botmux 3.10.0 → 3.23.1

package/dist/workflows/v3/daemon-ipc-auth.js

@@ -1,294 +0,0 @@
-/**
- * Workflow v3 daemon-mutation IPC authentication.
- *
- * This protocol deliberately has its own domain and headers.  The historical
- * dashboard CLI HMAC signs only `ts:nonce`; accepting it here would let a
- * credential captured for another local route be replayed against workflow
- * start/retry/grant/cancel.  A v1 credential is instead bound to the exact
- * request bytes and one daemon boot:
- *
- *   [domain, ts, nonce, METHOD, raw req.url, sha256(body), appId, port, bootId]
- *
- * The JSON-array encoding is unambiguous even if a future field contains a
- * newline.  `bootInstanceId` is public audience data, not a secret; including
- * it makes every credential invalid immediately after a daemon restart even
- * when the process reuses the same port and the nonce cache starts empty.
- * The HMAC key remains the established 0600 `.dashboard-secret`: putting a
- * per-boot key in the public discovery descriptor would hand the capability to
- * the exact port-only local process this boundary is intended to reject.
- */
-import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
-import { dashboardSecretPath } from '../../core/dashboard-secret.js';
-import { loadDashboardSecret } from '../../dashboard/auth.js';
-export const WORKFLOW_DAEMON_IPC_DOMAIN = 'botmux-workflow-daemon-ipc/v1';
-export const WORKFLOW_DAEMON_IPC_RESPONSE_DOMAIN = 'botmux-workflow-daemon-ipc/v1/response';
-/** Dedicated namespace unknown to pre-v1 daemons; never reuse legacy mutation paths. */
-export const WORKFLOW_DAEMON_IPC_ROUTE_PREFIX = '/__workflow-ipc/v1/runs';
-export const WORKFLOW_DAEMON_IPC_TS_WINDOW_MS = 60_000;
-export const WORKFLOW_DAEMON_IPC_NONCE_TTL_MS = 10 * 60_000;
-export const WORKFLOW_DAEMON_IPC_BODY_LIMIT_BYTES = 16 * 1024;
-export const WORKFLOW_DAEMON_IPC_BODY_READ_TIMEOUT_MS = 5_000;
-export const WORKFLOW_DAEMON_IPC_HEADERS = {
-    timestamp: 'x-botmux-workflow-ipc-ts',
-    nonce: 'x-botmux-workflow-ipc-nonce',
-    signature: 'x-botmux-workflow-ipc-signature',
-    responseSignature: 'x-botmux-workflow-ipc-response-signature',
-};
-const B64URL_32_BYTES_RE = /^[A-Za-z0-9_-]{43}$/;
-const CANONICAL_EPOCH_MS_RE = /^(?:0|[1-9][0-9]{0,15})$/;
-export const workflowDaemonIpcRealClock = { now: () => Date.now() };
-function bodyBytes(body) {
-    return typeof body === 'string' ? Buffer.from(body, 'utf8') : Buffer.from(body);
-}
-function isValidTarget(target) {
-    return Boolean(target.larkAppId) &&
-        !/[\r\n\0]/.test(target.larkAppId) &&
-        Number.isInteger(target.ipcPort) &&
-        target.ipcPort >= 1 &&
-        target.ipcPort <= 65_535 &&
-        B64URL_32_BYTES_RE.test(target.bootInstanceId);
-}
-/** Canonical bytes covered by the v1 HMAC. Exported for golden tests/audits. */
-export function canonicalWorkflowDaemonIpcMaterial(input) {
-    const bytes = bodyBytes(input.body);
-    const bodySha256 = createHash('sha256').update(bytes).digest('hex');
-    return JSON.stringify([
-        WORKFLOW_DAEMON_IPC_DOMAIN,
-        input.timestamp,
-        input.nonce,
-        input.method.toUpperCase(),
-        input.pathWithQuery,
-        bodySha256,
-        input.target.larkAppId,
-        String(input.target.ipcPort),
-        input.target.bootInstanceId,
-    ]);
-}
-export function signWorkflowDaemonIpcRequest(input) {
-    if (!input.secret)
-        throw new Error('workflow daemon IPC secret is empty');
-    if (!isValidTarget(input.target))
-        throw new Error('workflow daemon IPC target descriptor is invalid');
-    const material = canonicalWorkflowDaemonIpcMaterial(input);
-    return createHmac('sha256', input.secret).update(material, 'utf8').digest('base64url');
-}
-export function canonicalWorkflowDaemonIpcResponseMaterial(input) {
-    const responseSha256 = createHash('sha256').update(bodyBytes(input.body)).digest('hex');
-    return JSON.stringify([
-        WORKFLOW_DAEMON_IPC_RESPONSE_DOMAIN,
-        input.requestNonce,
-        input.method.toUpperCase(),
-        input.pathWithQuery,
-        String(input.status),
-        responseSha256,
-        input.target.larkAppId,
-        String(input.target.ipcPort),
-        input.target.bootInstanceId,
-    ]);
-}
-export function signWorkflowDaemonIpcResponse(input) {
-    if (!input.secret)
-        throw new Error('workflow daemon IPC secret is empty');
-    if (!B64URL_32_BYTES_RE.test(input.requestNonce)) {
-        throw new Error('workflow daemon IPC request nonce is invalid');
-    }
-    if (!Number.isInteger(input.status) || input.status < 100 || input.status > 599) {
-        throw new Error('workflow daemon IPC response status is invalid');
-    }
-    if (!isValidTarget(input.target))
-        throw new Error('workflow daemon IPC target descriptor is invalid');
-    return createHmac('sha256', input.secret)
-        .update(canonicalWorkflowDaemonIpcResponseMaterial(input), 'utf8')
-        .digest('base64url');
-}
-export function verifyWorkflowDaemonIpcResponse(input) {
-    if (!input.signature)
-        return false;
-    const expected = signWorkflowDaemonIpcResponse(input);
-    return timingSafeWireEqual(input.signature, expected);
-}
-export function createWorkflowDaemonIpcNonceStore(clock = workflowDaemonIpcRealClock) {
-    const entries = new Map();
-    const gc = () => {
-        const now = clock.now();
-        for (const [nonce, expiresAt] of entries) {
-            if (expiresAt <= now)
-                entries.delete(nonce);
-        }
-    };
-    return {
-        has(nonce) {
-            gc();
-            return entries.has(nonce);
-        },
-        add(nonce, expiresAt) {
-            entries.set(nonce, expiresAt);
-        },
-        size() {
-            gc();
-            return entries.size;
-        },
-    };
-}
-function headerString(req, name) {
-    const value = req.headers[name];
-    return typeof value === 'string' ? value : undefined;
-}
-function isLoopback(address) {
-    return address === '127.0.0.1' || address === '::1' || Boolean(address?.endsWith('::ffff:127.0.0.1'));
-}
-async function readBoundedBody(req, maxBytes, timeoutMs) {
-    const contentLength = headerString(req, 'content-length');
-    const transferEncoding = headerString(req, 'transfer-encoding');
-    if (contentLength !== undefined && transferEncoding !== undefined) {
-        return { ok: false, reason: 'body_length_mismatch' };
-    }
-    let declaredLength;
-    if (contentLength !== undefined) {
-        if (!/^(?:0|[1-9][0-9]*)$/.test(contentLength)) {
-            return { ok: false, reason: 'body_length_mismatch' };
-        }
-        declaredLength = Number(contentLength);
-        if (declaredLength > maxBytes)
-            return { ok: false, reason: 'body_too_large' };
-    }
-    const chunks = [];
-    let total = 0;
-    let timedOut = false;
-    const timer = setTimeout(() => {
-        timedOut = true;
-        req.destroy(new Error('workflow daemon IPC body read timeout'));
-    }, timeoutMs);
-    timer.unref?.();
-    try {
-        for await (const chunk of req) {
-            const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-            total += bytes.length;
-            if (total > maxBytes)
-                return { ok: false, reason: 'body_too_large' };
-            chunks.push(bytes);
-        }
-    }
-    catch {
-        return { ok: false, reason: timedOut ? 'body_read_timeout' : 'body_read_failed' };
-    }
-    finally {
-        clearTimeout(timer);
-    }
-    if (declaredLength !== undefined && declaredLength !== total) {
-        return { ok: false, reason: 'body_length_mismatch' };
-    }
-    return { ok: true, bytes: Buffer.concat(chunks, total) };
-}
-function decodeUtf8Strict(bytes) {
-    try {
-        return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
-    }
-    catch {
-        return null;
-    }
-}
-function timingSafeWireEqual(wire, expectedWire) {
-    if (!B64URL_32_BYTES_RE.test(wire) || !B64URL_32_BYTES_RE.test(expectedWire))
-        return false;
-    const provided = Buffer.from(wire, 'base64url');
-    const expected = Buffer.from(expectedWire, 'base64url');
-    return provided.length === expected.length && timingSafeEqual(provided, expected);
-}
-/**
- * Authenticate one inbound Workflow daemon mutation. The request body is read
- * exactly once here and returned to the route; handlers must never read `req`.
- */
-export async function verifyWorkflowDaemonIpcRequest(req, options) {
-    if (!isLoopback(req.socket?.remoteAddress)) {
-        return { ok: false, reason: 'remote_not_loopback', httpStatus: 403 };
-    }
-    const timestamp = headerString(req, WORKFLOW_DAEMON_IPC_HEADERS.timestamp);
-    const nonce = headerString(req, WORKFLOW_DAEMON_IPC_HEADERS.nonce);
-    const signature = headerString(req, WORKFLOW_DAEMON_IPC_HEADERS.signature);
-    if (!timestamp || !CANONICAL_EPOCH_MS_RE.test(timestamp) || String(Number(timestamp)) !== timestamp ||
-        !nonce || !B64URL_32_BYTES_RE.test(nonce) ||
-        !signature || !B64URL_32_BYTES_RE.test(signature)) {
-        return { ok: false, reason: 'missing_or_malformed_header', httpStatus: 401 };
-    }
-    const clock = options.clock ?? workflowDaemonIpcRealClock;
-    const timestampMs = Number(timestamp);
-    if (Math.abs(clock.now() - timestampMs) > WORKFLOW_DAEMON_IPC_TS_WINDOW_MS) {
-        return { ok: false, reason: 'timestamp_out_of_window', httpStatus: 401 };
-    }
-    const localPort = req.socket?.localPort;
-    const target = {
-        ...options.target,
-        ipcPort: typeof localPort === 'number' ? localPort : 0,
-    };
-    if (!isValidTarget(target)) {
-        return { ok: false, reason: 'target_identity_unavailable', httpStatus: 503 };
-    }
-    const read = await readBoundedBody(req, options.maxBodyBytes ?? WORKFLOW_DAEMON_IPC_BODY_LIMIT_BYTES, options.bodyReadTimeoutMs ?? WORKFLOW_DAEMON_IPC_BODY_READ_TIMEOUT_MS);
-    if (!read.ok) {
-        return {
-            ok: false,
-            reason: read.reason,
-            httpStatus: read.reason === 'body_too_large'
-                ? 413
-                : read.reason === 'body_read_timeout' ? 408 : 400,
-        };
-    }
-    const bodyRaw = decodeUtf8Strict(read.bytes);
-    if (bodyRaw === null)
-        return { ok: false, reason: 'body_not_utf8', httpStatus: 400 };
-    // No await may occur between nonce lookup and insert. Concurrent requests
-    // with the same nonce therefore have exactly one winner in this process.
-    if (options.nonceStore.has(nonce)) {
-        return { ok: false, reason: 'replay', httpStatus: 401 };
-    }
-    const expected = signWorkflowDaemonIpcRequest({
-        secret: options.secret,
-        timestamp,
-        nonce,
-        method: req.method ?? 'GET',
-        pathWithQuery: req.url ?? '/',
-        body: read.bytes,
-        target,
-    });
-    if (!timingSafeWireEqual(signature, expected)) {
-        return { ok: false, reason: 'signature_mismatch', httpStatus: 401 };
-    }
-    options.nonceStore.add(nonce, clock.now() + WORKFLOW_DAEMON_IPC_NONCE_TTL_MS);
-    return { ok: true, bodyRaw, nonce, target };
-}
-export function generateWorkflowDaemonBootInstanceId() {
-    return randomBytes(32).toString('base64url');
-}
-export function generateWorkflowDaemonIpcNonce() {
-    return randomBytes(32).toString('base64url');
-}
-export function defaultWorkflowDaemonIpcSecretPath() {
-    return dashboardSecretPath();
-}
-export function loadWorkflowDaemonIpcSecret(secretPath = defaultWorkflowDaemonIpcSecretPath()) {
-    const secret = loadDashboardSecret(secretPath);
-    if (!secret) {
-        throw new Error('缺少 .dashboard-secret；请协调重启全部 botmux daemon 与 dashboard 后重试');
-    }
-    return secret;
-}
-export function workflowDaemonIpcHeaders(input) {
-    const timestamp = input.timestamp ?? String(Date.now());
-    const nonce = input.nonce ?? generateWorkflowDaemonIpcNonce();
-    const signature = signWorkflowDaemonIpcRequest({
-        secret: input.secret,
-        timestamp,
-        nonce,
-        method: input.method,
-        pathWithQuery: input.pathWithQuery,
-        body: input.bodyRaw,
-        target: input.target,
-    });
-    return {
-        'X-Botmux-Workflow-Ipc-Ts': timestamp,
-        'X-Botmux-Workflow-Ipc-Nonce': nonce,
-        'X-Botmux-Workflow-Ipc-Signature': signature,
-    };
-}
-//# sourceMappingURL=daemon-ipc-auth.js.map

package/dist/workflows/v3/daemon-ipc-auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"daemon-ipc-auth.js","sourceRoot":"","sources":["../../../src/workflows/v3/daemon-ipc-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,MAAM,CAAC,MAAM,0BAA0B,GAAG,+BAA+B,CAAC;AAC1E,MAAM,CAAC,MAAM,mCAAmC,GAAG,wCAAwC,CAAC;AAC5F,wFAAwF;AACxF,MAAM,CAAC,MAAM,gCAAgC,GAAG,yBAAyB,CAAC;AAC1E,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC;AACvD,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,GAAG,MAAM,CAAC;AAC5D,MAAM,CAAC,MAAM,oCAAoC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9D,MAAM,CAAC,MAAM,wCAAwC,GAAG,KAAK,CAAC;AAE9D,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,SAAS,EAAE,0BAA0B;IACrC,KAAK,EAAE,6BAA6B;IACpC,SAAS,EAAE,iCAAiC;IAC5C,iBAAiB,EAAE,0CAA0C;CACrD,CAAC;AAEX,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AACjD,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAgEzD,MAAM,CAAC,MAAM,0BAA0B,GAA2B,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAE5F,SAAS,SAAS,CAAC,IAAyB;IAC1C,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,aAAa,CAAC,MAA+B;IACpD,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAC9B,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAClC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;QAChC,MAAM,CAAC,OAAO,IAAI,CAAC;QACnB,MAAM,CAAC,OAAO,IAAI,MAAM;QACxB,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AACnD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kCAAkC,CAChD,KAAiD;IAEjD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,0BAA0B;QAC1B,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;QAC1B,KAAK,CAAC,aAAa;QACnB,UAAU;QACV,KAAK,CAAC,MAAM,CAAC,SAAS;QACtB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;QAC5B,KAAK,CAAC,MAAM,CAAC,cAAc;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAiC;IAC5E,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC1E,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtG,MAAM,QAAQ,GAAG,kCAAkC,CAAC,KAAK,CAAC,CAAC;IAC3D,OAAO,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,0CAA0C,CACxD,KAAyD;IAEzD,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,mCAAmC;QACnC,KAAK,CAAC,YAAY;QAClB,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;QAC1B,KAAK,CAAC,aAAa;QACnB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QACpB,cAAc;QACd,KAAK,CAAC,MAAM,CAAC,SAAS;QACtB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;QAC5B,KAAK,CAAC,MAAM,CAAC,cAAc;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAyC;IACrF,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC1E,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtG,OAAO,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;SACtC,MAAM,CAAC,0CAA0C,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;SACjE,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAE/C;IACC,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,QAAQ,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACtD,OAAO,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,QAAgC,0BAA0B;IAE1D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,EAAE,GAAG,GAAS,EAAE;QACpB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,OAAO,EAAE,CAAC;YACzC,IAAI,SAAS,IAAI,GAAG;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,GAAG,CAAC,KAAa;YACf,EAAE,EAAE,CAAC;YACL,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,GAAG,CAAC,KAAa,EAAE,SAAiB;YAClC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAChC,CAAC;QACD,IAAI;YACF,EAAE,EAAE,CAAC;YACL,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAoB,EAAE,IAAY;IACtD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,OAA2B;IAC7C,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;AACxG,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,GAAoB,EACpB,QAAgB,EAChB,SAAiB;IAKjB,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC1D,MAAM,gBAAgB,GAAG,YAAY,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAChE,IAAI,aAAa,KAAK,SAAS,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,cAAkC,CAAC;IACvC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QACvD,CAAC;QACD,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QACvC,IAAI,cAAc,GAAG,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,QAAQ,GAAG,IAAI,CAAC;QAChB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;IAClE,CAAC,EAAE,SAAS,CAAC,CAAC;IACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;YAChF,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,KAAK,GAAG,QAAQ;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;YACrE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;IACpF,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,KAAK,EAAE,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,YAAoB;IAC7D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3F,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACxD,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACpF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,GAAoB,EACpB,OAAuC;IAEvC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAC3E,IACE,CAAC,SAAS,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,SAAS;QAC/F,CAAC,KAAK,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QACzC,CAAC,SAAS,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EACjD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,0BAA0B,CAAC;IAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,GAAG,gCAAgC,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC;IACxC,MAAM,MAAM,GAA4B;QACtC,GAAG,OAAO,CAAC,MAAM;QACjB,OAAO,EAAE,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;KACvD,CAAC;IACF,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,eAAe,CAChC,GAAG,EACH,OAAO,CAAC,YAAY,IAAI,oCAAoC,EAC5D,OAAO,CAAC,iBAAiB,IAAI,wCAAwC,CACtE,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,MAAM,KAAK,gBAAgB;gBAC1C,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;SACpD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAErF,0EAA0E;IAC1E,yEAAyE;IACzE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS;QACT,KAAK;QACL,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;QAC3B,aAAa,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG;QAC7B,IAAI,EAAE,IAAI,CAAC,KAAK;QAChB,MAAM;KACP,CAAC,CAAC;IACH,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACtE,CAAC;IACD,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,gCAAgC,CAAC,CAAC;IAC9E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,oCAAoC;IAClD,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,8BAA8B;IAC5C,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,kCAAkC;IAChD,OAAO,mBAAmB,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,UAAU,GAAG,kCAAkC,EAAE;IAC3F,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAQxC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,8BAA8B,EAAE,CAAC;IAC9D,MAAM,SAAS,GAAG,4BAA4B,CAAC;QAC7C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS;QACT,KAAK;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,IAAI,EAAE,KAAK,CAAC,OAAO;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,OAAO;QACL,0BAA0B,EAAE,SAAS;QACrC,6BAA6B,EAAE,KAAK;QACpC,iCAAiC,EAAE,SAAS;KAC7C,CAAC;AACJ,CAAC"}

package/dist/workflows/v3/daemon-ipc-body.d.ts

@@ -1,30 +0,0 @@
-/** Strict JSON schemas for the four authenticated Workflow daemon mutations. */
-import type { WorkflowDaemonMutation } from './daemon-ipc-client.js';
-export type WorkflowDaemonMutationBody = {
-    mutation: 'start';
-    value: Record<string, never>;
-} | {
-    mutation: 'cancel';
-    value: {
-        reason?: string;
-    };
-} | {
-    mutation: 'retry';
-    value: {
-        nodeId?: string;
-    };
-} | {
-    mutation: 'grant';
-    value: {
-        loopId?: string;
-    };
-};
-export type WorkflowDaemonMutationBodyResult = {
-    ok: true;
-    body: WorkflowDaemonMutationBody;
-} | {
-    ok: false;
-    error: 'bad_json' | 'bad_body' | 'bad_reason' | 'bad_node_id' | 'bad_loop_id';
-};
-export declare function parseWorkflowDaemonMutationBody(mutation: WorkflowDaemonMutation, bodyRaw: string): WorkflowDaemonMutationBodyResult;
-//# sourceMappingURL=daemon-ipc-body.d.ts.map

package/dist/workflows/v3/daemon-ipc-body.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"daemon-ipc-body.d.ts","sourceRoot":"","sources":["../../../src/workflows/v3/daemon-ipc-body.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAEhF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAKrE,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;CAAE,GACnD;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAClD;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACjD;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEtD,MAAM,MAAM,gCAAgC,GACxC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,0BAA0B,CAAA;CAAE,GAC9C;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,aAAa,GAAG,aAAa,CAAC;CAC/E,CAAC;AAWN,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,sBAAsB,EAChC,OAAO,EAAE,MAAM,GACd,gCAAgC,CAgDlC"}

package/dist/workflows/v3/daemon-ipc-body.js

@@ -1,65 +0,0 @@
-/** Strict JSON schemas for the four authenticated Workflow daemon mutations. */
-import { V3_DAG_SEGMENT_RE } from './dag.js';
-const CANCEL_REASON_MAX = 500;
-function plainJsonObject(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value) &&
-        (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
-}
-function exactKeys(value, allowed) {
-    return Object.keys(value).every((key) => allowed.includes(key));
-}
-export function parseWorkflowDaemonMutationBody(mutation, bodyRaw) {
-    let parsed;
-    if (bodyRaw === '')
-        return { ok: false, error: 'bad_json' };
-    try {
-        parsed = JSON.parse(bodyRaw);
-    }
-    catch {
-        return { ok: false, error: 'bad_json' };
-    }
-    // Clients sign one canonical JSON serialization. Requiring that same form
-    // rejects duplicate keys (JSON.parse would otherwise silently keep the last
-    // one), whitespace variants, and parse→re-stringify ambiguity.
-    if (JSON.stringify(parsed) !== bodyRaw)
-        return { ok: false, error: 'bad_json' };
-    if (!plainJsonObject(parsed))
-        return { ok: false, error: 'bad_body' };
-    if (mutation === 'start') {
-        if (!exactKeys(parsed, []))
-            return { ok: false, error: 'bad_body' };
-        return { ok: true, body: { mutation, value: {} } };
-    }
-    if (mutation === 'cancel') {
-        if (!exactKeys(parsed, ['reason']))
-            return { ok: false, error: 'bad_body' };
-        if (parsed.reason === undefined)
-            return { ok: true, body: { mutation, value: {} } };
-        if (typeof parsed.reason !== 'string' ||
-            !parsed.reason.trim() ||
-            parsed.reason.trim().length > CANCEL_REASON_MAX ||
-            /\0/.test(parsed.reason)) {
-            return { ok: false, error: 'bad_reason' };
-        }
-        return { ok: true, body: { mutation, value: { reason: parsed.reason.trim() } } };
-    }
-    if (mutation === 'retry') {
-        if (!exactKeys(parsed, ['nodeId']))
-            return { ok: false, error: 'bad_body' };
-        if (parsed.nodeId === undefined)
-            return { ok: true, body: { mutation, value: {} } };
-        if (typeof parsed.nodeId !== 'string' || !V3_DAG_SEGMENT_RE.test(parsed.nodeId)) {
-            return { ok: false, error: 'bad_node_id' };
-        }
-        return { ok: true, body: { mutation, value: { nodeId: parsed.nodeId } } };
-    }
-    if (!exactKeys(parsed, ['loopId']))
-        return { ok: false, error: 'bad_body' };
-    if (parsed.loopId === undefined)
-        return { ok: true, body: { mutation, value: {} } };
-    if (typeof parsed.loopId !== 'string' || !V3_DAG_SEGMENT_RE.test(parsed.loopId)) {
-        return { ok: false, error: 'bad_loop_id' };
-    }
-    return { ok: true, body: { mutation, value: { loopId: parsed.loopId } } };
-}
-//# sourceMappingURL=daemon-ipc-body.js.map

package/dist/workflows/v3/daemon-ipc-body.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"daemon-ipc-body.js","sourceRoot":"","sources":["../../../src/workflows/v3/daemon-ipc-body.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAGhF,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAe9B,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,OAA0B;IAC3E,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,QAAgC,EAChC,OAAe;IAEf,IAAI,MAAe,CAAC;IACpB,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,+DAA+D;IAC/D,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAChF,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAEtE,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC;QACpF,IACE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YACjC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,iBAAiB;YAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EACxB,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QAC5C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC;IACnF,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC;QACpF,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;IAC5E,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC;IACpF,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;AAC5E,CAAC"}

package/dist/workflows/v3/daemon-ipc-client.d.ts

@@ -1,32 +0,0 @@
-/** Shared client for authenticated Workflow v3 daemon mutations. */
-import type { OnlineDaemonInfo } from '../../utils/daemon-discovery.js';
-import { type WorkflowDaemonIpcTarget } from './daemon-ipc-auth.js';
-export type WorkflowDaemonMutation = 'start' | 'cancel' | 'retry' | 'grant';
-export interface WorkflowDaemonMutationResponse {
-    ok: boolean;
-    status: number;
-    bodyRaw: string;
-}
-export declare class WorkflowDaemonMutationTransportError extends Error {
-    readonly causeValue?: unknown | undefined;
-    constructor(message: string, causeValue?: unknown | undefined);
-}
-export declare function workflowDaemonMutationTarget(daemon: Pick<OnlineDaemonInfo, 'larkAppId' | 'ipcPort' | 'bootInstanceId' | 'workflowIpcProtocol'>): WorkflowDaemonIpcTarget;
-export declare function workflowDaemonMutationPath(runId: string, mutation: WorkflowDaemonMutation): string;
-/**
- * Serialize once, sign those exact bytes, and pass the same string to fetch.
- * Mutations are never transport-retried: a lost response must be reconciled by
- * the operation's durable/idempotent domain semantics, not by blind HTTP retry.
- */
-export declare function postWorkflowDaemonMutation(input: {
-    daemon: Pick<OnlineDaemonInfo, 'larkAppId' | 'ipcPort' | 'bootInstanceId' | 'workflowIpcProtocol'>;
-    runId: string;
-    mutation: WorkflowDaemonMutation;
-    body?: Record<string, unknown>;
-    secret?: string;
-    secretPath?: string;
-    fetchImpl?: typeof fetch;
-    timestamp?: string;
-    nonce?: string;
-}): Promise<WorkflowDaemonMutationResponse>;
-//# sourceMappingURL=daemon-ipc-client.d.ts.map

package/dist/workflows/v3/daemon-ipc-client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"daemon-ipc-client.d.ts","sourceRoot":"","sources":["../../../src/workflows/v3/daemon-ipc-client.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAEpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAML,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;AAE5E,MAAM,WAAW,8BAA8B;IAC7C,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,oCAAqC,SAAQ,KAAK;aAChB,UAAU,CAAC,EAAE,OAAO;gBAArD,OAAO,EAAE,MAAM,EAAkB,UAAU,CAAC,EAAE,OAAO,YAAA;CAIlE;AAED,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,IAAI,CACV,gBAAgB,EAChB,WAAW,GAAG,SAAS,GAAG,gBAAgB,GAAG,qBAAqB,CACnE,GACA,uBAAuB,CAWzB;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,sBAAsB,GAC/B,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,MAAM,EAAE,IAAI,CACV,gBAAgB,EAChB,WAAW,GAAG,SAAS,GAAG,gBAAgB,GAAG,qBAAqB,CACnE,CAAC;IACF,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,sBAAsB,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAgD1C"}

package/dist/workflows/v3/daemon-ipc-client.js

@@ -1,74 +0,0 @@
-/** Shared client for authenticated Workflow v3 daemon mutations. */
-import { generateWorkflowDaemonIpcNonce, loadWorkflowDaemonIpcSecret, WORKFLOW_DAEMON_IPC_ROUTE_PREFIX, verifyWorkflowDaemonIpcResponse, workflowDaemonIpcHeaders, } from './daemon-ipc-auth.js';
-export class WorkflowDaemonMutationTransportError extends Error {
-    causeValue;
-    constructor(message, causeValue) {
-        super(message);
-        this.causeValue = causeValue;
-        this.name = 'WorkflowDaemonMutationTransportError';
-    }
-}
-export function workflowDaemonMutationTarget(daemon) {
-    if (daemon.workflowIpcProtocol !== 'v1' || !daemon.bootInstanceId) {
-        throw new WorkflowDaemonMutationTransportError(`daemon ${daemon.larkAppId} 未声明 Workflow IPC v1；请协调升级并重启全部 botmux 进程后重试`);
-    }
-    return {
-        larkAppId: daemon.larkAppId,
-        ipcPort: daemon.ipcPort,
-        bootInstanceId: daemon.bootInstanceId,
-    };
-}
-export function workflowDaemonMutationPath(runId, mutation) {
-    return `${WORKFLOW_DAEMON_IPC_ROUTE_PREFIX}/${encodeURIComponent(runId)}/${mutation}`;
-}
-/**
- * Serialize once, sign those exact bytes, and pass the same string to fetch.
- * Mutations are never transport-retried: a lost response must be reconciled by
- * the operation's durable/idempotent domain semantics, not by blind HTTP retry.
- */
-export async function postWorkflowDaemonMutation(input) {
-    const target = workflowDaemonMutationTarget(input.daemon);
-    const secret = input.secret ?? loadWorkflowDaemonIpcSecret(input.secretPath);
-    const pathWithQuery = workflowDaemonMutationPath(input.runId, input.mutation);
-    const bodyRaw = JSON.stringify(input.body ?? {});
-    const timestamp = input.timestamp ?? String(Date.now());
-    const nonce = input.nonce ?? generateWorkflowDaemonIpcNonce();
-    const headers = workflowDaemonIpcHeaders({
-        secret,
-        method: 'POST',
-        pathWithQuery,
-        bodyRaw,
-        target,
-        timestamp,
-        nonce,
-    });
-    const fetchImpl = input.fetchImpl ?? fetch;
-    let response;
-    try {
-        response = await fetchImpl(`http://127.0.0.1:${target.ipcPort}${pathWithQuery}`, {
-            method: 'POST',
-            headers: { 'content-type': 'application/json', ...headers },
-            body: bodyRaw,
-        });
-    }
-    catch (err) {
-        throw new WorkflowDaemonMutationTransportError(`无法连接 daemon (port=${target.ipcPort}): ${err instanceof Error ? err.message : String(err)}`, err);
-    }
-    const responseBodyRaw = await response.text();
-    const responseSignature = response.headers.get('x-botmux-workflow-ipc-response-signature');
-    if (!verifyWorkflowDaemonIpcResponse({
-        secret,
-        requestNonce: nonce,
-        method: 'POST',
-        pathWithQuery,
-        status: response.status,
-        body: responseBodyRaw,
-        target,
-        signature: responseSignature,
-    })) {
-        throw new WorkflowDaemonMutationTransportError('daemon 响应未通过 Workflow IPC v1 认证；daemon 可能刚重启，请先重试一次，' +
-            '若持续出现再协调升级并重启全部 botmux 进程');
-    }
-    return { ok: response.ok, status: response.status, bodyRaw: responseBodyRaw };
-}
-//# sourceMappingURL=daemon-ipc-client.js.map

package/dist/workflows/v3/daemon-ipc-client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"daemon-ipc-client.js","sourceRoot":"","sources":["../../../src/workflows/v3/daemon-ipc-client.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAGpE,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,EAC3B,gCAAgC,EAChC,+BAA+B,EAC/B,wBAAwB,GAEzB,MAAM,sBAAsB,CAAC;AAU9B,MAAM,OAAO,oCAAqC,SAAQ,KAAK;IAChB;IAA7C,YAAY,OAAe,EAAkB,UAAoB;QAC/D,KAAK,CAAC,OAAO,CAAC,CAAC;QAD4B,eAAU,GAAV,UAAU,CAAU;QAE/D,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAC;IACrD,CAAC;CACF;AAED,MAAM,UAAU,4BAA4B,CAC1C,MAGC;IAED,IAAI,MAAM,CAAC,mBAAmB,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAClE,MAAM,IAAI,oCAAoC,CAC5C,UAAU,MAAM,CAAC,SAAS,8CAA8C,CACzE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAAa,EACb,QAAgC;IAEhC,OAAO,GAAG,gCAAgC,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;AACxF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAahD;IACC,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,2BAA2B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7E,MAAM,aAAa,GAAG,0BAA0B,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,8BAA8B,EAAE,CAAC;IAC9D,MAAM,OAAO,GAAG,wBAAwB,CAAC;QACvC,MAAM;QACN,MAAM,EAAE,MAAM;QACd,aAAa;QACb,OAAO;QACP,MAAM;QACN,SAAS;QACT,KAAK;KACN,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,oBAAoB,MAAM,CAAC,OAAO,GAAG,aAAa,EAAE,EAAE;YAC/E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;YAC3D,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,oCAAoC,CAC5C,qBAAqB,MAAM,CAAC,OAAO,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC3F,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,iBAAiB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;IAC3F,IAAI,CAAC,+BAA+B,CAAC;QACnC,MAAM;QACN,YAAY,EAAE,KAAK;QACnB,MAAM,EAAE,MAAM;QACd,aAAa;QACb,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI,EAAE,eAAe;QACrB,MAAM;QACN,SAAS,EAAE,iBAAiB;KAC7B,CAAC,EAAE,CAAC;QACH,MAAM,IAAI,oCAAoC,CAC5C,sDAAsD;YACtD,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;AAChF,CAAC"}