@kin-tio/cli 0.6.0

package/dist/src/ilink/login-manager.js

@@ -0,0 +1,198 @@
+import { IlinkLoginStore } from './login-store.js';
+import { IlinkClient, IlinkProtocolError, normalizeIlinkBaseUrl, } from './protocol/client.js';
+import { renderIlinkQrPng } from './qr.js';
+import { IlinkSecretBox } from './secret-box.js';
+import { IlinkSqliteStore } from './sqlite-store.js';
+import { createIlinkAccountKey } from './store-types.js';
+const POLL_INTERVAL_MS = 1_000;
+function sleep(milliseconds, signal) {
+    if (signal.aborted)
+        return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+        const done = () => {
+            signal.removeEventListener('abort', abort);
+            resolve();
+        };
+        const timer = setTimeout(done, milliseconds);
+        const abort = () => {
+            clearTimeout(timer);
+            signal.removeEventListener('abort', abort);
+            reject(signal.reason);
+        };
+        signal.addEventListener('abort', abort, { once: true });
+        timer.unref();
+    });
+}
+export class IlinkLoginManager {
+    #offers;
+    #accounts;
+    #secrets;
+    #client;
+    #logger;
+    #maxAccounts;
+    #clock;
+    #onAccountsChanged;
+    #sleep;
+    #running = new Map();
+    #closed = false;
+    constructor({ offers, accounts, secretBox, client = new IlinkClient(), maxAccounts = 20, clock = Date.now, onAccountsChanged = () => undefined, logger = console, sleep: sleepFunction = sleep, }) {
+        this.#offers = offers;
+        this.#accounts = accounts;
+        this.#secrets = secretBox;
+        this.#client = client;
+        this.#maxAccounts = maxAccounts;
+        this.#clock = clock;
+        this.#onAccountsChanged = onAccountsChanged;
+        this.#logger = logger;
+        this.#sleep = sleepFunction;
+    }
+    async start() {
+        if (this.#closed)
+            throw new Error('iLink login manager is closed');
+        for (const offer of this.#offers.listActive())
+            this.#startPolling(offer);
+    }
+    async offer(sessionToken) {
+        if (this.#closed)
+            throw new Error('iLink login manager is closed');
+        if (this.#offers.findForSession(sessionToken)) {
+            throw new Error('An iLink login offer is already pending');
+        }
+        if (this.#accounts.listActiveAccounts().length +
+            this.#offers.listActive().length >= this.#maxAccounts) {
+            throw new Error('iLink account limit reached');
+        }
+        const localTokens = this.#accounts.listActiveAccountsWithSecrets()
+            .slice(-10)
+            .reverse()
+            .map(({ account, secret }) => this.#secrets.open(secret.sealedBotToken, {
+            secretKind: 'bot_token',
+            accountId: account.accountKey,
+            peerId: account.ownerPeerId,
+            generation: secret.accountGeneration,
+        }));
+        const created = await this.#client.createQr({ local_token_list: localTokens });
+        if (this.#accounts.listActiveAccounts().length +
+            this.#offers.listActive().length >= this.#maxAccounts) {
+            throw new Error('iLink account limit reached');
+        }
+        const offer = this.#offers.create({
+            sessionToken,
+            qrCode: created.qrcode,
+            apiBaseUrl: normalizeIlinkBaseUrl('https://ilinkai.weixin.qq.com/'),
+        });
+        let png;
+        try {
+            png = await renderIlinkQrPng(created.qrcode_img_content);
+        }
+        catch (error) {
+            this.#offers.finish(offer.offerId, 'failed');
+            throw error;
+        }
+        this.#startPolling(offer);
+        return { offerId: offer.offerId, png };
+    }
+    cancel(offerId) {
+        this.#running.get(offerId)?.controller.abort();
+        this.#offers.finish(offerId, 'cancelled');
+    }
+    #startPolling(offer) {
+        if (this.#running.has(offer.offerId) || this.#closed)
+            return;
+        const controller = new AbortController();
+        const task = this.#poll(offer, controller.signal).finally(() => {
+            if (this.#running.get(offer.offerId)?.controller === controller) {
+                this.#running.delete(offer.offerId);
+            }
+        });
+        this.#running.set(offer.offerId, { controller, task });
+    }
+    async #poll(initial, signal) {
+        let offer = initial;
+        while (!this.#closed && !signal.aborted && Number(this.#clock()) < offer.expiresAt) {
+            try {
+                const result = await this.#client.getQrStatus({ qrcode: offer.qrCode }, { signal, baseUrl: offer.apiBaseUrl });
+                if (signal.aborted || !this.#offers.isActive(offer.offerId))
+                    return;
+                if (result.status === 'confirmed') {
+                    try {
+                        await this.#confirm(offer, result);
+                    }
+                    catch {
+                        this.#offers.finish(offer.offerId, 'failed');
+                        this.#logger.warn?.('[ilink-login] confirmed account activation failed');
+                    }
+                    return;
+                }
+                if (result.status === 'binded_redirect') {
+                    this.#offers.finish(offer.offerId, 'cancelled');
+                    this.#logger.info?.('[ilink-login] account is already connected');
+                    return;
+                }
+                if (result.status === 'scaned_but_redirect' && result.redirect_host) {
+                    offer = this.#offers.update(offer.offerId, {
+                        status: 'waiting',
+                        apiBaseUrl: this.#client.resolveRedirectBaseUrl(result.redirect_host),
+                    });
+                }
+                else if (result.status === 'scaned') {
+                    offer = this.#offers.update(offer.offerId, { status: 'scanned' });
+                }
+                else if (result.status !== 'wait') {
+                    this.#offers.finish(offer.offerId, result.status === 'expired' ? 'expired' : 'failed');
+                    return;
+                }
+                await this.#sleep(POLL_INTERVAL_MS, signal);
+            }
+            catch (error) {
+                if (signal.aborted || this.#closed)
+                    return;
+                if (error instanceof IlinkProtocolError && error.kind === 'configuration') {
+                    this.#offers.finish(offer.offerId, 'failed');
+                    return;
+                }
+                this.#logger.warn?.('[ilink-login] status poll failed; retrying');
+                await this.#sleep(POLL_INTERVAL_MS, signal).catch(() => undefined);
+            }
+        }
+        this.#offers.finish(offer.offerId, 'expired');
+    }
+    async #confirm(offer, result) {
+        const providerAccountId = String(result.ilink_bot_id || '');
+        const ownerPeerId = String(result.ilink_user_id || '');
+        const token = String(result.bot_token || '');
+        if (!providerAccountId || !ownerPeerId || !token) {
+            throw new Error('Confirmed iLink login is missing credentials');
+        }
+        const accountKey = createIlinkAccountKey(providerAccountId);
+        const existing = this.#accounts.getAccount(accountKey);
+        const generation = existing ? existing.generation + 1 : 1;
+        const encryptedBotToken = this.#secrets.seal(token, {
+            secretKind: 'bot_token',
+            accountId: accountKey,
+            peerId: ownerPeerId,
+            generation,
+        });
+        const baseUrl = normalizeIlinkBaseUrl(result.baseurl || offer.apiBaseUrl);
+        this.#accounts.confirmEnrollment({
+            offerId: offer.offerId,
+            accountGeneration: generation,
+            maxAccounts: this.#maxAccounts,
+            providerAccountId,
+            ownerPeerId,
+            baseUrl,
+            encryptedBotToken,
+            now: Number(this.#clock()),
+        });
+        await this.#onAccountsChanged();
+    }
+    async close() {
+        if (this.#closed)
+            return;
+        this.#closed = true;
+        for (const running of this.#running.values())
+            running.controller.abort();
+        await Promise.allSettled([...this.#running.values()].map(({ task }) => task));
+        this.#running.clear();
+    }
+}

package/dist/src/ilink/login-store.js

@@ -0,0 +1,197 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { normalizeIlinkBaseUrl } from './protocol/client.js';
+import { IlinkSecretBox } from './secret-box.js';
+const DEFAULT_TTL_MS = 5 * 60 * 1_000;
+const MAX_TTL_MS = 10 * 60 * 1_000;
+function sha256(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function secretGeneration(offerId) {
+    return Number.parseInt(sha256(offerId).slice(0, 12), 16);
+}
+function rowAs(value) {
+    return value === undefined ? undefined : value;
+}
+function mapped(row) {
+    return {
+        offerId: row.offer_id,
+        sourceMessageKey: row.source_message_key,
+        sourceOpenKfId: row.source_open_kfid,
+        sourceExternalUserId: row.source_external_userid,
+        apiBaseUrl: row.api_base_url,
+        status: row.status,
+        expiresAt: Number(row.expires_at),
+        lastPolledAt: Number(row.last_polled_at),
+        createdAt: Number(row.created_at),
+        updatedAt: Number(row.updated_at),
+    };
+}
+export class IlinkLoginStore {
+    #store;
+    #database;
+    #secrets;
+    #clock;
+    constructor({ store, database, secretBox, clock = Date.now, }) {
+        this.#store = store;
+        this.#database = database;
+        this.#secrets = secretBox;
+        this.#clock = clock;
+    }
+    #transaction(operation) {
+        if (this.#database.isTransaction)
+            return operation();
+        this.#database.exec('BEGIN IMMEDIATE');
+        try {
+            const result = operation();
+            this.#database.exec('COMMIT');
+            return result;
+        }
+        catch (error) {
+            this.#database.exec('ROLLBACK');
+            throw error;
+        }
+    }
+    #row(offerId) {
+        return rowAs(this.#database.prepare(`
+      SELECT * FROM ilink_login_offers WHERE offer_id = ?
+    `).get(offerId));
+    }
+    #runtime(row) {
+        return {
+            ...mapped(row),
+            qrCode: this.#secrets.open({
+                nonce: row.nonce,
+                ciphertext: row.ciphertext,
+                authTag: row.auth_tag,
+            }, {
+                secretKind: 'qr_token',
+                accountId: row.source_open_kfid,
+                peerId: row.source_external_userid,
+                generation: row.secret_generation,
+            }),
+        };
+    }
+    #expire(now = Number(this.#clock())) {
+        const expired = this.#database.prepare(`
+      SELECT * FROM ilink_login_offers
+      WHERE status IN ('waiting', 'scanned') AND expires_at <= ?
+    `).all(now);
+        for (const row of expired)
+            this.#finishRow(row, 'expired', '', now);
+    }
+    #finishRow(row, result, accountKey, now) {
+        this.#database.prepare(`
+      INSERT INTO ilink_enrollment_audit (
+        offer_id, source_message_key, source_open_kfid,
+        source_external_userid, account_key, result, offered_at, completed_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(offer_id) DO NOTHING
+    `).run(row.offer_id, row.source_message_key, row.source_open_kfid, row.source_external_userid, accountKey, result, row.created_at, now);
+        this.#database.prepare(`
+      DELETE FROM ilink_login_offers WHERE offer_id = ?
+    `).run(row.offer_id);
+    }
+    findForSession(sessionToken) {
+        const session = this.#store.getAgentSession(sessionToken);
+        if (session.channel !== 'wechat_kf')
+            throw new Error('Wrong channel for iLink offer');
+        return this.#transaction(() => {
+            this.#expire();
+            const row = rowAs(this.#database.prepare(`
+        SELECT * FROM ilink_login_offers
+        WHERE source_open_kfid = ? AND source_external_userid = ?
+          AND status IN ('waiting', 'scanned')
+      `).get(session.accountKey, session.peerId));
+            return row ? mapped(row) : undefined;
+        });
+    }
+    create({ sessionToken, qrCode, apiBaseUrl, ttlMs = DEFAULT_TTL_MS, }) {
+        const session = this.#store.getAgentSession(sessionToken);
+        if (session.channel !== 'wechat_kf')
+            throw new Error('Wrong channel for iLink offer');
+        if (!qrCode || Buffer.byteLength(qrCode, 'utf8') > 8_192) {
+            throw new Error('Invalid iLink QR token');
+        }
+        const lifetime = Math.max(1_000, Math.min(Number(ttlMs) || 0, MAX_TTL_MS));
+        const offerId = `qo_${randomBytes(20).toString('base64url')}`;
+        const generation = secretGeneration(offerId);
+        const sealed = this.#secrets.seal(qrCode, {
+            secretKind: 'qr_token',
+            accountId: session.accountKey,
+            peerId: session.peerId,
+            generation,
+        });
+        const now = Number(this.#clock());
+        return this.#transaction(() => {
+            this.#expire(now);
+            const existing = this.#database.prepare(`
+        SELECT 1 FROM ilink_login_offers
+        WHERE source_open_kfid = ? AND source_external_userid = ?
+          AND status IN ('waiting', 'scanned')
+      `).get(session.accountKey, session.peerId);
+            if (existing)
+                throw new Error('An iLink login offer is already pending');
+            this.#database.prepare(`
+        INSERT INTO ilink_login_offers (
+          offer_id, source_message_key, source_open_kfid,
+          source_external_userid, secret_generation,
+          nonce, ciphertext, auth_tag, api_base_url, status,
+          expires_at, last_polled_at, created_at, updated_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'waiting', ?, 0, ?, ?)
+      `).run(offerId, session.messageKey, session.accountKey, session.peerId, generation, sealed.nonce, sealed.ciphertext, sealed.authTag, normalizeIlinkBaseUrl(apiBaseUrl), now + lifetime, now, now);
+            return this.#runtime(this.#row(offerId));
+        });
+    }
+    listActive() {
+        return this.#transaction(() => {
+            this.#expire();
+            return this.#database.prepare(`
+        SELECT * FROM ilink_login_offers
+        WHERE status IN ('waiting', 'scanned') ORDER BY created_at
+      `).all().map((row) => this.#runtime(row));
+        });
+    }
+    isActive(offerId) {
+        return Boolean(this.#database.prepare(`
+      SELECT 1 FROM ilink_login_offers
+      WHERE offer_id = ? AND status IN ('waiting', 'scanned')
+        AND expires_at > ?
+    `).get(offerId, Number(this.#clock())));
+    }
+    update(offerId, input) {
+        const now = Number(this.#clock());
+        return this.#transaction(() => {
+            this.#expire(now);
+            const current = this.#row(offerId);
+            if (!current)
+                throw new Error('Unknown or expired iLink login offer');
+            this.#database.prepare(`
+        UPDATE ilink_login_offers
+        SET status = ?, api_base_url = ?, last_polled_at = ?, updated_at = ?
+        WHERE offer_id = ? AND status IN ('waiting', 'scanned')
+      `).run(input.status, input.apiBaseUrl
+                ? normalizeIlinkBaseUrl(input.apiBaseUrl)
+                : current.api_base_url, now, now, offerId);
+            return this.#runtime(this.#row(offerId));
+        });
+    }
+    finish(offerId, result = 'cancelled', accountKey = '') {
+        return this.#transaction(() => {
+            const row = this.#row(offerId);
+            if (!row)
+                return false;
+            this.#finishRow(row, result, accountKey, Number(this.#clock()));
+            return true;
+        });
+    }
+    cleanup(auditMaxAgeMs = 30 * 24 * 60 * 60 * 1_000) {
+        const maximumAge = Math.max(1, Number(auditMaxAgeMs) || 0);
+        return this.#transaction(() => {
+            const now = Number(this.#clock());
+            this.#expire(now);
+            return Number(this.#database.prepare(`
+        DELETE FROM ilink_enrollment_audit WHERE completed_at < ?
+      `).run(now - maximumAge).changes);
+        });
+    }
+}

package/dist/src/ilink/media-gateway.js

@@ -0,0 +1,83 @@
+import { downloadIlinkInboundImage, } from './inbound-image.js';
+import { IlinkSecretBox } from './secret-box.js';
+import { IlinkSqliteStore } from './sqlite-store.js';
+const MAX_IMAGES_PER_TURN = 4;
+const MAX_AGGREGATE_IMAGE_BYTES = 8 * 1024 * 1024;
+function imagePosition(mediaId) {
+    const match = /^ilink:(0|[1-9]\d?)$/u.exec(mediaId);
+    if (!match)
+        throw new Error('Invalid iLink image reference');
+    return Number(match[1]);
+}
+export class IlinkMediaGateway {
+    #store;
+    #secrets;
+    #download;
+    constructor({ store, secretBox, download = (imageItem) => downloadIlinkInboundImage(imageItem), }) {
+        this.#store = store;
+        this.#secrets = secretBox;
+        this.#download = download;
+    }
+    async resolveReference({ messageKey, mediaId, }) {
+        const stored = this.#store.getInboundImageSecret(messageKey, imagePosition(mediaId));
+        if (!stored)
+            throw new Error('iLink image reference is unavailable');
+        const plaintext = this.#secrets.open(stored.sealedLocator, {
+            secretKind: 'media_locator',
+            accountId: stored.accountKey,
+            peerId: stored.peerId,
+            generation: stored.secretGeneration,
+        });
+        let locator;
+        try {
+            locator = JSON.parse(plaintext);
+        }
+        catch {
+            throw new Error('iLink image locator is invalid');
+        }
+        if (!locator || typeof locator !== 'object' || Array.isArray(locator)) {
+            throw new Error('iLink image locator is invalid');
+        }
+        const { downloadUrl, aesKey } = locator;
+        if (typeof downloadUrl !== 'string' || typeof aesKey !== 'string' ||
+            !/^[A-Za-z0-9_-]{22}$/u.test(aesKey)) {
+            throw new Error('iLink image locator is invalid');
+        }
+        const key = Buffer.from(aesKey, 'base64url');
+        if (key.length !== 16 || key.toString('base64url') !== aesKey) {
+            key.fill(0);
+            throw new Error('iLink image locator is invalid');
+        }
+        try {
+            const resolved = await this.#download({
+                media: {
+                    full_url: downloadUrl,
+                    aes_key: key.toString('base64'),
+                },
+            });
+            return { kind: 'image', ...resolved };
+        }
+        finally {
+            key.fill(0);
+        }
+    }
+    async resolveForCodex(message) {
+        if (message.attachments.length > MAX_IMAGES_PER_TURN) {
+            throw new Error('Too many iLink images in one turn');
+        }
+        const resolved = [];
+        let total = 0;
+        for (const attachment of message.attachments) {
+            const image = await this.resolveReference({
+                messageKey: message.messageKey,
+                mediaId: attachment.mediaId,
+            });
+            total += image.bytes.length;
+            if (total > MAX_AGGREGATE_IMAGE_BYTES) {
+                throw new Error('iLink image aggregate exceeds the turn limit');
+            }
+            resolved.push(image);
+        }
+        return resolved;
+    }
+}