botmux 3.10.0 → 3.11.0

package/dist/services/idempotency-store.js

@@ -0,0 +1,299 @@
+/**
+ * Idempotency dispatch lease keyed by a caller-provided `options.idempotencyKey`
+ * (scoped per owning bot). The lease answers exactly ONE question: "may I
+ * dispatch this turn?" — it does NOT define what a caller sees as the terminal
+ * outcome. That terminal outcome lives in async-trigger-store (pending /
+ * completed / failed:dispatch_unknown), which trigger-result reads directly.
+ * Separating the two means correctness never depends on closeSession succeeding
+ * or on a second tombstone file (see PR #776 review 4878071011).
+ *
+ * States: reserved (claimed, not yet dispatched) → attempting (durably written
+ * BEFORE any fork/worker IPC side effect — commit-unknown). There is no
+ * "dispatched"/"completed" lease state: completion is proven by async-trigger
+ * store, and an attempting lease is a permanent "do-not-redispatch" fence.
+ *
+ * CONCURRENCY. rename(2) gives an atomic REPLACE, not a compare-and-swap. Every
+ * mutation therefore runs inside withFileLockSync(recordPath) (cross-process,
+ * per-key): read → verify full immutable identity + revision/state → durable
+ * atomic write, all under the lock. `atomicWriteFileSync` (tmp+fsync+rename,
+ * failure PRESERVES the old file) is used everywhere — never unlink→link, which
+ * could erase the only commit-unknown fence on an I/O failure.
+ *
+ * OWNERSHIP. (ownerLarkAppId, key) scoping + `ownerBootId` (this daemon process)
+ * + monotonic `revision`. Cross-bot reads are rejected fail-closed. Older-boot
+ * takeover of a `reserved` lease is safe under the repo's "one daemon per bot"
+ * invariant (daemon.ts): a different ownerBootId for the same bot means the
+ * previous process, which cannot still be advancing this lease.
+ *
+ * FAIL-CLOSED. Any ambiguous I/O / corruption on the claim path THROWS — the
+ * caller rolls back the just-created session and returns 5xx before dispatch.
+ */
+import { readFileSync, existsSync, mkdirSync, unlinkSync, readdirSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { createHash } from 'node:crypto';
+import { config } from '../config.js';
+import { logger } from '../utils/logger.js';
+import { withFileLockSync } from '../utils/file-lock.js';
+import { atomicWriteFileSync } from '../utils/atomic-write.js';
+export class IdempotencyConflictError extends Error {
+    existing;
+    constructor(existing) {
+        super('idempotency key already used with a different request payload');
+        this.existing = existing;
+        this.name = 'IdempotencyConflictError';
+    }
+}
+function baseDir() {
+    return join(config.session.dataDir, 'idempotency');
+}
+/** Per-owner subdirectory: sha256(owner). Owner-PARTITIONED layout so a boot
+ *  reconcile can enumerate ONLY its own bot's leases — a foreign (other-bot)
+ *  corrupt lease then lives under a different subdir and can never block this
+ *  bot's startup (the filename `sha256(owner\0key)` alone can't recover the
+ *  owner from unparseable JSON, so a flat dir + throwOnCorrupt was a cross-bot
+ *  startup DoS — codex #776 round-4 finding #4). */
+function ownerDir(ownerLarkAppId) {
+    const ownerHash = createHash('sha256').update(ownerLarkAppId).digest('hex');
+    return join(baseDir(), ownerHash);
+}
+/** Filename = <ownerDir>/sha256(owner \0 key).json. The NUL-separated key digest
+ *  keeps the same collision-free filename; the owner subdir gives partitioning. */
+function fileFor(ownerLarkAppId, key) {
+    const digest = createHash('sha256').update(ownerLarkAppId).update('\0').update(key).digest('hex');
+    return join(ownerDir(ownerLarkAppId), `${digest}.json`);
+}
+function ensureDirFor(fp) {
+    const dir = dirname(fp);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+}
+/** Acquire the per-key file lock, ensuring the record's OWNER subdir exists
+ *  first so withFileLockSync can create its `<path>.lock` sibling there. All
+ *  mutators route through here so the lock and the record live in a
+ *  materialized directory. */
+function withKeyLock(fp, fn) {
+    ensureDirFor(fp);
+    return withFileLockSync(fp, fn);
+}
+/** Read + validate. undefined only when ABSENT. Present-but-corrupt THROWS
+ *  (on the claim path an unreadable record is NOT provably absent). */
+function readRecord(fp) {
+    if (!existsSync(fp))
+        return undefined;
+    const data = JSON.parse(readFileSync(fp, 'utf-8'));
+    if (!data || typeof data !== 'object'
+        || typeof data.ownerLarkAppId !== 'string'
+        || typeof data.sessionId !== 'string'
+        || typeof data.triggerId !== 'string'
+        || typeof data.requestHash !== 'string'
+        || typeof data.ownerBootId !== 'string'
+        || typeof data.revision !== 'number'
+        || (data.state !== 'reserved' && data.state !== 'attempting')) {
+        throw new Error(`corrupt idempotency record: ${fp}`);
+    }
+    return data;
+}
+function writeRecord(fp, rec) {
+    ensureDirFor(fp);
+    atomicWriteFileSync(fp, JSON.stringify(rec, null, 2), { durable: true, followTargetSymlink: false });
+}
+/** True iff two records share the immutable identity fields (everything a CAS
+ *  must pin besides the mutable state/revision/updatedAt). */
+function sameIdentity(a, b) {
+    return a.ownerLarkAppId === b.ownerLarkAppId
+        && a.sessionId === b.sessionId
+        && a.triggerId === b.triggerId
+        && a.requestHash === b.requestHash
+        && a.ownerBootId === b.ownerBootId;
+}
+/** Non-locking read for the pre-check in trigger-session (a fast reject before
+ *  creating a session). Owner mismatch → undefined. Corrupt → THROWS. The
+ *  authoritative decision is always re-taken under the lock in claim/takeover. */
+export function lookup(ownerLarkAppId, key) {
+    const rec = readRecord(fileFor(ownerLarkAppId, key));
+    if (!rec)
+        return undefined;
+    if (rec.ownerLarkAppId !== ownerLarkAppId)
+        return undefined;
+    return rec;
+}
+/**
+ * Claim (owner, key) for a fresh `reserved` lease, or return the existing one —
+ * all inside the per-key lock (read → decide → durable write is atomic wrt other
+ * daemons/boots). Throws on corrupt/IO (fail-closed) and on payload conflict.
+ */
+export function claim(input) {
+    const fp = fileFor(input.ownerLarkAppId, input.key);
+    return withKeyLock(fp, () => {
+        const existing = readRecord(fp);
+        if (existing) {
+            if (existing.ownerLarkAppId !== input.ownerLarkAppId)
+                throw new Error('idempotency record owner mismatch');
+            if (existing.requestHash !== input.requestHash)
+                throw new IdempotencyConflictError(existing);
+            return { kind: 'existing', record: existing };
+        }
+        const rec = {
+            ownerLarkAppId: input.ownerLarkAppId, sessionId: input.sessionId, triggerId: input.triggerId,
+            requestHash: input.requestHash, ownerBootId: input.ownerBootId,
+            revision: 1, state: 'reserved', createdAt: input.now, updatedAt: input.now,
+        };
+        writeRecord(fp, rec);
+        return { kind: 'won', record: rec };
+    });
+}
+/**
+ * Take over an OLDER-boot `reserved` lease with a fresh reserved lease (new
+ * session/trigger), OR return the existing record if it's no longer a takeover
+ * target — all under the lock, re-reading current state (never trusting the
+ * caller's stale `from`). Returns won|existing so the caller handles a loss like
+ * a claim loss (close its new session, don't fork). Throws on conflict/IO.
+ *
+ *  - absent now → won (fresh claim).
+ *  - present, still the SAME older-boot reserved (identity+revision match) → won (replace).
+ *  - present, same payload but changed (attempting / newer revision / different
+ *    boot) → existing (someone advanced it; reuse, don't take over).
+ *  - present, different payload → conflict.
+ */
+export function takeover(input) {
+    const fp = fileFor(input.ownerLarkAppId, input.key);
+    return withKeyLock(fp, () => {
+        const current = readRecord(fp);
+        if (!current) {
+            const rec = {
+                ownerLarkAppId: input.ownerLarkAppId, sessionId: input.sessionId, triggerId: input.triggerId,
+                requestHash: input.requestHash, ownerBootId: input.ownerBootId,
+                revision: 1, state: 'reserved', createdAt: input.now, updatedAt: input.now,
+            };
+            writeRecord(fp, rec);
+            return { kind: 'won', record: rec };
+        }
+        if (current.ownerLarkAppId !== input.ownerLarkAppId)
+            throw new Error('idempotency record owner mismatch');
+        if (current.requestHash !== input.requestHash)
+            throw new IdempotencyConflictError(current);
+        // Only replace the EXACT older-boot reserved lease we saw. Anything else
+        // (advanced to attempting, bumped revision, or now owned by a live boot) is
+        // reused, not seized.
+        const stillTakeoverTarget = current.state === 'reserved'
+            && current.revision === input.expect.revision
+            && current.ownerBootId === input.expect.ownerBootId
+            && current.ownerBootId !== input.ownerBootId
+            && sameIdentity(current, input.expect);
+        if (!stillTakeoverTarget) {
+            return { kind: 'existing', record: current };
+        }
+        const rec = {
+            ownerLarkAppId: input.ownerLarkAppId, sessionId: input.sessionId, triggerId: input.triggerId,
+            requestHash: input.requestHash, ownerBootId: input.ownerBootId,
+            revision: current.revision + 1, state: 'reserved', createdAt: current.createdAt, updatedAt: input.now,
+        };
+        writeRecord(fp, rec);
+        return { kind: 'won', record: rec };
+    });
+}
+/** CAS a record to a new state under the lock. Verifies full identity + revision
+ *  before writing (rejects a stale/foreign writer). Returns the written record. */
+export function transition(ownerLarkAppId, key, from, patch) {
+    const fp = fileFor(ownerLarkAppId, key);
+    return withKeyLock(fp, () => {
+        const current = readRecord(fp);
+        if (!current)
+            throw new Error('idempotency transition: record vanished');
+        if (current.revision !== from.revision || !sameIdentity(current, from)) {
+            throw new Error(`idempotency CAS conflict: on-disk record changed under expected revision ${from.revision}`);
+        }
+        const next = { ...current, state: patch.state, revision: current.revision + 1, updatedAt: patch.now };
+        writeRecord(fp, next);
+        return next;
+    });
+}
+/** Delete a file, treating ONLY ENOENT as "already gone". EIO/EROFS/EACCES etc.
+ *  mean the file may still exist — the caller must NOT proceed as if released,
+ *  so we throw (finding: a swallowed unlink error left a reserved lease stuck to
+ *  a closed session). */
+function strictUnlink(fp) {
+    try {
+        unlinkSync(fp);
+    }
+    catch (err) {
+        if (err?.code !== 'ENOENT')
+            throw err;
+    }
+}
+/** Compare-and-remove: delete the lease ONLY if it still matches `expect`
+ *  (identity + revision + state) under the lock. Used to release a `reserved`
+ *  lease we created but abandoned before dispatch. Returns a discriminated
+ *  RemoveByPathResult (removed | absent | changed) — NOT a boolean — so the
+ *  barrier-release caller can tell a clean release (retryable) apart from "the
+ *  disk already advanced to attempting under me" (must durably terminalize, not
+ *  delete) instead of swallowing both (finding #1). A lock-internal re-read
+ *  corruption or an ambiguous unlink error (EIO/EROFS/…) THROWS — the caller
+ *  must be able to trust that `removed` means the lease is truly released. */
+export function compareAndRemove(ownerLarkAppId, key, expect) {
+    return compareAndRemoveByPath(fileFor(ownerLarkAppId, key), expect);
+}
+/** Enumerate the leases owned by a SINGLE bot (boot reconcile is owner-scoped).
+ *  Reads only `idempotency/<sha256(owner)>/` — a foreign bot's corrupt lease
+ *  lives under a different subdir and is never even opened here, so it can't
+ *  block this owner's startup (finding #4). By default a corrupt file under THIS
+ *  owner is logged + skipped; with `throwOnCorrupt`, a corrupt OWN lease THROWS
+ *  (the reconcile can't prove it converged, so it must fail-closed rather than
+ *  silently skip a possibly-unconverged attempting fence). */
+export function listAllForOwner(ownerLarkAppId, opts = {}) {
+    const dir = ownerDir(ownerLarkAppId);
+    if (!existsSync(dir))
+        return [];
+    const out = [];
+    for (const name of readdirSync(dir)) {
+        if (!name.endsWith('.json'))
+            continue;
+        const fp = join(dir, name);
+        try {
+            const rec = readRecord(fp);
+            // Defence-in-depth: the dir is already owner-partitioned, but a stray file
+            // whose stamped owner disagrees is not ours to touch — skip it.
+            if (rec && rec.ownerLarkAppId === ownerLarkAppId)
+                out.push({ file: fp, record: rec });
+        }
+        catch (err) {
+            if (opts.throwOnCorrupt)
+                throw new Error(`unreadable idempotency lease ${fp}: ${err.message}`);
+            logger.warn(`[idempotency] skipping unreadable lease ${fp}: ${err}`);
+        }
+    }
+    return out;
+}
+/** Reconcile-only compare-and-remove BY PATH (reconcile enumerated the file via
+ *  listAllForOwner and holds a snapshot record; the plaintext key isn't
+ *  recoverable from the hashed filename). Re-reads under the lock and removes
+ *  ONLY if the on-disk record still matches the snapshot's full identity +
+ *  revision + state — so a stale reserved snapshot can NOT delete a fence that
+ *  has since advanced to `attempting` (finding: old sweep erasing a crossed
+ *  commit-unknown barrier).
+ *
+ *  Returns a discriminated result rather than a boolean so the reconcile can
+ *  tell "converged (removed/absent)" apart from "changed under me" and act on
+ *  the latter (finding #2: a bare `false` folded both the changed case AND a
+ *  lock-internal corruption into a single value the caller ignored, declaring a
+ *  non-convergence a success). The `changed` result carries `sameIdentity` so
+ *  the caller never mistakes a DIFFERENT winner's record for its own advanced
+ *  fence (findings #2/#3). A lock-internal re-read corruption or an ambiguous
+ *  unlink error THROWS (fail-closed — the reconcile aborts startup rather than
+ *  bind while a lease is in an unprovable state). */
+export function compareAndRemoveByPath(fp, expect) {
+    return withKeyLock(fp, () => {
+        const current = readRecord(fp); // corrupt now → THROWS (never blind-delete, never fold to a success)
+        if (!current)
+            return { kind: 'absent' };
+        if (current.revision !== expect.revision || current.state !== expect.state || !sameIdentity(current, expect)) {
+            // Advanced/changed under us — hand it back for reclassification, marking
+            // whether it is STILL our exact immutable identity (only the mutable
+            // state/revision moved) or a wholly different winner replaced the slot.
+            return { kind: 'changed', current, sameIdentity: sameIdentity(current, expect) };
+        }
+        strictUnlink(fp); // throws on EIO/EROFS/… (never a silent success)
+        return { kind: 'removed' };
+    });
+}
+//# sourceMappingURL=idempotency-store.js.map

package/dist/services/idempotency-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency-store.js","sourceRoot":"","sources":["../../src/services/idempotency-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACvF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAoB/D,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACrB;IAA5B,YAA4B,QAA2B;QACrD,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAD7C,aAAQ,GAAR,QAAQ,CAAmB;QAErD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,SAAS,OAAO;IACd,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AACrD,CAAC;AAED;;;;;oDAKoD;AACpD,SAAS,QAAQ,CAAC,cAAsB;IACtC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AACpC,CAAC;AAED;mFACmF;AACnF,SAAS,OAAO,CAAC,cAAsB,EAAE,GAAW;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClG,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;IACxB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED;;;8BAG8B;AAC9B,SAAS,WAAW,CAAI,EAAU,EAAE,EAAW;IAC7C,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,OAAO,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED;uEACuE;AACvE,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAsB,CAAC;IACxE,IACE,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;WAC9B,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;WACvC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;WAClC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;WAClC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;WACpC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;WACpC,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;WACjC,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,CAAC,EAC7D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,EAAU,EAAE,GAAsB;IACrD,YAAY,CAAC,EAAE,CAAC,CAAC;IACjB,mBAAmB,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;AACvG,CAAC;AAED;8DAC8D;AAC9D,SAAS,YAAY,CAAC,CAAoB,EAAE,CAE3C;IACC,OAAO,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,cAAc;WACvC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;WAC3B,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;WAC3B,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW;WAC/B,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,CAAC;AACvC,CAAC;AAED;;kFAEkF;AAClF,MAAM,UAAU,MAAM,CAAC,cAAsB,EAAE,GAAW;IACxD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,GAAG,CAAC,cAAc,KAAK,cAAc;QAAE,OAAO,SAAS,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,KAAK,CAAC,KAGrB;IACC,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,OAAO,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE;QAC1B,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAC3G,IAAI,QAAQ,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;gBAAE,MAAM,IAAI,wBAAwB,CAAC,QAAQ,CAAC,CAAC;YAC7F,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAChD,CAAC;QACD,MAAM,GAAG,GAAsB;YAC7B,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;YAC5F,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9D,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG;SAC3E,CAAC;QACF,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,QAAQ,CAAC,KAGxB;IACC,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,OAAO,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE;QAC1B,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,GAAG,GAAsB;gBAC7B,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC5F,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9D,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG;aAC3E,CAAC;YACF,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACrB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC1G,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YAAE,MAAM,IAAI,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAC3F,yEAAyE;QACzE,4EAA4E;QAC5E,sBAAsB;QACtB,MAAM,mBAAmB,GACvB,OAAO,CAAC,KAAK,KAAK,UAAU;eACzB,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,CAAC,QAAQ;eAC1C,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW;eAChD,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;eACzC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC/C,CAAC;QACD,MAAM,GAAG,GAAsB;YAC7B,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;YAC5F,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9D,QAAQ,EAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG;SACtG,CAAC;QACF,WAAW,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;mFACmF;AACnF,MAAM,UAAU,UAAU,CACxB,cAAsB,EAAE,GAAW,EAAE,IAAuB,EAC5D,KAA+C;IAE/C,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACxC,OAAO,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE;QAC1B,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,4EAA4E,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,IAAI,GAAsB,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QACzH,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;yBAGyB;AACzB,SAAS,YAAY,CAAC,EAAU;IAC9B,IAAI,CAAC;QAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IACvB,OAAO,GAAQ,EAAE,CAAC;QAAC,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;8EAQ8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,cAAsB,EAAE,GAAW,EAAE,MAAyB;IAC7F,OAAO,sBAAsB,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;8DAM8D;AAC9D,MAAM,UAAU,eAAe,CAC7B,cAAsB,EACtB,OAAqC,EAAE;IAEvC,MAAM,GAAG,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,GAAG,GAAuD,EAAE,CAAC;IACnE,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;YAC3B,2EAA2E;YAC3E,gEAAgE;YAChE,IAAI,GAAG,IAAI,GAAG,CAAC,cAAc,KAAK,cAAc;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,EAAE,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1G,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAoBD;;;;;;;;;;;;;;;;qDAgBqD;AACrD,MAAM,UAAU,sBAAsB,CAAC,EAAU,EAAE,MAAyB;IAC1E,OAAO,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE;QAC1B,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,qEAAqE;QACrG,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7G,yEAAyE;YACzE,qEAAqE;YACrE,wEAAwE;YACxE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACnF,CAAC;QACD,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,iDAAiD;QACnE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/jsonl-cursor.d.ts

@@ -8,10 +8,14 @@ export interface JsonlScanOptions {
     onLine?: (line: string, lineStart: number) => void;
     onError?: (error: unknown) => void;
 }
+/** Scan a JSONL stream from a caller-owned regular file descriptor. The fd is
+ *  never closed here; ownership stays with the caller. */
+export declare function scanJsonlFromFd(fd: number, fromOffset: number, opts?: JsonlScanOptions): JsonlCursor | null;
 /**
- * Scan an append-only JSONL file from `fromOffset` using bounded-memory chunked
- * reads. Calls `onLine` for each COMPLETE line, and returns the durable byte
- * frontier plus any trailing partial line text left after the last newline.
+ * Scan an append-only JSONL file from `fromOffset` using chunked reads. Calls
+ * `onLine` for each COMPLETE line, and returns the durable byte frontier plus
+ * any trailing partial line text left after the last newline. One logical line
+ * is accumulated linearly, so memory remains proportional to that line length.
  */
 export declare function scanJsonlFromOffset(path: string, fromOffset: number, opts?: JsonlScanOptions): JsonlCursor | null;
 /**

package/dist/services/jsonl-cursor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jsonl-cursor.d.ts","sourceRoot":"","sources":["../../src/services/jsonl-cursor.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACnD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACpC;AAKD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,WAAW,GAAG,IAAI,CAsDrH;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAmC7D"}
+{"version":3,"file":"jsonl-cursor.d.ts","sourceRoot":"","sources":["../../src/services/jsonl-cursor.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACnD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACpC;AA4DD;0DAC0D;AAC1D,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,WAAW,GAAG,IAAI,CAE/G;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,WAAW,GAAG,IAAI,CAiBrH;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAmC7D"}

package/dist/services/jsonl-cursor.js

@@ -1,29 +1,15 @@
 import { closeSync, constants, existsSync, fstatSync, openSync, readSync, statSync, } from 'node:fs';
-import { StringDecoder } from 'node:string_decoder';
 const TAIL_PROBE_BYTES = 64 * 1024;
 const JSONL_SCAN_CHUNK_BYTES = 64 * 1024;
-/**
- * Scan an append-only JSONL file from `fromOffset` using bounded-memory chunked
- * reads. Calls `onLine` for each COMPLETE line, and returns the durable byte
- * frontier plus any trailing partial line text left after the last newline.
- */
-export function scanJsonlFromOffset(path, fromOffset, opts = {}) {
+function scanJsonlFromOpenFd(fd, fromOffset, opts = {}) {
     const endOffset = opts.endOffset;
     const chunkSize = Math.max(1, opts.chunkSize ?? JSONL_SCAN_CHUNK_BYTES);
-    let fd = null;
     let nextReadOffset = Math.max(0, fromOffset);
     let lineStartOffset = nextReadOffset;
-    let carry = '';
-    const decoder = new StringDecoder('utf8');
+    let lineBuffers = [];
+    let lineBytes = 0;
     const buf = Buffer.alloc(chunkSize);
     try {
-        // O_NONBLOCK prevents an untrusted transcript path swapped to a FIFO from
-        // hanging the daemon. Validate the opened fd (rather than only the path)
-        // so directories/devices and the stat→open replacement window fail closed.
-        fd = openSync(path, constants.O_RDONLY | (constants.O_NONBLOCK ?? 0));
-        if (!fstatSync(fd).isFile()) {
-            throw new Error(`JSONL source is not a regular file: ${path}`);
-        }
         while (true) {
             const remaining = endOffset === undefined ? chunkSize : endOffset - nextReadOffset;
             if (remaining <= 0)
@@ -33,33 +19,71 @@ export function scanJsonlFromOffset(path, fromOffset, opts = {}) {
             if (bytesRead <= 0)
                 break;
             nextReadOffset += bytesRead;
-            const decoded = decoder.write(buf.subarray(0, bytesRead));
-            const text = carry + decoded;
             let searchFrom = 0;
-            let currentLineStart = lineStartOffset;
-            // carry never contains '\n', so newlines can only appear at or after
-            // carry.length — starting there avoids re-scanning a growing carry on
-            // every chunk when a single record spans many chunks.
-            let nl = text.indexOf('\n', carry.length);
+            let nl = buf.subarray(0, bytesRead).indexOf(0x0a);
             while (nl >= 0) {
-                const line = text.slice(searchFrom, nl);
-                opts.onLine?.(line, currentLineStart);
-                currentLineStart += Buffer.byteLength(line, 'utf8') + 1;
+                const segment = Buffer.from(buf.subarray(searchFrom, nl));
+                if (segment.length > 0) {
+                    lineBuffers.push(segment);
+                    lineBytes += segment.length;
+                }
+                const line = lineBuffers.length === 1
+                    ? lineBuffers[0]
+                    : Buffer.concat(lineBuffers, lineBytes);
+                opts.onLine?.(line.toString('utf8'), lineStartOffset);
                 searchFrom = nl + 1;
-                nl = text.indexOf('\n', searchFrom);
+                lineStartOffset += lineBytes + 1;
+                lineBuffers = [];
+                lineBytes = 0;
+                nl = buf.subarray(searchFrom, bytesRead).indexOf(0x0a);
+                if (nl >= 0)
+                    nl += searchFrom;
+            }
+            if (searchFrom < bytesRead) {
+                const segment = Buffer.from(buf.subarray(searchFrom, bytesRead));
+                lineBuffers.push(segment);
+                lineBytes += segment.length;
             }
-            carry = text.slice(searchFrom);
-            lineStartOffset = currentLineStart;
         }
         return {
             newOffset: lineStartOffset,
-            pendingTail: carry + decoder.end(),
+            pendingTail: lineBuffers.length === 0
+                ? ''
+                : (lineBuffers.length === 1 ? lineBuffers[0] : Buffer.concat(lineBuffers, lineBytes)).toString('utf8'),
         };
     }
     catch (error) {
         opts.onError?.(error);
         return null;
     }
+}
+/** Scan a JSONL stream from a caller-owned regular file descriptor. The fd is
+ *  never closed here; ownership stays with the caller. */
+export function scanJsonlFromFd(fd, fromOffset, opts = {}) {
+    return scanJsonlFromOpenFd(fd, fromOffset, opts);
+}
+/**
+ * Scan an append-only JSONL file from `fromOffset` using chunked reads. Calls
+ * `onLine` for each COMPLETE line, and returns the durable byte frontier plus
+ * any trailing partial line text left after the last newline. One logical line
+ * is accumulated linearly, so memory remains proportional to that line length.
+ */
+export function scanJsonlFromOffset(path, fromOffset, opts = {}) {
+    let fd = null;
+    try {
+        // O_NONBLOCK prevents an untrusted transcript path swapped to a FIFO from
+        // hanging the daemon. Validate the opened fd (rather than only the path)
+        // so directories/devices and the stat→open replacement window fail closed.
+        fd = openSync(path, constants.O_RDONLY | (constants.O_NONBLOCK ?? 0));
+        if (!fstatSync(fd).isFile()) {
+            throw new Error(`JSONL source is not a regular file: ${path}`);
+        }
+        return scanJsonlFromOpenFd(fd, fromOffset, opts);
+    }
+    catch (error) {
+        opts.onError?.(error);
+        return null;
+    }
     finally {
         if (fd !== null)
             closeSync(fd);

package/dist/services/jsonl-cursor.js.map

@@ -1 +1 @@
-{"version":3,"file":"jsonl-cursor.js","sourceRoot":"","sources":["../../src/services/jsonl-cursor.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,QAAQ,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAcpD,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,UAAkB,EAAE,OAAyB,EAAE;IAC/F,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,IAAI,sBAAsB,CAAC,CAAC;IACxE,IAAI,EAAE,GAAkB,IAAI,CAAC;IAC7B,IAAI,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC7C,IAAI,eAAe,GAAG,cAAc,CAAC;IACrC,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEpC,IAAI,CAAC;QACH,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,cAAc,CAAC;YACnF,IAAI,SAAS,IAAI,CAAC;gBAAE,MAAM;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAG,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;YAC/D,IAAI,SAAS,IAAI,CAAC;gBAAE,MAAM;YAC1B,cAAc,IAAI,SAAS,CAAC;YAE5B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,KAAK,GAAG,OAAO,CAAC;YAC7B,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,gBAAgB,GAAG,eAAe,CAAC;YACvC,qEAAqE;YACrE,sEAAsE;YACtE,sDAAsD;YACtD,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1C,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;gBACf,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;gBACxC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;gBACtC,gBAAgB,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;gBACxD,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC;gBACpB,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACtC,CAAC;YACD,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/B,eAAe,GAAG,gBAAgB,CAAC;QACrC,CAAC;QACD,OAAO;YACL,SAAS,EAAE,eAAe;YAC1B,WAAW,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE;SACnC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAEhE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAEzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,GAAG,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,sEAAsE;QACtE,yEAAyE;QACzE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChE,OAAO;QACL,SAAS,EAAE,KAAK,GAAG,MAAM,GAAG,CAAC;QAC7B,WAAW;KACZ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"jsonl-cursor.js","sourceRoot":"","sources":["../../src/services/jsonl-cursor.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,QAAQ,GACT,MAAM,SAAS,CAAC;AAcjB,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,SAAS,mBAAmB,CAAC,EAAU,EAAE,UAAkB,EAAE,OAAyB,EAAE;IACtF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,IAAI,sBAAsB,CAAC,CAAC;IACxE,IAAI,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC7C,IAAI,eAAe,GAAG,cAAc,CAAC;IACrC,IAAI,WAAW,GAAa,EAAE,CAAC;IAC/B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEpC,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,cAAc,CAAC;YACnF,IAAI,SAAS,IAAI,CAAC;gBAAE,MAAM;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAG,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;YAC/D,IAAI,SAAS,IAAI,CAAC;gBAAE,MAAM;YAC1B,cAAc,IAAI,SAAS,CAAC;YAE5B,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClD,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACvB,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAC1B,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC;gBAC9B,CAAC;gBACD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,KAAK,CAAC;oBACnC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;oBAChB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;gBAC1C,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC,CAAC;gBACtD,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC;gBACpB,eAAe,IAAI,SAAS,GAAG,CAAC,CAAC;gBACjC,WAAW,GAAG,EAAE,CAAC;gBACjB,SAAS,GAAG,CAAC,CAAC;gBACd,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACvD,IAAI,EAAE,IAAI,CAAC;oBAAE,EAAE,IAAI,UAAU,CAAC;YAChC,CAAC;YACD,IAAI,UAAU,GAAG,SAAS,EAAE,CAAC;gBAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;gBACjE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC1B,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,OAAO;YACL,SAAS,EAAE,eAAe;YAC1B,WAAW,EAAE,WAAW,CAAC,MAAM,KAAK,CAAC;gBACnC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;SACzG,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;0DAC0D;AAC1D,MAAM,UAAU,eAAe,CAAC,EAAU,EAAE,UAAkB,EAAE,OAAyB,EAAE;IACzF,OAAO,mBAAmB,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,UAAkB,EAAE,OAAyB,EAAE;IAC/F,IAAI,EAAE,GAAkB,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,mBAAmB,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAEhE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAEzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,GAAG,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,sEAAsE;QACtE,yEAAyE;QACzE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChE,OAAO;QACL,SAAS,EAAE,KAAK,GAAG,MAAM,GAAG,CAAC;QAC7B,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/services/open-platform-rename.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"open-platform-rename.d.ts","sourceRoot":"","sources":["../../src/services/open-platform-rename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAUL,KAAK,wBAAwB,EAC7B,KAAK,YAAY,EAClB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAkB,KAAK,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAGtE,MAAM,MAAM,+BAA+B,GACvC,mBAAmB,GACnB,YAAY,GACZ,iBAAiB,GACjB,WAAW,GACX,WAAW,CAAC;AAEhB,MAAM,MAAM,wBAAwB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,+BAA+B,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,MAAM,YAAY,EAAE,GAAG,IAAI,CAAC;IAC1C,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;CAChF;AAoTD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,KAAK,GAAG,SAAS,EACxB,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,wBAAwB,CAAC,CAenC;AAID,MAAM,MAAM,wBAAwB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,+BAA+B,GAAG,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9F;gDACgD;AAChD,eAAO,MAAM,iBAAiB,MAAM,CAAC;AACrC,eAAO,MAAM,sBAAsB,QAAkB,CAAC;AAuBtD;;kDAEkD;AAClD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAqB7F;AASD;;;;GAIG;AACH,wBAAsB,6BAA6B,CACjD,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,KAAK,GAAG,SAAS,EACxB,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,wBAAwB,CAAC,CAqCnC"}
+{"version":3,"file":"open-platform-rename.d.ts","sourceRoot":"","sources":["../../src/services/open-platform-rename.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAUL,KAAK,wBAAwB,EAC7B,KAAK,YAAY,EAClB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAkB,KAAK,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAGtE,MAAM,MAAM,+BAA+B,GACvC,mBAAmB,GACnB,YAAY,GACZ,iBAAiB,GACjB,WAAW,GACX,WAAW,CAAC;AAEhB,MAAM,MAAM,wBAAwB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,+BAA+B,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,MAAM,YAAY,EAAE,GAAG,IAAI,CAAC;IAC1C,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;CAChF;AA0MD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,KAAK,GAAG,SAAS,EACxB,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,wBAAwB,CAAC,CAenC;AAID,MAAM,MAAM,wBAAwB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,+BAA+B,GAAG,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9F;gDACgD;AAChD,eAAO,MAAM,iBAAiB,MAAM,CAAC;AACrC,eAAO,MAAM,sBAAsB,QAAkB,CAAC;AAuBtD;;kDAEkD;AAClD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAqB7F;AASD;;;;GAIG;AACH,wBAAsB,6BAA6B,CACjD,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,KAAK,GAAG,SAAS,EACxB,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,wBAAwB,CAAC,CAqCnC"}

package/dist/services/open-platform-rename.js

@@ -21,6 +21,7 @@
  *   • api_error         — 其余 console API 失败（含审核中无法建版等）
  */
 import { botmuxFeishuSessionFilePath, buildAppVersionCreatePayload, bytedcliFeishuSessionFilePath, createOpenPlatformApiClient, extractVersionId, nextAppVersion, OpenPlatformApiError, readStoredCookiesFromSessionFile, } from '../setup/open-platform-automation.js';
+import { parseOnlineVisibility } from '../setup/open-platform-visibility.js';
 import { normalizeBrand } from '../im/lark/lark-hosts.js';
 import { logger } from '../utils/logger.js';
 function defaultLoadCookies() {
@@ -37,114 +38,6 @@ function isPlainRecord(value) {
 function asRecord(value) {
     return isPlainRecord(value) ? value : {};
 }
-// visible/online 各集合的 id 字段族：console 内部接口的条目形态没有公开契约，
-// members 实测是 { id }，departments / groups 未实测——按开放平台常见命名把
-// 候选 key 都列上，并配合下面的 fail-closed 兜底。
-const MEMBER_ID_KEYS = ['id', 'openId', 'open_id', 'userId', 'user_id', 'memberId', 'member_id'];
-const DEPARTMENT_ID_KEYS = ['id', 'departmentId', 'department_id', 'openDepartmentId', 'open_department_id'];
-const GROUP_ID_KEYS = ['id', 'groupId', 'group_id', 'chatId', 'chat_id', 'openChatId', 'open_chat_id'];
-/** 可见范围形态未识别 —— 绝不能发布可能改变可见性的版本，fail closed。 */
-class VisibilityParseError extends Error {
-    collection;
-    constructor(collection) {
-        super(`visible/online ${collection} 形态未识别，已中止（避免把线上可见范围发布成空/发漏）`);
-        this.collection = collection;
-    }
-}
-function pickIdByKeys(item, keys) {
-    if (typeof item === 'string')
-        return item;
-    if (typeof item === 'number' && Number.isFinite(item))
-        return String(item);
-    const rec = asRecord(item);
-    for (const key of keys) {
-        const v = rec[key];
-        if (typeof v === 'string' && v)
-            return v;
-        if (typeof v === 'number' && Number.isFinite(v))
-            return String(v);
-    }
-    return '';
-}
-/**
- * 条目 → id 列表。fail closed：任何一个条目解析不出 id 就抛
- * {@link VisibilityParseError}——部分丢失同样会收窄可见范围，宁可中止
- * 走降级路径，也不发布一个"看起来成功"但少了人的版本。
- */
-function idList(value, keys, collection) {
-    if (!Array.isArray(value))
-        return [];
-    const ids = value.map((item) => pickIdByKeys(item, keys)).filter(Boolean);
-    if (ids.length < value.length)
-        throw new VisibilityParseError(collection);
-    return ids;
-}
-/** 集合键：只有「键不存在」允许当空（仅 legacy 顶层形态的可选 groups 会走到）；
- *  键存在则值必须是数组——null/字符串等一律 fail closed，不得静默变空集合。 */
-function idListStrict(rec, key, keys, label) {
-    if (!(key in rec))
-        return [];
-    const value = rec[key];
-    if (!Array.isArray(value))
-        throw new VisibilityParseError(`${label}.${key}`);
-    return idList(value, keys, `${label}.${key}`);
-}
-const EMPTY_VISIBILITY = { departments: [], members: [], groups: [], isAll: 0 };
-/**
- * visible/online 的白/黑名单块 → 版本 payload 的 visibleSuggest 形态。
- * fail closed：块必须是对象且带齐 requiredKeys（实测线上契约 whiteList/blackList
- * 恒有 departments/groups/members/isAll 四键）——{}、null、缺键的残缺响应一律
- * 中止，绝不默认成「空可见范围」发布出去（那会把应用从所有人面前收走；黑名单
- * 丢失同理会把被拉黑的人放出来）。
- */
-function visibilityBlock(raw, label, requiredKeys) {
-    if (!isPlainRecord(raw))
-        throw new VisibilityParseError(label);
-    for (const key of requiredKeys) {
-        if (!(key in raw))
-            throw new VisibilityParseError(`${label}.${key}(缺失)`);
-    }
-    // isAll 只认 0/1/false/true：'1'、null 等异常值可能把「全员可见」误发布成
-    // 不可见（或反之），一律 fail closed。
-    const isAllRaw = raw.isAll;
-    if (isAllRaw !== 0 && isAllRaw !== 1 && isAllRaw !== false && isAllRaw !== true) {
-        throw new VisibilityParseError(`${label}.isAll`);
-    }
-    return {
-        departments: idListStrict(raw, 'departments', DEPARTMENT_ID_KEYS, label),
-        members: idListStrict(raw, 'members', MEMBER_ID_KEYS, label),
-        groups: idListStrict(raw, 'groups', GROUP_ID_KEYS, label),
-        isAll: isAllRaw === 1 || isAllRaw === true ? 1 : 0,
-    };
-}
-/** 现行契约块的必备键（实测所有 app 的 whiteList/blackList 都带齐这四键）。 */
-const BLOCK_REQUIRED_KEYS = ['departments', 'groups', 'members', 'isAll'];
-/** 旧形态（可见范围直接铺在 data 顶层）没有 groups 容器。 */
-const LEGACY_TOP_REQUIRED_KEYS = ['departments', 'members', 'isAll'];
-/**
- * 解析 visible/online 响应为 白/黑名单 suggest 对。两种已知形态：
- *   • 现行：data.whiteList + data.blackList 成对出现（成对是契约的一部分——
- *     只认白名单会把 blackList 静默丢成空、把被拉黑的人放出来，fail closed）
- *   • 旧形态兜底：可见范围直接铺在 data 顶层（无 whiteList 容器）；此形态
- *     没有黑名单容器，blackList 缺失按空处理，出现则严格解析
- */
-function parseOnlineVisibility(payload) {
-    const data = asRecord(payload).data;
-    if (!isPlainRecord(data))
-        throw new VisibilityParseError('data');
-    if ('whiteList' in data) {
-        return {
-            visibleSuggest: visibilityBlock(data.whiteList, 'whiteList', BLOCK_REQUIRED_KEYS),
-            blackVisibleSuggest: visibilityBlock(data.blackList, 'blackList', BLOCK_REQUIRED_KEYS),
-        };
-    }
-    return {
-        visibleSuggest: visibilityBlock(data, 'whiteList', LEGACY_TOP_REQUIRED_KEYS),
-        blackVisibleSuggest: data.blackList == null
-            ? { ...EMPTY_VISIBILITY }
-            : visibilityBlock(data.blackList, 'blackList', BLOCK_REQUIRED_KEYS),
-    };
-}
 function failureFromError(err, fallbackReason = 'api_error') {
     if (err instanceof OpenPlatformApiError) {
         const code = asRecord(err.payload).code;