF,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;IAC5E,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC;IACpF,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;AAC5E,CAAC"}

package/dist/workflows/v3/daemon-ipc-client.d.ts

@@ -0,0 +1,32 @@
+/** Shared client for authenticated Workflow v3 daemon mutations. */
+import type { OnlineDaemonInfo } from '../../utils/daemon-discovery.js';
+import { type WorkflowDaemonIpcTarget } from './daemon-ipc-auth.js';
+export type WorkflowDaemonMutation = 'start' | 'cancel' | 'retry' | 'grant';
+export interface WorkflowDaemonMutationResponse {
+    ok: boolean;
+    status: number;
+    bodyRaw: string;
+}
+export declare class WorkflowDaemonMutationTransportError extends Error {
+    readonly causeValue?: unknown | undefined;
+    constructor(message: string, causeValue?: unknown | undefined);
+}
+export declare function workflowDaemonMutationTarget(daemon: Pick<OnlineDaemonInfo, 'larkAppId' | 'ipcPort' | 'bootInstanceId' | 'workflowIpcProtocol'>): WorkflowDaemonIpcTarget;
+export declare function workflowDaemonMutationPath(runId: string, mutation: WorkflowDaemonMutation): string;
+/**
+ * Serialize once, sign those exact bytes, and pass the same string to fetch.
+ * Mutations are never transport-retried: a lost response must be reconciled by
+ * the operation's durable/idempotent domain semantics, not by blind HTTP retry.
+ */
+export declare function postWorkflowDaemonMutation(input: {
+    daemon: Pick<OnlineDaemonInfo, 'larkAppId' | 'ipcPort' | 'bootInstanceId' | 'workflowIpcProtocol'>;
+    runId: string;
+    mutation: WorkflowDaemonMutation;
+    body?: Record<string, unknown>;
+    secret?: string;
+    secretPath?: string;
+    fetchImpl?: typeof fetch;
+    timestamp?: string;
+    nonce?: string;
+}): Promise<WorkflowDaemonMutationResponse>;
+//# sourceMappingURL=daemon-ipc-client.d.ts.map

package/dist/workflows/v3/daemon-ipc-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-ipc-client.d.ts","sourceRoot":"","sources":["../../../src/workflows/v3/daemon-ipc-client.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAEpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAML,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;AAE5E,MAAM,WAAW,8BAA8B;IAC7C,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,oCAAqC,SAAQ,KAAK;aAChB,UAAU,CAAC,EAAE,OAAO;gBAArD,OAAO,EAAE,MAAM,EAAkB,UAAU,CAAC,EAAE,OAAO,YAAA;CAIlE;AAED,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,IAAI,CACV,gBAAgB,EAChB,WAAW,GAAG,SAAS,GAAG,gBAAgB,GAAG,qBAAqB,CACnE,GACA,uBAAuB,CAWzB;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,sBAAsB,GAC/B,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,MAAM,EAAE,IAAI,CACV,gBAAgB,EAChB,WAAW,GAAG,SAAS,GAAG,gBAAgB,GAAG,qBAAqB,CACnE,CAAC;IACF,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,sBAAsB,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAgD1C"}

package/dist/workflows/v3/daemon-ipc-client.js

@@ -0,0 +1,74 @@
+/** Shared client for authenticated Workflow v3 daemon mutations. */
+import { generateWorkflowDaemonIpcNonce, loadWorkflowDaemonIpcSecret, WORKFLOW_DAEMON_IPC_ROUTE_PREFIX, verifyWorkflowDaemonIpcResponse, workflowDaemonIpcHeaders, } from './daemon-ipc-auth.js';
+export class WorkflowDaemonMutationTransportError extends Error {
+    causeValue;
+    constructor(message, causeValue) {
+        super(message);
+        this.causeValue = causeValue;
+        this.name = 'WorkflowDaemonMutationTransportError';
+    }
+}
+export function workflowDaemonMutationTarget(daemon) {
+    if (daemon.workflowIpcProtocol !== 'v1' || !daemon.bootInstanceId) {
+        throw new WorkflowDaemonMutationTransportError(`daemon ${daemon.larkAppId} 未声明 Workflow IPC v1；请协调升级并重启全部 botmux 进程后重试`);
+    }
+    return {
+        larkAppId: daemon.larkAppId,
+        ipcPort: daemon.ipcPort,
+        bootInstanceId: daemon.bootInstanceId,
+    };
+}
+export function workflowDaemonMutationPath(runId, mutation) {
+    return `${WORKFLOW_DAEMON_IPC_ROUTE_PREFIX}/${encodeURIComponent(runId)}/${mutation}`;
+}
+/**
+ * Serialize once, sign those exact bytes, and pass the same string to fetch.
+ * Mutations are never transport-retried: a lost response must be reconciled by
+ * the operation's durable/idempotent domain semantics, not by blind HTTP retry.
+ */
+export async function postWorkflowDaemonMutation(input) {
+    const target = workflowDaemonMutationTarget(input.daemon);
+    const secret = input.secret ?? loadWorkflowDaemonIpcSecret(input.secretPath);
+    const pathWithQuery = workflowDaemonMutationPath(input.runId, input.mutation);
+    const bodyRaw = JSON.stringify(input.body ?? {});
+    const timestamp = input.timestamp ?? String(Date.now());
+    const nonce = input.nonce ?? generateWorkflowDaemonIpcNonce();
+    const headers = workflowDaemonIpcHeaders({
+        secret,
+        method: 'POST',
+        pathWithQuery,
+        bodyRaw,
+        target,
+        timestamp,
+        nonce,
+    });
+    const fetchImpl = input.fetchImpl ?? fetch;
+    let response;
+    try {
+        response = await fetchImpl(`http://127.0.0.1:${target.ipcPort}${pathWithQuery}`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', ...headers },
+            body: bodyRaw,
+        });
+    }
+    catch (err) {
+        throw new WorkflowDaemonMutationTransportError(`无法连接 daemon (port=${target.ipcPort}): ${err instanceof Error ? err.message : String(err)}`, err);
+    }
+    const responseBodyRaw = await response.text();
+    const responseSignature = response.headers.get('x-botmux-workflow-ipc-response-signature');
+    if (!verifyWorkflowDaemonIpcResponse({
+        secret,
+        requestNonce: nonce,
+        method: 'POST',
+        pathWithQuery,
+        status: response.status,
+        body: responseBodyRaw,
+        target,
+        signature: responseSignature,
+    })) {
+        throw new WorkflowDaemonMutationTransportError('daemon 响应未通过 Workflow IPC v1 认证；daemon 可能刚重启，请先重试一次，' +
+            '若持续出现再协调升级并重启全部 botmux 进程');
+    }
+    return { ok: response.ok, status: response.status, bodyRaw: responseBodyRaw };
+}
+//# sourceMappingURL=daemon-ipc-client.js.map