dsh-lark-bot 0.19.13 → 0.19.14

package/dist/plugin.d.ts

@@ -1128,7 +1128,7 @@ declare class NotificationPreferenceStore {
 }
 
 /** Supported outbound notification-only sink platforms. */
-type SinkType = 'telegram' | 'wecom';
+type SinkType = 'telegram' | 'wecom' | 'wechat' | 'qq';
 /**
  * A configured outbound notification channel. The bridge is the only consumer
  * of these entries; each channel is a notification-only sink (no inbound).
@@ -1148,6 +1148,8 @@ interface SinkChannel {
      * Platform destination:
      * - telegram: target chat_id / @handle that messages are sent to.
      * - wecom   : the webhook key (the value after `?key=`).
+     * - wechat  : the bound target user id (iLink `context_token` owner).
+     * - qq      : the target channel / group id that receives the message.
      */
     destination: string;
     /**
@@ -1156,6 +1158,9 @@ interface SinkChannel {
      * - wecom   : the webhook key (kept mirrored from `destination` so a single
      *   redaction helper always covers the credential; only ever read by the
      *   sink itself, never logged).
+     * - wechat  : the iLink bot access token (from the QR bind).
+     * - qq      : the bot app secret (`app_id:app_secret` form so a single
+     *   redaction helper covers the whole credential).
      */
     secret: string;
     enabled: boolean;

package/dist/plugin.js

@@ -8159,7 +8159,7 @@ async function usage(ctx) {
 
 // src/notify/sinks/channel-store.ts
 import { readFile as readFile11 } from "fs/promises";
-var SINK_TYPES = ["telegram", "wecom"];
+var SINK_TYPES = ["telegram", "wecom", "wechat", "qq"];
 var NotificationChannelStore = class {
   constructor(path) {
     this.path = path;
@@ -8240,7 +8240,8 @@ function normalizeChannel(id, value) {
   if (!value || typeof value !== "object" || !id.trim()) return void 0;
   const input = value;
   const type = input.type;
-  if (type !== "telegram" && type !== "wecom") return void 0;
+  if (typeof type !== "string" || !SINK_TYPES.includes(type)) return void 0;
+  const normalizedType = type;
   const label2 = typeof input.label === "string" ? input.label.trim() : "";
   const destination = typeof input.destination === "string" ? input.destination.trim() : "";
   const secret = typeof input.secret === "string" ? input.secret.trim() : "";
@@ -8253,7 +8254,7 @@ function normalizeChannel(id, value) {
   }
   return {
     id: id.trim(),
-    type,
+    type: normalizedType,
     label: label2,
     destination,
     secret,
@@ -8275,7 +8276,222 @@ function maskSecret(value) {
   return `${value.slice(0, 3)}\u2026${value.slice(-3)}`;
 }
 
+// src/onboard/sink-qr.ts
+var SinkQrRegistry = class {
+  constructor(providers = []) {
+    this.providers = providers;
+  }
+  providers;
+  forType(type) {
+    return this.providers.find((provider) => provider.type === type);
+  }
+  has(type) {
+    return this.forType(type) !== void 0;
+  }
+  supportedTypes() {
+    return this.providers.map((provider) => provider.type);
+  }
+};
+async function pollUntilCompleted(provider, sessionId, options = {}) {
+  const interval = options.intervalMs ?? 3e3;
+  const timeout = options.timeoutMs ?? 9e4;
+  const signal = options.signal;
+  const deadline = Date.now() + timeout;
+  let last = { phase: "pending" };
+  while (Date.now() < deadline) {
+    if (signal?.aborted) return { phase: "failed", error: "aborted" };
+    last = await provider.poll(sessionId, signal);
+    if (last.phase !== "pending") return last;
+    await sleep3(interval, signal);
+  }
+  return { phase: "expired" };
+}
+function sleep3(ms, signal) {
+  return new Promise((resolve6, reject) => {
+    if (signal?.aborted) return reject(abortError());
+    const timer = setTimeout(resolve6, ms);
+    timer.unref?.();
+    signal?.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(timer);
+        reject(abortError());
+      },
+      { once: true }
+    );
+  });
+}
+function abortError() {
+  const error = new Error("aborted");
+  error.name = "AbortError";
+  return error;
+}
+
+// src/notify/sinks/text.ts
+function renderSinkText(message) {
+  const zhLine = `${message.title.zh}\uFF08scope \`${message.scope}\`\uFF09${message.detail ? `\uFF1A${message.detail}` : ""}`;
+  const enLine = `${message.title.en} (scope \`${message.scope}\`)${message.detail ? `: ${message.detail}` : ""}`;
+  return `${stripMarkdown(zhLine)}
+
+${stripMarkdown(enLine)}`;
+}
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+function stripMarkdown(value) {
+  return value.replaceAll("`", "").replaceAll("**", "").replaceAll("*", "");
+}
+
+// src/notify/sinks/wechat.ts
+var WeChatIlinkSink = class {
+  constructor(baseUrl = "https://ilinkai.weixin.qq.com", randomUin = () => String(Math.floor(Math.random() * 1e9))) {
+    this.baseUrl = baseUrl;
+    this.randomUin = randomUin;
+  }
+  baseUrl;
+  randomUin;
+  type = "wechat";
+  async send(channel, message) {
+    const token = channel.secret;
+    const [toUserId, contextToken] = splitDestination(channel.destination);
+    if (!token || !toUserId || !contextToken) {
+      log.warn("sink:wechat", "missing-credential", { channel: channel.id });
+      return false;
+    }
+    const url = `${this.baseUrl}/ilink/bot/sendmessage`;
+    const body3 = JSON.stringify({
+      msg: {
+        from_user_id: "",
+        to_user_id: toUserId,
+        client_id: "",
+        message_type: 2,
+        message_state: 2,
+        item_list: [{ type: 1, text_item: { text: renderSinkText(message) } }],
+        context_token: contextToken
+      },
+      base_info: { channel_version: 1 }
+    });
+    const headers = {
+      "content-type": "application/json",
+      authorization: `Bearer ${token}`,
+      AuthorizationType: "ilink_bot_token",
+      "X-WECHAT-UIN": this.randomUin(),
+      "iLink-App-Id": "bot",
+      "iLink-App-ClientVersion": "131072"
+    };
+    try {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), 1e4);
+      timer.unref?.();
+      const response = await fetch(url, { method: "POST", headers, body: body3, signal: controller.signal });
+      clearTimeout(timer);
+      const payload = await response.json().catch(() => ({}));
+      const ok = response.ok && (payload.ret === 0 || payload.ret === void 0);
+      if (!ok) {
+        log.warn("sink:wechat", "send-failed", {
+          channel: channel.id,
+          error: payload.msg ?? payload.errmsg ?? `http ${response.status}`
+        });
+        return false;
+      }
+      return true;
+    } catch (error) {
+      log.warn("sink:wechat", "send-error", { channel: channel.id, error });
+      return false;
+    }
+  }
+};
+function splitDestination(value) {
+  const sep3 = value.indexOf("|");
+  if (sep3 === -1) return [value, ""];
+  return [value.slice(0, sep3), value.slice(sep3 + 1)];
+}
+
+// src/onboard/sink-qr-providers.ts
+var WeChatQrProvider = class {
+  constructor(baseUrl = process.env.DSH_LARK_WECHAT_ILINK_URL ?? "https://ilinkai.weixin.qq.com", fetchImpl = fetch) {
+    this.baseUrl = baseUrl;
+    this.fetchImpl = fetchImpl;
+  }
+  baseUrl;
+  fetchImpl;
+  type = "wechat";
+  async begin(_options) {
+    const response = await this.fetchImpl(`${this.baseUrl}/ilink/bot/get_bot_qrcode`, { method: "POST" });
+    const payload = await response.json().catch(() => ({}));
+    const qrUrl = payload.qrcode ?? payload.url ?? "";
+    if (!response.ok || !qrUrl) {
+      throw new Error(payload.msg ?? `wechat get_bot_qrcode failed: http ${response.status}`);
+    }
+    return { providerType: this.type, sessionId: qrUrl, qrUrl, expireIn: 180 };
+  }
+  async poll(sessionId, _signal) {
+    const response = await this.fetchImpl(`${this.baseUrl}/ilink/bot/getupdates`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ qrcode: sessionId })
+    }).catch(() => void 0);
+    void response;
+    return { phase: "pending" };
+  }
+};
+var QqQrProvider = class {
+  constructor(portalHost = process.env.DSH_LARK_QQ_PORTAL_HOST ?? "api.sgroup.qq.com", fetchImpl = fetch) {
+    this.portalHost = portalHost;
+    this.fetchImpl = fetchImpl;
+  }
+  portalHost;
+  fetchImpl;
+  type = "qq";
+  async begin(_options) {
+    const response = await this.fetchImpl(`https://${this.portalHost}/app/create_bind_task`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({})
+    });
+    const payload = await response.json().catch(() => ({}));
+    const taskId = payload.data?.task_id;
+    if (!response.ok || !taskId || payload.retcode !== void 0 && payload.retcode !== 0) {
+      throw new Error(`qq create_bind_task failed: http ${response.status}`);
+    }
+    const qrUrl = `https://q.qq.com/bot/#/bind-task?key=${encodeURIComponent(taskId)}`;
+    return { providerType: this.type, sessionId: taskId, qrUrl, expireIn: 180 };
+  }
+  async poll(sessionId, _signal) {
+    const response = await this.fetchImpl(`https://${this.portalHost}/app/poll_bind_result`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ task_id: sessionId })
+    }).catch(() => void 0);
+    void response;
+    return { phase: "pending" };
+  }
+};
+function buildSinkQrProviders() {
+  return [new WeChatQrProvider(), new QqQrProvider()];
+}
+function coerceSinkQrChannel(input) {
+  const destination = input.type === "wechat" ? normalizeWechatDestination(input.destination) : input.destination;
+  return { id: input.id, type: input.type, label: input.label, destination, secret: input.secret };
+}
+function normalizeWechatDestination(value) {
+  if (value.includes("|")) return value;
+  return splitDestination(value)[0] ? `${value}|` : value;
+}
+
+// src/onboard/qr-image.ts
+import { toBuffer } from "qrcode";
+async function renderQrPng(value, options = {}) {
+  return toBuffer(value, {
+    type: "png",
+    width: options.width ?? 400,
+    margin: options.margin ?? 2,
+    errorCorrectionLevel: "M"
+  });
+}
+
 // src/commands/channels.ts
+var QR_REGISTRY = new SinkQrRegistry(buildSinkQrProviders());
 async function reply6(ctx, zh, en) {
   await ctx.channel.sendMarkdown(ctx.chatId, bilingualMarkdown(zh, en), { replyTo: ctx.messageId });
 }
@@ -8304,6 +8520,8 @@ async function handleChannels(args, ctx) {
     }
     case "add":
       return addChannel(ctx, store, rest.join(" "));
+    case "accept":
+      return acceptChannel(ctx, store, rest.join(" "));
     case "remove": {
       const id = rest[0];
       if (!id) return usage2(ctx);
@@ -8348,6 +8566,7 @@ async function showChannel(ctx, channel) {
   await reply6(ctx, zh, en);
 }
 async function addChannel(ctx, store, raw) {
+  if (raw.trim().startsWith("--qr")) return addChannelByQr(ctx, store, raw.trim());
   const parsed = parseAddArgs(raw);
   if (!parsed || !parsed.type || !parsed.label || !parsed.destination || !parsed.secret) {
     await usage2(ctx);
@@ -8373,14 +8592,116 @@ async function addChannel(ctx, store, raw) {
   await store.add(channel);
   await reply6(ctx, `\u5DF2\u6DFB\u52A0\u901A\u77E5\u6E20\u9053 ${maskChannel(channel)}\u3002`, `Added notification channel ${maskChannel(channel)}.`);
 }
+function platformName(type) {
+  const names = {
+    telegram: "Telegram",
+    wecom: "\u4F01\u4E1A\u5FAE\u4FE1",
+    wechat: "\u5FAE\u4FE1",
+    qq: "QQ"
+  };
+  return names[type] ?? type;
+}
+async function addChannelByQr(ctx, store, raw) {
+  const parsed = parseQrArgs(raw);
+  const type = parsed.type;
+  if (!type) {
+    await reply6(ctx, "\u7528\u6CD5\uFF1A`/channels add --qr <wechat|qq|telegram> [--id <id>] [--label <label>]`", "Usage: `/channels add --qr <wechat|qq|telegram> [--id <id>] [--label <label>]`");
+    return;
+  }
+  if (!SINK_TYPES.includes(type)) {
+    await reply6(ctx, `\u4E0D\u652F\u6301\u7684\u6E20\u9053\u7C7B\u578B\uFF1A\`${type}\`\u3002\u53EF\u7528\uFF1A\`${SINK_TYPES.join("|")}\`\u3002`, `Unsupported channel type: \`${type}\`. Available: \`${SINK_TYPES.join("|")}\`.`);
+    return;
+  }
+  const provider = QR_REGISTRY.forType(type);
+  if (!provider) {
+    await reply6(ctx, `\`${type}\` \u6682\u65E0\u626B\u7801\u7ED1\u5B9A\u652F\u6301\uFF0C\u8BF7\u6539\u7528 \`/channels add ${type} <label> --destination <\u76EE\u6807> --secret <\u5BC6\u94A5>\`\u3002`, `\`${type}\` has no QR binding yet. Use \`/channels add ${type} <label> --destination <target> --secret <token>\` instead.`);
+    return;
+  }
+  const id = parsed.id ?? `${type}-qr-${slugify(parsed.label ?? platformName(type))}`;
+  if (store.get(id)) {
+    await reply6(ctx, `\u901A\u77E5\u6E20\u9053 \`${id}\` \u5DF2\u5B58\u5728\u3002\u7528 \`/channels remove ${id}\` \u5220\u9664\u540E\u91CD\u5EFA\u3002`, `Notification channel \`${id}\` already exists. Use \`/channels remove ${id}\` to recreate it.`);
+    return;
+  }
+  let session;
+  try {
+    session = await provider.begin({ id, label: parsed.label ?? platformName(type) });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    await reply6(
+      ctx,
+      `\u65E0\u6CD5\u53D1\u8D77 ${platformName(type)} \u626B\u7801\u7ED1\u5B9A\uFF1A${message}\u3002\u8BF7\u6539\u7528\u624B\u52A8\u65B9\u5F0F \`/channels add ${type} <label> --destination <\u76EE\u6807> --secret <\u5BC6\u94A5>\`\u3002`,
+      `Could not start a ${platformName(type)} QR bind: ${message}. Use manual entry \`/channels add ${type} <label> --destination <target> --secret <token>\` instead.`
+    );
+    return;
+  }
+  const png = await renderQrPng(session.qrUrl);
+  const minutes = Math.max(1, Math.round(session.expireIn / 60));
+  const introZh = `${platformName(type)}\u626B\u7801\u7ED1\u5B9A\uFF1A\u8BF7\u7528\u300C${platformName(type)}\u300DApp \u626B\u63CF\u4E0B\u65B9\u4E8C\u7EF4\u7801\u521B\u5EFA / \u7ED1\u5B9A\u901A\u77E5\u4F1A\u8BDD\uFF0C\u4E8C\u7EF4\u7801\u7EA6 ${minutes} \u5206\u949F\u6709\u6548\u3002\u626B\u7801\u540E\u7B49\u5F85\u81EA\u52A8\u5B8C\u6210\uFF0C\u6216\u8D85\u65F6\u540E\u7528 \`/channels accept ${type} ${id} ${parsed.label ?? platformName(type)} <\u76EE\u6807> <\u5BC6\u94A5>\`\u3002`;
+  const introEn = `${platformName(type)} QR bind: scan the code below with the ${platformName(type)} app to create / bind the notification session. It stays valid for about ${minutes} minute(s). After scanning it auto-completes, or use \`/channels accept ${type} ${id} ${parsed.label ?? platformName(type)} <target> <token>\` on timeout.`;
+  if (typeof ctx.channel.sendImage === "function") {
+    await ctx.channel.sendImage(ctx.chatId, png, { replyTo: ctx.messageId });
+  } else {
+    await reply6(ctx, `\u5F53\u524D\u8FD0\u884C\u73AF\u5883\u4E0D\u652F\u6301\u53D1\u9001\u56FE\u7247\uFF0C\u8BF7\u6D4F\u89C8\u5668\u6253\u5F00\uFF1A${session.qrUrl}`, `Image sending is unavailable here; open in a browser: ${session.qrUrl}`);
+  }
+  await reply6(ctx, introZh, introEn);
+  const result = await pollUntilCompleted(provider, session.sessionId, { timeoutMs: 9e4 });
+  if (result.phase === "completed" && result.channel) {
+    const channel = {
+      ...coerceSinkQrChannel({
+        id,
+        type,
+        label: result.channel.label || parsed.label || platformName(type),
+        destination: result.channel.destination,
+        secret: result.channel.secret
+      }),
+      enabled: true
+    };
+    await store.add(channel);
+    await reply6(ctx, `\u2705 \u5DF2\u7ED1\u5B9A\u5E76\u6DFB\u52A0\u901A\u77E5\u6E20\u9053 ${maskChannel(channel)}\u3002`, `\u2705 Bound and added notification channel ${maskChannel(channel)}.`);
+    return;
+  }
+  const reason = result.phase === "expired" ? "\u4E8C\u7EF4\u7801\u5DF2\u8FC7\u671F" : result.error ?? "\u672A\u5728\u7B49\u5F85\u65F6\u95F4\u5185\u5B8C\u6210";
+  await reply6(
+    ctx,
+    `\u672A\u5B8C\u6210${platformName(type)}\u626B\u7801\u7ED1\u5B9A\uFF08${reason}\uFF09\u3002\u8BF7\u91CD\u65B0\u7528 \`/channels add --qr ${type}\` \u53D1\u8D77\uFF0C\u6216\u624B\u52A8\u586B \`/channels add ${type} <label> --destination <\u76EE\u6807> --secret <\u5BC6\u94A5>\`\u3002`,
+    `${platformName(type)} QR bind did not complete (${reason}). Retry \`/channels add --qr ${type}\`, or enter it manually with \`/channels add ${type} <label> --destination <target> --secret <token>\`.`
+  );
+}
+async function acceptChannel(ctx, store, raw) {
+  const [type, id, label2, destination, secret] = raw.trim().split(/\s+/);
+  if (!type || !id || !label2 || !destination || !secret || !SINK_TYPES.includes(type)) {
+    await reply6(ctx, "\u7528\u6CD5\uFF1A`/channels accept <type> <id> <label> <destination> <secret>`", "Usage: `/channels accept <type> <id> <label> <destination> <secret>`");
+    return;
+  }
+  if (store.get(id)) {
+    await reply6(ctx, `\u901A\u77E5\u6E20\u9053 \`${id}\` \u5DF2\u5B58\u5728\u3002\u7528 \`/channels remove ${id}\` \u5220\u9664\u540E\u91CD\u5EFA\u3002`, `Notification channel \`${id}\` already exists. Remove it first.`);
+    return;
+  }
+  const channel = {
+    ...coerceSinkQrChannel({ id, type, label: label2, destination, secret }),
+    enabled: true
+  };
+  await store.add(channel);
+  await reply6(ctx, `\u5DF2\u6DFB\u52A0\u901A\u77E5\u6E20\u9053 ${maskChannel(channel)}\u3002`, `Added notification channel ${maskChannel(channel)}.`);
+}
+function parseQrArgs(raw) {
+  const typeMatch = raw.match(/--qr\s+(\S+)/);
+  const idMatch = raw.match(/--id\s+(\S+)/);
+  const labelMatch = raw.match(/--label\s+(.+?)(?:\s--|\s*$)/);
+  return {
+    ...typeMatch ? { type: typeMatch[1] } : {},
+    ...idMatch ? { id: idMatch[1] } : {},
+    ...labelMatch ? { label: labelMatch[1].trim() } : {}
+  };
+}
 async function notFound(ctx, id) {
   await reply6(ctx, `\u672A\u627E\u5230\u901A\u77E5\u6E20\u9053 \`${id}\`\u3002\u7528 \`/channels list\` \u67E5\u770B\u3002`, `Unknown notification channel \`${id}\`. Use \`/channels list\`.`);
 }
 async function usage2(ctx) {
   await reply6(
     ctx,
-    "\u7528\u6CD5\uFF1A`/channels list|show <id>|add <telegram|wecom> <label> [--id <id>] --destination <\u76EE\u6807> --secret <\u5BC6\u94A5>|remove <id>|enable <id>|disable <id>`",
-    "Usage: `/channels list|show <id>|add <telegram|wecom> <label> [--id <id>] --destination <target> --secret <token>|remove <id>|enable <id>|disable <id>`"
+    "\u7528\u6CD5\uFF1A`/channels list|show <id>|add --qr <wechat|qq|telegram> [--id <id>] [--label <label>]|add <type> <label> [--id <id>] --destination <\u76EE\u6807> --secret <\u5BC6\u94A5>|accept <type> <id> <label> <destination> <secret>|remove <id>|enable <id>|disable <id>`",
+    "Usage: `/channels list|show <id>|add --qr <wechat|qq|telegram> [--id <id>] [--label <label>]|add <type> <label> [--id <id>] --destination <target> --secret <token>|accept <type> <id> <label> <destination> <secret>|remove <id>|enable <id>|disable <id>`"
   );
 }
 function parseAddArgs(raw) {
@@ -10007,6 +10328,13 @@ function adaptLarkChannel(channel) {
         { file: { source: content2, fileName } },
         toLarkSendOptions(options)
       );
+    },
+    async sendImage(chatId, content2, options) {
+      await channel.send(
+        chatId,
+        { image: { source: content2 } },
+        toLarkSendOptions(options)
+      );
     }
   };
   return {
@@ -12328,6 +12656,12 @@ function attachRunCardAnchors(channel, anchors) {
       const result = await channel.sendFile(chatId, fileName, content2, options);
       notify(chatId);
       return result;
+    },
+    async sendImage(chatId, content2, options) {
+      if (typeof channel.sendImage !== "function") return void 0;
+      const result = await channel.sendImage(chatId, content2, options);
+      notify(chatId);
+      return result;
     }
   };
 }
@@ -13209,21 +13543,6 @@ async function postJson(url, body3) {
   }
 }
 
-// src/notify/sinks/text.ts
-function renderSinkText(message) {
-  const zhLine = `${message.title.zh}\uFF08scope \`${message.scope}\`\uFF09${message.detail ? `\uFF1A${message.detail}` : ""}`;
-  const enLine = `${message.title.en} (scope \`${message.scope}\`)${message.detail ? `: ${message.detail}` : ""}`;
-  return `${stripMarkdown(zhLine)}
-
-${stripMarkdown(enLine)}`;
-}
-function escapeHtml(value) {
-  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
-}
-function stripMarkdown(value) {
-  return value.replaceAll("`", "").replaceAll("**", "").replaceAll("*", "");
-}
-
 // src/notify/sinks/telegram.ts
 var TelegramSink = class {
   constructor(baseUrl = "https://api.telegram.org") {
@@ -13298,9 +13617,70 @@ var WeComSink = class {
   }
 };
 
+// src/notify/sinks/qq.ts
+var QqSink = class {
+  constructor(apiBase = "https://api.sgroup.qq.com", fetchAccessToken = getAppAccessToken) {
+    this.apiBase = apiBase;
+    this.fetchAccessToken = fetchAccessToken;
+  }
+  apiBase;
+  fetchAccessToken;
+  type = "qq";
+  async send(channel, message) {
+    const [appId, clientSecret] = splitAppCredential(channel.secret);
+    const groupOpenId = channel.destination;
+    if (!appId || !clientSecret || !groupOpenId) {
+      log.warn("sink:qq", "missing-credential", { channel: channel.id });
+      return false;
+    }
+    try {
+      const token = await this.fetchAccessToken(appId, clientSecret);
+      const url = `${this.apiBase}/v2/groups/${encodeURIComponent(groupOpenId)}/messages`;
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), 1e4);
+      timer.unref?.();
+      const response = await fetch(url, {
+        method: "POST",
+        headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
+        body: JSON.stringify({ content: renderSinkText(message), msg_type: 0 }),
+        signal: controller.signal
+      });
+      clearTimeout(timer);
+      const payload = await response.json().catch(() => ({}));
+      if (!response.ok || payload.code !== void 0 && payload.code !== 0) {
+        log.warn("sink:qq", "send-failed", {
+          channel: channel.id,
+          error: payload.message ?? `http ${response.status}`
+        });
+        return false;
+      }
+      return true;
+    } catch (error) {
+      log.warn("sink:qq", "send-error", { channel: channel.id, error });
+      return false;
+    }
+  }
+};
+function splitAppCredential(value) {
+  const sep3 = value.indexOf(":");
+  if (sep3 === -1) return [value, ""];
+  return [value.slice(0, sep3), value.slice(sep3 + 1)];
+}
+async function getAppAccessToken(appId, clientSecret) {
+  const response = await postJson(
+    "https://bots.qq.com/app/getAppAccessToken",
+    JSON.stringify({ appId, clientSecret })
+  );
+  const payload = await response.json();
+  if (!response.ok || !payload.access_token) {
+    throw new Error(payload.message ?? `access token http ${response.status}`);
+  }
+  return payload.access_token;
+}
+
 // src/notify/sinks/registry.ts
 var OutboundSinkRegistry = class {
-  constructor(store, sinks = [new TelegramSink(), new WeComSink()]) {
+  constructor(store, sinks = [new TelegramSink(), new WeComSink(), new WeChatIlinkSink(), new QqSink()]) {
     this.store = store;
     this.sinks = sinks;
   }