@zhin.js/adapter-dingtalk 1.0.81 → 1.1.2

package/lib/protocol.d.ts

@@ -0,0 +1,130 @@
+/**
+ * DingTalk protocol helpers — no legacy Adapter/Endpoint / segment-mapper.
+ * Canonicalization is owned by gateway/core before endpoint.send.
+ */
+import type { IncomingMessage } from 'node:http';
+import { type ConversationRef } from '@zhin.js/im-contract';
+/** One endpoint config after AdapterIndex expands `plugins.<instanceKey>.endpoints`. */
+export interface DingTalkEndpointConfig {
+    readonly id: string;
+    readonly appKey: string;
+    readonly appSecret: string;
+    readonly webhookPath?: string;
+    readonly robotCode?: string;
+    readonly apiBaseUrl?: string;
+}
+export interface ResolvedDingTalkConfig {
+    readonly context: 'dingtalk';
+    readonly id: string;
+    readonly appKey: string;
+    readonly appSecret: string;
+    readonly webhookPath: string;
+    readonly robotCode?: string;
+    readonly apiBaseUrl: string;
+}
+export interface DingTalkMessage {
+    readonly msgtype?: string;
+    readonly text?: {
+        readonly content?: string;
+    };
+    readonly msgId?: string;
+    readonly createAt?: number;
+    readonly conversationType?: string;
+    readonly conversationId?: string;
+    readonly senderId?: string;
+    readonly senderNick?: string;
+    readonly senderCorpId?: string;
+    readonly sessionWebhook?: string;
+    readonly chatbotCorpId?: string;
+    readonly chatbotUserId?: string;
+    readonly isAdmin?: boolean;
+    readonly senderStaffId?: string;
+    readonly atUsers?: ReadonlyArray<{
+        readonly dingtalkId?: string;
+        readonly staffId?: string;
+    }>;
+    readonly content?: Record<string, unknown>;
+}
+export interface DingTalkEvent extends DingTalkMessage {
+    readonly [key: string]: unknown;
+}
+/**
+ * 钉钉回调消息 @ 机器人判定：机器人被 @ 时回调带 `isInAtList: true`；
+ * 部分回调形态的 `atUserIds` / `atUsers[].dingtalkId` 会包含机器人 robotCode（来自配置）。
+ * 两者都不满足则不标注。
+ */
+export declare function isDingtalkBotMentioned(event: DingTalkMessage, robotCode?: string): boolean;
+export interface AccessToken {
+    token: string;
+    expires_in: number;
+    timestamp: number;
+}
+export interface DingTalkApiResponse {
+    readonly errcode: number;
+    readonly errmsg?: string;
+    readonly access_token?: string;
+    readonly expires_in?: number;
+    readonly msgId?: string;
+    readonly chatid?: string;
+    readonly result?: unknown;
+    readonly chat_info?: unknown;
+    readonly [key: string]: unknown;
+}
+export interface DingTalkWireSegment {
+    readonly type: string;
+    readonly data?: Record<string, unknown>;
+}
+export interface DingTalkSendBody {
+    readonly msgtype: string;
+    readonly text?: {
+        readonly content: string;
+    };
+    readonly picture?: {
+        readonly picURL: string;
+    };
+    readonly markdown?: {
+        readonly title: string;
+        readonly text: string;
+    };
+    readonly link?: {
+        readonly title: string;
+        readonly text: string;
+        readonly messageUrl?: string;
+        readonly picUrl?: string;
+    };
+    readonly at?: {
+        readonly atUserIds: string[];
+        readonly isAtAll: boolean;
+    };
+    readonly robotCode?: string;
+}
+export declare function resolveDingTalkConfig(config: DingTalkEndpointConfig): ResolvedDingTalkConfig;
+export declare function normalizeWebhookPath(path: string): string;
+export declare function resolveChatType(conversationType?: string): 'group' | 'private';
+/**
+ * 入站归一化 → ConversationRef：`conversationType: '2'` 为群会话（kind 'group'），
+ * 其余为单聊（kind 'private'）；会话原生 id 取 conversationId，缺省回退 senderId。
+ * 钉钉无 guild/频道容器概念，不产生 parent。
+ */
+export declare function dingtalkInboundConversation(endpointKey: string, msg: DingTalkMessage): ConversationRef;
+export declare function resolveSender(msg: DingTalkMessage): string;
+export declare function generateMessageId(msg: DingTalkMessage): string;
+/** Build inbound text for OutboundMessageService.receive. */
+export declare function formatInboundContent(msg: DingTalkMessage): string;
+/** DingTalk timestamps are epoch milliseconds; reject replays outside ±1 hour. */
+export declare const MAX_TIMESTAMP_DRIFT_MS: number;
+export declare function verifySignature(appSecret: string, timestamp: string, sign: string): boolean;
+/**
+ * Wire-encode an already-rendered outbound payload into DingTalk robot body.
+ * Segment canonicalization is intentionally not done here: media segments carry
+ * the canonical `data.media` MediaRef and nothing else is consulted.
+ *
+ * 钉钉机器人媒体消息仅支持远程 URL（picture.picURL）：
+ * - image 段 kind=url → 直发 picture；
+ * - 其余 kind / audio / video / file 段无投递面，warn + 丢弃。
+ */
+export declare function formatOutboundBody(payload: unknown): DingTalkSendBody;
+export declare function headerValue(headers: IncomingMessage['headers'], name: string): string;
+export declare function readTextBody(request: IncomingMessage, options?: {
+    readonly limit?: number;
+}): Promise<string>;

package/lib/protocol.js

@@ -0,0 +1,264 @@
+/**
+ * DingTalk protocol helpers — no legacy Adapter/Endpoint / segment-mapper.
+ * Canonicalization is owned by gateway/core before endpoint.send.
+ */
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { isMediaRef } from '@zhin.js/im-contract';
+import { formatCompact, getLogger } from '@zhin.js/logger';
+const logger = getLogger('dingtalk');
+/**
+ * 钉钉回调消息 @ 机器人判定：机器人被 @ 时回调带 `isInAtList: true`；
+ * 部分回调形态的 `atUserIds` / `atUsers[].dingtalkId` 会包含机器人 robotCode（来自配置）。
+ * 两者都不满足则不标注。
+ */
+export function isDingtalkBotMentioned(event, robotCode) {
+    const extra = event;
+    if (extra.isInAtList === true)
+        return true;
+    if (!robotCode)
+        return false;
+    if (Array.isArray(extra.atUserIds) && extra.atUserIds.some((id) => String(id) === robotCode)) {
+        return true;
+    }
+    return (event.atUsers ?? []).some((user) => user.dingtalkId === robotCode);
+}
+export function resolveDingTalkConfig(config) {
+    const id = requiredEndpointField(config.id, 'id');
+    const appKey = requiredEndpointField(config.appKey, 'appKey');
+    const appSecret = requiredEndpointField(config.appSecret, 'appSecret');
+    const webhookPath = normalizeWebhookPath(config.webhookPath ?? '/dingtalk/webhook');
+    const apiBaseUrl = (config.apiBaseUrl ?? 'https://oapi.dingtalk.com').replace(/\/$/, '');
+    const robotCode = config.robotCode;
+    return {
+        context: 'dingtalk',
+        id,
+        appKey,
+        appSecret,
+        webhookPath,
+        ...(robotCode ? { robotCode } : {}),
+        apiBaseUrl,
+    };
+}
+function requiredEndpointField(value, field) {
+    if (typeof value !== 'string' || !value.trim()) {
+        throw new TypeError(`DingTalk endpoint requires a non-empty ${field}`);
+    }
+    return value.trim();
+}
+export function normalizeWebhookPath(path) {
+    const trimmed = path.trim() || '/dingtalk/webhook';
+    return trimmed.startsWith('/') ? trimmed : `/${trimmed}`;
+}
+export function resolveChatType(conversationType) {
+    return conversationType === '2' ? 'group' : 'private';
+}
+/**
+ * 入站归一化 → ConversationRef：`conversationType: '2'` 为群会话（kind 'group'），
+ * 其余为单聊（kind 'private'）；会话原生 id 取 conversationId，缺省回退 senderId。
+ * 钉钉无 guild/频道容器概念，不产生 parent。
+ */
+export function dingtalkInboundConversation(endpointKey, msg) {
+    return {
+        endpoint: { id: endpointKey, adapter: endpointKey.split('\0')[0] ?? endpointKey },
+        kind: resolveChatType(msg.conversationType),
+        id: msg.conversationId || msg.senderId || 'unknown',
+    };
+}
+export function resolveSender(msg) {
+    return msg.senderId || msg.senderStaffId || 'unknown';
+}
+export function generateMessageId(msg) {
+    return msg.msgId || `${msg.createAt ?? Date.now()}`;
+}
+/** Build inbound text for OutboundMessageService.receive. */
+export function formatInboundContent(msg) {
+    if (!msg.msgtype)
+        return '';
+    switch (msg.msgtype) {
+        case 'text':
+            return msg.text?.content || '';
+        case 'picture':
+            return '[image]';
+        case 'file': {
+            const name = typeof msg.content?.fileName === 'string' ? msg.content.fileName : '';
+            return name ? `[file: ${name}]` : '[file]';
+        }
+        case 'audio':
+            return '[audio]';
+        case 'video':
+            return '[video]';
+        case 'richText': {
+            const rich = msg.content?.richText;
+            if (Array.isArray(rich)) {
+                return rich
+                    .map((item) => (item && typeof item === 'object' && 'text' in item
+                    ? String(item.text || '')
+                    : ''))
+                    .join('');
+            }
+            return '[richText]';
+        }
+        case 'markdown':
+            return typeof msg.content?.text === 'string' ? msg.content.text : '[markdown]';
+        default:
+            return `[${msg.msgtype}]`;
+    }
+}
+/** DingTalk timestamps are epoch milliseconds; reject replays outside ±1 hour. */
+export const MAX_TIMESTAMP_DRIFT_MS = 60 * 60 * 1000;
+export function verifySignature(appSecret, timestamp, sign) {
+    try {
+        const ts = Number(timestamp);
+        if (!Number.isFinite(ts) || Math.abs(Date.now() - ts) > MAX_TIMESTAMP_DRIFT_MS) {
+            return false;
+        }
+        const stringToSign = `${timestamp}\n${appSecret}`;
+        const hmac = createHmac('sha256', appSecret);
+        hmac.update(stringToSign);
+        const calculated = hmac.digest('base64');
+        const a = Buffer.from(calculated);
+        const b = Buffer.from(sign);
+        if (a.length !== b.length)
+            return false;
+        return timingSafeEqual(a, b);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Wire-encode an already-rendered outbound payload into DingTalk robot body.
+ * Segment canonicalization is intentionally not done here: media segments carry
+ * the canonical `data.media` MediaRef and nothing else is consulted.
+ *
+ * 钉钉机器人媒体消息仅支持远程 URL（picture.picURL）：
+ * - image 段 kind=url → 直发 picture；
+ * - 其余 kind / audio / video / file 段无投递面，warn + 丢弃。
+ */
+export function formatOutboundBody(payload) {
+    if (typeof payload === 'string') {
+        return { msgtype: 'text', text: { content: payload } };
+    }
+    const items = Array.isArray(payload)
+        ? payload
+        : payload && typeof payload === 'object' && 'type' in payload
+            ? [payload]
+            : [];
+    if (items.length === 0) {
+        const text = payload == null
+            ? ''
+            : typeof payload === 'object'
+                ? JSON.stringify(payload)
+                : String(payload);
+        return { msgtype: 'text', text: { content: text } };
+    }
+    const textParts = [];
+    const atUserIds = [];
+    let media = null;
+    let markdownTitle;
+    for (const item of items) {
+        if (typeof item === 'string') {
+            textParts.push(item);
+            continue;
+        }
+        const data = item.data ?? {};
+        switch (item.type) {
+            case 'text':
+                textParts.push(String(data.content ?? data.text ?? ''));
+                break;
+            case 'at': {
+                const userId = data.id ?? data.userId;
+                if (userId) {
+                    atUserIds.push(String(userId));
+                    textParts.push(`@${String(data.name || userId)} `);
+                }
+                break;
+            }
+            case 'image': {
+                if (media)
+                    break;
+                const ref = data.media;
+                if (isMediaRef(ref) && ref.kind === 'url') {
+                    media = {
+                        msgtype: 'picture',
+                        picture: { picURL: ref.value },
+                    };
+                    break;
+                }
+                logger.warn(formatCompact({
+                    op: 'dingtalk_outbound_media_dropped',
+                    type: item.type,
+                    reason: isMediaRef(ref) ? `unsupported_kind:${ref.kind}` : 'missing_media_ref',
+                }));
+                break;
+            }
+            case 'audio':
+            case 'video':
+            case 'file':
+                // 钉钉机器人无音频/视频/文件投递面，warn + 丢弃
+                logger.warn(formatCompact({
+                    op: 'dingtalk_outbound_media_dropped',
+                    type: item.type,
+                    reason: 'undeliverable_msgtype',
+                }));
+                break;
+            case 'markdown':
+                markdownTitle ??= String(data.title || '消息');
+                textParts.push(String(data.content ?? data.text ?? ''));
+                break;
+            case 'link':
+                if (!media) {
+                    media = {
+                        msgtype: 'link',
+                        link: {
+                            title: String(data.title || '链接'),
+                            text: String(data.text ?? data.content ?? ''),
+                            messageUrl: typeof data.url === 'string' ? data.url : undefined,
+                            picUrl: typeof data.picUrl === 'string' ? data.picUrl : undefined,
+                        },
+                    };
+                }
+                break;
+            default:
+                textParts.push(`[${item.type}]`);
+        }
+    }
+    if (media)
+        return media;
+    if (markdownTitle !== undefined) {
+        return {
+            msgtype: 'markdown',
+            markdown: { title: markdownTitle, text: textParts.join('') },
+            ...(atUserIds.length > 0 ? { at: { atUserIds, isAtAll: false } } : {}),
+        };
+    }
+    const result = {
+        msgtype: 'text',
+        text: { content: textParts.join('') },
+    };
+    if (atUserIds.length > 0) {
+        return { ...result, at: { atUserIds, isAtAll: false } };
+    }
+    return result;
+}
+export function headerValue(headers, name) {
+    const value = headers[name] ?? headers[name.toLowerCase()];
+    if (Array.isArray(value))
+        return value[0] ?? '';
+    return value ?? '';
+}
+export async function readTextBody(request, options = {}) {
+    const limit = options.limit ?? 1_048_576;
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of request) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        size += buffer.length;
+        if (size > limit) {
+            request.destroy();
+            throw new Error(`Request body exceeds ${limit} bytes`);
+        }
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}

package/lib/webhook.d.ts

@@ -0,0 +1,13 @@
+/**
+ * DingTalk webhook HTTP: signature → parse → admit.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { HttpHost, HttpRouteRegistration } from '@zhin.js/host-http';
+import { type DingTalkEvent, type ResolvedDingTalkConfig } from './protocol.js';
+export interface DingTalkWebhookHandler {
+    readonly config: ResolvedDingTalkConfig;
+    readonly isOpen: boolean;
+    admit(event: DingTalkEvent): void;
+}
+export declare function registerDingTalkWebhookRoutes(http: HttpHost, handler: DingTalkWebhookHandler): HttpRouteRegistration[];
+export declare function handleDingTalkWebhookRequest(request: IncomingMessage, response: ServerResponse, handler: DingTalkWebhookHandler): Promise<void>;

package/lib/webhook.js

@@ -0,0 +1,47 @@
+import { formatCompact, getLogger } from '@zhin.js/logger';
+import { headerValue, readTextBody, verifySignature, } from './protocol.js';
+const logger = getLogger('dingtalk');
+export function registerDingTalkWebhookRoutes(http, handler) {
+    const path = handler.config.webhookPath;
+    return [
+        http.route('POST', path, async (request, response) => {
+            await handleDingTalkWebhookRequest(request, response, handler);
+        }, { summary: 'DingTalk robot webhook', tags: ['dingtalk'] }),
+    ];
+}
+export async function handleDingTalkWebhookRequest(request, response, handler) {
+    try {
+        // DingTalk outgoing callbacks put timestamp/sign on the URL query;
+        // headers are accepted as a fallback for legacy senders.
+        const query = new URL(request.url ?? '/', 'http://localhost').searchParams;
+        const timestamp = query.get('timestamp') || headerValue(request.headers, 'timestamp');
+        const sign = query.get('sign') || headerValue(request.headers, 'sign');
+        // Missing credentials must never be admitted: verify unconditionally.
+        if (!timestamp || !sign || !verifySignature(handler.config.appSecret, timestamp, sign)) {
+            logger.warn(formatCompact({ op: 'webhook', ok: false, error: 'invalid signature' }));
+            response.writeHead(403, { 'Content-Type': 'application/json' });
+            response.end(JSON.stringify({ code: -1, msg: 'Forbidden' }));
+            return;
+        }
+        const rawBody = await readTextBody(request);
+        let event;
+        try {
+            event = JSON.parse(rawBody);
+        }
+        catch {
+            response.writeHead(200, { 'Content-Type': 'application/json' });
+            response.end(JSON.stringify({ code: 0, msg: 'success' }));
+            return;
+        }
+        if (event.msgtype && handler.isOpen) {
+            handler.admit(event);
+        }
+        response.writeHead(200, { 'Content-Type': 'application/json' });
+        response.end(JSON.stringify({ code: 0, msg: 'success' }));
+    }
+    catch (error) {
+        logger.error('Webhook error:', error);
+        response.writeHead(500, { 'Content-Type': 'application/json' });
+        response.end(JSON.stringify({ code: -1, msg: 'Internal Server Error' }));
+    }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zhin.js/adapter-dingtalk",
-  "version": "1.0.81",
-  "description": "Zhin.js adapter for DingTalk (钉钉)",
+  "version": "1.1.2",
+  "description": "Zhin.js DingTalk (钉钉) adapter for Plugin Runtime (HTTP webhook)",
   "type": "module",
   "main": "./lib/index.js",
   "types": "./lib/index.d.ts",
@@ -32,39 +32,96 @@
     "type": "git",
     "directory": "plugins/adapters/dingtalk"
   },
-  "devDependencies": {
-    "@types/koa": "^3.0.3",
-    "@types/node": "^25.9.1",
-    "typescript": "^6.0.3",
-    "zhin.js": "1.0.93"
+  "dependencies": {
+    "@zhin.js/adapter": "1.1.14",
+    "@zhin.js/agent-feature": "1.1.1",
+    "@zhin.js/core": "1.1.37",
+    "@zhin.js/feature-kit": "1.1.1",
+    "@zhin.js/host-http": "1.1.1",
+    "@zhin.js/im-contract": "1.1.1",
+    "@zhin.js/logger": "1.1.1",
+    "@zhin.js/skill": "1.1.1",
+    "@zhin.js/tool": "1.1.1"
   },
   "peerDependencies": {
-    "@zhin.js/host-router": "0.0.3",
-    "zhin.js": "1.0.93"
+    "zod": "^4.0.0",
+    "@zhin.js/adapter": "^1.1.14",
+    "@zhin.js/command": "^1.1.1",
+    "@zhin.js/core": "^1.1.37",
+    "@zhin.js/host-http": "^1.1.1",
+    "@zhin.js/permission": "^1.1.1",
+    "zhin.js": "^1.1.2"
   },
   "peerDependenciesMeta": {
-    "@zhin.js/host-router": {
-      "optional": false
+    "@zhin.js/command": {
+      "optional": true
+    },
+    "zhin.js": {
+      "optional": true
+    },
+    "zod": {
+      "optional": true
     }
   },
+  "devDependencies": {
+    "@types/node": "^26.1.2",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.10",
+    "zod": "^4.4.3",
+    "zhin.js": "1.1.2"
+  },
   "files": [
+    "adapters",
+    "commands",
+    "plugin.js",
+    "schema.json",
     "src",
     "lib",
-    "client",
-    "dist",
-    "skills",
-    "plugin.yml",
+    "agents",
     "README.md",
-    "node",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "PERMITS.md"
   ],
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org"
   },
+  "engines": {
+    "node": "^20.19.0 || >=22.12.0"
+  },
+  "zhin": {
+    "protocol": 1,
+    "type": "plugin",
+    "entry": "./plugin.js",
+    "engine": "^1.0.0",
+    "runtime": "trusted",
+    "features": [
+      {
+        "package": "@zhin.js/adapter",
+        "api": "^1.0.0"
+      },
+      {
+        "package": "@zhin.js/command",
+        "api": "^1.0.0"
+      },
+      {
+        "package": "@zhin.js/tool",
+        "api": "^1.0.0"
+      },
+      {
+        "package": "@zhin.js/skill",
+        "api": "^1.0.0"
+      },
+      {
+        "package": "@zhin.js/agent-feature",
+        "api": "^1.0.0"
+      }
+    ],
+    "plugins": []
+  },
   "scripts": {
-    "build": "pnpm build:node",
+    "build": "tsc",
     "clean": "rimraf lib",
-    "build:node": "tsc"
+    "test": "NODE_OPTIONS=--experimental-strip-types vitest run --root ../../.. plugins/adapters/dingtalk/tests"
   }
 }

package/plugin.js

@@ -0,0 +1,19 @@
+// Generated by build-plugin-runtime-entries.mjs. Do not edit.
+import { createEndpointRuntimeState } from 'zhin.js/adapter';
+import { definePlugin } from 'zhin.js';
+import { permissionHostToken } from '@zhin.js/permission';
+import { checkDingtalkPlatformPermit } from "./lib/platform-permit.js";
+import { dingtalkRuntimeStateToken } from "./lib/dingtalk-runtime-state.js";
+export default definePlugin({
+    name: 'dingtalk',
+    metadata: {
+        displayName: 'DingTalk (钉钉) Adapter',
+    },
+    setup(context) {
+        context.resources.provide(dingtalkRuntimeStateToken, createEndpointRuntimeState());
+        if (context.resources.has(permissionHostToken)) {
+            const host = context.resources.use(permissionHostToken);
+            return host.registerPlatform('dingtalk', checkDingtalkPlatformPermit);
+        }
+    },
+});