larkin 0.2.70

package/dist/platform/build-info.mjs

@@ -0,0 +1,18 @@
+import fs from "node:fs";
+import path from "node:path";
+import { dashboardBuildFingerprint } from "../dashboard/dashboard-lifecycle.mjs";
+export function packageVersion(root) {
+    if (typeof LARKIN_BUILD_VERSION !== "undefined" && LARKIN_BUILD_VERSION)
+        return LARKIN_BUILD_VERSION;
+    try {
+        return String(JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8")).version || "dev");
+    }
+    catch {
+        return "dev";
+    }
+}
+export function buildFingerprint(root) {
+    if (typeof LARKIN_BUILD_FINGERPRINT !== "undefined" && LARKIN_BUILD_FINGERPRINT)
+        return LARKIN_BUILD_FINGERPRINT;
+    return dashboardBuildFingerprint(root);
+}

package/dist/platform/callback-capability.cjs

@@ -0,0 +1,301 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.callbackCapability = callbackCapability;
+exports.documentCommentCapability = documentCommentCapability;
+exports.documentCommentReplyCapability = documentCommentReplyCapability;
+exports.documentCommentSubscriptionCapability = documentCommentSubscriptionCapability;
+exports.effectiveDocumentCommentSubscription = effectiveDocumentCommentSubscription;
+exports.readDocumentCommentSubscription = readDocumentCommentSubscription;
+exports.readDocumentCommentCapability = readDocumentCommentCapability;
+exports.readDocumentCommentReplyCapability = readDocumentCommentReplyCapability;
+exports.markDocumentCommentSubscriptionVerified = markDocumentCommentSubscriptionVerified;
+exports.readCallbackCapability = readCallbackCapability;
+exports.markCallbackRequested = markCallbackRequested;
+exports.markSetupCapabilitiesRequested = markSetupCapabilitiesRequested;
+exports.issueCallbackProbe = issueCallbackProbe;
+exports.verifyCallbackProbe = verifyCallbackProbe;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const APP_ID = /^cli_[A-Za-z0-9]+$/;
+const NONCE = /^[a-f0-9]{32}$/;
+function credentialFile(configDir, appId) {
+    if (!APP_ID.test(appId))
+        throw new Error("invalid callback capability App ID");
+    return path.join(path.resolve(configDir), "bots", `${appId}.json`);
+}
+function readCredential(file) {
+    const stat = fs.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o777) !== 0o600
+        || (typeof process.getuid === "function" && stat.uid !== process.getuid())) {
+        throw new Error("callback capability credential must be an owned 0600 regular file");
+    }
+    const value = JSON.parse(fs.readFileSync(file, "utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype)
+        throw new Error("callback capability credential is invalid");
+    return value;
+}
+function writeCredential(file, value) {
+    const temporary = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${(0, node_crypto_1.randomUUID)()}.tmp`);
+    let fd;
+    try {
+        fd = fs.openSync(temporary, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW, 0o600);
+        fs.writeFileSync(fd, `${JSON.stringify(value, null, 2)}\n`);
+        fs.fsyncSync(fd);
+        fs.closeSync(fd);
+        fd = undefined;
+        if (fs.lstatSync(file).isSymbolicLink())
+            throw new Error("callback capability credential became a symlink");
+        fs.renameSync(temporary, file);
+        fs.chmodSync(file, 0o600);
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+        try {
+            fs.unlinkSync(temporary);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+}
+function callbackCapability(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const capabilities = value.capabilities;
+    const capability = capabilities?.cardActionCallback;
+    if (!capabilities || typeof capabilities !== "object" || Array.isArray(capabilities) || Object.getPrototypeOf(capabilities) !== Object.prototype
+        || !capability || typeof capability !== "object" || Array.isArray(capability) || Object.getPrototypeOf(capability) !== Object.prototype
+        || Object.keys(capability).some((key) => !["status", "requestedAt", "probeNonce", "probeIssuedAt", "verifiedAt", "verifiedEventId"].includes(key))
+        || !["requested-unverified", "probe-issued", "verified-effective"].includes(capability.status)
+        || typeof capability.requestedAt !== "string" || !Number.isFinite(Date.parse(capability.requestedAt)))
+        return null;
+    if (capability.status === "probe-issued" && (!capability.probeNonce || !NONCE.test(capability.probeNonce)))
+        return null;
+    if (capability.status === "verified-effective" && (!capability.verifiedAt || !Number.isFinite(Date.parse(capability.verifiedAt))))
+        return null;
+    return capability;
+}
+function documentCommentCapability(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const capabilities = value.capabilities;
+    const capability = capabilities?.documentCommentEvent;
+    if (!capabilities || typeof capabilities !== "object" || Array.isArray(capabilities) || Object.getPrototypeOf(capabilities) !== Object.prototype
+        || !capability || typeof capability !== "object" || Array.isArray(capability) || Object.getPrototypeOf(capability) !== Object.prototype
+        || Object.keys(capability).some((key) => !["status", "event", "scope", "requestedAt"].includes(key))
+        || capability.status !== "requested-unverified"
+        || capability.event !== "drive.notice.comment_add_v1"
+        || capability.scope !== "drive:drive"
+        || typeof capability.requestedAt !== "string" || !Number.isFinite(Date.parse(capability.requestedAt)))
+        return null;
+    return capability;
+}
+function documentCommentReplyCapability(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const capabilities = value.capabilities;
+    const capability = capabilities?.documentCommentReply;
+    if (!capabilities || typeof capabilities !== "object" || Array.isArray(capabilities) || Object.getPrototypeOf(capabilities) !== Object.prototype
+        || !capability || typeof capability !== "object" || Array.isArray(capability) || Object.getPrototypeOf(capability) !== Object.prototype
+        || Object.keys(capability).some((key) => !["status", "scope", "requestedAt"].includes(key))
+        || capability.status !== "requested-unverified"
+        || capability.scope !== "docs:document.comment:create"
+        || typeof capability.requestedAt !== "string" || !Number.isFinite(Date.parse(capability.requestedAt)))
+        return null;
+    return capability;
+}
+function documentCommentSubscriptionCapability(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const capabilities = value.capabilities;
+    const capability = capabilities?.documentCommentSubscription;
+    if (!capabilities || typeof capabilities !== "object" || Array.isArray(capabilities) || Object.getPrototypeOf(capabilities) !== Object.prototype
+        || !capability || typeof capability !== "object" || Array.isArray(capability) || Object.getPrototypeOf(capability) !== Object.prototype)
+        return null;
+    const keys = Object.keys(capability);
+    if (capability.mode === "none" && capability.status === "safe-default" && capability.source === "setup-default") {
+        return keys.length === 4 && keys.every((key) => ["mode", "status", "source", "updatedAt"].includes(key))
+            && typeof capability.updatedAt === "string" && Number.isFinite(Date.parse(capability.updatedAt)) ? capability : null;
+    }
+    if (capability.mode === "none" && capability.status === "requested-unverified" && capability.source === "setup-opt-in") {
+        return keys.length === 5 && keys.every((key) => ["mode", "status", "source", "dimension", "requestedAt"].includes(key))
+            && capability.dimension === "application"
+            && typeof capability.requestedAt === "string" && Number.isFinite(Date.parse(capability.requestedAt)) ? capability : null;
+    }
+    if (capability.mode === "subscribed" && capability.status === "platform-verified" && capability.source === "platform-status") {
+        return keys.length === 6 && keys.every((key) => ["mode", "status", "source", "dimension", "requestedAt", "verifiedAt"].includes(key))
+            && capability.dimension === "application"
+            && typeof capability.requestedAt === "string" && Number.isFinite(Date.parse(capability.requestedAt))
+            && typeof capability.verifiedAt === "string" && Number.isFinite(Date.parse(capability.verifiedAt)) ? capability : null;
+    }
+    return null;
+}
+function effectiveDocumentCommentSubscription(value) {
+    const capability = documentCommentSubscriptionCapability(value);
+    if (!capability)
+        return { mode: "none", status: "safe-default", source: "legacy-default", dimension: null };
+    return {
+        mode: capability.mode,
+        status: capability.status,
+        source: capability.source,
+        dimension: "dimension" in capability ? capability.dimension : null,
+    };
+}
+function readDocumentCommentSubscription(configDir, appId) {
+    return effectiveDocumentCommentSubscription(readCredential(credentialFile(configDir, appId)));
+}
+function readDocumentCommentCapability(configDir, appId) {
+    return documentCommentCapability(readCredential(credentialFile(configDir, appId)));
+}
+function readDocumentCommentReplyCapability(configDir, appId) {
+    return documentCommentReplyCapability(readCredential(credentialFile(configDir, appId)));
+}
+function markDocumentCommentSubscriptionVerified(configDir, appId, dimension, now = Date.now()) {
+    const file = credentialFile(configDir, appId);
+    const credential = readCredential(file);
+    const prior = documentCommentSubscriptionCapability(credential);
+    if (!prior || prior.status !== "requested-unverified" || prior.dimension !== dimension) {
+        throw new Error("document comment subscription was not explicitly requested for this dimension");
+    }
+    const capability = {
+        mode: "subscribed",
+        status: "platform-verified",
+        source: "platform-status",
+        dimension,
+        requestedAt: prior.requestedAt,
+        verifiedAt: new Date(now).toISOString(),
+    };
+    credential.capabilities = { ...(credential.capabilities || {}), documentCommentSubscription: capability };
+    writeCredential(file, credential);
+    return capability;
+}
+function readCallbackCapability(configDir, appId) {
+    return callbackCapability(readCredential(credentialFile(configDir, appId)));
+}
+function markCallbackRequested(configDir, appId, now = Date.now()) {
+    const file = credentialFile(configDir, appId);
+    const credential = readCredential(file);
+    const prior = callbackCapability(credential);
+    const capability = {
+        status: "requested-unverified",
+        requestedAt: prior?.requestedAt || new Date(now).toISOString(),
+    };
+    credential.capabilities = { ...(credential.capabilities || {}), cardActionCallback: capability };
+    writeCredential(file, credential);
+    return capability;
+}
+function markSetupCapabilitiesRequested(configDir, appId, now = Date.now(), commentSubscription) {
+    const file = credentialFile(configDir, appId);
+    const credential = readCredential(file);
+    const priorCallback = callbackCapability(credential);
+    const priorComment = documentCommentCapability(credential);
+    const priorReply = documentCommentReplyCapability(credential);
+    const priorSubscription = documentCommentSubscriptionCapability(credential);
+    const requestedAt = new Date(now).toISOString();
+    const cardActionCallback = {
+        status: "requested-unverified",
+        requestedAt: priorCallback?.requestedAt || requestedAt,
+    };
+    const documentCommentEvent = {
+        status: "requested-unverified",
+        event: "drive.notice.comment_add_v1",
+        scope: "drive:drive",
+        requestedAt: priorComment?.requestedAt || requestedAt,
+    };
+    const documentCommentReply = {
+        status: "requested-unverified",
+        scope: "docs:document.comment:create",
+        requestedAt: priorReply?.requestedAt || requestedAt,
+    };
+    const documentCommentSubscription = commentSubscription === "application"
+        ? {
+            mode: "none",
+            status: "requested-unverified",
+            source: "setup-opt-in",
+            dimension: commentSubscription,
+            requestedAt: requestedAt,
+        }
+        : commentSubscription === "none" || !priorSubscription
+            ? { mode: "none", status: "safe-default", source: "setup-default", updatedAt: requestedAt }
+            : priorSubscription;
+    credential.capabilities = { ...(credential.capabilities || {}), cardActionCallback, documentCommentEvent, documentCommentReply, documentCommentSubscription };
+    writeCredential(file, credential);
+    return { cardActionCallback, documentCommentEvent, documentCommentReply, documentCommentSubscription };
+}
+function issueCallbackProbe(configDir, appId, now = Date.now(), random = node_crypto_1.randomUUID) {
+    const file = credentialFile(configDir, appId);
+    const credential = readCredential(file);
+    const prior = callbackCapability(credential);
+    if (!prior)
+        throw new Error("card.action.trigger was not requested by setup; rerun larkin setup first");
+    if (prior.status === "verified-effective")
+        return { nonce: "", capability: prior };
+    const nonce = random().replaceAll("-", "").slice(0, 32);
+    if (!NONCE.test(nonce))
+        throw new Error("callback probe nonce generator returned an invalid value");
+    const capability = {
+        status: "probe-issued",
+        requestedAt: prior.requestedAt,
+        probeNonce: nonce,
+        probeIssuedAt: new Date(now).toISOString(),
+    };
+    credential.capabilities = { ...(credential.capabilities || {}), cardActionCallback: capability };
+    writeCredential(file, credential);
+    return { nonce, capability };
+}
+function verifyCallbackProbe(configDir, appId, nonce, eventId, now = Date.now()) {
+    if (!NONCE.test(nonce) || !eventId)
+        return false;
+    const file = credentialFile(configDir, appId);
+    const credential = readCredential(file);
+    const prior = callbackCapability(credential);
+    if (!prior || prior.status !== "probe-issued" || prior.probeNonce !== nonce)
+        return false;
+    credential.capabilities = {
+        ...(credential.capabilities || {}),
+        cardActionCallback: {
+            status: "verified-effective",
+            requestedAt: prior.requestedAt,
+            verifiedAt: new Date(now).toISOString(),
+            verifiedEventId: eventId,
+        },
+    };
+    writeCredential(file, credential);
+    return true;
+}

package/dist/platform/callback-capability.mjs

@@ -0,0 +1,252 @@
+import { randomUUID } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+const APP_ID = /^cli_[A-Za-z0-9]+$/;
+const NONCE = /^[a-f0-9]{32}$/;
+function credentialFile(configDir, appId) {
+    if (!APP_ID.test(appId))
+        throw new Error("invalid callback capability App ID");
+    return path.join(path.resolve(configDir), "bots", `${appId}.json`);
+}
+function readCredential(file) {
+    const stat = fs.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o777) !== 0o600
+        || (typeof process.getuid === "function" && stat.uid !== process.getuid())) {
+        throw new Error("callback capability credential must be an owned 0600 regular file");
+    }
+    const value = JSON.parse(fs.readFileSync(file, "utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype)
+        throw new Error("callback capability credential is invalid");
+    return value;
+}
+function writeCredential(file, value) {
+    const temporary = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${randomUUID()}.tmp`);
+    let fd;
+    try {
+        fd = fs.openSync(temporary, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW, 0o600);
+        fs.writeFileSync(fd, `${JSON.stringify(value, null, 2)}\n`);
+        fs.fsyncSync(fd);
+        fs.closeSync(fd);
+        fd = undefined;
+        if (fs.lstatSync(file).isSymbolicLink())
+            throw new Error("callback capability credential became a symlink");
+        fs.renameSync(temporary, file);
+        fs.chmodSync(file, 0o600);
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+        try {
+            fs.unlinkSync(temporary);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+}
+export function callbackCapability(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const capabilities = value.capabilities;
+    const capability = capabilities?.cardActionCallback;
+    if (!capabilities || typeof capabilities !== "object" || Array.isArray(capabilities) || Object.getPrototypeOf(capabilities) !== Object.prototype
+        || !capability || typeof capability !== "object" || Array.isArray(capability) || Object.getPrototypeOf(capability) !== Object.prototype
+        || Object.keys(capability).some((key) => !["status", "requestedAt", "probeNonce", "probeIssuedAt", "verifiedAt", "verifiedEventId"].includes(key))
+        || !["requested-unverified", "probe-issued", "verified-effective"].includes(capability.status)
+        || typeof capability.requestedAt !== "string" || !Number.isFinite(Date.parse(capability.requestedAt)))
+        return null;
+    if (capability.status === "probe-issued" && (!capability.probeNonce || !NONCE.test(capability.probeNonce)))
+        return null;
+    if (capability.status === "verified-effective" && (!capability.verifiedAt || !Number.isFinite(Date.parse(capability.verifiedAt))))
+        return null;
+    return capability;
+}
+export function documentCommentCapability(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const capabilities = value.capabilities;
+    const capability = capabilities?.documentCommentEvent;
+    if (!capabilities || typeof capabilities !== "object" || Array.isArray(capabilities) || Object.getPrototypeOf(capabilities) !== Object.prototype
+        || !capability || typeof capability !== "object" || Array.isArray(capability) || Object.getPrototypeOf(capability) !== Object.prototype
+        || Object.keys(capability).some((key) => !["status", "event", "scope", "requestedAt"].includes(key))
+        || capability.status !== "requested-unverified"
+        || capability.event !== "drive.notice.comment_add_v1"
+        || capability.scope !== "drive:drive"
+        || typeof capability.requestedAt !== "string" || !Number.isFinite(Date.parse(capability.requestedAt)))
+        return null;
+    return capability;
+}
+export function documentCommentReplyCapability(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const capabilities = value.capabilities;
+    const capability = capabilities?.documentCommentReply;
+    if (!capabilities || typeof capabilities !== "object" || Array.isArray(capabilities) || Object.getPrototypeOf(capabilities) !== Object.prototype
+        || !capability || typeof capability !== "object" || Array.isArray(capability) || Object.getPrototypeOf(capability) !== Object.prototype
+        || Object.keys(capability).some((key) => !["status", "scope", "requestedAt"].includes(key))
+        || capability.status !== "requested-unverified"
+        || capability.scope !== "docs:document.comment:create"
+        || typeof capability.requestedAt !== "string" || !Number.isFinite(Date.parse(capability.requestedAt)))
+        return null;
+    return capability;
+}
+export function documentCommentSubscriptionCapability(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const capabilities = value.capabilities;
+    const capability = capabilities?.documentCommentSubscription;
+    if (!capabilities || typeof capabilities !== "object" || Array.isArray(capabilities) || Object.getPrototypeOf(capabilities) !== Object.prototype
+        || !capability || typeof capability !== "object" || Array.isArray(capability) || Object.getPrototypeOf(capability) !== Object.prototype)
+        return null;
+    const keys = Object.keys(capability);
+    if (capability.mode === "none" && capability.status === "safe-default" && capability.source === "setup-default") {
+        return keys.length === 4 && keys.every((key) => ["mode", "status", "source", "updatedAt"].includes(key))
+            && typeof capability.updatedAt === "string" && Number.isFinite(Date.parse(capability.updatedAt)) ? capability : null;
+    }
+    if (capability.mode === "none" && capability.status === "requested-unverified" && capability.source === "setup-opt-in") {
+        return keys.length === 5 && keys.every((key) => ["mode", "status", "source", "dimension", "requestedAt"].includes(key))
+            && capability.dimension === "application"
+            && typeof capability.requestedAt === "string" && Number.isFinite(Date.parse(capability.requestedAt)) ? capability : null;
+    }
+    if (capability.mode === "subscribed" && capability.status === "platform-verified" && capability.source === "platform-status") {
+        return keys.length === 6 && keys.every((key) => ["mode", "status", "source", "dimension", "requestedAt", "verifiedAt"].includes(key))
+            && capability.dimension === "application"
+            && typeof capability.requestedAt === "string" && Number.isFinite(Date.parse(capability.requestedAt))
+            && typeof capability.verifiedAt === "string" && Number.isFinite(Date.parse(capability.verifiedAt)) ? capability : null;
+    }
+    return null;
+}
+export function effectiveDocumentCommentSubscription(value) {
+    const capability = documentCommentSubscriptionCapability(value);
+    if (!capability)
+        return { mode: "none", status: "safe-default", source: "legacy-default", dimension: null };
+    return {
+        mode: capability.mode,
+        status: capability.status,
+        source: capability.source,
+        dimension: "dimension" in capability ? capability.dimension : null,
+    };
+}
+export function readDocumentCommentSubscription(configDir, appId) {
+    return effectiveDocumentCommentSubscription(readCredential(credentialFile(configDir, appId)));
+}
+export function readDocumentCommentCapability(configDir, appId) {
+    return documentCommentCapability(readCredential(credentialFile(configDir, appId)));
+}
+export function readDocumentCommentReplyCapability(configDir, appId) {
+    return documentCommentReplyCapability(readCredential(credentialFile(configDir, appId)));
+}
+export function markDocumentCommentSubscriptionVerified(configDir, appId, dimension, now = Date.now()) {
+    const file = credentialFile(configDir, appId);
+    const credential = readCredential(file);
+    const prior = documentCommentSubscriptionCapability(credential);
+    if (!prior || prior.status !== "requested-unverified" || prior.dimension !== dimension) {
+        throw new Error("document comment subscription was not explicitly requested for this dimension");
+    }
+    const capability = {
+        mode: "subscribed",
+        status: "platform-verified",
+        source: "platform-status",
+        dimension,
+        requestedAt: prior.requestedAt,
+        verifiedAt: new Date(now).toISOString(),
+    };
+    credential.capabilities = { ...(credential.capabilities || {}), documentCommentSubscription: capability };
+    writeCredential(file, credential);
+    return capability;
+}
+export function readCallbackCapability(configDir, appId) {
+    return callbackCapability(readCredential(credentialFile(configDir, appId)));
+}
+export function markCallbackRequested(configDir, appId, now = Date.now()) {
+    const file = credentialFile(configDir, appId);
+    const credential = readCredential(file);
+    const prior = callbackCapability(credential);
+    const capability = {
+        status: "requested-unverified",
+        requestedAt: prior?.requestedAt || new Date(now).toISOString(),
+    };
+    credential.capabilities = { ...(credential.capabilities || {}), cardActionCallback: capability };
+    writeCredential(file, credential);
+    return capability;
+}
+export function markSetupCapabilitiesRequested(configDir, appId, now = Date.now(), commentSubscription) {
+    const file = credentialFile(configDir, appId);
+    const credential = readCredential(file);
+    const priorCallback = callbackCapability(credential);
+    const priorComment = documentCommentCapability(credential);
+    const priorReply = documentCommentReplyCapability(credential);
+    const priorSubscription = documentCommentSubscriptionCapability(credential);
+    const requestedAt = new Date(now).toISOString();
+    const cardActionCallback = {
+        status: "requested-unverified",
+        requestedAt: priorCallback?.requestedAt || requestedAt,
+    };
+    const documentCommentEvent = {
+        status: "requested-unverified",
+        event: "drive.notice.comment_add_v1",
+        scope: "drive:drive",
+        requestedAt: priorComment?.requestedAt || requestedAt,
+    };
+    const documentCommentReply = {
+        status: "requested-unverified",
+        scope: "docs:document.comment:create",
+        requestedAt: priorReply?.requestedAt || requestedAt,
+    };
+    const documentCommentSubscription = commentSubscription === "application"
+        ? {
+            mode: "none",
+            status: "requested-unverified",
+            source: "setup-opt-in",
+            dimension: commentSubscription,
+            requestedAt: requestedAt,
+        }
+        : commentSubscription === "none" || !priorSubscription
+            ? { mode: "none", status: "safe-default", source: "setup-default", updatedAt: requestedAt }
+            : priorSubscription;
+    credential.capabilities = { ...(credential.capabilities || {}), cardActionCallback, documentCommentEvent, documentCommentReply, documentCommentSubscription };
+    writeCredential(file, credential);
+    return { cardActionCallback, documentCommentEvent, documentCommentReply, documentCommentSubscription };
+}
+export function issueCallbackProbe(configDir, appId, now = Date.now(), random = randomUUID) {
+    const file = credentialFile(configDir, appId);
+    const credential = readCredential(file);
+    const prior = callbackCapability(credential);
+    if (!prior)
+        throw new Error("card.action.trigger was not requested by setup; rerun larkin setup first");
+    if (prior.status === "verified-effective")
+        return { nonce: "", capability: prior };
+    const nonce = random().replaceAll("-", "").slice(0, 32);
+    if (!NONCE.test(nonce))
+        throw new Error("callback probe nonce generator returned an invalid value");
+    const capability = {
+        status: "probe-issued",
+        requestedAt: prior.requestedAt,
+        probeNonce: nonce,
+        probeIssuedAt: new Date(now).toISOString(),
+    };
+    credential.capabilities = { ...(credential.capabilities || {}), cardActionCallback: capability };
+    writeCredential(file, credential);
+    return { nonce, capability };
+}
+export function verifyCallbackProbe(configDir, appId, nonce, eventId, now = Date.now()) {
+    if (!NONCE.test(nonce) || !eventId)
+        return false;
+    const file = credentialFile(configDir, appId);
+    const credential = readCredential(file);
+    const prior = callbackCapability(credential);
+    if (!prior || prior.status !== "probe-issued" || prior.probeNonce !== nonce)
+        return false;
+    credential.capabilities = {
+        ...(credential.capabilities || {}),
+        cardActionCallback: {
+            status: "verified-effective",
+            requestedAt: prior.requestedAt,
+            verifiedAt: new Date(now).toISOString(),
+            verifiedEventId: eventId,
+        },
+    };
+    writeCredential(file, credential);
+    return true;
+}

package/dist/platform/check-bun-version.cjs

@@ -0,0 +1,12 @@
+"use strict";
+const REQUIRED = "1.3.14";
+function supported(version) {
+    return String(version || "") === REQUIRED;
+}
+function assertSupportedBun(version = globalThis.Bun?.version) {
+    if (supported(version))
+        return;
+    throw new Error(`Larkin requires Bun ${REQUIRED} (current: ${version || "unknown"}). Install the pinned toolchain from packageManager before running Larkin.`);
+}
+assertSupportedBun();
+module.exports = { REQUIRED, supported, assertSupportedBun };