dsh-connect 0.8.0 → 0.9.0

package/lib/settings/credential-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../../src/settings/credential-store.ts"],"names":[],"mappings":"AAmBA,0EAA0E;AAC1E,MAAM,CAAC,MAAM,eAAe,GAA2C,MAAM,CAAC,MAAM,CAAC;IACnF,MAAM,EAAE,CAAC,2BAA2B,EAAE,+BAA+B,CAAC;IACtE,QAAQ,EAAE,CAAC,gCAAgC,CAAC;IAC5C,QAAQ,EAAE,CAAC,kCAAkC,EAAE,6BAA6B,CAAC;IAC7E,GAAG,EAAE,EAAE;CACR,CAA2C,CAAC;AAE7C;iFACiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAgD,MAAM,CAAC,MAAM,CAAC;IAC5F,MAAM,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,SAAS,EAAE,+BAA+B,EAAE;IAC1F,QAAQ,EAAE,EAAE,QAAQ,EAAE,gCAAgC,EAAE;IACxD,QAAQ,EAAE;QACR,UAAU,EAAE,kCAAkC;QAC9C,MAAM,EAAE,6BAA6B;QACrC,QAAQ,EAAE,gCAAgC;QAC1C,YAAY,EAAE,oCAAoC;KACnD;IACD,GAAG,EAAE,EAAE;CACR,CAAC,CAAC;AAcH,SAAS,cAAc,CAAC,QAA6B;IACnD,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAU,EAAE,CAAC;QACtE,IAAI,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;YAC3C,MAAM,IAAI,SAAS,CAAC,kCAAkC,MAAM,gBAAgB,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,QAA6B;IACjE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,OAAoB,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACtE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,UAAU,CAAC,OAAoB;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACpC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/E,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAoB,EAAE,MAA8B;YAC7D,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAoB;YAC5B,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE;gBACjD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC1C,OAAO,CAAC,SAAS,EAAE,KAAK,CAAU,CAAC;YACrC,CAAC,CAAC,CACH,CAAC;YACF,MAAM,GAAG,GAA2B,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;gBACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;YAC5E,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,OAAoB;YAC9B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3F,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,eAAe,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../../src/settings/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,QAAQ,EAAoB,MAAM,eAAe,CAAC;AA4B3D,4EAA4E;AAC5E,SAAS,YAAY,CAAC,QAAwD;IAC5E,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC;IACxE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED;;;;;;kEAMkE;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAgD,MAAM,CAAC,MAAM,CAAC;IAC5F,MAAM,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,SAAS,EAAE,+BAA+B,EAAE;IAC1F,QAAQ,EAAE,EAAE,QAAQ,EAAE,gCAAgC,EAAE;IACxD,QAAQ,EAAE;QACR,UAAU,EAAE,kCAAkC;QAC9C,MAAM,EAAE,6BAA6B;QACrC,QAAQ,EAAE,gCAAgC;QAC1C,YAAY,EAAE,oCAAoC;KACnD;IACD,GAAG,EAAE,EAAE;CACR,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAwD,MAAM,CAAC,MAAM,CAAC;IAClG,MAAM,EAAE,CAAC,CAAC,2BAA2B,EAAE,+BAA+B,CAAC,CAAC;IACxE,QAAQ,EAAE,CAAC,CAAC,gCAAgC,CAAC,CAAC;IAC9C,QAAQ,EAAE;QACR,CAAC,kCAAkC,EAAE,6BAA6B,CAAC;QACnE,CAAC,gCAAgC,EAAE,oCAAoC,CAAC;KACzE;IACD,GAAG,EAAE,EAAE;CACR,CAAwD,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAA2C,MAAM,CAAC,MAAM,CAClF,MAAM,CAAC,WAAW,CAChB,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CACzD,CACwC,CAAC;AAE5C,oEAAoE;AACpE,SAAS,SAAS,CAAC,OAAoB;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACrD,KAAK,MAAM,GAAG,IAAI,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,OAAoB;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAiBD,SAAS,cAAc,CAAC,QAA6B;IACnD,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAU,EAAE,CAAC;QACtE,IAAI,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;YAC3C,MAAM,IAAI,SAAS,CAAC,kCAAkC,MAAM,gBAAgB,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,QAA6B;IACjE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,UAAU,CAAC,OAAoB;YACnC,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAChD,qEAAqE;YACrE,8DAA8D;YAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAChF,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAC;YACjE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAoB,EAAE,MAA8B;YAC7D,wEAAwE;YACxE,yEAAyE;YACzE,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACpE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAoB;YAC5B,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE;gBACjD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxD,OAAO,CAAC,SAAS,EAAE,KAAK,CAAU,CAAC;YACrC,CAAC,CAAC,CACH,CAAC;YACF,MAAM,GAAG,GAA2B,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;gBACzC,IAAI,KAAK,KAAK,SAAS;oBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;YAClD,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,OAAoB;YAC9B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAChG,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,eAAe,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/lib/settings/namespace.d.ts

@@ -0,0 +1,175 @@
+/**
+ * The `dsh-connect` user-settings namespace.
+ *
+ * DSH ships a first-party user-settings seam (`ctx.settings`, backed by
+ * `$DSH_HOME/settings.yaml` via `@deepseek-ai/dsh-settings-file`, hot-reloaded,
+ * atomic, file-locked, comment-preserving). Registering a namespace is how a
+ * plugin makes its configuration user-editable *and effective*: the official
+ * Plugins page renders the fields from the schema, writes go through the
+ * provider, and `scope.watch()` tells the plugin to re-read.
+ *
+ * Two properties of that seam shape this module:
+ *
+ * - **`installSection` is the consumer entry point.** It registers the plugin's
+ *   own composition entry as the schema's *base* layer while the settings
+ *   service is present, and falls back to that entry if the service detaches.
+ *   Bare `register` would make `$DSH_HOME/settings.yaml` the only source and
+ *   silently drop a YAML-configured profile.
+ * - **The schema is applied to `mergeLayers(base, userSection)` at registration
+ *   time**, so a stored section that fails validation throws out of
+ *   `installSection`. Every install here is therefore guarded: a hand-edited
+ *   `settings.yaml` with a typo must degrade to the plugin config, not abort
+ *   the plugin's `apply`.
+ *
+ * **Secrets are deliberately not part of this schema.** They live in the DSH
+ * credential store (`ctx.credentials`), which is where the onboarding flow and
+ * the `FEISHU_*`-style env layering already put them; `settings.yaml` is a
+ * plain document users are invited to paste into bug reports. `sectionOf()`
+ * projects secret keys *out* of the base for the same reason — schemastery
+ * preserves undeclared keys verbatim, so anything left in the base rides out
+ * through `describe()` and the settings RPC. The same projection guards the
+ * write path (`LiveConnectSection.write`), which is the mirror hazard: an
+ * undeclared key in a *submitted* section would be preserved into the document.
+ *
+ * `installSection` returns nothing, so the write handle it hands back is built
+ * here: `setSource` already wires a thunk onto `scope.get()`, which reads the
+ * registration's resolved value at call time — live in both directions.
+ *
+ * @module dsh-connect/settings/namespace
+ */
+import z from "@deepseek-ai/schemastery";
+import { type ChannelName, type ChannelsConfig, type LoggerLike } from "./channels.js";
+/** The settings namespace this plugin owns. */
+export declare const CONNECT_SETTINGS_NS = "dsh-connect";
+/** Channel-agnostic defaults section of the namespace. */
+export type ConnectSectionDefaults = Record<string, unknown> & {
+    language?: string;
+    notifyLevel?: string;
+};
+/**
+ * The resolved namespace value. Every field is optional: a user who only ever
+ * edits `channels` leaves the rest absent, and each adapter applies its own
+ * default for anything missing.
+ */
+export interface ConnectSection {
+    channels?: ChannelName[];
+    channelDefaults?: ConnectSectionDefaults;
+    feishu?: Record<string, unknown>;
+    telegram?: Record<string, unknown>;
+    dingtalk?: Record<string, unknown>;
+    web?: Record<string, unknown>;
+}
+/**
+ * The namespace schema, derived from the same field tables the settings pane
+ * renders. Deriving rather than restating them is the point: a field added to
+ * `CHANNEL_CONFIG_FIELDS` becomes user-editable and hot-appliable in one edit,
+ * and a field that the pane exposes can never be silently unrepresentable in
+ * `settings.yaml`.
+ *
+ * `required(false)` on every field means an absent key stays absent — it does
+ * *not* materialize a default. That matters for `dmMode`, whose first option is
+ * the permissive one: a schema-provided default would silently open DMs for
+ * every user who never touched the field.
+ */
+export declare const ConnectSectionSchema: z<Schemastery.ObjectS<{
+    channels: z<ChannelName[], ChannelName[]>;
+    channelDefaults: z<any, any>;
+    feishu: z<any, any>;
+    telegram: z<any, any>;
+    dingtalk: z<any, any>;
+    web: z<any, any>;
+}>, Schemastery.ObjectT<{
+    channels: z<ChannelName[], ChannelName[]>;
+    channelDefaults: z<any, any>;
+    feishu: z<any, any>;
+    telegram: z<any, any>;
+    dingtalk: z<any, any>;
+    web: z<any, any>;
+}>>;
+/**
+ * Project a channel config onto the namespace's schema: only declared,
+ * non-secret keys, with `channels` always present.
+ *
+ * `channels` is emitted unconditionally because an absent array resolves to
+ * `[]` (schemastery's array default), which would read as "activate nothing".
+ *
+ * Secret keys are dropped here, not by the schema: `redactSecrets` only strips
+ * nodes declared with `role("secret")`, and we declare none — so the projection
+ * is what keeps an `appSecret` from a legacy profile out of the settings
+ * document and off the RPC.
+ *
+ * The argument is typed `unknown` because this doubles as the *write* guard:
+ * a section submitted through the settings RPC is untrusted JSON, and it must
+ * go through the same projection before it can reach the document.
+ */
+export declare function sectionOf(config: unknown): ConnectSection;
+/**
+ * The slice of the settings service this module calls. Declared structurally so
+ * the plugin keeps no dependency on `@deepseek-ai/dsh-settings` — the service is
+ * a `dsh-base` row, present whenever dsh-connect loads, and a missing method
+ * degrades to "no settings support" rather than a crash.
+ */
+export interface SettingsProviderLike {
+    installSection?(owner: unknown, ns: string, schema: unknown, entry: unknown, hooks: {
+        setSource: (source: () => unknown) => void;
+        onChange: () => void;
+    }): void;
+    /** Resolved value of a registered namespace, `undefined` while unregistered. */
+    get?(ns: string): unknown;
+    /**
+     * Replace a registered namespace's *user* section wholesale (validated by the
+     * provider, persisted by whichever file provider is wired up). Resolves after
+     * the new value is committed, so a read straight after it is fresh.
+     *
+     * Replace rather than merge, because the settings pane always submits its
+     * complete visible config: a merge would make a cleared field un-clearable
+     * (the stale value stays in the user layer and reappears on the next read).
+     * The declared-key set is identical for both writers of this namespace (this
+     * plugin's pane and the host's own Plugins page, which renders the same
+     * schema), so a replace cannot drop anything either surface can produce.
+     */
+    replace?(ns: string, section: unknown, expectedRevision?: number): Promise<unknown>;
+}
+/** A live handle onto the installed namespace: read the effective section, write a new one. */
+export interface LiveConnectSection {
+    /** The section in force right now (base layered under the user's section). */
+    read(): ConnectSection;
+    /**
+     * Replace the user's section with the declared-key projection of `config`.
+     * Rejects if the provider's schema refuses the result — the caller is
+     * expected to surface that rather than swallow it.
+     */
+    write(config: unknown): Promise<void>;
+}
+/** Outcome of wiring the namespace. */
+export interface InstallConnectSectionResult {
+    /** True when this fiber owns the namespace and receives live updates. */
+    live: boolean;
+    /** The section in force at install time (resolved, or the entry fallback). */
+    section: ConnectSection;
+    /**
+     * Read/write onto the registration. Present only when this fiber owns a live
+     * namespace *and* the provider exposes a write method; otherwise the caller
+     * keeps its own fallback (the plugin config, or the legacy state file).
+     */
+    handle?: LiveConnectSection;
+}
+export interface InstallConnectSectionOptions<Ctx extends LoggerLike> {
+    /** Context whose unload releases the registration. */
+    owner: Ctx;
+    settings: SettingsProviderLike | undefined;
+    /** The plugin's own config: the schema's `base` layer and the fallback. */
+    entry: ChannelsConfig | null | undefined;
+    /** Called with the in-force section now and on every change. */
+    onChange: (section: ConnectSection) => void;
+}
+/**
+ * Register `dsh-connect` and report the section in force.
+ *
+ * Never throws: a missing settings service, an already-claimed namespace, or a
+ * `settings.yaml` section that fails validation all fall back to the plugin's
+ * own config with a warning. A user's typo in a settings document must not be
+ * able to stop the bridge from starting.
+ */
+export declare function installConnectSection<Ctx extends LoggerLike>(options: InstallConnectSectionOptions<Ctx>): InstallConnectSectionResult;
+//# sourceMappingURL=namespace.d.ts.map

package/lib/settings/namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../src/settings/namespace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,CAAC,MAAM,0BAA0B,CAAC;AACzC,OAAO,EAAY,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAOjG,+CAA+C;AAC/C,eAAO,MAAM,mBAAmB,gBAAgB,CAAC;AAEjD,0DAA0D;AAC1D,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3G;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IACzB,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAyBD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;GAO/B,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,OAAO,GAAG,cAAc,CAoBzD;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,cAAc,CAAC,CACb,KAAK,EAAE,OAAO,EACd,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,OAAO,EACd,KAAK,EAAE;QAAE,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,IAAI,CAAA;KAAE,GAC1E,IAAI,CAAC;IACR,gFAAgF;IAChF,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrF;AAED,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,IAAI,IAAI,cAAc,CAAC;IACvB;;;;OAIG;IACH,KAAK,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,uCAAuC;AACvC,MAAM,WAAW,2BAA2B;IAC1C,yEAAyE;IACzE,IAAI,EAAE,OAAO,CAAC;IACd,8EAA8E;IAC9E,OAAO,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,MAAM,CAAC,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,4BAA4B,CAAC,GAAG,SAAS,UAAU;IAClE,sDAAsD;IACtD,KAAK,EAAE,GAAG,CAAC;IACX,QAAQ,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAC3C,2EAA2E;IAC3E,KAAK,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC,gEAAgE;IAChE,QAAQ,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,CAAC;CAC7C;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,SAAS,UAAU,EAC1D,OAAO,EAAE,4BAA4B,CAAC,GAAG,CAAC,GACzC,2BAA2B,CAmE7B"}

package/lib/settings/namespace.js

@@ -0,0 +1,200 @@
+/**
+ * The `dsh-connect` user-settings namespace.
+ *
+ * DSH ships a first-party user-settings seam (`ctx.settings`, backed by
+ * `$DSH_HOME/settings.yaml` via `@deepseek-ai/dsh-settings-file`, hot-reloaded,
+ * atomic, file-locked, comment-preserving). Registering a namespace is how a
+ * plugin makes its configuration user-editable *and effective*: the official
+ * Plugins page renders the fields from the schema, writes go through the
+ * provider, and `scope.watch()` tells the plugin to re-read.
+ *
+ * Two properties of that seam shape this module:
+ *
+ * - **`installSection` is the consumer entry point.** It registers the plugin's
+ *   own composition entry as the schema's *base* layer while the settings
+ *   service is present, and falls back to that entry if the service detaches.
+ *   Bare `register` would make `$DSH_HOME/settings.yaml` the only source and
+ *   silently drop a YAML-configured profile.
+ * - **The schema is applied to `mergeLayers(base, userSection)` at registration
+ *   time**, so a stored section that fails validation throws out of
+ *   `installSection`. Every install here is therefore guarded: a hand-edited
+ *   `settings.yaml` with a typo must degrade to the plugin config, not abort
+ *   the plugin's `apply`.
+ *
+ * **Secrets are deliberately not part of this schema.** They live in the DSH
+ * credential store (`ctx.credentials`), which is where the onboarding flow and
+ * the `FEISHU_*`-style env layering already put them; `settings.yaml` is a
+ * plain document users are invited to paste into bug reports. `sectionOf()`
+ * projects secret keys *out* of the base for the same reason — schemastery
+ * preserves undeclared keys verbatim, so anything left in the base rides out
+ * through `describe()` and the settings RPC. The same projection guards the
+ * write path (`LiveConnectSection.write`), which is the mirror hazard: an
+ * undeclared key in a *submitted* section would be preserved into the document.
+ *
+ * `installSection` returns nothing, so the write handle it hands back is built
+ * here: `setSource` already wires a thunk onto `scope.get()`, which reads the
+ * registration's resolved value at call time — live in both directions.
+ *
+ * @module dsh-connect/settings/namespace
+ */
+import z from "@deepseek-ai/schemastery";
+import { CHANNELS } from "./channels.js";
+import { CHANNEL_CONFIG_FIELDS, CHANNEL_DEFAULT_FIELDS, } from "./settings-model.js";
+/** The settings namespace this plugin owns. */
+export const CONNECT_SETTINGS_NS = "dsh-connect";
+/** schemastery schema for one non-secret config field. */
+function fieldSchema(field) {
+    switch (field.kind) {
+        case "number":
+            return z.number().required(false);
+        case "boolean":
+            return z.boolean().required(false);
+        case "select":
+            return field.options !== undefined && field.options.length > 0
+                ? z.union(field.options.map((option) => z.const(option))).required(false)
+                : z.string().required(false);
+        default:
+            return z.string().required(false);
+    }
+}
+/** Build an object schema from a field table (unknown keys pass through). */
+function objectSchema(fields) {
+    return z.object(Object.fromEntries(fields.map((field) => [field.key, fieldSchema(field)])));
+}
+/**
+ * The namespace schema, derived from the same field tables the settings pane
+ * renders. Deriving rather than restating them is the point: a field added to
+ * `CHANNEL_CONFIG_FIELDS` becomes user-editable and hot-appliable in one edit,
+ * and a field that the pane exposes can never be silently unrepresentable in
+ * `settings.yaml`.
+ *
+ * `required(false)` on every field means an absent key stays absent — it does
+ * *not* materialize a default. That matters for `dmMode`, whose first option is
+ * the permissive one: a schema-provided default would silently open DMs for
+ * every user who never touched the field.
+ */
+export const ConnectSectionSchema = z.object({
+    channels: z.array(z.union(CHANNELS.map((name) => z.const(name)))).required(false),
+    channelDefaults: objectSchema(CHANNEL_DEFAULT_FIELDS).required(false),
+    feishu: objectSchema(CHANNEL_CONFIG_FIELDS.feishu).required(false),
+    telegram: objectSchema(CHANNEL_CONFIG_FIELDS.telegram).required(false),
+    dingtalk: objectSchema(CHANNEL_CONFIG_FIELDS.dingtalk).required(false),
+    web: objectSchema(CHANNEL_CONFIG_FIELDS.web).required(false),
+});
+/**
+ * Project a channel config onto the namespace's schema: only declared,
+ * non-secret keys, with `channels` always present.
+ *
+ * `channels` is emitted unconditionally because an absent array resolves to
+ * `[]` (schemastery's array default), which would read as "activate nothing".
+ *
+ * Secret keys are dropped here, not by the schema: `redactSecrets` only strips
+ * nodes declared with `role("secret")`, and we declare none — so the projection
+ * is what keeps an `appSecret` from a legacy profile out of the settings
+ * document and off the RPC.
+ *
+ * The argument is typed `unknown` because this doubles as the *write* guard:
+ * a section submitted through the settings RPC is untrusted JSON, and it must
+ * go through the same projection before it can reach the document.
+ */
+export function sectionOf(config) {
+    const source = (config !== null && typeof config === "object" ? config : {});
+    const section = { channels: (source.channels ?? CHANNELS) };
+    const defaults = {};
+    const rawDefaults = (source.channelDefaults ?? {});
+    for (const field of CHANNEL_DEFAULT_FIELDS) {
+        if (rawDefaults[field.key] !== undefined)
+            defaults[field.key] = rawDefaults[field.key];
+    }
+    if (Object.keys(defaults).length > 0)
+        section.channelDefaults = defaults;
+    for (const name of CHANNELS) {
+        const raw = (source[name] ?? {});
+        const projected = {};
+        for (const field of CHANNEL_CONFIG_FIELDS[name]) {
+            if (raw[field.key] !== undefined)
+                projected[field.key] = raw[field.key];
+        }
+        if (Object.keys(projected).length > 0)
+            section[name] = projected;
+    }
+    return section;
+}
+/**
+ * Register `dsh-connect` and report the section in force.
+ *
+ * Never throws: a missing settings service, an already-claimed namespace, or a
+ * `settings.yaml` section that fails validation all fall back to the plugin's
+ * own config with a warning. A user's typo in a settings document must not be
+ * able to stop the bridge from starting.
+ */
+export function installConnectSection(options) {
+    const { settings, entry, onChange } = options;
+    const entrySection = sectionOf(entry);
+    const warn = (message) => {
+        options.owner.logger?.warn?.(`connect: ${message}`);
+    };
+    if (settings?.installSection === undefined) {
+        // No settings service: the plugin config is the only source, as it was
+        // before this namespace existed.
+        onChange(entrySection);
+        return { live: false, section: entrySection };
+    }
+    let source = () => entrySection;
+    try {
+        settings.installSection(options.owner, CONNECT_SETTINGS_NS, ConnectSectionSchema, entrySection, {
+            setSource: (fn) => {
+                source = () => fn();
+            },
+            onChange: () => onChange(source()),
+        });
+    }
+    catch (error) {
+        // Two reachable causes, both handled the same way:
+        //   - a stored section that fails the schema (a hand-edited settings.yaml);
+        //   - the namespace is already registered by an earlier fiber. `register`
+        //     is an effect on the *settings service*, which outlives a plugin
+        //     reload, so a live config reload lands here.
+        // `get()` returns the previously resolved value in the second case, which
+        // keeps the user's saved settings effective — only the live watch is gone
+        // until the process restarts.
+        const resolved = readRegistered(settings);
+        if (resolved !== undefined) {
+            warn(`settings namespace "${CONNECT_SETTINGS_NS}" is already registered ` +
+                `(the plugin reloaded without a host restart); using the saved section — ` +
+                `restart dsh to re-enable live settings updates`);
+            onChange(resolved);
+            return { live: false, section: resolved };
+        }
+        warn(`settings namespace "${CONNECT_SETTINGS_NS}" unavailable (${String(error)}); ` +
+            `falling back to the plugin config`);
+        onChange(entrySection);
+        return { live: false, section: entrySection };
+    }
+    // `source` is reassigned (not rebound) by `setSource`, so a thunk closing
+    // over the variable reads whatever the provider's `scope.get()` returns now.
+    const read = () => source();
+    const replace = settings.replace?.bind(settings);
+    return {
+        live: true,
+        section: source(),
+        ...(replace === undefined
+            ? {}
+            : {
+                handle: {
+                    read,
+                    write: async (config) => {
+                        await replace(CONNECT_SETTINGS_NS, sectionOf(config));
+                    },
+                },
+            }),
+    };
+}
+/** Read a namespace an earlier fiber registered, if any. */
+function readRegistered(settings) {
+    const value = settings.get?.(CONNECT_SETTINGS_NS);
+    if (value === null || typeof value !== "object")
+        return undefined;
+    return value;
+}
+//# sourceMappingURL=namespace.js.map

package/lib/settings/namespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../src/settings/namespace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,CAAC,MAAM,0BAA0B,CAAC;AACzC,OAAO,EAAE,QAAQ,EAA0D,MAAM,eAAe,CAAC;AACjG,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,qBAAqB,CAAC;AAE7B,+CAA+C;AAC/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAmBjD,0DAA0D;AAC1D,SAAS,WAAW,CAAC,KAAkB;IACrC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpC,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrC,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBAC5D,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACzE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC;YACE,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,MAA8B;IAClD,OAAO,CAAC,CAAC,MAAM,CACb,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACjF,eAAe,EAAE,YAAY,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACrE,MAAM,EAAE,YAAY,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IAClE,QAAQ,EAAE,YAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACtE,QAAQ,EAAE,YAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACtE,GAAG,EAAE,YAAY,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;CAC7D,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,SAAS,CAAC,MAAe;IACvC,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IACxG,MAAM,OAAO,GAAmB,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAkB,EAAE,CAAC;IAE7F,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAA4B,CAAC;IAC9E,KAAK,MAAM,KAAK,IAAI,sBAAsB,EAAE,CAAC;QAC3C,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,eAAe,GAAG,QAAkC,CAAC;IAEnG,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC5D,MAAM,SAAS,GAA4B,EAAE,CAAC;QAC9C,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IACnE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAqED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA0C;IAE1C,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC9C,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,OAAe,EAAQ,EAAE;QACrC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC;IAEF,IAAI,QAAQ,EAAE,cAAc,KAAK,SAAS,EAAE,CAAC;QAC3C,uEAAuE;QACvE,iCAAiC;QACjC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAChD,CAAC;IAED,IAAI,MAAM,GAAyB,GAAG,EAAE,CAAC,YAAY,CAAC;IACtD,IAAI,CAAC;QACH,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,YAAY,EAAE;YAC9F,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE;gBAChB,MAAM,GAAG,GAAG,EAAE,CAAC,EAAE,EAAoB,CAAC;YACxC,CAAC;YACD,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mDAAmD;QACnD,4EAA4E;QAC5E,0EAA0E;QAC1E,sEAAsE;QACtE,kDAAkD;QAClD,0EAA0E;QAC1E,0EAA0E;QAC1E,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CACF,uBAAuB,mBAAmB,0BAA0B;gBAClE,0EAA0E;gBAC1E,gDAAgD,CACnD,CAAC;YACF,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACnB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC5C,CAAC;QACD,IAAI,CACF,uBAAuB,mBAAmB,kBAAkB,MAAM,CAAC,KAAK,CAAC,KAAK;YAC5E,mCAAmC,CACtC,CAAC;QACF,QAAQ,CAAC,YAAY,CAAC,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAChD,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAM,IAAI,GAAG,GAAmB,EAAE,CAAC,MAAM,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO;QACL,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,MAAM,EAAE;QACjB,GAAG,CAAC,OAAO,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,MAAM,EAAE;oBACN,IAAI;oBACJ,KAAK,EAAE,KAAK,EAAE,MAAe,EAAiB,EAAE;wBAC9C,MAAM,OAAO,CAAC,mBAAmB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;oBACxD,CAAC;iBACF;aACF,CAAC;KACP,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,SAAS,cAAc,CAAC,QAA8B;IACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,KAAuB,CAAC;AACjC,CAAC"}

package/lib/settings/secret-disclosure.d.ts

@@ -0,0 +1,50 @@
+/**
+ * How much of a stored secret the settings pane is allowed to show.
+ *
+ * The user has to be able to *confirm* what they configured — a pane that only
+ * ever says 「已配置」 cannot tell a correct appId from a typo — but a browser
+ * tab (or a screenshot of one) must never hold a usable credential. The two are
+ * reconciled here: the host masks the value **before it crosses the wire**, so
+ * what the pane receives is already unusable, and `maskSecret` is the only
+ * place that decides how much survives.
+ *
+ * Deliberately pure and dependency-free: the host (`settings-service`) masks
+ * with it and the client bundle imports the same compiled module for the input
+ * `type`, so the two can never drift into disagreeing about which keys are
+ * confidential.
+ *
+ * @module dsh-connect/settings/secret-disclosure
+ */
+/**
+ * - `full` — shown verbatim. For identifiers, not authenticators.
+ * - `mask` — head and tail survive, the middle does not.
+ * - `url` — a URL whose *query* carries the token, so only that part is masked.
+ */
+export type Disclosure = "full" | "mask" | "url";
+/**
+ * Per-config-key policy, keyed by the channel config key (`CREDENTIAL`-style
+ * keys are unique across channels: no channel has two fields that share a name
+ * but want different treatment).
+ *
+ * `appId` / `clientId` are `full` on purpose. They are **identifiers**: they
+ * appear in the URL or body of every outbound API call, are readable in the
+ * vendor's own console, and grant nothing without the paired secret. Masking
+ * them would cost the user the one thing this pane is for — checking that the
+ * id they pasted is the one they meant — and buy no secrecy at all.
+ */
+export declare const SECRET_DISCLOSURE: Record<string, Disclosure>;
+/** Policy for a config key; unknown keys are treated as confidential. */
+export declare function disclosureOf(configKey: string): Disclosure;
+/** True when the pane should render this key as a password input. */
+export declare function isMaskedSecret(configKey: string): boolean;
+/**
+ * The display preview for one stored secret. Never returns the input: for
+ * `mask` and `url` the returned string is lossy by construction, so a caller
+ * that echoes it to a browser cannot leak a usable credential.
+ *
+ * Surrounding whitespace is trimmed first — a pasted value commonly carries a
+ * trailing newline, and the mask should describe the stored value, not the
+ * paste.
+ */
+export declare function maskSecret(configKey: string, value: string): string;
+//# sourceMappingURL=secret-disclosure.d.ts.map

package/lib/settings/secret-disclosure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-disclosure.d.ts","sourceRoot":"","sources":["../../src/settings/secret-disclosure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAQvD,CAAC;AAkBH,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,CAE1D;AAED,qEAAqE;AACrE,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEzD;AAqDD;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAWnE"}

package/lib/settings/secret-disclosure.js

@@ -0,0 +1,132 @@
+/**
+ * How much of a stored secret the settings pane is allowed to show.
+ *
+ * The user has to be able to *confirm* what they configured — a pane that only
+ * ever says 「已配置」 cannot tell a correct appId from a typo — but a browser
+ * tab (or a screenshot of one) must never hold a usable credential. The two are
+ * reconciled here: the host masks the value **before it crosses the wire**, so
+ * what the pane receives is already unusable, and `maskSecret` is the only
+ * place that decides how much survives.
+ *
+ * Deliberately pure and dependency-free: the host (`settings-service`) masks
+ * with it and the client bundle imports the same compiled module for the input
+ * `type`, so the two can never drift into disagreeing about which keys are
+ * confidential.
+ *
+ * @module dsh-connect/settings/secret-disclosure
+ */
+/**
+ * Per-config-key policy, keyed by the channel config key (`CREDENTIAL`-style
+ * keys are unique across channels: no channel has two fields that share a name
+ * but want different treatment).
+ *
+ * `appId` / `clientId` are `full` on purpose. They are **identifiers**: they
+ * appear in the URL or body of every outbound API call, are readable in the
+ * vendor's own console, and grant nothing without the paired secret. Masking
+ * them would cost the user the one thing this pane is for — checking that the
+ * id they pasted is the one they meant — and buy no secrecy at all.
+ */
+export const SECRET_DISCLOSURE = Object.freeze({
+    appId: "full",
+    clientId: "full",
+    appSecret: "mask",
+    clientSecret: "mask",
+    botToken: "mask",
+    secret: "mask",
+    webhookUrl: "url",
+});
+/** Query parameters whose *value* is a credential and must not be echoed. */
+const SECRET_QUERY_PARAM = /(secret|token|key|sign)/i;
+/** Characters kept visible on each end of a masked value. */
+const EDGE = 4;
+/**
+ * Below this length there is no middle to hide — showing 4+4 of a 10-character
+ * value would print it in full — so short values collapse to a fixed-width
+ * mask, which also avoids leaking the length.
+ */
+const MIN_MASKABLE = 12;
+/** The width of the all-bullets mask used for values too short to split. */
+const BULLETS = "••••••";
+/** Policy for a config key; unknown keys are treated as confidential. */
+export function disclosureOf(configKey) {
+    return SECRET_DISCLOSURE[configKey] ?? "mask";
+}
+/** True when the pane should render this key as a password input. */
+export function isMaskedSecret(configKey) {
+    return disclosureOf(configKey) !== "full";
+}
+/** `head…tail`, or the bullets mask when the value is too short to split. */
+function maskMiddle(value) {
+    if (value.length < MIN_MASKABLE)
+        return BULLETS;
+    return value.slice(0, EDGE) + "…" + value.slice(-EDGE);
+}
+/** Escape a query-parameter name for use inside a `RegExp`. */
+function escapeForRegExp(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * Mask the credential-bearing query parameters of a URL, keeping the origin,
+ * path and the innocent parameters readable.
+ *
+ * Masking such a URL end-to-end would defeat the purpose: DingTalk's webhook is
+ * `https://oapi.dingtalk.com/robot/send?access_token=…`, so `https…bcde` tells
+ * the user nothing about whether they pasted the right robot. Falls back to the
+ * plain mask when the value isn't a parseable URL (a bare token, a typo, an
+ * empty-ish string).
+ *
+ * The masking is a surgical replace on the original text rather than a
+ * re-serialize through `URLSearchParams`, which would percent-encode the `…`
+ * into `%E2%80%A6` and render the preview unreadable.
+ */
+function maskUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return maskMiddle(value);
+    }
+    let masked = value;
+    for (const key of new Set(url.searchParams.keys())) {
+        if (!SECRET_QUERY_PARAM.test(key))
+            continue;
+        const pattern = new RegExp(`([?&]${escapeForRegExp(key)}=)([^&#]*)`, "g");
+        masked = masked.replace(pattern, (whole, prefix, held) => {
+            // Tolerate a percent-encoded token: decode to measure it, mask the
+            // decoded form, and splice the readable result back into the raw text.
+            let decoded = held;
+            try {
+                decoded = decodeURIComponent(held);
+            }
+            catch {
+                /* not encoded — use as-is */
+            }
+            return decoded.length === 0 ? whole : prefix + maskMiddle(decoded);
+        });
+    }
+    return masked;
+}
+/**
+ * The display preview for one stored secret. Never returns the input: for
+ * `mask` and `url` the returned string is lossy by construction, so a caller
+ * that echoes it to a browser cannot leak a usable credential.
+ *
+ * Surrounding whitespace is trimmed first — a pasted value commonly carries a
+ * trailing newline, and the mask should describe the stored value, not the
+ * paste.
+ */
+export function maskSecret(configKey, value) {
+    const trimmed = value.trim();
+    if (trimmed.length === 0)
+        return "";
+    switch (disclosureOf(configKey)) {
+        case "full":
+            return trimmed;
+        case "url":
+            return maskUrl(trimmed);
+        default:
+            return maskMiddle(trimmed);
+    }
+}
+//# sourceMappingURL=secret-disclosure.js.map

package/lib/settings/secret-disclosure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-disclosure.js","sourceRoot":"","sources":["../../src/settings/secret-disclosure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA+B,MAAM,CAAC,MAAM,CAAC;IACzE,KAAK,EAAE,MAAM;IACb,QAAQ,EAAE,MAAM;IAChB,SAAS,EAAE,MAAM;IACjB,YAAY,EAAE,MAAM;IACpB,QAAQ,EAAE,MAAM;IAChB,MAAM,EAAE,MAAM;IACd,UAAU,EAAE,KAAK;CAClB,CAAC,CAAC;AAEH,6EAA6E;AAC7E,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAEtD,6DAA6D;AAC7D,MAAM,IAAI,GAAG,CAAC,CAAC;AAEf;;;;GAIG;AACH,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,4EAA4E;AAC5E,MAAM,OAAO,GAAG,QAAQ,CAAC;AAEzB,yEAAyE;AACzE,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,OAAO,iBAAiB,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC;AAChD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,OAAO,YAAY,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC;AAC5C,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,YAAY;QAAE,OAAO,OAAO,CAAC;IAChD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,+DAA+D;AAC/D,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,OAAO,CAAC,KAAa;IAC5B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,QAAQ,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAC1E,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAc,EAAE,IAAY,EAAE,EAAE;YACvE,mEAAmE;YACnE,uEAAuE;YACvE,IAAI,OAAO,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC;gBACH,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,6BAA6B;YAC/B,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB,EAAE,KAAa;IACzD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,QAAQ,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM;YACT,OAAO,OAAO,CAAC;QACjB,KAAK,KAAK;YACR,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B;YACE,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC"}

package/lib/settings/settings-model.d.ts

@@ -92,8 +92,25 @@ export interface SettingsForm {
     channels: ChannelName[];
     channelDefaults: Record<string, unknown>;
     channelConfigs: Record<string, Record<string, unknown>>;
+    /** Secret inputs the user is *typing*: written on save, never seeded by a read. */
     secrets: Record<string, Record<string, string>>;
+    /**
+     * Whether a value is already stored for a secret key, for the placeholder.
+     * Separate from `secrets` because the two have opposite lifetimes: presence
+     * comes from the snapshot and the typed values start empty and are cleared
+     * after a save — a read must never be able to populate an input.
+     */
+    secretPresence: Record<string, Record<string, boolean>>;
+    /**
+     * Host-masked previews of the stored secrets, so the user can confirm what
+     * they configured. Rendered as read-only text and **never** fed into
+     * `secrets`: a masked value is not a credential, and treating one as a value
+     * to save would overwrite a working secret with its own mask.
+     */
+    secretPreviews: Record<string, Record<string, string>>;
     settingsStatePath?: string;
+    /** True when the section lives in the settings namespace: a save is immediate and durable. */
+    live: boolean;
 }
 /** Build the initial form from a snapshot. */
 export declare function snapshotToForm(snapshot: SettingsSnapshot): SettingsForm;

package/lib/settings/settings-model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-model.d.ts","sourceRoot":"","sources":["../../src/settings/settings-model.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,EAE7B,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC/C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsB8B,CAAC;AAEjE,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,EAAE,SAAS,WAAW,EAGxD,CAAC;AAEF,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAclF;AAED,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,8CAA8C;AAC9C,wBAAgB,cAAc,CAAC,QAAQ,EAAE,gBAAgB,GAAG,YAAY,CAYvE;AASD,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAU3E;AAED,kFAAkF;AAClF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,YAAY,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,EAAE,CAM9G"}
+{"version":3,"file":"settings-model.d.ts","sourceRoot":"","sources":["../../src/settings/settings-model.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,EAE7B,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC/C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsB8B,CAAC;AAEjE,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,EAAE,SAAS,WAAW,EAGxD,CAAC;AAEF,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAclF;AAED,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,8FAA8F;IAC9F,IAAI,EAAE,OAAO,CAAC;CACf;AAED,8CAA8C;AAC9C,wBAAgB,cAAc,CAAC,QAAQ,EAAE,gBAAgB,GAAG,YAAY,CAoBvE;AASD,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAU3E;AAED,kFAAkF;AAClF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,YAAY,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,EAAE,CAM9G"}