n8n-nodes-dingtalk-card 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.7.0 (stable)
+
+Promotes the production-validated v0.7.0-beta.1 Event Handling & Reliability behavior without runtime changes. Connected-instance acceptance covered Create & Deliver, Trigger deactivation/reactivation, a real callback after reactivation, normalized event correlation, and card Update. Exact-message duplicate suppression remains validated by deterministic tests; live duplicate redelivery was not forced. The npm `beta` channel remains on `0.7.0-beta.1`. See [release verification](docs/VERIFICATION.md).
+
+## 0.7.0-beta.1 (published prerelease)
+
+- Suppress duplicate Stream callbacks by `messageId` within one active Trigger lifecycle; duplicates still receive the immediate receipt ACK. Cache is bounded (10,000 entries), TTL-based (10 minutes), and explicitly not durable exactly-once across restart or instances.
+- Preserve the existing native WebSocket reconnect/backoff and shutdown lifecycle; no competing SDK/transport was introduced.
+- Normalize outbound error operation, phase, attempts, ambiguity and correlation fields. Only explicit invalid-token rejection is automatically retried for writes; network/timeout/5xx outcomes remain ambiguous and non-retryable, preventing blind Create replay.
+- Published to npm under `beta`; `latest` remains on stable `0.6.0`. Release evidence, provenance, and canonical tarball identity are recorded in [verification](docs/VERIFICATION.md#v070-beta1-public-prerelease--2026-10-25).
+
 ## 0.6.0 (stable)
 
 Promotes the production-accepted v0.6.0-beta.3 A2UI callback params normalization without runtime changes. Connected-instance acceptance passed for delivery, callback normalization, and the original card A2UI Update. The npm `beta` channel remains on `0.6.0-beta.3`.

package/README.md

@@ -2,13 +2,13 @@
 
 Focused n8n community nodes for the **DingTalk Card Platform lifecycle and Stream card callbacks**.
 
-**v0.6.0 is the stable release.** It promotes the production-accepted v0.6.0-beta.3 A2UI action callback params normalization without runtime changes. Connected-instance acceptance covered card delivery, the real callback, normalized params, and a successful A2UI Update. This does not certify v1.0 or untested platform/runtime behavior. This project is not n8n-verified and is not affiliated with DingTalk or n8n. See [release verification](docs/VERIFICATION.md).
+**v0.7.0 is the stable release.** It promotes the production-validated v0.7.0-beta.1 Event Handling & Reliability behavior without runtime changes. Connected-instance acceptance covered Create & Deliver, Trigger deactivation/reactivation, a real callback after reactivation, normalized event correlation, and card Update. Exact-message duplicate suppression is covered by deterministic tests; live duplicate redelivery was not forced. This does not certify v1.0 or untested platform/runtime behavior. This project is not n8n-verified and is not affiliated with DingTalk or n8n. See [release verification](docs/VERIFICATION.md).
 
 The published **v0.4.0-beta.2** established the functional baseline for stable v0.4.0. A true Presentation-mode status card rendered correctly in Mac DingTalk without workflow-supplied `flowStatus` or a JSON request body; the final live Create & Deliver regression passed for alert, status, digest, action, and report. The package ships no DingTalk templates. See the [presentation contract](docs/PRESENTATION.md) and [release verification](docs/VERIFICATION.md).
 
 The published **v0.5.0-beta.1** remains available on the beta channel and is the functional baseline for stable v0.5.0. Its optional normalized Trigger envelope passed production acceptance for one real request-button/action-callback path, with existing downstream expressions continuing to work. Form and Selection remain unverified and deferred. See [release verification](docs/VERIFICATION.md#v050-beta1-production-acceptance--2026-10-25).
 
-The npm `latest` dist-tag resolves to `0.6.0`; `beta` remains on `0.6.0-beta.3`. Releases use GitHub Actions Trusted Publisher/OIDC with provenance. Beta publication leaves `latest` unchanged now that a stable version exists.
+The npm `latest` dist-tag resolves to `0.7.0`; `beta` remains on `0.7.0-beta.1`. Releases use GitHub Actions Trusted Publisher/OIDC with provenance. Beta publication leaves `latest` unchanged now that a stable version exists.
 
 It provides **DingTalk Card**, **DingTalk Card Trigger**, and the shared **DingTalk Card API** enterprise app credential. It does not implement OA, todo, tables or general robot messaging, and does not depend on `@cryozerolabs/n8n-nodes-dingtalk`. Robot delivery fields here exist only to deliver Card Platform instances.
 
@@ -57,13 +57,13 @@ For a reusable stable-ID Create & Deliver node recipe and success/error branch c
 
 DingTalk requires **one Stream service per Client ID** for card callbacks. The module-local lock rejects a second active Card Trigger with the same Client ID in this n8n process, including a manual listener competing with an active workflow. It cannot detect another n8n process, worker, replica, package copy or external Stream service. Use separate Client IDs for development and production, and a single listener service for each. See [DingTalk’s callback troubleshooting](https://github.com/open-dingtalk/dingtalk-card-examples#注意事项).
 
-The trigger subscribes **only** to `CALLBACK /v1.0/card/instances/callback`. It immediately queues `200 / OK` with empty JSON-object data (`"{}"`) **before** emitting one item; it never waits for downstream nodes. This avoids delaying acknowledgement toward the reported ~60-second card retry window. Downstream updates are asynchronous. **No synchronous local-update ACK support in this beta.** An ACK is receipt acknowledgement, not proof of downstream success. Network retries/duplicate deliveries remain possible; make business actions idempotent. There is no persistent deduplication or replay queue; an acknowledged event can be lost if the workflow subsequently fails.
+The trigger subscribes **only** to `CALLBACK /v1.0/card/instances/callback`. It immediately queues `200 / OK` with empty JSON-object data (`"{}"`) **before** emitting one item; it never waits for downstream nodes. Duplicate `messageId` callbacks in the same active Trigger lifecycle are ACKed and ignored after the first emission. The cache is process-local, bounded to 10,000 IDs and expires entries after 10 minutes; eviction can also allow an earlier ID to emit again. This is not durable exactly-once delivery across restart, multiple processes or instances. An ACK is receipt acknowledgement, not proof of downstream success; acknowledged work may be lost if workflow processing subsequently fails. Make consequential business actions idempotent in n8n.
 
 Items include `type`, `specVersion`, `headers`, `topic`, `messageId`, ISO `receivedAt`, parsed `data`, and unchanged `rawData`. JSON `content` is exposed if it is an object; `cardPrivateData`, `params` (including `content.cardPrivateData.params`), and supplied `outTrackId`, `userId`, `userIdType`, `openId`, `unionId`, `operatorId`, `operatorUserId` retain source names/values. Missing optional fields stay absent; no identifier types are inferred. Invalid data JSON still receives an ACK and is emitted as a raw string. Invalid outer envelopes, missing message IDs and other topics are ignored. Callback payloads can contain private form/user data: control execution-data access and retention.
 
 The trigger adds a versioned `normalized` object while retaining all existing top-level fields; existing workflows need no migration. Raw callback serialization remains enabled by default and can be omitted with **Include Raw Callback Data**. This reduces duplicate raw serialization but does not remove sensitive callback content. See [the v1 interaction contract](docs/INTERACTIONS.md). Only the existing request-button/action callback path is live-verified; form and selection inputs remain deferred.
 
-The self-contained transport deliberately avoids the upstream `dingtalk-stream` SDK following verified ticket-bearing URL logging risk on SDK error paths. It uses Node 24+ native WebSocket, n8n’s HTTP helper, validated `wss:` endpoints and `URL.searchParams`; no SDK copy, runtime dependency or global console patch. Gateway bodies, tickets, secrets, URLs and original connection errors never enter its diagnostics. It answers SYSTEM ping with the supplied opaque value, reconnects on SYSTEM disconnect/unexpected close/errors, and watches opening (30s) and idle connections (120s). Reconnect delays are bounded at 1, 2, 4, 8, 16, 30 seconds, then 30 seconds until traffic resumes; each attempt gets a fresh ticket. Lookup/connect failures log generic diagnostics and retry while the workflow stays active. Deactivation aborts gateway lookup, closes pending/active sockets, cancels timers and releases the local lock.
+The self-contained transport deliberately avoids the upstream `dingtalk-stream` SDK following verified ticket-bearing URL logging risk on SDK error paths. It uses Node 24+ native WebSocket, n8n’s HTTP helper, validated `wss:` endpoints and `URL.searchParams`; no SDK copy, runtime dependency or global console patch. Gateway bodies, tickets, secrets, URLs and original connection errors never enter its diagnostics. It answers SYSTEM ping with the supplied opaque value, reconnects on SYSTEM disconnect/unexpected close/errors, and watches opening (30s) and idle connections (120s). Reconnect delays are bounded at 1, 2, 4, 8, 16, 30 seconds, then 30 seconds until traffic resumes; each attempt gets a fresh ticket. This is the existing transport reconnect policy, not SDK-managed reconnect. Lookup/connect failures log generic diagnostics and retry while the workflow stays active. Deactivation aborts gateway lookup, closes pending/active sockets, cancels timers and releases the local lock.
 
 The real button callback E2E on 2026-10-24 used the same enterprise-app Client ID for creation and listening. DingTalk Card Trigger activated successfully, and a request-button card with `callbackType=STREAM` was delivered. One real button click produced a `CALLBACK /v1.0/card/instances/callback` trigger execution; normalized `params` contained the expected button id/text. Downstream asynchronous Update returned success, the card visibly changed, and execution completed successfully. This validates the tested button path and immediate receipt ACK transport with asynchronous downstream execution in practice. It does not certify every template, form submission, reconnect or failure mode; synchronous local-update ACKs remain unsupported.
 
@@ -93,7 +93,7 @@ The corresponding [API payload](examples/error-notification.payload.json) is usa
 
 - Credentials belong exclusively in n8n's encrypted credential store. Do not commit `.env` files, tokens, exported credentials or private destination IDs.
 - Requests use a fixed HTTPS origin, a 30-second timeout and disabled redirects. This package has no runtime dependencies beyond the n8n peer API. It never logs request/response credentials.
-- A recognized explicit invalid/expired-token API rejection refreshes auth and retries once with the **same payload/identifiers**. There are no other automatic write retries. If `errorDetails.mayHaveSucceeded` is true, inspect/verify the card and delivery before any workflow/operator replay; use the same caller-controlled identifiers. A stable `outTrackId` still does not guarantee Create deduplication or upsert.
+- A recognized explicit invalid/expired-token API rejection refreshes auth and retries once with the **same payload/identifiers**. This is the only automatic write retry. Timeouts, network failures, HTTP 5xx, partial delivery, and incomplete write responses are non-retryable and may have an ambiguous outcome; in particular, a Create timeout can occur after card creation. `errorDetails` reports operation, phase, attempt count, `retryable`, `ambiguousOutcome`, and stable identifiers. Verify before any operator replay; reuse the same caller-controlled `outTrackId`. A stable `outTrackId` still does not guarantee Create deduplication or upsert.
 - n8n's own Retry On Fail reruns the node; an auto-generated `outTrackId` may change because it is stable only within one execution. Use an ID derived from a stable business/event key when replay correlation matters. Multiple items execute sequentially; partial success is possible before a later item fails.
 - Card content is sent to DingTalk and successful raw responses are retained in n8n execution data. Apply suitable execution-data retention and access controls.
 
@@ -109,7 +109,7 @@ npm run verify:package
 npm audit --omit=dev --audit-level=high
 ```
 
-Uses the official [n8n node CLI](https://docs.n8n.io/connect/create-nodes/build-your-node/using-the-n8n-node-tool.md) and current starter conventions, established in place without example nodes. The CLI is pinned to **0.54.2 beta** because the registry's stable 0.53.4 pins vulnerable Handlebars 4.7.9; the beta includes the patched upstream dependency without overrides. No CLI release script is provided: `n8n-node release` would publish to npm, which this beta process must not do. Tests use Node's built-in runner, mocked HTTP/sockets and real local TLS WebSocket fixtures (OpenSSL is required for tests). No live credentials are needed.
+Uses the official [n8n node CLI](https://docs.n8n.io/connect/create-nodes/build-your-node/using-the-n8n-node-tool.md) and current starter conventions, established in place without example nodes. The CLI is pinned to **0.54.2 beta** because the registry's stable 0.53.4 pins vulnerable Handlebars 4.7.9; the beta includes the patched upstream dependency without overrides. Releases use the repository's Trusted Publisher workflow; `n8n-node release` is not used. Tests use Node's built-in runner, mocked HTTP/sockets and real local TLS WebSocket fixtures (OpenSSL is required for tests). No live credentials are needed.
 
 Programmatic execution is intentional: shared token handling, strict 2xx/partial-delivery failure checks, generated identifier propagation and sanitized item-level errors are implemented once, separated from pure payload builders. The current custom credential-test context in `n8n-workflow` exposes only the legacy `request` helper; that single call has a documented lint exception and sanitized error boundary. Main execution uses `httpRequest`. Pure helper errors are converted to `NodeOperationError` at the execution boundary.
 

package/dist/nodes/DingTalkCard/DingTalkCard.node.js

@@ -310,7 +310,7 @@ class DingTalkCard {
         };
     }
     async execute() {
-        var _a;
+        var _a, _b, _c;
         const items = this.getInputData();
         const output = [];
         const credential = await this.getCredentials('dingTalkCardApi');
@@ -386,6 +386,7 @@ class DingTalkCard {
                         outTrackId: body.outTrackId,
                         ...(body.guid ? { guid: body.guid } : {}),
                         success: true,
+                        correlation: { outTrackId: body.outTrackId, ...(body.guid ? { guid: body.guid } : {}) },
                         raw: raw,
                     },
                     pairedItem: { item: i },
@@ -401,12 +402,20 @@ class DingTalkCard {
                         retryable: cardError.retryable,
                         mayHaveSucceeded: cardError.mayHaveSucceeded,
                         ...(cardError.httpStatus === undefined ? {} : { httpStatus: cardError.httpStatus }),
+                        operation,
+                        phase: (_b = cardError.phase) !== null && _b !== void 0 ? _b : 'request',
+                        attemptCount: cardError.attemptCount,
+                        ambiguousOutcome: cardError.ambiguousOutcome,
                     }
                     : {
                         code: 'DINGTALK_ERROR',
                         category: 'internal',
                         retryable: false,
                         mayHaveSucceeded: false,
+                        operation,
+                        phase: 'validation',
+                        attemptCount: 0,
+                        ambiguousOutcome: false,
                     };
                 const outTrackId = typeof body.outTrackId === 'string' ? body.outTrackId : '';
                 if (this.continueOnFail()) {
@@ -415,6 +424,7 @@ class DingTalkCard {
                             operation,
                             outTrackId,
                             ...(body.guid ? { guid: body.guid } : {}),
+                            correlation: { outTrackId, ...(body.guid ? { guid: body.guid } : {}) },
                             success: false,
                             error: message,
                             errorDetails,
@@ -425,9 +435,9 @@ class DingTalkCard {
                 else
                     throw new n8n_workflow_1.NodeOperationError(this.getNode(), message, {
                         itemIndex: i,
-                        description: `Operation: ${operation}. Error code: ${errorDetails.code}. Category: ${errorDetails.category}. Retryable: ${errorDetails.retryable}. May have succeeded: ${errorDetails.mayHaveSucceeded}.${errorDetails.httpStatus === undefined
+                        description: `Operation: ${operation}. Phase: ${(_c = errorDetails.phase) !== null && _c !== void 0 ? _c : 'request'}. Attempt count: ${errorDetails.attemptCount}. Error code: ${errorDetails.code}. Category: ${errorDetails.category}. Retryable: ${errorDetails.retryable}. Ambiguous outcome: ${errorDetails.ambiguousOutcome}. May have succeeded: ${errorDetails.mayHaveSucceeded}.${errorDetails.httpStatus === undefined
                             ? ''
-                            : ` HTTP status: ${errorDetails.httpStatus}.`} Out Track ID: ${outTrackId || '(not assigned)'}. Preserve this identifier when investigating partial delivery.`,
+                            : ` HTTP status: ${errorDetails.httpStatus}.`} Out Track ID: ${outTrackId || '(not assigned)'}.${body.guid ? ` GUID: ${String(body.guid)}.` : ''} Preserve these identifiers when investigating partial delivery.`,
                     });
             }
         }

package/dist/nodes/DingTalkCard/transport.js

@@ -23,13 +23,17 @@ function validHttpStatus(value) {
 }
 class CardError extends Error {
     constructor(message, code = 'DINGTALK_ERROR', metadata = {}) {
-        var _a, _b, _c;
+        var _a, _b, _c, _d;
         super(message);
         this.code = safeCode(code);
         this.category = (_a = metadata.category) !== null && _a !== void 0 ? _a : 'validation';
         this.retryable = (_b = metadata.retryable) !== null && _b !== void 0 ? _b : false;
         this.mayHaveSucceeded = (_c = metadata.mayHaveSucceeded) !== null && _c !== void 0 ? _c : false;
         this.httpStatus = validHttpStatus(metadata.httpStatus);
+        this.operation = typeof metadata.operation === 'string' ? metadata.operation : undefined;
+        this.phase = typeof metadata.phase === 'string' ? metadata.phase : undefined;
+        this.attemptCount = typeof metadata.attemptCount === 'number' ? metadata.attemptCount : 1;
+        this.ambiguousOutcome = (_d = metadata.ambiguousOutcome) !== null && _d !== void 0 ? _d : this.mayHaveSucceeded;
     }
 }
 exports.CardError = CardError;
@@ -129,11 +133,9 @@ async function send(request, options) {
             : 'network/timeout failure';
         throw new CardError(`DingTalk ${label} (${code}). Check connectivity, app credentials, API permissions and payload. ${tokenRequest ? 'Token acquisition failed before the card write.' : 'A write may have succeeded; verify before retrying.'}`, code, {
             category,
-            retryable: (!tokenRequest && invalidToken) ||
-                (tokenRequest &&
-                    !invalidToken &&
-                    (status === undefined || status === 408 || status === 429 || status >= 500)),
+            retryable: (!tokenRequest && invalidToken) || (tokenRequest && !invalidToken && (status === undefined || status === 408 || status === 429 || status >= 500)),
             mayHaveSucceeded: !tokenRequest && !invalidToken && !authenticationStatus,
+            ambiguousOutcome: !tokenRequest && !invalidToken && !authenticationStatus,
             httpStatus: status,
         });
     }
@@ -190,8 +192,25 @@ function createClient(request, appKey, appSecret, now = Date.now) {
         }
     }
     const call = async (method, path, body) => {
+        const operation = path.endsWith('/createAndDeliver')
+            ? 'createAndDeliver'
+            : path.endsWith('/streaming')
+                ? (body.isFinalize === true ? 'finalize' : 'stream')
+                : 'update';
         for (let attempt = 0;; attempt++) {
-            const auth = await token();
+            let auth;
+            try {
+                auth = await token();
+            }
+            catch (error) {
+                if (error instanceof CardError)
+                    throw new CardError(error.message, error.code, {
+                        category: error.category, retryable: error.retryable, mayHaveSucceeded: false,
+                        httpStatus: error.httpStatus, operation,
+                        phase: 'token', attemptCount: 1, ambiguousOutcome: false,
+                    });
+                throw error;
+            }
             try {
                 const response = checkBusinessResponse(await send(request, {
                     method,
@@ -216,6 +235,13 @@ function createClient(request, appKey, appSecret, now = Date.now) {
                         tokens.delete(cacheKey);
                     continue;
                 }
+                if (error instanceof CardError) {
+                    throw new CardError(error.message, error.code, {
+                        category: error.category, retryable: error.retryable, mayHaveSucceeded: error.mayHaveSucceeded,
+                        httpStatus: error.httpStatus, operation,
+                        phase: 'write', attemptCount: attempt + 1, ambiguousOutcome: error.ambiguousOutcome,
+                    });
+                }
                 throw error;
             }
         }

package/dist/nodes/DingTalkCardTrigger/stream.js

@@ -6,6 +6,8 @@ exports.createCardStream = createCardStream;
 const transport_1 = require("../DingTalkCard/transport");
 exports.CARD_TOPIC = '/v1.0/card/instances/callback';
 const activeClients = new Set();
+const DEDUPE_TTL_MS = 10 * 60 * 1000;
+const DEDUPE_MAX_ENTRIES = 10000;
 function parse(value) {
     if (typeof value !== 'string')
         return value;
@@ -115,7 +117,7 @@ function normalizeCallback(frame, receivedAt = new Date().toISOString(), include
     return result;
 }
 function createCardStream(clientId, clientSecret, deps) {
-    var _a, _b;
+    var _a, _b, _c;
     if (!clientId || !clientSecret)
         throw new transport_1.CardError('Configure Client ID and Client Secret in the DingTalk Card API credential.');
     if (activeClients.has(clientId))
@@ -130,6 +132,22 @@ function createCardStream(clientId, clientSecret, deps) {
     let reconnect;
     let watchdog;
     let attempts = 0;
+    const seenMessages = new Map();
+    const now = (_c = deps.now) !== null && _c !== void 0 ? _c : Date.now;
+    function duplicate(messageId) {
+        const time = now();
+        for (const [id, expiresAt] of seenMessages) {
+            if (expiresAt > time)
+                break;
+            seenMessages.delete(id);
+        }
+        if (seenMessages.has(messageId))
+            return true;
+        while (seenMessages.size >= DEDUPE_MAX_ENTRIES)
+            seenMessages.delete(seenMessages.keys().next().value);
+        seenMessages.set(messageId, time + DEDUPE_TTL_MS);
+        return false;
+    }
     function clearWatchdog() {
         if (watchdog !== undefined)
             clearTimer(watchdog);
@@ -242,6 +260,8 @@ function createCardStream(clientId, clientSecret, deps) {
                     else if (frame.type === 'CALLBACK' && topic === exports.CARD_TOPIC) {
                         acknowledge(current, messageId, {});
                         attempts = 0;
+                        if (duplicate(messageId))
+                            return;
                         deps.emit(normalizeCallback(frame, new Date().toISOString(), deps.includeRawData !== false));
                     }
                 }

package/docs/DESIGN.md

@@ -39,6 +39,12 @@ Each layer owns a distinct responsibility:
 6. **Reusable automation patterns:** provide workflow-layer examples and assets that users can adapt without coupling the generic plugin to one owner's business systems.
 7. **Verifiable claims:** specific platform features, templates, callback behaviors, and compatibility claims require current documentation and suitable acceptance evidence.
 
+## Event and write reliability boundary
+
+The Stream Trigger acknowledges valid callbacks promptly and suppresses repeated `messageId` values only within its active process lifecycle using bounded TTL memory. This reduces duplicate executions but is not durable exactly-once delivery; restart, eviction, another process/instance, and downstream failure remain outside that guarantee. Workflows own durable business idempotency and state.
+
+The existing native WebSocket transport owns reconnect, backoff, and deactivation. Outbound calls have bounded timeouts. The card client retries a write only after an explicit invalid-token rejection, preserving its payload and identifiers. A timeout or other uncertain write result is reported as potentially ambiguous and is never automatically replayed; `outTrackId` is a correlation key, not a Create deduplication/upsert contract.
+
 ## Controlled presentation and action contract
 
 The high-level contract is a versioned descriptor, not arbitrary UI. Validation must be deterministic and reject unknown versions, unknown fields where unsafe, unapproved components, and actions outside the allowlist. Rendering must use only verified template/component mappings and safe primitives. Invalid input needs a documented safe failure/fallback. Inputs and resulting actions should remain auditable and bounded by the contract.

package/docs/ROADMAP.md

@@ -2,9 +2,9 @@
 
 This roadmap is subordinate to the project's [design baseline](DESIGN.md), which governs architecture, scope, non-goals, and acceptance boundaries. Roadmap items may sequence work within those boundaries but cannot override them; resolve conflicts by updating the proposal to fit the baseline or deliberately revising the baseline first.
 
-This roadmap starts from the published **v0.4.0** stable state. It describes intended milestones, not released capabilities. The current release and its tested limits remain documented in the [README](../README.md), [API contracts](API.md), and [verification record](VERIFICATION.md). Dates are omitted; milestones are semantic versions, not calendar commitments.
+This roadmap records the v0.4.0 onward milestones, including later releases documented below. It describes intended milestones, not released capabilities. The current release and its tested limits remain documented in the [README](../README.md), [API contracts](API.md), and [verification record](VERIFICATION.md). Dates are omitted; milestones are semantic versions, not calendar commitments.
 
-The repository candidate version is **0.6.0-beta.1**. npm `latest` remains `0.5.0`; this candidate has not been published. The v0.4.0 Presentation Contract & Template Kit is implemented and production acceptance is complete. v0.5.0 promotes the beta.1 baseline without runtime changes. Its production acceptance covers only the request-button/action-callback path; Form and Selection remain unverified and deferred. See [verification](VERIFICATION.md).
+v0.7.0 is the current stable release; beta.1 production and publication evidence is in the [verification record](VERIFICATION.md). v0.6.0 and earlier milestones remain documented below. The v0.4.0 Presentation Contract & Template Kit is implemented and production acceptance is complete. v0.5.0 promotes its beta.1 baseline without runtime changes. Its production acceptance covers only the request-button/action-callback path; Form and Selection remain unverified and deferred. See [verification](VERIFICATION.md).
 
 ## Vision and product principle
 
@@ -103,23 +103,22 @@ The beta.1 implementation is specified in [INTERACTIONS.md](INTERACTIONS.md), wi
 
 **Compatibility and migration:** Additive `a2ui` Card Data Mode for Create & Deliver and Update. Preserve Form/JSON/Presentation behavior and the low-level raw JSON expert path. Update does not enable callbacks.
 
-### v0.7.0 — n8n Action & Workflow Kit
+### v0.7.0 — Event Handling & Reliability (stable release)
 
-**Objective:** Make common card-to-automation loops reusable while keeping business logic in n8n.
+**Objective:** Make callback handling, reconnect lifecycle, outbound retry decisions, timeouts, and correlation predictable while keeping business logic in n8n.
 
 **Main deliverables:**
 
-- Reusable example/subworkflow contracts for Notification Hub, Report Hub, and Action Router.
-- Action classes: **Direct** (deterministic, no LLM), **Parameterized** (collect/validate needed inputs), and **Intelligent** (optional ChatGPT Worker).
-- Standard `outTrackId`, correlation, idempotency, and state model; acknowledgement, retry, refresh, run, ignore, and open patterns.
-- Explicit confirmation and authorization patterns for destructive actions.
-- Documented paths from callback to deterministic subworkflow or optional AI worker.
+- Bounded process-local callback duplicate suppression keyed by DingTalk `messageId`.
+- Predictable Stream reconnect/deactivation lifecycle using the existing native WebSocket transport.
+- Bounded external request timeouts and sanitized operation/phase/retry/ambiguity/correlation error details.
+- Automatic retry only for an explicit invalid-token write rejection; ambiguous writes, including Create timeouts, are never retried by the node.
 
-**Acceptance gates:** Examples make deterministic routing the default, show bounded retry and duplicate/replay handling, and avoid blind Create replay. Destructive examples require explicit confirmation/authorization. Keep the kit portable as reusable n8n assets/examples.
+**Acceptance gates:** Unit coverage for duplicate ACK/emit, TTL and bounded eviction, reconnect lifecycle, retry safety, timeout/error shape and correlation passed. Connected-instance validation passed for Create & Deliver, Trigger deactivation/reactivation, a real callback after reactivation, normalized correlation, and card Update. Exact-message duplicate suppression is unit-tested; live duplicate redelivery was not forced.
 
-**Non-goals / deferrals:** Do not hard-code business automation into the node. The kit does not claim delivery guarantees beyond the underlying node/platform behavior, and does not require ChatGPT for Direct actions.
+**Non-goals / deferrals:** No durable or distributed exactly-once guarantee, no persistent deduplication store, and no hard-coded business automation. Workflows own durable business idempotency.
 
-**Compatibility and migration:** Track state and idempotency explicitly in the workflow layer; do not imply the current plugin has a persistent deduplication store. Existing node identifiers and fields remain usable.
+**Compatibility and migration:** Additive event/result/error fields only. Dedupe is bounded in-process and expires; it is not durable exactly-once across restart or multiple instances. Existing node identifiers and fields remain usable.
 
 ### v0.8.0 — Automation Presentation Kit
 
@@ -136,7 +135,7 @@ The beta.1 implementation is specified in [INTERACTIONS.md](INTERACTIONS.md), wi
 
 **Non-goals / deferrals:** These are patterns and examples, not built-in external-service integrations or a generic content ingestion suite.
 
-**Compatibility and migration:** Build on the v0.4 presentation contract and v0.7 workflow kit. Keep existing raw JSON recipes available.
+**Compatibility and migration:** Build on the v0.4 presentation contract and v0.7 reliability primitives. Keep existing raw JSON recipes available.
 
 ### v0.9.0 — Production Hardening
 

package/docs/VERIFICATION.md

@@ -1,5 +1,23 @@
 # Release verification record — 2026-10-24
 
+## v0.7.0-beta.1 public prerelease — 2026-10-25
+
+The annotated tag `v0.7.0-beta.1` (tag object `2b0fafa12e406b8cd829c4851ac81d8d9f87b287`) points to release commit `d598fc289c871d46f183692ae91eaee9ce4901f7`. Main CI [40173686130](https://github.com/NTLx/n8n-nodes-dingtalk-card/actions/runs/40173686130) passed on that exact commit. The repository’s manually dispatched [Trusted Publisher/OIDC publish workflow](https://github.com/NTLx/n8n-nodes-dingtalk-card/actions/runs/40173797932), dispatched on the release tag, reran npm ci, lint, typecheck, build, all 74 tests, package verification, production audit and release-ref validation before publication; all steps passed. The stable publish step was skipped. The tag push did not produce a separate CI workflow run; the same commit passed main CI and the tag-based publish run repeated the complete CI quality gates.
+
+Public npm dist-tags are `beta -> 0.7.0-beta.1` and `latest -> 0.6.0`. Registry metadata reports `gitHead=d598fc289c871d46f183692ae91eaee9ce4901f7`, 34 files, unpacked size 257,412 bytes, tarball `https://registry.npmjs.org/n8n-nodes-dingtalk-card/-/n8n-nodes-dingtalk-card-0.7.0-beta.1.tgz`, SHA-1 `bfe29ec865425ae361c22348030848b85de3b371`, and integrity `sha512-rQFSeFGnwTC5b50nRBfKm3PcGxVQWBDVsCExImPBjiyaE6Pb1YRYwBT+N9d0PXlmqqlOJomw1XO2usjdeG67uQ==`. An isolated install verified 94 registry signatures and 6 attestations with `npm audit signatures`; no invalid or missing signatures were reported. The verified SLSA provenance subject SHA-512 is `ad01527851a7c130b96f9d274417ca9b73dc1b15505810d5b021312263c18e2c9a13a3dbd58458c014fe37d7743d7966aaa94e2689b0d573b6bac8dd786ebbb9`. Its predicate identifies `.github/workflows/publish.yml`, `refs/tags/v0.7.0-beta.1`, the release commit above, and publish run 40173797932 attempt 1. The transparency-log entry is [3454929240](https://search.sigstore.dev/?logIndex=3454929240).
+
+The [GitHub prerelease](https://github.com/NTLx/n8n-nodes-dingtalk-card/releases/tag/v0.7.0-beta.1) (release ID `423226951`) has `draft=false` and `prerelease=true`. Its sole canonical asset `n8n-nodes-dingtalk-card-0.7.0-beta.1.tgz` is byte-identical to the public npm tarball: 77,300 bytes, SHA-256 `8a3c6d92a297e60001e5c829251dd2637396fa5b999909af092bf4d9039f827a`, SHA-1 `bfe29ec865425ae361c22348030848b85de3b371`, and npm integrity as above. GitHub reports the matching SHA-256 asset digest. Use the exact package spec `n8n-nodes-dingtalk-card@0.7.0-beta.1` for connected-instance validation. No production n8n instance was changed for this release.
+
+## v0.7.0-beta.1 connected-instance acceptance — 2026-10-25
+
+The maintainer reports that beta.1 was installed in production n8n. Manual Create & Deliver execution **5702** succeeded and returned `correlation.outTrackId`. The workflow was deactivated and reactivated successfully on the same active package version. After reactivation, real Trigger callback execution **5703** succeeded with `normalized.interaction.params = {"gate":"event-reliability","source":"v0.7.0-beta.1"}` and `normalized.correlation = {"messageId":"be36c1a_1572_1a125150ef8_ee37cc","topic":"/v1.0/card/instances/callback"}`. The original card update succeeded with `correlation.outTrackId = "6d7b686c-848b-440c-84b9-87cb121ad97b"`; the temporary listener was then unpublished.
+
+The execution 5702/5703 data, workflow deactivation/reactivation state, normalized params/correlation, and update result were independently queried by the parent ChatGPT through the production n8n MCP on n8n-VPS. The screenshot was user-supplied client-side corroboration. This verifies Create & Deliver, Trigger deactivation/reactivation, a real callback after reactivation, normalized correlation, and the original card update on the connected instance. Exact-message duplicate suppression is covered by deterministic unit tests; live duplicate redelivery was not forced.
+
+## v0.7.0 stable release preparation — 2026-10-25
+
+Stable promotion changes package version metadata, release workflow/ref policy, and release-status documentation only. No runtime source, dependencies, or beta behavior changed. Package and lockfile versions are promoted together from `0.7.0-beta.1` to `0.7.0`; beta remains `0.7.0-beta.1` after stable publication. The connected-instance acceptance above completes the v0.7 stable gate for the tested path; duplicate redelivery remains covered only by deterministic tests.
+
 ## v0.6.0-beta.3 candidate: serialized A2UI action params normalization — 2026-10-25
 
 The production callback received on beta.2 exposed descriptor params as `cardPrivateData.params = {"params":"{\"source\":\"v0.6-beta.2\"}"}`, so workflows had to parse the nested string. Beta.3 changes only `normalized.interaction.params` for this exact one-key wrapper when its value parses as a JSON object. Local tests cover the observed shape, malformed JSON, JSON non-objects, additional wrapper keys, ordinary params, and preservation of top-level params and raw callback data. The change passed lint, typecheck, build, all 71 unit tests, packed-package standalone loading/registration (34 allowlisted files), and `git diff --check` at package version `0.6.0-beta.2`. No production n8n was changed. Live confirmation of the normalized result remains part of release validation.
@@ -24,6 +42,16 @@ Stable promotion preserves the beta.3 production-accepted runtime. Release-only
 
 On Node **26.12.1 / npm 12.2.1**, the release gates passed: clean `npm ci`; lint; typecheck; build; all **71 tests**; package verification with standalone packed class loading/registration (**34 allowlisted files**, 74,569 bytes); production audit (**0 vulnerabilities**); release-ref self-test and `0.6.0 -> latest` check; `npm pack --dry-run` inspection (**28 package entries**); and `git diff --check`. The first parallel test attempt raced the concurrent build and failed while `dist` was being rewritten; the complete test suite passed after the build completed. GitHub CI for the pushed release commit is required before tagging. The existing publish workflow repeats all gates and publishes the stable tag through npm Trusted Publisher/OIDC with provenance.
 
+## v0.6.0 stable public release — 2026-10-25
+
+Annotated tag `v0.6.0` (tag object `7c860a9997bbb895b96489402c5d906083ff2825`) points to release commit `de2c79496e0e2a699b312448eff0c4de9cca8ed6`. Main CI run [40171338211](https://github.com/NTLx/n8n-nodes-dingtalk-card/actions/runs/40171338211) and tag CI run [40171408700](https://github.com/NTLx/n8n-nodes-dingtalk-card/actions/runs/40171408700) passed. The existing Trusted Publisher/OIDC publish workflow run [40171484374](https://github.com/NTLx/n8n-nodes-dingtalk-card/actions/runs/40171484374), attempt 1, passed the repeated quality gates, tag/package check, stable npm publication, dist-tag verification and published metadata/tarball verification.
+
+Public npm dist-tags are `latest -> 0.6.0` and `beta -> 0.6.0-beta.3`. Registry metadata reports `gitHead=de2c79496e0e2a699b312448eff0c4de9cca8ed6`, 34 files, unpacked size 248,072 bytes, tarball SHA-1 `26dff4c3d9f6bce9718780c0fd9116bce81c7212`, and integrity `sha512-5ik4E4QdCVHnBp2DcSJgxHLPLqs7EZxY07QadtIIYVKJAc/90MBGHLaRFZWkQ468N4yFYj9fxQNH3GeUpLy3hw==`. An isolated install of this exact package passed `npm audit signatures` with no invalid or missing signatures/attestations; the command verified 94 registry signatures and 6 attestations across the install. The package SLSA provenance subject SHA-512 is `e6293813841d0951e7069d83712260c472cf2eab3b119c58d3b41a76d20861528901cffdd0c0461cb6911595a4438ebc378c85623f5fc50347dc6794a4bcb787`. Its verified predicate identifies `.github/workflows/publish.yml`, `refs/tags/v0.6.0`, release commit `de2c79496e0e2a699b312448eff0c4de9cca8ed6`, and publish run 40171484374 attempt 1; the transparency log entry is `3453987183`.
+
+The [GitHub stable release](https://github.com/NTLx/n8n-nodes-dingtalk-card/releases/tag/v0.6.0) (release ID `423205382`) is published with `draft=false` and `prerelease=false`. Its only asset, `n8n-nodes-dingtalk-card-0.6.0.tgz`, is byte-identical to the public npm tarball: 74,770 bytes, SHA-256 `6d20e4f788db3c4762f80852e52f9fbaa820c1f1e6173d43b72db4563d176a11`, and SHA-1 `26dff4c3d9f6bce9718780c0fd9116bce81c7212`; GitHub reports the matching SHA-256 digest.
+
+The connected-instance acceptance evidence and its scope are recorded above. This release did not modify production n8n or change the validated A2UI runtime behavior.
+
 ## v0.5.0-beta.1 local verification scope (historical, before production acceptance)
 
 This candidate adds normalized callback fields beside the existing output contract. Local verification exercises the existing request-button/action callback path, normalization precedence, optional fields, timestamps, raw-data control, privacy-safe diagnostics, and ACK-before-emit ordering. Form and selection interactions have not been live-verified and remain deferred. No production n8n was touched for this candidate. Stable release still requires scoped live acceptance before expanding interaction claims.
@@ -393,3 +421,10 @@ Public npm dist-tags are `beta -> 0.6.0-beta.1` and `latest -> 0.5.0`. Registry
 The [GitHub prerelease](https://github.com/NTLx/n8n-nodes-dingtalk-card/releases/tag/v0.6.0-beta.1) is published with `draft=false` and `prerelease=true`. Its only asset, `n8n-nodes-dingtalk-card-0.6.0-beta.1.tgz`, was downloaded from the public npm registry and verified byte-identical to the npm tarball: 69,986 bytes, 34 files, SHA-256 `00bfde616fb3cfccdb0de12adcee9e55858a9bb09b22b1171d87272b62c72605`, SHA-1 `02c18b3ad02461b28b4e9c687fb59d3a0adc9c19`, and npm SHA-512 integrity `sha512-hPEIfESbEweehI+UwC8cQ69m81RJK67dVrtHqbFDhbVpp8ZcMTovgsL2ct/2ZxK53YOib8h1VdCXGXX12S1OoQ==`.
 
 The official NORMAL schemaVersion 3.0.0 loop example is reference evidence only; it is not an accepted `universal-v1` template asset. No transformed `universal-v1` template import asset is shipped. Live template import, client rendering, Create, Update, and an action click through the callback path remain pending production beta acceptance. Production n8n was not touched for this release.
+# v0.7 Event Handling & Reliability candidate
+
+Local candidate scope: process-local duplicate callback suppression by `messageId` (10-minute TTL, 10,000-entry FIFO bound), existing native WebSocket reconnect lifecycle, 30-second bounded DingTalk HTTP requests, conservative write retry classification, and additive operation/error correlation metadata. Duplicates are acknowledged and ignored while their ID remains cached. This does not provide durable exactly-once delivery across process restart, cache eviction, multiple workers/instances, or independent package copies. Acknowledged events can still be lost after downstream failure.
+
+Automatic write replay remains limited to one retry after DingTalk explicitly rejects the access token; the same payload and identifiers are retained. A timeout, network failure, HTTP 5xx, partial delivery or incomplete write response is not automatically retried and may have an ambiguous outcome. For Create & Deliver, verify before replay because the card may already exist; stable `outTrackId` is correlation, not a dedupe/upsert guarantee. Stream connection diagnostics remain generic and credential-safe.
+
+Connected-instance stable gates still required: validate callback duplicate delivery/ACK behavior against a live DingTalk Stream; exercise disconnect/reconnect and Trigger deactivation on the supported n8n runtime; confirm workflow execution data retains the additive correlation/error shape and legacy top-level fields. No production instance was modified for this candidate.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-nodes-dingtalk-card",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "DingTalk Card Platform lifecycle nodes for n8n",
   "license": "MIT",
   "homepage": "https://github.com/NTLx/n8n-nodes-dingtalk-card#readme",