dlinkclaw-openclaw 2026.8.24-alpha.1

package/dist/src/channel.js

@@ -0,0 +1,153 @@
+import pkg from '../package.json' with { type: 'json' };
+import { monitorDuolinkProvider } from "./monitor.js";
+import { checkConfigured, deleteDLAccount, listDLConfiguredAccountIds, resolveDefaultDLAccountId, resolveDLAccount, setDLChannelAccountEnabled, dlSetupWizard, dlSetupAdapter, dlAccountStatus, dlDescribeAccount } from "./account.js";
+import { formatPairingApproveHint } from "openclaw/plugin-sdk/core";
+import { getDLLogger } from "./runtime.js";
+import { dlOutbound, dlPairing } from "./outbound.js";
+export const channelMeta = pkg.openclaw.channel;
+export const LOG_TAG = channelMeta.selectionLabel;
+const channelId = channelMeta.id;
+export const dlChannel = {
+    id: channelId,
+    meta: {
+        ...channelMeta,
+    },
+    configSchema: {
+        schema: {
+            type: "object",
+            additionalProperties: true,
+            properties: {
+                enabled: { type: "boolean" },
+                apiKey: { type: "string" },
+                secret: { type: "string" },
+                baseUrl: { type: "string" }
+            }
+        }
+    },
+    capabilities: {
+        chatTypes: ['direct', 'group'],
+        reactions: true,
+        polls: false,
+        edit: false,
+        groupManagement: false,
+        threads: true,
+        reply: true,
+        media: true,
+        nativeCommands: true,
+        blockStreaming: true,
+    },
+    setupWizard: dlSetupWizard(channelId),
+    setup: dlSetupAdapter(channelId),
+    status: dlAccountStatus(channelId),
+    agentPrompt: {
+        messageToolHints: () => {
+            return [
+                // 2026-08-24 优化：target 格式补齐第 4 段 relayId（与 message.ts fromLabel 4 段格式保持一致，
+                // 否则 dl-client.ts autoReply 解析不到 relayId，出站消息无法路由到正确中继）
+                `- ${channelId} targeting: omit 'target' to reply to the current conversation (auto-inferred). Explicit targets: 'user:<userId>-<botId>-<botType>-<relayId>' or 'group:<chatId>-<botId>-<botType>-<relayId>'.`,
+                `- Example for user: user:I27484094711599104-I27484094749347841-{ewx|qq|dd|feishu|dLink}-<relayId> (botType varies by client).`,
+                `- Example for group: group:I27484094711599104-I27484094749347841-{ewx|qq|dd|feishu|dLink}-<relayId> (botType varies by client).`,
+                `- ${channelId} outbound with markdown text or media file upload can be realized.`,
+                `- **Outbound delivery**: All messages MUST route through ${channelId} channel. Never use webchat.`,
+                `- When creating cron jobs: always set delivery.channel: "${channelId}" and delivery.to: "${channelId}:group:<chatId>-<botId>-{dLink|ewx|qq|dd|feishu}-<relayId>" — botType depends on the client. Extract it from the current incoming message address. Omitting channel silently falls back to webchat.`,
+                `- When using the message tool: always channel: "${channelId}"`,
+                // 2026-08-24 新增：发送媒体/文件后必须补发一条文本确认，禁止静默（NO_REPLY）。
+                // 否则客户端 UI 一直显示"工作/转圈"状态（等不到完成信号），石头哥已明确要求。
+                `- **After sending media/files via the message tool, ALWAYS follow up with a short text confirmation (e.g. "✅ 已发出 3 个文件：a.png / b.pdf / c.txt"). Never reply NO_REPLY or stay silent after a media send — the client keeps showing a spinner/working state until it receives a final text reply.`,
+            ];
+        }
+    },
+    reload: {
+        configPrefixes: [
+            `channels.${channelId}`
+        ]
+    },
+    config: {
+        listAccountIds: (cfg) => listDLConfiguredAccountIds(cfg, channelId),
+        resolveAccount: (cfg, accountId) => resolveDLAccount({ cfg, accountId }, channelId),
+        defaultAccountId: (cfg) => resolveDefaultDLAccountId(cfg, channelId),
+        setAccountEnabled: (params) => setDLChannelAccountEnabled(params, channelId),
+        deleteAccount: (params) => deleteDLAccount(params, channelId),
+        isConfigured: (account) => {
+            const configured = checkConfigured(account.config);
+            account.config.configured = configured;
+            return configured;
+        },
+        describeAccount: (account, cfg) => dlDescribeAccount({ account, cfg }),
+        //暂时关闭inspectAccount: (cfg, accountId) => dlInspectAccount({ cfg, accountId, channelId })
+    },
+    resolver: {
+        //未了解其作用!,测试以观察日志
+        resolveTargets: (params) => {
+            const { accountId, inputs, kind, runtime } = params;
+            const logger = getDLLogger();
+            logger.info(`ResolveTargets account[${accountId}], kind=${kind}, input=[${inputs.join('')}]`);
+            const result = inputs.map(item => {
+                return {
+                    input: item,
+                    id: accountId || '',
+                    resolved: true
+                };
+            });
+            return new Promise((ok) => {
+                ok(result);
+            });
+        }
+    },
+    messaging: {
+        normalizeTarget(raw) {
+            const trimmed = raw.trim();
+            const logger = getDLLogger();
+            logger.info(`Messaging[normalizeTarget] target normalized >>> ${trimmed}`);
+            if (!trimmed)
+                return undefined;
+            return trimmed;
+        },
+        targetResolver: {
+            looksLikeId: (id) => {
+                const trimmed = id?.trim();
+                return Boolean(trimmed);
+            },
+            hint: "<userId|groupId>",
+        },
+        formatTargetDisplay(params) {
+            getDLLogger().info('Messaging[formatTargetDisplay]:' + JSON.stringify(params));
+            return `FormatTargetDisplay: ${params.target}`;
+        }
+    },
+    security: {
+        resolveDmPolicy: ({ account }) => {
+            const basePath = `channels.${channelId}.`;
+            return {
+                policy: account.config.dmPolicy ?? "pairing",
+                allowFrom: account.config.allowFrom ?? [],
+                policyPath: `${basePath}dmPolicy`,
+                allowFromPath: basePath,
+                approveHint: formatPairingApproveHint(channelId),
+                normalizeEntry: (raw) => {
+                    getDLLogger().info('Security[resolveDmPolicy]:' + raw);
+                    const result = raw.replace(new RegExp(`^${channelId}:`, "i"), "").trim();
+                    getDLLogger().info('Security[resolveDmPolicy]:' + result);
+                    return result;
+                },
+            };
+        }
+    },
+    pairing: dlPairing(channelId),
+    outbound: dlOutbound(),
+    gateway: {
+        startAccount: async (ctx) => {
+            ctx.setStatus({
+                accountId: ctx.accountId,
+                lastStartAt: Date.now()
+            });
+            return monitorDuolinkProvider({
+                config: ctx.cfg,
+                runtime: ctx.runtime,
+                abortSignal: ctx.abortSignal,
+                accountId: ctx.accountId,
+                channelId
+            });
+        },
+    }
+};

package/dist/src/client/client-manager.d.ts

@@ -0,0 +1,4 @@
+import { DLClient } from "./dl-client.js";
+export declare const getDLClient: (accountId: string) => DLClient | null;
+export declare const setDLClient: (accountId: string, client: DLClient) => void;
+export declare const removeDLClient: (accountId: string) => void;

package/dist/src/client/client-manager.js

@@ -0,0 +1,10 @@
+const dlClients = new Map();
+export const getDLClient = (accountId) => {
+    return dlClients.get(accountId) ?? null;
+};
+export const setDLClient = (accountId, client) => {
+    dlClients.set(accountId, client);
+};
+export const removeDLClient = (accountId) => {
+    dlClients.delete(accountId);
+};

package/dist/src/client/const.d.ts

@@ -0,0 +1,37 @@
+/** 仅包含图片时的消息占位符 */
+export declare const MEDIA_IMAGE_PLACEHOLDER = "<media:image>";
+export declare const MEDIA_VOICE_PLACEHOLDER = "<media:audio>";
+export declare const MEDIA_VIDEO_PLACEHOLDER = "<media:video>";
+/** 仅包含文件时的消息占位符 */
+export declare const MEDIA_DOCUMENT_PLACEHOLDER = "<media:document>";
+/** 默认媒体大小上限（MB）——插件↔服务端链路（下载/上传）的兜底限制 */
+export declare const DEFAULT_MEDIA_MAX_MB = 50;
+/**
+ * 2026-08-23 安装时写入 openclaw.json 的默认媒体上限（MB）
+ * 注意：OpenClaw 核心出站媒体校验读取的是 channels.<id>.mediaMaxMb（默认仅 5MB），
+ * 与 DEFAULT_MEDIA_MAX_MB（插件↔服务端）无关。安装向导写入本值后，核心出站即放行。
+ */
+export declare const DEFAULT_INSTALL_MEDIA_MAX_MB = 100;
+/** 文本分块大小上限 */
+export declare const TEXT_CHUNK_LIMIT = 4000;
+/** 图片下载超时时间（毫秒） */
+export declare const IMAGE_DOWNLOAD_TIMEOUT_MS: number;
+/** 文件下载超时时间（毫秒） */
+export declare const FILE_DOWNLOAD_TIMEOUT_MS: number;
+/** 消息发送超时时间（毫秒） */
+export declare const REPLY_SEND_TIMEOUT_MS = 15000;
+/**
+ * 主动回复API
+ */
+export declare const AUTO_RELAY_API = "/guest/relayBot/sendNotification";
+export declare const AUTO_RELAY_UPLOAD = "/guest/relayBot/uploadMediaFiles";
+export declare const FILE_LIMITS: {
+    image: {
+        maxSize: number;
+    };
+    attachment: {
+        maxSize: number;
+    };
+};
+export declare const IMAGE_EXTS: Set<string>;
+export type ATTACHMENT_KINK = "image" | "video" | "audio" | "document" | "unknown" | undefined;

package/dist/src/client/const.js

@@ -0,0 +1,155 @@
+/** 仅包含图片时的消息占位符 */
+export const MEDIA_IMAGE_PLACEHOLDER = "<media:image>";
+export const MEDIA_VOICE_PLACEHOLDER = "<media:audio>";
+export const MEDIA_VIDEO_PLACEHOLDER = "<media:video>";
+/** 仅包含文件时的消息占位符 */
+export const MEDIA_DOCUMENT_PLACEHOLDER = "<media:document>";
+/** 默认媒体大小上限（MB）——插件↔服务端链路（下载/上传）的兜底限制 */
+export const DEFAULT_MEDIA_MAX_MB = 50;
+/**
+ * 2026-08-23 安装时写入 openclaw.json 的默认媒体上限（MB）
+ * 注意：OpenClaw 核心出站媒体校验读取的是 channels.<id>.mediaMaxMb（默认仅 5MB），
+ * 与 DEFAULT_MEDIA_MAX_MB（插件↔服务端）无关。安装向导写入本值后，核心出站即放行。
+ */
+export const DEFAULT_INSTALL_MEDIA_MAX_MB = 100;
+/** 文本分块大小上限 */
+export const TEXT_CHUNK_LIMIT = 4000;
+/** 图片下载超时时间（毫秒） */
+export const IMAGE_DOWNLOAD_TIMEOUT_MS = 60_000 * 2;
+/** 文件下载超时时间（毫秒） */
+export const FILE_DOWNLOAD_TIMEOUT_MS = 60_000 * 5;
+/** 消息发送超时时间（毫秒） */
+export const REPLY_SEND_TIMEOUT_MS = 15_000;
+/**
+ * 主动回复API
+ */
+export const AUTO_RELAY_API = '/guest/relayBot/sendNotification';
+export const AUTO_RELAY_UPLOAD = "/guest/relayBot/uploadMediaFiles";
+// ====== 上传文件配置常量（根据服务器性能调整）=======
+export const FILE_LIMITS = {
+    image: { maxSize: 10 * 1024 * 1024 }, // 图片 10MB
+    attachment: { maxSize: 50 * 1024 * 1024 }, // 附件 50MB
+};
+const IMAGE_TYPES = ['.jpg', '.jpeg', '.png', '.bmp', '.gif', '.webp'];
+export const IMAGE_EXTS = new Set(IMAGE_TYPES);
+//export const ATTACHMENT_EXTS = new Set([
+//     // ====== 图片 ======
+//     ...IMAGE_TYPES,
+//     // ====== Office 文档 ======
+//     '.doc', '.docx', '.xls', '.xlsx', '.ppt', '.pptx',
+//     // ====== 文本/代码（AI 最常处理的） ======
+//     '.txt', '.csv', '.json', '.xml', '.yaml', '.yml', '.md', '.log',
+//     // ====== PDF ======
+//     '.pdf',
+//     // ====== 压缩包 ======
+//     '.zip', '.rar', '.7z', '.tar', '.gz',
+//     // ====== 代码源文件 ======
+//     '.js', '.ts', '.jsx', '.tsx', '.py', '.java', '.go', '.rs',
+//     '.c', '.cpp', '.h', '.hpp', '.cs', '.php', '.rb', '.swift',
+//     '.kt', '.sh', '.bat', '.ps1', '.sql', '.css', '.scss', '.less',
+//     '.html', '.vue', '.svelte',
+//     // ====== 配置文件 ======
+//     '.env', '.toml', '.ini', '.cfg',
+//     // ====== 电子书/文档 ======
+//     '.epub', '.mobi',
+//     // ====== 音频 ======
+//     '.mp3', '.wav', '.ogg', '.m4a', '.flac', '.aac', '.wma', '.opus',
+//     // ====== 视频 ======
+//     '.mp4', '.avi', '.mov', '.wmv', '.flv', '.mkv', '.webm', '.m4v', '.mpg', '.mpeg', '.3gp'
+// 
+//])
+// export const ATTACHMENT_TYPE: Record<string, string> = {
+//     // ====== 图片类型 ======
+//     'image/jpeg': '.jpg',
+//     'image/jpg': '.jpg',
+//     'image/png': '.png',
+//     'image/gif': '.gif',
+//     'image/webp': '.webp',
+//     'image/bmp': '.bmp',
+//     'image/svg+xml': '.svg',
+//     'image/tiff': '.tiff',
+//     // ====== Office 文档 ======
+//     'application/msword': '.doc',
+//     'application/vnd.openxmlformats-officedocument.wordprocessingml.document': '.docx',
+//     'application/vnd.ms-excel': '.xls',
+//     'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet': '.xlsx',
+//     'application/vnd.ms-powerpoint': '.ppt',
+//     'application/vnd.openxmlformats-officedocument.presentationml.presentation': '.pptx',
+//     // ====== 文本/代码 ======
+//     'text/plain': '.txt',
+//     'text/csv': '.csv',
+//     'application/json': '.json',
+//     'application/xml': '.xml',
+//     'text/xml': '.xml',
+//     'text/yaml': '.yaml',
+//     'application/x-yaml': '.yml',
+//     'text/markdown': '.md',
+//     'text/x-log': '.log',
+//     // ====== PDF ======
+//     'application/pdf': '.pdf',
+//     // ====== 压缩包 ======
+//     'application/zip': '.zip',
+//     'application/x-rar-compressed': '.rar',
+//     'application/x-7z-compressed': '.7z',
+//     'application/x-tar': '.tar',
+//     'application/gzip': '.gz',
+//     // ====== 代码源文件 ======
+//     'application/javascript': '.js',
+//     'text/javascript': '.js',
+//     'application/typescript': '.ts',
+//     'text/typescript': '.ts',
+//     'text/jsx': '.jsx',
+//     'text/tsx': '.tsx',
+//     'text/x-python': '.py',
+//     'text/x-java': '.java',
+//     'text/x-go': '.go',
+//     'text/x-rust': '.rs',
+//     'text/x-c': '.c',
+//     'text/x-c++': '.cpp',
+//     'text/x-csharp': '.cs',
+//     'text/x-php': '.php',
+//     'text/x-ruby': '.rb',
+//     'text/x-swift': '.swift',
+//     'text/x-kotlin': '.kt',
+//     'text/x-shellscript': '.sh',
+//     'application/x-bat': '.bat',
+//     'text/x-powershell': '.ps1',
+//     'text/x-sql': '.sql',
+//     'text/css': '.css',
+//     'text/scss': '.scss',
+//     'text/less': '.less',
+//     'text/html': '.html',
+//     'application/vue': '.vue',
+//     // ====== 配置文件 ======
+//     'text/x-env': '.env',
+//     'application/toml': '.toml',
+//     'text/ini': '.ini',
+//     'text/x-cfg': '.cfg',
+//     // ====== 电子书/文档 ======
+//     'application/epub+zip': '.epub',
+//     'application/x-mobipocket-ebook': '.mobi',
+//     // ====== 音频 ======
+//     'audio/mpeg': '.mp3',
+//     'audio/mp3': '.mp3',
+//     'audio/wav': '.wav',
+//     'audio/x-wav': '.wav',
+//     'audio/ogg': '.ogg',
+//     'audio/opus': '.opus',
+//     'audio/mp4': '.m4a',
+//     'audio/x-m4a': '.m4a',
+//     'audio/flac': '.flac',
+//     'audio/x-flac': '.flac',
+//     'audio/aac': '.aac',
+//     'audio/x-ms-wma': '.wma',
+//     // ====== 视频 ======
+//     'video/mp4': '.mp4',
+//     'video/mpeg': '.mpeg',
+//     'video/x-msvideo': '.avi',
+//     'video/quicktime': '.mov',
+//     'video/x-ms-wmv': '.wmv',
+//     'video/x-flv': '.flv',
+//     'video/x-matroska': '.mkv',
+//     'video/webm': '.webm',
+//     'video/x-m4v': '.m4v',
+//     'video/3gpp': '.3gp'
+// };

package/dist/src/client/crypto.d.ts

@@ -0,0 +1,47 @@
+import { MqttConfig } from "./dl-client.js";
+export type DeviceConfig = {
+    deviceId: string;
+    publicKey: string;
+    publicKeyPem: string;
+    privateKeyPem: string;
+    deviceToken?: string;
+};
+export declare function reqBootstrapToken(gatewayUrl: string): Promise<string>;
+export declare function getDeviceId(): string;
+export declare function getDeviceConfig(): DeviceConfig;
+export declare function saveDeviceConfig(config: DeviceConfig): void;
+export declare function decryptAesEcbPkcs5(encryptedData: string, key: string): MqttConfig;
+export declare function signConnectPayload(params: {
+    deviceId: string;
+    privateKeyPem: string;
+    token: string;
+    clientId: string;
+    clientMode: string;
+    role: string;
+    scopes: Array<string>;
+    platform: string;
+    nonce: string;
+    deviceFamily?: string;
+}): {
+    signedAtMs: number;
+    signature: string;
+    payload: string;
+};
+export declare function generateSignature(params: Record<string, string>, secret: string): string;
+export declare function md5(str: string): string;
+/**
+ * 使用 AES-256-CBC 解密文件
+ *
+ * @param encryptedBuffer - 加密的文件数据
+ * @param aesKey - Base64 编码的 AES-256 密钥
+ * @returns 解密后的文件 Buffer
+ */
+export declare function ewxDecryptFile(encryptedBuffer: Buffer, aesKey: string): Buffer;
+/**
+ * 使用 AES-256-CBC 解密文件
+ *
+ * @param encryptedBuffer - 加密的文件数据
+ * @param aesKey - Base64 编码的 AES-256 密钥
+ * @returns 解密后的文件 Buffer
+ */
+export declare function dlinkDecryptFile(encryptedBuffer: Buffer, aesKey: string): Buffer;

package/dist/src/client/crypto.js

@@ -0,0 +1,260 @@
+import crypto, { createSecretKey } from "crypto";
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import { exec } from 'child_process';
+const DEVICE_FILE = '.dlinkclaw';
+function base64url(buf) {
+    return buf.toString('base64').replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
+}
+// function generateDeviceId(): string {
+//   const interfaces = os.networkInterfaces();
+//   for (const name of Object.keys(interfaces)) {
+//     const iface = interfaces[name];
+//     if (!iface) continue;
+//     for (const info of iface) {
+//       if (info.mac && info.mac !== "00:00:00:00:00:00") {
+//         return info.mac.replace(/:/g, "").toUpperCase();
+//       }
+//     }
+//   }
+//   return crypto.randomUUID().replace(/-/g, "").toUpperCase();
+// }
+function generateDeviceIdentity() {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+    const pubPem = publicKey.export({ type: 'spki', format: 'pem' });
+    const privPem = privateKey.export({ type: 'pkcs8', format: 'pem' });
+    // 提取 raw public key → deviceId = sha256(公钥)
+    const spki = crypto.createPublicKey(pubPem).export({ type: 'spki', format: 'der' });
+    const ED25519_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+    const rawPub = spki.subarray(ED25519_PREFIX.length);
+    const deviceId = crypto.createHash('sha256').update(rawPub).digest('hex');
+    const pubKeyB64Url = base64url(rawPub);
+    return { deviceId, publicKey: pubKeyB64Url, privateKeyPem: privPem, publicKeyPem: pubPem };
+}
+export async function reqBootstrapToken(gatewayUrl) {
+    const safeUrl = gatewayUrl.replace(/[^a-zA-Z0-9:/._-]/g, '');
+    return new Promise((resolve, reject) => {
+        exec(`openclaw qr --json --url ${safeUrl}`, { timeout: 10000, encoding: 'utf-8' }, (err, stdout) => {
+            if (err)
+                return reject(new Error(`获取失败: ${err.message}`));
+            try {
+                const result = JSON.parse(stdout);
+                const decoded = JSON.parse(Buffer.from(result.setupCode, 'base64').toString());
+                resolve(decoded.bootstrapToken);
+            }
+            catch (e) {
+                reject(new Error(`解析失败: ${String(e)}`));
+            }
+        });
+    });
+}
+export function getDeviceId() {
+    const userDir = os.homedir();
+    const filePath = path.join(userDir, DEVICE_FILE);
+    try {
+        const fileData = fs.readFileSync(filePath, 'utf8');
+        const result = JSON.parse(fileData);
+        return result.deviceId;
+    }
+    catch (e) {
+        const { deviceId, publicKey, publicKeyPem, privateKeyPem } = generateDeviceIdentity();
+        const model = {
+            deviceId: deviceId,
+            publicKey: publicKey,
+            publicKeyPem: publicKeyPem,
+            privateKeyPem: privateKeyPem
+        };
+        try {
+            const userDir = os.homedir();
+            const filePath = path.join(userDir, DEVICE_FILE);
+            fs.writeFileSync(filePath, JSON.stringify(model), 'utf-8');
+            return deviceId;
+        }
+        catch (e) {
+            throw new Error(`Write file error ${String(e)}`);
+        }
+    }
+}
+export function getDeviceConfig() {
+    const userDir = os.homedir();
+    const filePath = path.join(userDir, DEVICE_FILE);
+    try {
+        const fileData = fs.readFileSync(filePath, 'utf8');
+        const result = JSON.parse(fileData);
+        return result;
+    }
+    catch (e) {
+        throw new Error(String(e));
+    }
+}
+export function saveDeviceConfig(config) {
+    try {
+        const userDir = os.homedir();
+        const filePath = path.join(userDir, DEVICE_FILE);
+        fs.writeFile(filePath, JSON.stringify(config), 'utf-8', (err) => {
+            if (err) {
+                console.error(`写DeviceConfig文件[${filePath}],失败${err.message}`);
+            }
+        });
+    }
+    catch (e) {
+        console.error(`写DeviceConfig文件失败${String(e)}`);
+    }
+}
+export function decryptAesEcbPkcs5(encryptedData, key) {
+    const keyBytes = Buffer.from(key, "base64");
+    const keyLength = keyBytes.length;
+    let algorithm;
+    if (keyLength === 16) {
+        algorithm = "aes-128-ecb";
+    }
+    else if (keyLength === 24) {
+        algorithm = "aes-192-ecb";
+    }
+    else if (keyLength === 32) {
+        algorithm = "aes-256-ecb";
+    }
+    else {
+        throw new Error(`Invalid key length: ${keyLength}`);
+    }
+    const keySpec = crypto.createSecretKey(keyBytes);
+    const decipher = crypto.createDecipheriv(algorithm, keySpec, null);
+    decipher.setAutoPadding(true);
+    let decrypted = decipher.update(encryptedData, "base64", "utf8");
+    decrypted += decipher.final("utf8");
+    return JSON.parse(decrypted);
+}
+export function signConnectPayload(params) {
+    const { deviceId, clientId, clientMode, role, scopes, token, platform, deviceFamily, privateKeyPem, nonce } = params;
+    const signedAtMs = Date.now();
+    const payload = [
+        'v3',
+        deviceId,
+        clientId,
+        clientMode,
+        role,
+        scopes.join(','),
+        String(signedAtMs),
+        token,
+        nonce,
+        platform,
+        deviceFamily ?? ''
+    ].join('|');
+    const key = crypto.createPrivateKey(privateKeyPem);
+    const signature = base64url(crypto.sign(null, Buffer.from(payload, 'utf8'), key));
+    return { signedAtMs, signature, payload };
+}
+export function generateSignature(params, secret) {
+    const sortedKeys = Object.keys(params).sort((a, b) => a.toLowerCase().localeCompare(b.toLowerCase(), undefined, {
+        numeric: true,
+        sensitivity: 'base'
+    }));
+    const signString = sortedKeys
+        .map(key => `${key}=${params[key]}`)
+        .join("&") + `&key=${secret}`;
+    const signStr = signString.toUpperCase();
+    //console.log("签名字符串 >>> ", signStr);
+    return crypto.createHash("md5").update(signStr).digest("hex");
+}
+export function md5(str) {
+    return crypto.createHash("md5").update(str).digest("hex");
+}
+/**
+ * 使用 AES-256-CBC 解密文件
+ *
+ * @param encryptedBuffer - 加密的文件数据
+ * @param aesKey - Base64 编码的 AES-256 密钥
+ * @returns 解密后的文件 Buffer
+ */
+export function ewxDecryptFile(encryptedBuffer, aesKey) {
+    // 参数验证
+    if (!encryptedBuffer || encryptedBuffer.length === 0) {
+        throw new Error('decryptFile: encryptedBuffer is empty or not provided');
+    }
+    if (!aesKey || typeof aesKey !== 'string') {
+        throw new Error('decryptFile: aesKey must be a non-empty string');
+    }
+    // 将 Base64 编码的 aesKey 解码为 Buffer
+    const key = Buffer.from(aesKey, 'base64');
+    // IV 取 aesKey 解码后的前 16 字节
+    const iv = key.subarray(0, 16);
+    try {
+        const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv);
+        // 关闭自动 padding，因为文档要求 PKCS#7 填充至 32 字节的倍数，
+        // 而 Node.js 默认按 16 字节 block 去除 padding，会导致 bad decrypt 错误
+        decipher.setAutoPadding(false);
+        const decrypted = Buffer.concat([
+            decipher.update(encryptedBuffer),
+            decipher.final(),
+        ]);
+        // 手动去除 PKCS#7 填充（支持 32 字节 block）
+        const padLen = decrypted[decrypted.length - 1];
+        if (padLen < 1 || padLen > 32 || padLen > decrypted.length) {
+            throw new Error(`Invalid PKCS#7 padding value: ${padLen}`);
+        }
+        // 验证所有 padding 字节是否一致
+        for (let i = decrypted.length - padLen; i < decrypted.length; i++) {
+            if (decrypted[i] !== padLen) {
+                throw new Error('Invalid PKCS#7 padding: padding bytes mismatch');
+            }
+        }
+        return decrypted.subarray(0, decrypted.length - padLen);
+    }
+    catch (error) {
+        throw new Error(`decryptFile: Decryption failed - ${error.message}. This may indicate corrupted data or an incorrect aesKey.`);
+    }
+}
+/**
+ * 使用 AES-256-CBC 解密文件
+ *
+ * @param encryptedBuffer - 加密的文件数据
+ * @param aesKey - Base64 编码的 AES-256 密钥
+ * @returns 解密后的文件 Buffer
+ */
+export function dlinkDecryptFile(encryptedBuffer, aesKey) {
+    // 参数验证
+    if (!encryptedBuffer || encryptedBuffer.length === 0) {
+        throw new Error('dlinkDecryptFile: encryptedBuffer is empty or not provided');
+    }
+    if (!aesKey || typeof aesKey !== 'string') {
+        throw new Error('dlinkDecryptFile: aesKey must be a non-empty string');
+    }
+    // 将 Base64 编码的 aesKey 解码为 Buffer
+    const key = Buffer.from(aesKey, 'base64');
+    // IV 取 aesKey 解码后的前 16 字节
+    //const iv = key.subarray(0, 16);
+    const iv = encryptedBuffer.subarray(0, 16);
+    const encryptedData = encryptedBuffer.subarray(16);
+    try {
+        const keyObj = createSecretKey(new Uint8Array(key));
+        const decipher = crypto.createDecipheriv('aes-256-cbc', keyObj, new Uint8Array(iv));
+        // 关闭自动 padding，因为文档要求 PKCS#7 填充至 32 字节的倍数，
+        // 而 Node.js 默认按 16 字节 block 去除 padding，会导致 bad decrypt 错误
+        decipher.setAutoPadding(false);
+        // const decrypted = Buffer.concat([
+        //   decipher.update(encryptedBuffer),
+        //   decipher.final(),
+        // ]);
+        const a = decipher.update(new Uint8Array(encryptedData));
+        const decrypted = Buffer.concat([
+            new Uint8Array(a),
+            new Uint8Array(decipher.final()),
+        ]);
+        // 手动去除 PKCS#7 填充（支持 32 字节 block）
+        const padLen = decrypted[decrypted.length - 1];
+        if (padLen < 1 || padLen > 32 || padLen > decrypted.length) {
+            throw new Error(`dlinkDecryptFile Invalid PKCS#7 padding value: ${padLen}`);
+        }
+        // 验证所有 padding 字节是否一致
+        for (let i = decrypted.length - padLen; i < decrypted.length; i++) {
+            if (decrypted[i] !== padLen) {
+                throw new Error('dlinkDecryptFile Invalid PKCS#7 padding: padding bytes mismatch');
+            }
+        }
+        return decrypted.subarray(0, decrypted.length - padLen);
+    }
+    catch (error) {
+        throw new Error(`dlinkDecryptFile: Decryption failed - ${error.message}. This may indicate corrupted data or an incorrect aesKey.`);
+    }
+}