@ecat/weixin-bot-cli 0.1.0

package/dist/auth/login-qr.js

@@ -0,0 +1,235 @@
+import { randomUUID } from "node:crypto";
+import { apiGetFetch } from "../api/api.js";
+import { logger } from "../util/logger.js";
+import { redactToken } from "../util/redact.js";
+const ACTIVE_LOGIN_TTL_MS = 5 * 60_000;
+/** Client-side timeout for the get_bot_qrcode request. */
+const GET_QRCODE_TIMEOUT_MS = 5_000;
+/** Client-side timeout for the long-poll get_qrcode_status request. */
+const QR_LONG_POLL_TIMEOUT_MS = 35_000;
+/** Default `bot_type` for ilink get_bot_qrcode / get_qrcode_status (this channel build). */
+export const DEFAULT_ILINK_BOT_TYPE = "3";
+/** Fixed API base URL for all QR code requests. */
+const FIXED_BASE_URL = "https://ilinkai.weixin.qq.com";
+const activeLogins = new Map();
+function isLoginFresh(login) {
+    return Date.now() - login.startedAt < ACTIVE_LOGIN_TTL_MS;
+}
+/** Remove all expired entries from the activeLogins map to prevent memory leaks. */
+function purgeExpiredLogins() {
+    for (const [id, login] of activeLogins) {
+        if (!isLoginFresh(login)) {
+            activeLogins.delete(id);
+        }
+    }
+}
+async function fetchQRCode(apiBaseUrl, botType) {
+    logger.info(`Fetching QR code from: ${apiBaseUrl} bot_type=${botType}`);
+    const rawText = await apiGetFetch({
+        baseUrl: apiBaseUrl,
+        endpoint: `ilink/bot/get_bot_qrcode?bot_type=${encodeURIComponent(botType)}`,
+        timeoutMs: GET_QRCODE_TIMEOUT_MS,
+        label: "fetchQRCode",
+    });
+    return JSON.parse(rawText);
+}
+async function pollQRStatus(apiBaseUrl, qrcode) {
+    logger.debug(`Long-poll QR status from: ${apiBaseUrl} qrcode=***`);
+    try {
+        const rawText = await apiGetFetch({
+            baseUrl: apiBaseUrl,
+            endpoint: `ilink/bot/get_qrcode_status?qrcode=${encodeURIComponent(qrcode)}`,
+            timeoutMs: QR_LONG_POLL_TIMEOUT_MS,
+            label: "pollQRStatus",
+        });
+        logger.debug(`pollQRStatus: body=${rawText.substring(0, 200)}`);
+        return JSON.parse(rawText);
+    }
+    catch (err) {
+        if (err instanceof Error && err.name === "AbortError") {
+            logger.debug(`pollQRStatus: client-side timeout after ${QR_LONG_POLL_TIMEOUT_MS}ms, returning wait`);
+            return { status: "wait" };
+        }
+        // 网关超时（如 Cloudflare 524）或其他网络错误，视为等待状态继续轮询
+        logger.warn(`pollQRStatus: network/gateway error, will retry: ${String(err)}`);
+        return { status: "wait" };
+    }
+}
+export async function startWeixinLoginWithQr(opts) {
+    const sessionKey = opts.accountId || randomUUID();
+    purgeExpiredLogins();
+    const existing = activeLogins.get(sessionKey);
+    if (!opts.force && existing && isLoginFresh(existing) && existing.qrcodeUrl) {
+        return {
+            qrcodeUrl: existing.qrcodeUrl,
+            message: "二维码已就绪，请使用微信扫描。",
+            sessionKey,
+        };
+    }
+    try {
+        const botType = opts.botType || DEFAULT_ILINK_BOT_TYPE;
+        logger.info(`Starting Weixin login with bot_type=${botType}`);
+        const qrResponse = await fetchQRCode(FIXED_BASE_URL, botType);
+        logger.info(`QR code received, qrcode=${redactToken(qrResponse.qrcode)} imgContentLen=${qrResponse.qrcode_img_content?.length ?? 0}`);
+        logger.info(`二维码链接: ${qrResponse.qrcode_img_content}`);
+        const login = {
+            sessionKey,
+            id: randomUUID(),
+            qrcode: qrResponse.qrcode,
+            qrcodeUrl: qrResponse.qrcode_img_content,
+            startedAt: Date.now(),
+        };
+        activeLogins.set(sessionKey, login);
+        return {
+            qrcodeUrl: qrResponse.qrcode_img_content,
+            message: "使用微信扫描以下二维码，以完成连接。",
+            sessionKey,
+        };
+    }
+    catch (err) {
+        logger.error(`Failed to start Weixin login: ${String(err)}`);
+        return {
+            message: `Failed to start login: ${String(err)}`,
+            sessionKey,
+        };
+    }
+}
+const MAX_QR_REFRESH_COUNT = 3;
+export async function waitForWeixinLogin(opts) {
+    let activeLogin = activeLogins.get(opts.sessionKey);
+    if (!activeLogin) {
+        logger.warn(`waitForWeixinLogin: no active login sessionKey=${opts.sessionKey}`);
+        return {
+            connected: false,
+            message: "当前没有进行中的登录，请先发起登录。",
+        };
+    }
+    if (!isLoginFresh(activeLogin)) {
+        logger.warn(`waitForWeixinLogin: login QR expired sessionKey=${opts.sessionKey}`);
+        activeLogins.delete(opts.sessionKey);
+        return {
+            connected: false,
+            message: "二维码已过期，请重新生成。",
+        };
+    }
+    const timeoutMs = Math.max(opts.timeoutMs ?? 480_000, 1000);
+    const deadline = Date.now() + timeoutMs;
+    let scannedPrinted = false;
+    let qrRefreshCount = 1;
+    // Initialize the effective polling base URL; may be updated on IDC redirect.
+    activeLogin.currentApiBaseUrl = FIXED_BASE_URL;
+    logger.info("Starting to poll QR code status...");
+    while (Date.now() < deadline) {
+        try {
+            const currentBaseUrl = activeLogin.currentApiBaseUrl ?? FIXED_BASE_URL;
+            const statusResponse = await pollQRStatus(currentBaseUrl, activeLogin.qrcode);
+            logger.debug(`pollQRStatus: status=${statusResponse.status} hasBotToken=${Boolean(statusResponse.bot_token)} hasBotId=${Boolean(statusResponse.ilink_bot_id)}`);
+            activeLogin.status = statusResponse.status;
+            switch (statusResponse.status) {
+                case "wait":
+                    if (opts.verbose) {
+                        process.stdout.write(".");
+                    }
+                    break;
+                case "scaned":
+                    if (!scannedPrinted) {
+                        process.stdout.write("\n👀 已扫码，在微信继续操作...\n");
+                        scannedPrinted = true;
+                    }
+                    break;
+                case "expired": {
+                    qrRefreshCount++;
+                    if (qrRefreshCount > MAX_QR_REFRESH_COUNT) {
+                        logger.warn(`waitForWeixinLogin: QR expired ${MAX_QR_REFRESH_COUNT} times, giving up sessionKey=${opts.sessionKey}`);
+                        activeLogins.delete(opts.sessionKey);
+                        return {
+                            connected: false,
+                            message: "登录超时：二维码多次过期，请重新开始登录流程。",
+                        };
+                    }
+                    process.stdout.write(`\n⏳ 二维码已过期，正在刷新...(${qrRefreshCount}/${MAX_QR_REFRESH_COUNT})\n`);
+                    logger.info(`waitForWeixinLogin: QR expired, refreshing (${qrRefreshCount}/${MAX_QR_REFRESH_COUNT})`);
+                    try {
+                        const botType = opts.botType || DEFAULT_ILINK_BOT_TYPE;
+                        const qrResponse = await fetchQRCode(FIXED_BASE_URL, botType);
+                        activeLogin.qrcode = qrResponse.qrcode;
+                        activeLogin.qrcodeUrl = qrResponse.qrcode_img_content;
+                        activeLogin.startedAt = Date.now();
+                        scannedPrinted = false;
+                        logger.info(`waitForWeixinLogin: new QR code obtained qrcode=${redactToken(qrResponse.qrcode)}`);
+                        process.stdout.write(`🔄 新二维码已生成，请重新扫描\n\n`);
+                        try {
+                            const qrterm = await import("qrcode-terminal");
+                            qrterm.default.generate(qrResponse.qrcode_img_content, { small: true });
+                            process.stdout.write(`如果二维码未能成功展示，请用浏览器打开以下链接扫码：\n`);
+                            process.stdout.write(`${qrResponse.qrcode_img_content}\n`);
+                        }
+                        catch {
+                            process.stdout.write(`二维码未加载成功，请用浏览器打开以下链接扫码：\n`);
+                            process.stdout.write(`${qrResponse.qrcode_img_content}\n`);
+                        }
+                    }
+                    catch (refreshErr) {
+                        logger.error(`waitForWeixinLogin: failed to refresh QR code: ${String(refreshErr)}`);
+                        activeLogins.delete(opts.sessionKey);
+                        return {
+                            connected: false,
+                            message: `刷新二维码失败: ${String(refreshErr)}`,
+                        };
+                    }
+                    break;
+                }
+                case "scaned_but_redirect": {
+                    const redirectHost = statusResponse.redirect_host;
+                    if (redirectHost) {
+                        const newBaseUrl = `https://${redirectHost}`;
+                        activeLogin.currentApiBaseUrl = newBaseUrl;
+                        process.stdout.write(`\n🔀 IDC 跳转，切换 host 为 ${redirectHost}\n`);
+                        logger.info(`waitForWeixinLogin: IDC redirect, switching polling host to ${redirectHost}`);
+                    }
+                    else {
+                        logger.warn(`waitForWeixinLogin: received scaned_but_redirect but redirect_host is missing, continuing with current host`);
+                    }
+                    break;
+                }
+                case "confirmed": {
+                    if (!statusResponse.ilink_bot_id) {
+                        activeLogins.delete(opts.sessionKey);
+                        logger.error("Login confirmed but ilink_bot_id missing from response");
+                        return {
+                            connected: false,
+                            message: "登录失败：服务器未返回 ilink_bot_id。",
+                        };
+                    }
+                    activeLogin.botToken = statusResponse.bot_token;
+                    activeLogins.delete(opts.sessionKey);
+                    logger.info(`✅ Login confirmed! ilink_bot_id=${statusResponse.ilink_bot_id} ilink_user_id=${redactToken(statusResponse.ilink_user_id)}`);
+                    return {
+                        connected: true,
+                        botToken: statusResponse.bot_token,
+                        accountId: statusResponse.ilink_bot_id,
+                        baseUrl: statusResponse.baseurl,
+                        userId: statusResponse.ilink_user_id,
+                        message: "✅ 与微信连接成功！",
+                    };
+                }
+            }
+        }
+        catch (err) {
+            logger.error(`Error polling QR status: ${String(err)}`);
+            activeLogins.delete(opts.sessionKey);
+            return {
+                connected: false,
+                message: `Login failed: ${String(err)}`,
+            };
+        }
+        await new Promise((r) => setTimeout(r, 1000));
+    }
+    logger.warn(`waitForWeixinLogin: timed out waiting for QR scan sessionKey=${opts.sessionKey} timeoutMs=${timeoutMs}`);
+    activeLogins.delete(opts.sessionKey);
+    return {
+        connected: false,
+        message: "登录超时，请重试。",
+    };
+}
+//# sourceMappingURL=login-qr.js.map

package/dist/auth/login-qr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-qr.js","sourceRoot":"","sources":["../../src/auth/login-qr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAehD,MAAM,mBAAmB,GAAG,CAAC,GAAG,MAAM,CAAC;AACvC,0DAA0D;AAC1D,MAAM,qBAAqB,GAAG,KAAK,CAAC;AACpC,uEAAuE;AACvE,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAEvC,4FAA4F;AAC5F,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAE1C,mDAAmD;AACnD,MAAM,cAAc,GAAG,+BAA+B,CAAC;AAEvD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;AAkBpD,SAAS,YAAY,CAAC,KAAkB;IACtC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,mBAAmB,CAAC;AAC5D,CAAC;AAED,oFAAoF;AACpF,SAAS,kBAAkB;IACzB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,UAAkB,EAAE,OAAe;IAC5D,MAAM,CAAC,IAAI,CAAC,0BAA0B,UAAU,aAAa,OAAO,EAAE,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC;QAChC,OAAO,EAAE,UAAU;QACnB,QAAQ,EAAE,qCAAqC,kBAAkB,CAAC,OAAO,CAAC,EAAE;QAC5E,SAAS,EAAE,qBAAqB;QAChC,KAAK,EAAE,aAAa;KACrB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,UAAkB,EAAE,MAAc;IAC5D,MAAM,CAAC,KAAK,CAAC,6BAA6B,UAAU,aAAa,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC;YAChC,OAAO,EAAE,UAAU;YACnB,QAAQ,EAAE,sCAAsC,kBAAkB,CAAC,MAAM,CAAC,EAAE;YAC5E,SAAS,EAAE,uBAAuB;YAClC,KAAK,EAAE,cAAc;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,sBAAsB,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACtD,MAAM,CAAC,KAAK,CAAC,2CAA2C,uBAAuB,oBAAoB,CAAC,CAAC;YACrG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5B,CAAC;QACD,2CAA2C;QAC3C,MAAM,CAAC,IAAI,CAAC,oDAAoD,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAO5C;IACC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC;IAElD,kBAAkB,EAAE,CAAC;IAErB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC5E,OAAO;YACL,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,OAAO,EAAE,iBAAiB;YAC1B,UAAU;SACX,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,sBAAsB,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,uCAAuC,OAAO,EAAE,CAAC,CAAC;QAE9D,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAC9D,MAAM,CAAC,IAAI,CACT,4BAA4B,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,kBAAkB,UAAU,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC,EAAE,CACzH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAEvD,MAAM,KAAK,GAAgB;YACzB,UAAU;YACV,EAAE,EAAE,UAAU,EAAE;YAChB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,SAAS,EAAE,UAAU,CAAC,kBAAkB;YACxC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAEpC,OAAO;YACL,SAAS,EAAE,UAAU,CAAC,kBAAkB;YACxC,OAAO,EAAE,oBAAoB;YAC7B,UAAU;SACX,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,iCAAiC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7D,OAAO;YACL,OAAO,EAAE,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE;YAChD,UAAU;SACX,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAMxC;IACC,IAAI,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAEpD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,kDAAkD,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACjF,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,oBAAoB;SAC9B,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,mDAAmD,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAClF,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,eAAe;SACzB,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,6EAA6E;IAC7E,WAAW,CAAC,iBAAiB,GAAG,cAAc,CAAC;IAE/C,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IAElD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,WAAW,CAAC,iBAAiB,IAAI,cAAc,CAAC;YACvE,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YAC9E,MAAM,CAAC,KAAK,CAAC,wBAAwB,cAAc,CAAC,MAAM,gBAAgB,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,aAAa,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAChK,WAAW,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC;YAE3C,QAAQ,cAAc,CAAC,MAAM,EAAE,CAAC;gBAC9B,KAAK,MAAM;oBACT,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;wBACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC5B,CAAC;oBACD,MAAM;gBACR,KAAK,QAAQ;oBACX,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;wBAC9C,cAAc,GAAG,IAAI,CAAC;oBACxB,CAAC;oBACD,MAAM;gBACR,KAAK,SAAS,CAAC,CAAC,CAAC;oBACf,cAAc,EAAE,CAAC;oBACjB,IAAI,cAAc,GAAG,oBAAoB,EAAE,CAAC;wBAC1C,MAAM,CAAC,IAAI,CACT,kCAAkC,oBAAoB,gCAAgC,IAAI,CAAC,UAAU,EAAE,CACxG,CAAC;wBACF,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;wBACrC,OAAO;4BACL,SAAS,EAAE,KAAK;4BAChB,OAAO,EAAE,yBAAyB;yBACnC,CAAC;oBACJ,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,cAAc,IAAI,oBAAoB,KAAK,CAAC,CAAC;oBACxF,MAAM,CAAC,IAAI,CACT,+CAA+C,cAAc,IAAI,oBAAoB,GAAG,CACzF,CAAC;oBAEF,IAAI,CAAC;wBACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,sBAAsB,CAAC;wBACvD,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;wBAC9D,WAAW,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;wBACvC,WAAW,CAAC,SAAS,GAAG,UAAU,CAAC,kBAAkB,CAAC;wBACtD,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;wBACnC,cAAc,GAAG,KAAK,CAAC;wBACvB,MAAM,CAAC,IAAI,CAAC,mDAAmD,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;wBACjG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;wBAC7C,IAAI,CAAC;4BACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;4BAC/C,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;4BACxE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;4BACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,kBAAkB,IAAI,CAAC,CAAC;wBAC7D,CAAC;wBAAC,MAAM,CAAC;4BACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;4BAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,kBAAkB,IAAI,CAAC,CAAC;wBAC7D,CAAC;oBACH,CAAC;oBAAC,OAAO,UAAU,EAAE,CAAC;wBACpB,MAAM,CAAC,KAAK,CAAC,kDAAkD,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;wBACrF,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;wBACrC,OAAO;4BACL,SAAS,EAAE,KAAK;4BAChB,OAAO,EAAE,YAAY,MAAM,CAAC,UAAU,CAAC,EAAE;yBAC1C,CAAC;oBACJ,CAAC;oBACD,MAAM;gBACR,CAAC;gBACD,KAAK,qBAAqB,CAAC,CAAC,CAAC;oBAC3B,MAAM,YAAY,GAAG,cAAc,CAAC,aAAa,CAAC;oBAClD,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,UAAU,GAAG,WAAW,YAAY,EAAE,CAAC;wBAC7C,WAAW,CAAC,iBAAiB,GAAG,UAAU,CAAC;wBAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,YAAY,IAAI,CAAC,CAAC;wBAChE,MAAM,CAAC,IAAI,CAAC,+DAA+D,YAAY,EAAE,CAAC,CAAC;oBAC7F,CAAC;yBAAM,CAAC;wBACN,MAAM,CAAC,IAAI,CAAC,6GAA6G,CAAC,CAAC;oBAC7H,CAAC;oBACD,MAAM;gBACR,CAAC;gBACD,KAAK,WAAW,CAAC,CAAC,CAAC;oBACjB,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,CAAC;wBACjC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;wBACrC,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;wBACvE,OAAO;4BACL,SAAS,EAAE,KAAK;4BAChB,OAAO,EAAE,2BAA2B;yBACrC,CAAC;oBACJ,CAAC;oBAED,WAAW,CAAC,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC;oBAChD,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAErC,MAAM,CAAC,IAAI,CACT,mCAAmC,cAAc,CAAC,YAAY,kBAAkB,WAAW,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,CAC5H,CAAC;oBAEF,OAAO;wBACL,SAAS,EAAE,IAAI;wBACf,QAAQ,EAAE,cAAc,CAAC,SAAS;wBAClC,SAAS,EAAE,cAAc,CAAC,YAAY;wBACtC,OAAO,EAAE,cAAc,CAAC,OAAO;wBAC/B,MAAM,EAAE,cAAc,CAAC,aAAa;wBACpC,OAAO,EAAE,YAAY;qBACtB,CAAC;gBACJ,CAAC;YACH,CAAC;QAEH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,4BAA4B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxD,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACrC,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,iBAAiB,MAAM,CAAC,GAAG,CAAC,EAAE;aACxC,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,CAAC,IAAI,CACT,gEAAgE,IAAI,CAAC,UAAU,cAAc,SAAS,EAAE,CACzG,CAAC;IACF,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrC,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,WAAW;KACrB,CAAC;AACJ,CAAC"}

package/dist/cdn/aes-ecb.d.ts

@@ -0,0 +1,6 @@
+/** Encrypt buffer with AES-128-ECB (PKCS7 padding is default). */
+export declare function encryptAesEcb(plaintext: Buffer, key: Buffer): Buffer;
+/** Decrypt buffer with AES-128-ECB (PKCS7 padding). */
+export declare function decryptAesEcb(ciphertext: Buffer, key: Buffer): Buffer;
+/** Compute AES-128-ECB ciphertext size (PKCS7 padding to 16-byte boundary). */
+export declare function aesEcbPaddedSize(plaintextSize: number): number;

package/dist/cdn/aes-ecb.js

@@ -0,0 +1,19 @@
+/**
+ * Shared AES-128-ECB crypto utilities for CDN upload and download.
+ */
+import { createCipheriv, createDecipheriv } from "node:crypto";
+/** Encrypt buffer with AES-128-ECB (PKCS7 padding is default). */
+export function encryptAesEcb(plaintext, key) {
+    const cipher = createCipheriv("aes-128-ecb", key, null);
+    return Buffer.concat([cipher.update(plaintext), cipher.final()]);
+}
+/** Decrypt buffer with AES-128-ECB (PKCS7 padding). */
+export function decryptAesEcb(ciphertext, key) {
+    const decipher = createDecipheriv("aes-128-ecb", key, null);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+}
+/** Compute AES-128-ECB ciphertext size (PKCS7 padding to 16-byte boundary). */
+export function aesEcbPaddedSize(plaintextSize) {
+    return Math.ceil((plaintextSize + 1) / 16) * 16;
+}
+//# sourceMappingURL=aes-ecb.js.map

package/dist/cdn/aes-ecb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aes-ecb.js","sourceRoot":"","sources":["../../src/cdn/aes-ecb.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/D,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,GAAW;IAC1D,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,GAAW;IAC3D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,aAAqB;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;AAClD,CAAC"}

package/dist/cdn/cdn-upload.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Upload one buffer to the Weixin CDN with AES-128-ECB encryption.
+ * Returns the download encrypted_query_param from the CDN response.
+ * Retries up to UPLOAD_MAX_RETRIES times on server errors; client errors (4xx) abort immediately.
+ */
+export declare function uploadBufferToCdn(params: {
+    buf: Buffer;
+    /** From getUploadUrl.upload_full_url; POST target when set (takes precedence over uploadParam). */
+    uploadFullUrl?: string;
+    uploadParam?: string;
+    filekey: string;
+    cdnBaseUrl: string;
+    label: string;
+    aeskey: Buffer;
+}): Promise<{
+    downloadParam: string;
+}>;

package/dist/cdn/cdn-upload.js

@@ -0,0 +1,73 @@
+import { encryptAesEcb } from "./aes-ecb.js";
+import { buildCdnUploadUrl } from "./cdn-url.js";
+import { logger } from "../util/logger.js";
+import { redactUrl } from "../util/redact.js";
+/** Maximum retry attempts for CDN upload. */
+const UPLOAD_MAX_RETRIES = 3;
+/**
+ * Upload one buffer to the Weixin CDN with AES-128-ECB encryption.
+ * Returns the download encrypted_query_param from the CDN response.
+ * Retries up to UPLOAD_MAX_RETRIES times on server errors; client errors (4xx) abort immediately.
+ */
+export async function uploadBufferToCdn(params) {
+    const { buf, uploadFullUrl, uploadParam, filekey, cdnBaseUrl, label, aeskey } = params;
+    const ciphertext = encryptAesEcb(buf, aeskey);
+    const trimmedFull = uploadFullUrl?.trim();
+    let cdnUrl;
+    if (trimmedFull) {
+        cdnUrl = trimmedFull;
+    }
+    else if (uploadParam) {
+        cdnUrl = buildCdnUploadUrl({ cdnBaseUrl, uploadParam, filekey });
+    }
+    else {
+        throw new Error(`${label}: CDN upload URL missing (need upload_full_url or upload_param)`);
+    }
+    logger.debug(`${label}: CDN POST url=${redactUrl(cdnUrl)} ciphertextSize=${ciphertext.length}`);
+    let downloadParam;
+    let lastError;
+    for (let attempt = 1; attempt <= UPLOAD_MAX_RETRIES; attempt++) {
+        try {
+            const res = await fetch(cdnUrl, {
+                method: "POST",
+                headers: { "Content-Type": "application/octet-stream" },
+                body: new Uint8Array(ciphertext),
+            });
+            if (res.status >= 400 && res.status < 500) {
+                const errMsg = res.headers.get("x-error-message") ?? (await res.text());
+                logger.error(`${label}: CDN client error attempt=${attempt} status=${res.status} errMsg=${errMsg}`);
+                throw new Error(`CDN upload client error ${res.status}: ${errMsg}`);
+            }
+            if (res.status !== 200) {
+                const errMsg = res.headers.get("x-error-message") ?? `status ${res.status}`;
+                logger.error(`${label}: CDN server error attempt=${attempt} status=${res.status} errMsg=${errMsg}`);
+                throw new Error(`CDN upload server error: ${errMsg}`);
+            }
+            downloadParam = res.headers.get("x-encrypted-param") ?? undefined;
+            if (!downloadParam) {
+                logger.error(`${label}: CDN response missing x-encrypted-param header attempt=${attempt}`);
+                throw new Error("CDN upload response missing x-encrypted-param header");
+            }
+            logger.debug(`${label}: CDN upload success attempt=${attempt}`);
+            break;
+        }
+        catch (err) {
+            lastError = err;
+            if (err instanceof Error && err.message.includes("client error"))
+                throw err;
+            if (attempt < UPLOAD_MAX_RETRIES) {
+                logger.error(`${label}: attempt ${attempt} failed, retrying... err=${String(err)}`);
+            }
+            else {
+                logger.error(`${label}: all ${UPLOAD_MAX_RETRIES} attempts failed err=${String(err)}`);
+            }
+        }
+    }
+    if (!downloadParam) {
+        throw lastError instanceof Error
+            ? lastError
+            : new Error(`CDN upload failed after ${UPLOAD_MAX_RETRIES} attempts`);
+    }
+    return { downloadParam };
+}
+//# sourceMappingURL=cdn-upload.js.map

package/dist/cdn/cdn-upload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cdn-upload.js","sourceRoot":"","sources":["../../src/cdn/cdn-upload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,6CAA6C;AAC7C,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MASvC;IACC,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACvF,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC;IAC1C,IAAI,MAAc,CAAC;IACnB,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,GAAG,WAAW,CAAC;IACvB,CAAC;SAAM,IAAI,WAAW,EAAE,CAAC;QACvB,MAAM,GAAG,iBAAiB,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iEAAiE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,kBAAkB,SAAS,CAAC,MAAM,CAAC,mBAAmB,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAEhG,IAAI,aAAiC,CAAC;IACtC,IAAI,SAAkB,CAAC;IAEvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,kBAAkB,EAAE,OAAO,EAAE,EAAE,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;gBAC9B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;gBACvD,IAAI,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC;aACjC,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBACxE,MAAM,CAAC,KAAK,CACV,GAAG,KAAK,8BAA8B,OAAO,WAAW,GAAG,CAAC,MAAM,WAAW,MAAM,EAAE,CACtF,CAAC;gBACF,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC5E,MAAM,CAAC,KAAK,CACV,GAAG,KAAK,8BAA8B,OAAO,WAAW,GAAG,CAAC,MAAM,WAAW,MAAM,EAAE,CACtF,CAAC;gBACF,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,SAAS,CAAC;YAClE,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,CAAC,KAAK,CACV,GAAG,KAAK,2DAA2D,OAAO,EAAE,CAC7E,CAAC;gBACF,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,gCAAgC,OAAO,EAAE,CAAC,CAAC;YAChE,MAAM;QACR,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,CAAC;YAChB,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC5E,IAAI,OAAO,GAAG,kBAAkB,EAAE,CAAC;gBACjC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,aAAa,OAAO,4BAA4B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtF,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,kBAAkB,wBAAwB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzF,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,SAAS,YAAY,KAAK;YAC9B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,KAAK,CAAC,2BAA2B,kBAAkB,WAAW,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,CAAC;AAC3B,CAAC"}

package/dist/cdn/cdn-url.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Unified CDN URL construction for Weixin CDN upload/download.
+ */
+/** 设为 true 时，当服务端未返回 full_url 字段，回退到客户端拼接 URL；false 则直接报错。 */
+export declare const ENABLE_CDN_URL_FALLBACK = true;
+/** Build a CDN download URL from encrypt_query_param. */
+export declare function buildCdnDownloadUrl(encryptedQueryParam: string, cdnBaseUrl: string): string;
+/** Build a CDN upload URL from upload_param and filekey. */
+export declare function buildCdnUploadUrl(params: {
+    cdnBaseUrl: string;
+    uploadParam: string;
+    filekey: string;
+}): string;

package/dist/cdn/cdn-url.js

@@ -0,0 +1,14 @@
+/**
+ * Unified CDN URL construction for Weixin CDN upload/download.
+ */
+/** 设为 true 时，当服务端未返回 full_url 字段，回退到客户端拼接 URL；false 则直接报错。 */
+export const ENABLE_CDN_URL_FALLBACK = true;
+/** Build a CDN download URL from encrypt_query_param. */
+export function buildCdnDownloadUrl(encryptedQueryParam, cdnBaseUrl) {
+    return `${cdnBaseUrl}/download?encrypted_query_param=${encodeURIComponent(encryptedQueryParam)}`;
+}
+/** Build a CDN upload URL from upload_param and filekey. */
+export function buildCdnUploadUrl(params) {
+    return `${params.cdnBaseUrl}/upload?encrypted_query_param=${encodeURIComponent(params.uploadParam)}&filekey=${encodeURIComponent(params.filekey)}`;
+}
+//# sourceMappingURL=cdn-url.js.map

package/dist/cdn/cdn-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cdn-url.js","sourceRoot":"","sources":["../../src/cdn/cdn-url.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C,yDAAyD;AACzD,MAAM,UAAU,mBAAmB,CAAC,mBAA2B,EAAE,UAAkB;IACjF,OAAO,GAAG,UAAU,mCAAmC,kBAAkB,CAAC,mBAAmB,CAAC,EAAE,CAAC;AACnG,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,iBAAiB,CAAC,MAIjC;IACC,OAAO,GAAG,MAAM,CAAC,UAAU,iCAAiC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AACrJ,CAAC"}

package/dist/cdn/pic-decrypt.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Download and AES-128-ECB decrypt a CDN media file. Returns plaintext Buffer.
+ * aesKeyBase64: CDNMedia.aes_key JSON field (see parseAesKey for supported formats).
+ */
+export declare function downloadAndDecryptBuffer(encryptedQueryParam: string, aesKeyBase64: string, cdnBaseUrl: string, label: string, fullUrl?: string): Promise<Buffer>;
+/**
+ * Download plain (unencrypted) bytes from the CDN. Returns the raw Buffer.
+ */
+export declare function downloadPlainCdnBuffer(encryptedQueryParam: string, cdnBaseUrl: string, label: string, fullUrl?: string): Promise<Buffer>;

package/dist/cdn/pic-decrypt.js

@@ -0,0 +1,89 @@
+import { decryptAesEcb } from "./aes-ecb.js";
+import { buildCdnDownloadUrl, ENABLE_CDN_URL_FALLBACK } from "./cdn-url.js";
+import { logger } from "../util/logger.js";
+/**
+ * Download raw bytes from the CDN (no decryption).
+ */
+async function fetchCdnBytes(url, label) {
+    let res;
+    try {
+        res = await fetch(url);
+    }
+    catch (err) {
+        const cause = err.cause ?? err.code ?? "(no cause)";
+        logger.error(`${label}: fetch network error url=${url} err=${String(err)} cause=${String(cause)}`);
+        throw err;
+    }
+    logger.debug(`${label}: response status=${res.status} ok=${res.ok}`);
+    if (!res.ok) {
+        const body = await res.text().catch(() => "(unreadable)");
+        const msg = `${label}: CDN download ${res.status} ${res.statusText} body=${body}`;
+        logger.error(msg);
+        throw new Error(msg);
+    }
+    return Buffer.from(await res.arrayBuffer());
+}
+/**
+ * Parse CDNMedia.aes_key into a raw 16-byte AES key.
+ *
+ * Two encodings are seen in the wild:
+ *   - base64(raw 16 bytes)          → images (aes_key from media field)
+ *   - base64(hex string of 16 bytes) → file / voice / video
+ *
+ * In the second case, base64-decoding yields 32 ASCII hex chars which must
+ * then be parsed as hex to recover the actual 16-byte key.
+ */
+function parseAesKey(aesKeyBase64, label) {
+    const decoded = Buffer.from(aesKeyBase64, "base64");
+    if (decoded.length === 16) {
+        return decoded;
+    }
+    if (decoded.length === 32 && /^[0-9a-fA-F]{32}$/.test(decoded.toString("ascii"))) {
+        // hex-encoded key: base64 → hex string → raw bytes
+        return Buffer.from(decoded.toString("ascii"), "hex");
+    }
+    const msg = `${label}: aes_key must decode to 16 raw bytes or 32-char hex string, got ${decoded.length} bytes (base64="${aesKeyBase64}")`;
+    logger.error(msg);
+    throw new Error(msg);
+}
+/**
+ * Download and AES-128-ECB decrypt a CDN media file. Returns plaintext Buffer.
+ * aesKeyBase64: CDNMedia.aes_key JSON field (see parseAesKey for supported formats).
+ */
+export async function downloadAndDecryptBuffer(encryptedQueryParam, aesKeyBase64, cdnBaseUrl, label, fullUrl) {
+    const key = parseAesKey(aesKeyBase64, label);
+    let url;
+    if (fullUrl) {
+        url = fullUrl;
+    }
+    else if (ENABLE_CDN_URL_FALLBACK) {
+        url = buildCdnDownloadUrl(encryptedQueryParam, cdnBaseUrl);
+    }
+    else {
+        throw new Error(`${label}: fullUrl is required (CDN URL fallback is disabled)`);
+    }
+    logger.debug(`${label}: fetching url=${url}`);
+    const encrypted = await fetchCdnBytes(url, label);
+    logger.debug(`${label}: downloaded ${encrypted.byteLength} bytes, decrypting`);
+    const decrypted = decryptAesEcb(encrypted, key);
+    logger.debug(`${label}: decrypted ${decrypted.length} bytes`);
+    return decrypted;
+}
+/**
+ * Download plain (unencrypted) bytes from the CDN. Returns the raw Buffer.
+ */
+export async function downloadPlainCdnBuffer(encryptedQueryParam, cdnBaseUrl, label, fullUrl) {
+    let url;
+    if (fullUrl) {
+        url = fullUrl;
+    }
+    else if (ENABLE_CDN_URL_FALLBACK) {
+        url = buildCdnDownloadUrl(encryptedQueryParam, cdnBaseUrl);
+    }
+    else {
+        throw new Error(`${label}: fullUrl is required (CDN URL fallback is disabled)`);
+    }
+    logger.debug(`${label}: fetching url=${url}`);
+    return fetchCdnBytes(url, label);
+}
+//# sourceMappingURL=pic-decrypt.js.map

package/dist/cdn/pic-decrypt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pic-decrypt.js","sourceRoot":"","sources":["../../src/cdn/pic-decrypt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C;;GAEG;AACH,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,KAAa;IACrD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GACR,GAA6B,CAAC,KAAK,IAAK,GAA6B,CAAC,IAAI,IAAI,YAAY,CAAC;QAC9F,MAAM,CAAC,KAAK,CACV,GAAG,KAAK,6BAA6B,GAAG,QAAQ,MAAM,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,KAAK,CAAC,EAAE,CACrF,CAAC;QACF,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,qBAAqB,GAAG,CAAC,MAAM,OAAO,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,GAAG,KAAK,kBAAkB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,SAAS,IAAI,EAAE,CAAC;QAClF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,WAAW,CAAC,YAAoB,EAAE,KAAa;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACjF,mDAAmD;QACnD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,KAAK,oEAAoE,OAAO,CAAC,MAAM,mBAAmB,YAAY,IAAI,CAAC;IAC1I,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClB,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,mBAA2B,EAC3B,YAAoB,EACpB,UAAkB,EAClB,KAAa,EACb,OAAgB;IAEhB,MAAM,GAAG,GAAG,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,GAAW,CAAC;IAChB,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,GAAG,OAAO,CAAC;IAChB,CAAC;SAAM,IAAI,uBAAuB,EAAE,CAAC;QACnC,GAAG,GAAG,mBAAmB,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sDAAsD,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,kBAAkB,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,gBAAgB,SAAS,CAAC,UAAU,oBAAoB,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,eAAe,SAAS,CAAC,MAAM,QAAQ,CAAC,CAAC;IAC9D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,mBAA2B,EAC3B,UAAkB,EAClB,KAAa,EACb,OAAgB;IAEhB,IAAI,GAAW,CAAC;IAChB,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,GAAG,OAAO,CAAC;IAChB,CAAC;SAAM,IAAI,uBAAuB,EAAE,CAAC;QACnC,GAAG,GAAG,mBAAmB,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sDAAsD,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,kBAAkB,GAAG,EAAE,CAAC,CAAC;IAC9C,OAAO,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC"}

package/dist/cdn/upload.d.ts

@@ -0,0 +1,42 @@
+import type { WeixinApiOptions } from "../api/api.js";
+export type UploadedFileInfo = {
+    filekey: string;
+    /** 由 upload_param 上传后 CDN 返回的下载加密参数; fill into ImageItem.media.encrypt_query_param */
+    downloadEncryptedQueryParam: string;
+    /** AES-128-ECB key, hex-encoded; convert to base64 for CDNMedia.aes_key */
+    aeskey: string;
+    /** Plaintext file size in bytes */
+    fileSize: number;
+    /** Ciphertext file size in bytes (AES-128-ECB with PKCS7 padding); use for ImageItem.hd_size / mid_size */
+    fileSizeCiphertext: number;
+};
+/**
+ * Download a remote media URL (image, video, file) to a local temp file in destDir.
+ * Returns the local file path; extension is inferred from Content-Type / URL.
+ */
+export declare function downloadRemoteImageToTemp(url: string, destDir: string): Promise<string>;
+/** Upload a local image file to the Weixin CDN with AES-128-ECB encryption. */
+export declare function uploadFileToWeixin(params: {
+    filePath: string;
+    toUserId: string;
+    opts: WeixinApiOptions;
+    cdnBaseUrl: string;
+}): Promise<UploadedFileInfo>;
+/** Upload a local video file to the Weixin CDN. */
+export declare function uploadVideoToWeixin(params: {
+    filePath: string;
+    toUserId: string;
+    opts: WeixinApiOptions;
+    cdnBaseUrl: string;
+}): Promise<UploadedFileInfo>;
+/**
+ * Upload a local file attachment (non-image, non-video) to the Weixin CDN.
+ * Uses media_type=FILE; no thumbnail required.
+ */
+export declare function uploadFileAttachmentToWeixin(params: {
+    filePath: string;
+    fileName: string;
+    toUserId: string;
+    opts: WeixinApiOptions;
+    cdnBaseUrl: string;
+}): Promise<UploadedFileInfo>;