botmux 3.10.0 → 3.23.1

package/dist/cli/dashboard-endpoint.d.ts

@@ -1,76 +0,0 @@
-/**
- * Loopback HMAC client for the dashboard process's `/__cli/*` endpoints, used by
- * `botmux dashboard` (rotate) and the post-start/restart hint (current).
- *
- * Two subtleties this module exists to handle correctly:
- *
- * 1. **404 is ambiguous.** Only the dashboard's `/__cli/current` returns 404 to
- *    mean "no token minted yet" (`{ error: 'no_active_token' }`). Any *other*
- *    404 means the request hit a server that doesn't speak the `/__cli`
- *    protocol — most commonly the daemon IPC server, whose unknown-route 404 is
- *    `{ error: 'not_found', path }`. Conflating the two surfaces the infamous
- *    misleading `Rotation failed: no-active-token` when the real problem is that
- *    `.dashboard-port` points at the wrong service.
- *
- * 2. **`.dashboard-port` can go stale.** The dashboard (wildcard) and the daemon
- *    IPC servers (loopback) both `listenWithProbe` upward. Their base ports are
- *    now kept disjoint (config.dashboard.port 7891 + probe span vs ipcBasePort
- *    7950 — see config.ts, guarded by dashboard-ipc-port-range.test.ts), so a
- *    recorded dashboard port should no longer end up owned by an IPC server. The
- *    HMAC self-heal below stays as defense-in-depth: when the recorded port
- *    answers as the *wrong service* (e.g. a foreign squatter pushed the dashboard
- *    onto an unexpected port), we rediscover the real dashboard by HMAC-probing
- *    the probe range (only the genuine dashboard can validate the signature) and
- *    self-heal `.dashboard-port`.
- */
-export type DashboardEndpoint = '/__cli/rotate' | '/__cli/current' | '/__cli/reload-binding';
-export type DashboardFailReason = 'no-secret' | 'unreachable' | 'auth-failed' | 'http-error' | 'no-active-token' | 'wrong-service';
-export type DashboardResult = {
-    ok: true;
-    url: string;
-    localUrl?: string;
-} | {
-    ok: false;
-    reason: DashboardFailReason;
-    detail?: string;
-};
-type FetchImpl = typeof fetch;
-/**
- * Classify a 404 from a `/__cli/*` request. A genuine "no token yet" only comes
- * from `/__cli/current` carrying `{ error: 'no_active_token' }`; everything else
- * means the port is answering for some other service (daemon IPC, a stray HTTP
- * server, …), not the dashboard rotate/current routes.
- */
-export declare function classifyDashboard404(path: DashboardEndpoint, bodyText: string): DashboardResult;
-/**
- * A 401 sig_mismatch from the recorded port does NOT prove that we reached the
- * live dashboard. On macOS a wildcard dashboard bind can coexist with another
- * process listening on 127.0.0.1:same-port, so the CLI's loopback request may
- * hit the shadowing process or a stale dashboard. Treat it as rediscoverable.
- */
-export declare function classifyDashboard401(bodyText: string): DashboardResult;
-/** Issue a single HMAC-authed request to one candidate port. */
-export declare function requestDashboardAt(opts: {
-    host: string;
-    port: number;
-    path: DashboardEndpoint;
-    secret: string;
-    fetchImpl?: FetchImpl;
-}): Promise<DashboardResult>;
-/**
- * Resolve the dashboard URL for `path`, trying the recorded port first and
- * self-healing the port file when it points at the wrong service or a loopback
- * shadow returns an HMAC mismatch.
- */
-export declare function callDashboard(opts: {
-    configDir: string;
-    defaultPort: number;
-    host?: string;
-    envPort?: string;
-    probeSpan?: number;
-    persistPort?: boolean;
-    path: DashboardEndpoint;
-    fetchImpl?: FetchImpl;
-}): Promise<DashboardResult>;
-export {};
-//# sourceMappingURL=dashboard-endpoint.d.ts.map

package/dist/cli/dashboard-endpoint.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dashboard-endpoint.d.ts","sourceRoot":"","sources":["../../src/cli/dashboard-endpoint.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,MAAM,iBAAiB,GAAG,eAAe,GAAG,gBAAgB,GAAG,uBAAuB,CAAC;AAE7F,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,aAAa,GACb,aAAa,GACb,YAAY,GACZ,iBAAiB,GACjB,eAAe,CAAC;AAEpB,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE,KAAK,SAAS,GAAG,OAAO,KAAK,CAAC;AAE9B;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAY/F;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAiBtE;AAED,gEAAgE;AAChE,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,GAAG,OAAO,CAAC,eAAe,CAAC,CAmC3B;AAWD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,GAAG,OAAO,CAAC,eAAe,CAAC,CAkD3B"}

package/dist/cli/dashboard-endpoint.js

@@ -1,161 +0,0 @@
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { atomicWriteFileSync } from '../utils/atomic-write.js';
-import { cliAuthBind, loadDashboardSecret, signCliAuth } from '../dashboard/auth.js';
-/**
- * Classify a 404 from a `/__cli/*` request. A genuine "no token yet" only comes
- * from `/__cli/current` carrying `{ error: 'no_active_token' }`; everything else
- * means the port is answering for some other service (daemon IPC, a stray HTTP
- * server, …), not the dashboard rotate/current routes.
- */
-export function classifyDashboard404(path, bodyText) {
-    let body = null;
-    try {
-        body = JSON.parse(bodyText);
-    }
-    catch { /* non-JSON body → wrong service */ }
-    const err = (body && typeof body === 'object') ? body.error : undefined;
-    if (path === '/__cli/current' && err === 'no_active_token') {
-        return { ok: false, reason: 'no-active-token' };
-    }
-    return {
-        ok: false,
-        reason: 'wrong-service',
-        detail: bodyText ? `404 ${bodyText.slice(0, 200)}` : '404',
-    };
-}
-/**
- * A 401 sig_mismatch from the recorded port does NOT prove that we reached the
- * live dashboard. On macOS a wildcard dashboard bind can coexist with another
- * process listening on 127.0.0.1:same-port, so the CLI's loopback request may
- * hit the shadowing process or a stale dashboard. Treat it as rediscoverable.
- */
-export function classifyDashboard401(bodyText) {
-    let body = null;
-    try {
-        body = JSON.parse(bodyText);
-    }
-    catch { /* non-JSON 401 */ }
-    const err = (body && typeof body === 'object') ? body.error : undefined;
-    const authReason = (body && typeof body === 'object') ? body.reason : undefined;
-    if (err === 'unauthorized' && authReason === 'sig_mismatch') {
-        return {
-            ok: false,
-            reason: 'auth-failed',
-            detail: bodyText ? `401 ${bodyText.slice(0, 200)}` : '401 sig_mismatch',
-        };
-    }
-    return {
-        ok: false,
-        reason: 'http-error',
-        detail: bodyText ? `401 ${bodyText.slice(0, 200)}` : '401',
-    };
-}
-/** Issue a single HMAC-authed request to one candidate port. */
-export async function requestDashboardAt(opts) {
-    const { host, port, path, secret } = opts;
-    const fetchImpl = opts.fetchImpl ?? fetch;
-    // Bind the credential to method + path + the port we're dialing. A malicious
-    // server handed these headers during discovery therefore can't forward them
-    // to a different `/__cli/*` route or to the real dashboard on another port —
-    // the verifier reconstructs the bind from the port IT bound, so any forward
-    // mismatches the signature (and the attacker can't re-sign without the secret).
-    const { ts, nonce, sig } = signCliAuth(secret, cliAuthBind('POST', path, port));
-    let res;
-    try {
-        res = await fetchImpl(`http://${host}:${port}${path}`, {
-            method: 'POST',
-            headers: {
-                'X-Botmux-Cli-Ts': ts,
-                'X-Botmux-Cli-Nonce': nonce,
-                'X-Botmux-Cli-Auth': sig,
-            },
-        });
-    }
-    catch {
-        return { ok: false, reason: 'unreachable' };
-    }
-    if (res.status === 404)
-        return classifyDashboard404(path, await res.text().catch(() => ''));
-    if (res.status === 401)
-        return classifyDashboard401(await res.text().catch(() => ''));
-    if (!res.ok) {
-        return { ok: false, reason: 'http-error', detail: `${res.status} ${await res.text().catch(() => '')}` };
-    }
-    // reload-binding 不返回 url，200 即成功（仅用于「捅一下 daemon 重连」）
-    if (path === '/__cli/reload-binding')
-        return { ok: true, url: '' };
-    const body = await res.json().catch(() => ({}));
-    if (!body.url)
-        return { ok: false, reason: 'http-error', detail: 'malformed response (no url)' };
-    // localUrl is present only when the dashboard link routes through the central
-    // platform — a direct host:port fallback for when the platform is down.
-    return { ok: true, url: body.url, localUrl: body.localUrl };
-}
-/** A result that proves we actually reached the dashboard (vs. wrong port). */
-function reachedDashboard(r) {
-    return r.ok || (!r.ok && (r.reason === 'no-active-token' || r.reason === 'http-error'));
-}
-function shouldRediscover(r) {
-    return !r.ok && (r.reason === 'wrong-service' || r.reason === 'auth-failed');
-}
-/**
- * Resolve the dashboard URL for `path`, trying the recorded port first and
- * self-healing the port file when it points at the wrong service or a loopback
- * shadow returns an HMAC mismatch.
- */
-export async function callDashboard(opts) {
-    const host = opts.host ?? '127.0.0.1';
-    const probeSpan = opts.probeSpan ?? 20;
-    const persistPort = opts.persistPort ?? true;
-    const fetchImpl = opts.fetchImpl ?? fetch;
-    const secretPath = join(opts.configDir, '.dashboard-secret');
-    let secret;
-    try {
-        secret = loadDashboardSecret(secretPath);
-    }
-    catch (e) {
-        return { ok: false, reason: 'no-secret', detail: e.message };
-    }
-    if (!secret)
-        return { ok: false, reason: 'no-secret' };
-    const portFile = join(opts.configDir, '.dashboard-port');
-    const recorded = (existsSync(portFile) ? readFileSync(portFile, 'utf8').trim() : '')
-        || opts.envPort
-        || String(opts.defaultPort);
-    const candidate = Number(recorded);
-    // 1. Try the recorded port. A success — or any state that proves we reached
-    //    the dashboard (no-active-token / http-error) — is returned as-is.
-    const first = await requestDashboardAt({ host, port: candidate, path: opts.path, secret, fetchImpl });
-    if (reachedDashboard(first))
-        return first;
-    // 2. Rediscover only when some server answered on the recorded loopback port
-    //    but failed dashboard identity checks: explicit wrong-service 404, or a
-    //    sig_mismatch from a shadow/stale dashboard. (`unreachable` during boot
-    //    resolves by retrying the same port, not by scanning — so we leave it to
-    //    the caller's retry loop.)
-    if (!shouldRediscover(first))
-        return first;
-    const base = Number(opts.envPort || opts.defaultPort);
-    for (let p = base; p <= base + probeSpan; p++) {
-        if (p === candidate)
-            continue;
-        // Probe read-only (`/__cli/current`) so discovery never mints a token on a
-        // server we're merely identifying. Only the real dashboard can answer the
-        // HMAC-gated route as `ok` or `no-active-token`.
-        const probe = await requestDashboardAt({ host, port: p, path: '/__cli/current', secret, fetchImpl });
-        if (probe.ok || (!probe.ok && probe.reason === 'no-active-token')) {
-            if (persistPort) {
-                try {
-                    atomicWriteFileSync(portFile, String(p));
-                }
-                catch { /* best-effort self-heal */ }
-            }
-            // Found the dashboard — perform the actually-requested op on its port.
-            return requestDashboardAt({ host, port: p, path: opts.path, secret, fetchImpl });
-        }
-    }
-    // No dashboard found in the probe range; surface the original wrong-service.
-    return first;
-}
-//# sourceMappingURL=dashboard-endpoint.js.map

package/dist/cli/dashboard-endpoint.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dashboard-endpoint.js","sourceRoot":"","sources":["../../src/cli/dashboard-endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AA4CrF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAuB,EAAE,QAAgB;IAC5E,IAAI,IAAI,GAAY,IAAI,CAAC;IACzB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,mCAAmC,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAE,IAA4B,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,IAAI,IAAI,KAAK,gBAAgB,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,eAAe;QACvB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK;KAC3D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,IAAI,IAAI,GAAY,IAAI,CAAC;IACzB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAE,IAA4B,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,MAAM,UAAU,GAAG,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAE,IAA6B,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,IAAI,GAAG,KAAK,cAAc,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;QAC5D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB;SACxE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK;KAC3D,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAMxC;IACC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,gFAAgF;IAChF,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAEhF,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,UAAU,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,iBAAiB,EAAE,EAAE;gBACrB,oBAAoB,EAAE,KAAK;gBAC3B,mBAAmB,EAAE,GAAG;aACzB;SACF,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5F,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,oBAAoB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;IAC1G,CAAC;IACD,qDAAqD;IACrD,IAAI,IAAI,KAAK,uBAAuB;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IACnE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAwC,CAAC;IACvF,IAAI,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IACjG,8EAA8E;IAC9E,wEAAwE;IACxE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;AAC9D,CAAC;AAED,+EAA+E;AAC/E,SAAS,gBAAgB,CAAC,CAAkB;IAC1C,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,iBAAiB,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAkB;IAC1C,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IASnC;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAE1C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAC7D,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAEvD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;WAC/E,IAAI,CAAC,OAAO;WACZ,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEnC,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACtG,IAAI,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1C,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,+BAA+B;IAC/B,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;IACtD,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,2EAA2E;QAC3E,0EAA0E;QAC1E,iDAAiD;QACjD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACrG,IAAI,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,iBAAiB,CAAC,EAAE,CAAC;YAClE,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC;oBAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,CAAC;YACzF,CAAC;YACD,uEAAuE;YACvE,OAAO,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cli/deferred-topic-send.d.ts

@@ -1,48 +0,0 @@
-import { type DeferredTopicBinding } from '../core/deferred-topic-binding.js';
-export interface DeferredScheduleRunData {
-    taskId: string;
-    turnId: string;
-    routingAnchor: string;
-    topicTitle?: string;
-    createdAt: string;
-}
-export interface DeferredTopicSendSession {
-    sessionId: string;
-    chatId: string;
-    larkAppId: string;
-    deferredScheduleRun?: DeferredScheduleRunData;
-}
-export interface DeferredTopicSendResult {
-    handled: boolean;
-    messageId?: string;
-    rootMessageId?: string;
-    materializedNow?: boolean;
-}
-export declare function deferredTopicBindingMatches(session: DeferredTopicSendSession, binding: DeferredTopicBinding): boolean;
-/** Existing deferred runs reply into their materialized topic before the
- * nominal send target is considered. Mirror that precedence for advisory
- * reachability without materializing a new topic. */
-export declare function reusableDeferredTopicRoot(input: {
-    session: DeferredTopicSendSession;
-    binding: DeferredTopicBinding | undefined;
-    explicitTopLevel: boolean;
-    reuseBoundRootWhenTopLevel?: boolean;
-}): string | undefined;
-/** Route one `botmux send` effect for a lazily-materialized schedule topic.
- * The per-session file lock spans the provider request so two concurrent CLI
- * processes cannot both create a root. A stable provider UUID (sessionId)
- * makes retry-after-local-write-failure converge on the same Lark message. */
-export declare function dispatchDeferredTopicSend(opts: {
-    dataDir: string;
-    session: DeferredTopicSendSession;
-    currentTurnId?: string;
-    explicitTopLevel: boolean;
-    reuseBoundRootWhenTopLevel?: boolean;
-    content: string;
-    msgType: string;
-    uuid?: string;
-    sendRoot: (content: string, msgType: string, uuid: string) => Promise<string>;
-    sendTitleSeed: (title: string, uuid: string) => Promise<string>;
-    replyRoot: (rootMessageId: string, content: string, msgType: string, uuid?: string) => Promise<string>;
-}): Promise<DeferredTopicSendResult>;
-//# sourceMappingURL=deferred-topic-send.d.ts.map

package/dist/cli/deferred-topic-send.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"deferred-topic-send.d.ts","sourceRoot":"","sources":["../../src/cli/deferred-topic-send.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,mCAAmC,CAAC;AAE3C,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;CAC/C;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,wBAAwB,EACjC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAQT;AAED;;qDAEqD;AACrD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,OAAO,EAAE,wBAAwB,CAAC;IAClC,OAAO,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAC1C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,0BAA0B,CAAC,EAAE,OAAO,CAAC;CACtC,GAAG,MAAM,GAAG,SAAS,CAKrB;AAED;;;8EAG8E;AAC9E,wBAAsB,yBAAyB,CAAC,IAAI,EAAE;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,wBAAwB,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE,SAAS,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACxG,GAAG,OAAO,CAAC,uBAAuB,CAAC,CA0DnC"}

package/dist/cli/deferred-topic-send.js

@@ -1,86 +0,0 @@
-import { readDeferredTopicBinding, withDeferredTopicBindingLock, writeDeferredTopicBinding, } from '../core/deferred-topic-binding.js';
-export function deferredTopicBindingMatches(session, binding) {
-    const run = session.deferredScheduleRun;
-    return !!run
-        && binding.sessionId === session.sessionId
-        && binding.turnId === run.turnId
-        && binding.chatId === session.chatId
-        && binding.larkAppId === session.larkAppId
-        && binding.routingAnchor === run.routingAnchor;
-}
-/** Existing deferred runs reply into their materialized topic before the
- * nominal send target is considered. Mirror that precedence for advisory
- * reachability without materializing a new topic. */
-export function reusableDeferredTopicRoot(input) {
-    const { binding } = input;
-    if (!binding || !deferredTopicBindingMatches(input.session, binding))
-        return undefined;
-    if (input.explicitTopLevel && !input.reuseBoundRootWhenTopLevel)
-        return undefined;
-    return binding.rootMessageId;
-}
-/** Route one `botmux send` effect for a lazily-materialized schedule topic.
- * The per-session file lock spans the provider request so two concurrent CLI
- * processes cannot both create a root. A stable provider UUID (sessionId)
- * makes retry-after-local-write-failure converge on the same Lark message. */
-export async function dispatchDeferredTopicSend(opts) {
-    const run = opts.session.deferredScheduleRun;
-    if (!run)
-        return { handled: false };
-    return withDeferredTopicBindingLock(opts.dataDir, opts.session.sessionId, async () => {
-        const existing = readDeferredTopicBinding(opts.dataDir, opts.session.sessionId);
-        if (existing) {
-            if (!deferredTopicBindingMatches(opts.session, existing)) {
-                throw new Error('deferred topic binding identity mismatch');
-            }
-            if (opts.explicitTopLevel && !opts.reuseBoundRootWhenTopLevel)
-                return { handled: false };
-            const messageId = await opts.replyRoot(existing.rootMessageId, opts.content, opts.msgType, opts.uuid);
-            return { handled: true, messageId, rootMessageId: existing.rootMessageId, materializedNow: false };
-        }
-        // Only the scheduled turn itself may materialize an as-yet invisible run.
-        // A stale/local process without the exact turn marker must not publish it.
-        if (!opts.currentTurnId || opts.currentTurnId !== run.turnId) {
-            // A missing binding after the scheduled turn must fail closed. Falling
-            // through to ordinary chat-scope routing would leak a resumed/stale
-            // hidden session's output to the group top level. Explicit --top-level
-            // remains the deliberate escape hatch for an operator.
-            if (opts.explicitTopLevel)
-                return { handled: false };
-            throw new Error('deferred topic is not materialized for this turn');
-        }
-        const title = run.topicTitle?.trim();
-        let rootMessageId;
-        let messageId;
-        if (title) {
-            rootMessageId = await opts.sendTitleSeed(title, opts.session.sessionId);
-            const binding = {
-                sessionId: opts.session.sessionId,
-                turnId: run.turnId,
-                chatId: opts.session.chatId,
-                larkAppId: opts.session.larkAppId,
-                routingAnchor: run.routingAnchor,
-                rootMessageId,
-                createdAt: new Date().toISOString(),
-            };
-            writeDeferredTopicBinding(opts.dataDir, binding);
-            messageId = await opts.replyRoot(rootMessageId, opts.content, opts.msgType, opts.uuid);
-        }
-        else {
-            rootMessageId = await opts.sendRoot(opts.content, opts.msgType, opts.session.sessionId);
-            const binding = {
-                sessionId: opts.session.sessionId,
-                turnId: run.turnId,
-                chatId: opts.session.chatId,
-                larkAppId: opts.session.larkAppId,
-                routingAnchor: run.routingAnchor,
-                rootMessageId,
-                createdAt: new Date().toISOString(),
-            };
-            writeDeferredTopicBinding(opts.dataDir, binding);
-            messageId = rootMessageId;
-        }
-        return { handled: true, messageId, rootMessageId, materializedNow: true };
-    });
-}
-//# sourceMappingURL=deferred-topic-send.js.map

package/dist/cli/deferred-topic-send.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"deferred-topic-send.js","sourceRoot":"","sources":["../../src/cli/deferred-topic-send.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,yBAAyB,GAE1B,MAAM,mCAAmC,CAAC;AAwB3C,MAAM,UAAU,2BAA2B,CACzC,OAAiC,EACjC,OAA6B;IAE7B,MAAM,GAAG,GAAG,OAAO,CAAC,mBAAmB,CAAC;IACxC,OAAO,CAAC,CAAC,GAAG;WACP,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;WACvC,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;WAC7B,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;WACjC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;WACvC,OAAO,CAAC,aAAa,KAAK,GAAG,CAAC,aAAa,CAAC;AACnD,CAAC;AAED;;qDAEqD;AACrD,MAAM,UAAU,yBAAyB,CAAC,KAKzC;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC,OAAO,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACvF,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,0BAA0B;QAAE,OAAO,SAAS,CAAC;IAClF,OAAO,OAAO,CAAC,aAAa,CAAC;AAC/B,CAAC;AAED;;;8EAG8E;AAC9E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAY/C;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAEpC,OAAO,4BAA4B,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChF,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,0BAA0B;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACzF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACtG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QACrG,CAAC;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAC7D,uEAAuE;YACvE,oEAAoE;YACpE,uEAAuE;YACvE,uDAAuD;YACvD,IAAI,IAAI,CAAC,gBAAgB;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;QACrC,IAAI,aAAqB,CAAC;QAC1B,IAAI,SAAiB,CAAC;QACtB,IAAI,KAAK,EAAE,CAAC;YACV,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACxE,MAAM,OAAO,GAAyB;gBACpC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;gBACjC,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC3B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;gBACjC,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,aAAa;gBACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YACF,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACjD,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACxF,MAAM,OAAO,GAAyB;gBACpC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;gBACjC,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC3B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;gBACjC,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,aAAa;gBACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YACF,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACjD,SAAS,GAAG,aAAa,CAAC;QAC5B,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/exact-chat-grant-client.d.ts

@@ -1,48 +0,0 @@
-export interface ExactChatGrantDaemon {
-    ipcPort: number;
-    larkAppId: string;
-}
-export interface ExactChatGrantClientInput {
-    daemon: ExactChatGrantDaemon;
-    secret: string;
-    receiverLarkAppId: string;
-    chatId: string;
-    operation?: 'grant' | 'revoke' | 'readback';
-    subjectOpenIds?: string[];
-    subjectLarkAppIds?: string[];
-}
-export declare class ExactChatGrantClientError extends Error {
-    readonly status?: number | undefined;
-    readonly body?: Record<string, unknown> | undefined;
-    constructor(message: string, status?: number | undefined, body?: Record<string, unknown> | undefined);
-}
-/**
- * Call a receiver daemon's HMAC-protected exact-grant endpoint.
- *
- * `subjectLarkAppIds` is resolved inside the receiver daemon so app-scoped
- * open_ids never cross receiver boundaries. The endpoint still performs a
- * live membership check before persisting the talk-only grant.
- */
-export declare function requestExactChatGrant(input: ExactChatGrantClientInput, fetchImpl?: typeof fetch): Promise<Record<string, any>>;
-export interface BotChatGrantMatrixDeps {
-    findDaemon(larkAppId: string): ExactChatGrantDaemon | null;
-    secret: string;
-    request?: typeof requestExactChatGrant;
-    retryDelaysMs?: number[];
-}
-export interface BotChatGrantMatrixResult {
-    ok: true;
-    chatId: string;
-    participants: string[];
-    receivers: Array<{
-        receiverLarkAppId: string;
-        subjectLarkAppIds: string[];
-    }>;
-}
-/**
- * Establish a full-mesh, talk-only grant matrix for local bots in one chat.
- * Every receiver resolves the other stable app ids in its own Lark namespace.
- * The operation is idempotent; any unresolved/offline receiver fails closed.
- */
-export declare function ensureBotChatGrantMatrix(chatId: string, rawParticipantAppIds: string[], deps: BotChatGrantMatrixDeps): Promise<BotChatGrantMatrixResult>;
-//# sourceMappingURL=exact-chat-grant-client.d.ts.map

package/dist/cli/exact-chat-grant-client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"exact-chat-grant-client.d.ts","sourceRoot":"","sources":["../../src/cli/exact-chat-grant-client.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,oBAAoB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC5C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,qBAAa,yBAA0B,SAAQ,KAAK;IAGhD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAFvC,OAAO,EAAE,MAAM,EACN,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAK1C;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,yBAAyB,EAChC,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CA8C9B;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAAC;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,qBAAqB,CAAC;IACvC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,KAAK,CAAC;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAC9E;AAMD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,oBAAoB,EAAE,MAAM,EAAE,EAC9B,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,wBAAwB,CAAC,CAsCnC"}

package/dist/cli/exact-chat-grant-client.js

@@ -1,108 +0,0 @@
-import { cliAuthBind, signCliAuth } from '../dashboard/auth.js';
-export class ExactChatGrantClientError extends Error {
-    status;
-    body;
-    constructor(message, status, body) {
-        super(message);
-        this.status = status;
-        this.body = body;
-        this.name = 'ExactChatGrantClientError';
-    }
-}
-/**
- * Call a receiver daemon's HMAC-protected exact-grant endpoint.
- *
- * `subjectLarkAppIds` is resolved inside the receiver daemon so app-scoped
- * open_ids never cross receiver boundaries. The endpoint still performs a
- * live membership check before persisting the talk-only grant.
- */
-export async function requestExactChatGrant(input, fetchImpl = fetch) {
-    if (input.daemon.larkAppId !== input.receiverLarkAppId) {
-        throw new ExactChatGrantClientError('receiver daemon mismatch');
-    }
-    const path = '/api/grants/chat';
-    const { ts, nonce, sig } = signCliAuth(input.secret, cliAuthBind('POST', path, input.daemon.ipcPort));
-    let response;
-    try {
-        response = await fetchImpl(`http://127.0.0.1:${input.daemon.ipcPort}${path}`, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                'X-Botmux-Cli-Ts': ts,
-                'X-Botmux-Cli-Nonce': nonce,
-                'X-Botmux-Cli-Auth': sig,
-            },
-            body: JSON.stringify({
-                operation: input.operation ?? 'grant',
-                receiverLarkAppId: input.receiverLarkAppId,
-                chatId: input.chatId,
-                ...(input.subjectOpenIds ? { subjectOpenIds: input.subjectOpenIds } : {}),
-                ...(input.subjectLarkAppIds ? { subjectLarkAppIds: input.subjectLarkAppIds } : {}),
-            }),
-        });
-    }
-    catch (err) {
-        throw new ExactChatGrantClientError(`receiver daemon unavailable: ${err?.message ?? err}`);
-    }
-    const raw = await response.text();
-    let body;
-    try {
-        body = JSON.parse(raw);
-    }
-    catch {
-        body = { ok: false, error: raw || `HTTP ${response.status}` };
-    }
-    if (!response.ok || body.ok !== true) {
-        throw new ExactChatGrantClientError(typeof body.message === 'string' ? body.message : `exact chat grant failed (HTTP ${response.status})`, response.status, body);
-    }
-    return body;
-}
-function delay(ms) {
-    return new Promise(resolve => setTimeout(resolve, ms));
-}
-/**
- * Establish a full-mesh, talk-only grant matrix for local bots in one chat.
- * Every receiver resolves the other stable app ids in its own Lark namespace.
- * The operation is idempotent; any unresolved/offline receiver fails closed.
- */
-export async function ensureBotChatGrantMatrix(chatId, rawParticipantAppIds, deps) {
-    const participants = [...new Set(rawParticipantAppIds.map(value => value.trim()).filter(Boolean))];
-    if (participants.length < 2) {
-        return { ok: true, chatId, participants, receivers: [] };
-    }
-    const request = deps.request ?? requestExactChatGrant;
-    const retryDelays = deps.retryDelaysMs ?? [250, 750, 1_500];
-    const receivers = [];
-    for (const receiverLarkAppId of participants) {
-        const daemon = deps.findDaemon(receiverLarkAppId);
-        if (!daemon) {
-            throw new ExactChatGrantClientError(`receiver daemon offline: ${receiverLarkAppId}`);
-        }
-        const subjectLarkAppIds = participants.filter(appId => appId !== receiverLarkAppId);
-        let lastError;
-        for (let attempt = 0; attempt <= retryDelays.length; attempt += 1) {
-            try {
-                await request({
-                    daemon,
-                    secret: deps.secret,
-                    operation: 'grant',
-                    receiverLarkAppId,
-                    chatId,
-                    subjectLarkAppIds,
-                });
-                lastError = undefined;
-                break;
-            }
-            catch (err) {
-                lastError = err;
-                if (attempt < retryDelays.length)
-                    await delay(retryDelays[attempt]);
-            }
-        }
-        if (lastError)
-            throw lastError;
-        receivers.push({ receiverLarkAppId, subjectLarkAppIds });
-    }
-    return { ok: true, chatId, participants, receivers };
-}
-//# sourceMappingURL=exact-chat-grant-client.js.map

package/dist/cli/exact-chat-grant-client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"exact-chat-grant-client.js","sourceRoot":"","sources":["../../src/cli/exact-chat-grant-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAiBhE,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAGvC;IACA;IAHX,YACE,OAAe,EACN,MAAe,EACf,IAA8B;QAEvC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAS;QACf,SAAI,GAAJ,IAAI,CAA0B;QAGvC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAgC,EAChC,YAA0B,KAAK;IAE/B,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACvD,MAAM,IAAI,yBAAyB,CAAC,0BAA0B,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAAC;IAChC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,WAAW,CACpC,KAAK,CAAC,MAAM,EACZ,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAChD,CAAC;IACF,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,oBAAoB,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YAC5E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,iBAAiB,EAAE,EAAE;gBACrB,oBAAoB,EAAE,KAAK;gBAC3B,mBAAmB,EAAE,GAAG;aACzB;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,OAAO;gBACrC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnF,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,yBAAyB,CAAC,gCAAgC,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,IAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,yBAAyB,CACjC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC,QAAQ,CAAC,MAAM,GAAG,EACrG,QAAQ,CAAC,MAAM,EACf,IAAI,CACL,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAgBD,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,oBAA8B,EAC9B,IAA4B;IAE5B,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACnG,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,qBAAqB,CAAC;IACtD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,SAAS,GAA0C,EAAE,CAAC;IAE5D,KAAK,MAAM,iBAAiB,IAAI,YAAY,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,yBAAyB,CAAC,4BAA4B,iBAAiB,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,iBAAiB,CAAC,CAAC;QACpF,IAAI,SAAkB,CAAC;QACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC;oBACZ,MAAM;oBACN,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,SAAS,EAAE,OAAO;oBAClB,iBAAiB;oBACjB,MAAM;oBACN,iBAAiB;iBAClB,CAAC,CAAC;gBACH,SAAS,GAAG,SAAS,CAAC;gBACtB,MAAM;YACR,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,CAAC;gBAChB,IAAI,OAAO,GAAG,WAAW,CAAC,MAAM;oBAAE,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QACD,IAAI,SAAS;YAAE,MAAM,SAAS,CAAC;QAC/B,SAAS,CAAC,IAAI,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AACvD,CAAC"}

package/dist/cli/exact-chat-grant.d.ts

@@ -1,18 +0,0 @@
-/** Strict parser for the script-facing `botmux grant chat` command. */
-export type ExactChatGrantCliOperation = 'grant' | 'revoke' | 'readback';
-export interface ExactChatGrantCliArgs {
-    operation: ExactChatGrantCliOperation;
-    receiverRef: string;
-    chatId: string;
-    subjectOpenIds: string[];
-    subjectLarkAppIds: string[];
-}
-export type ExactChatGrantCliParseResult = {
-    ok: true;
-    value: ExactChatGrantCliArgs;
-} | {
-    ok: false;
-    error: string;
-};
-export declare function parseExactChatGrantCliArgs(args: string[]): ExactChatGrantCliParseResult;
-//# sourceMappingURL=exact-chat-grant.d.ts.map

package/dist/cli/exact-chat-grant.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"exact-chat-grant.d.ts","sourceRoot":"","sources":["../../src/cli/exact-chat-grant.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAEvE,MAAM,MAAM,0BAA0B,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEzE,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,0BAA0B,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,MAAM,4BAA4B,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,qBAAqB,CAAA;CAAE,GAC1C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AA8BjC,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,4BAA4B,CAuEvF"}