@aalis/plugin-office 0.9.2 → 0.11.0

package/dist/utils.js

@@ -1,24 +1,53 @@
 import { safeFetch } from '@aalis/util-network-guard';
+/** 远程图片下载与 plugin-media、ASR 同口径：20 MiB 上限，连接加读完响应体共 15 秒。 */
+const DOWNLOAD_MAX_BYTES = 20 * 1024 * 1024;
+const DOWNLOAD_TIMEOUT_MS = 15_000;
 /**
  * 从 URL 或 storage URI 加载图片为 Buffer。
- * - http/https URL：直接 fetch
+ * - http/https URL：safeFetch 下载，带超时，按流式累计限额读取响应体
  * - storage URI（含 `:/`）：通过 storage.readFile
- * - 其它（裸路径/相对路径）：若给了 baseUri，按 baseUri 拼接（不带尾部斜杠时自动补）
+ * - 其它（裸路径/相对路径）：按 baseUri 拼接（不带尾部斜杠时自动补）
  */
 export async function loadImage(storage, source, baseUri) {
     if (source.startsWith('http://') || source.startsWith('https://')) {
-        const resp = await safeFetch(source);
-        if (!resp.ok)
+        // safeFetch 只管 SSRF 与重定向，不带超时也不限体积：源地址来自模型或用户，
+        // 慢速对端会挂住整轮工具调用，超大响应整块读进内存。体积按流式累计判定——
+        // 无 Content-Length 的响应要全部读完才看得到大小。
+        const resp = await safeFetch(source, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
+        if (!resp.ok) {
+            // 响应体不读也要取消，释放底层连接
+            await resp.body?.cancel().catch(() => { });
             throw new Error(`图片下载失败: ${resp.status} ${source}`);
-        const arrayBuf = await resp.arrayBuffer();
+        }
+        const declared = Number(resp.headers.get('content-length'));
+        if (declared > DOWNLOAD_MAX_BYTES) {
+            await resp.body?.cancel().catch(() => { });
+            throw new Error(`图片过大 (${declared} > ${DOWNLOAD_MAX_BYTES}): ${source}`);
+        }
+        if (!resp.body)
+            throw new Error(`图片下载失败：上游无响应体 ${source}`);
+        const reader = resp.body.getReader();
+        const chunks = [];
+        let received = 0;
+        for (;;) {
+            const { value, done } = await reader.read();
+            if (done)
+                break;
+            received += value.byteLength;
+            if (received > DOWNLOAD_MAX_BYTES) {
+                await reader.cancel().catch(() => { });
+                throw new Error(`图片过大 (流式累计 > ${DOWNLOAD_MAX_BYTES}): ${source}`);
+            }
+            chunks.push(Buffer.from(value));
+        }
         const mime = resp.headers.get('content-type') || guessMime(source);
-        return { buffer: Buffer.from(arrayBuf), mime };
+        return { buffer: Buffer.concat(chunks), mime };
     }
-    const uri = source.includes(':/') ? source : joinUri(baseUri ?? 'workspace:/', source);
+    const uri = source.includes(':/') ? source : joinUri(baseUri, source);
     const data = (await storage.readFile(uri));
     return { buffer: Buffer.from(data), mime: guessMime(uri) };
 }
-function joinUri(base, rel) {
+export function joinUri(base, rel) {
     const b = base.endsWith('/') ? base : `${base}/`;
     return `${b}${rel.replace(/^\/+/, '')}`;
 }

package/dist/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAuB,EACvB,MAAc,EACd,OAAgB;IAEhB,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,aAAa,EAAE,MAAM,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAe,CAAC;IACzD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,GAAW;IACxC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;IACjD,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC;IACjD,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,KAAK;YACR,OAAO,WAAW,CAAC;QACrB,KAAK,KAAK,CAAC;QACX,KAAK,MAAM;YACT,OAAO,YAAY,CAAC;QACtB,KAAK,KAAK;YACR,OAAO,WAAW,CAAC;QACrB,KAAK,KAAK;YACR,OAAO,eAAe,CAAC;QACzB,KAAK,MAAM;YACT,OAAO,YAAY,CAAC;QACtB,KAAK,KAAK;YACR,OAAO,WAAW,CAAC;QACrB;YACE,OAAO,WAAW,CAAC;IACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,6DAA6D;AAC7D,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5C,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAuB,EACvB,MAAc,EACd,OAAe;IAEf,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAClE,+CAA+C;QAC/C,uCAAuC;QACvC,mCAAmC;QACnC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,mBAAmB;YACnB,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC5D,IAAI,QAAQ,GAAG,kBAAkB,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,SAAS,QAAQ,MAAM,kBAAkB,MAAM,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,SAAS,CAAC;YACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC;YAC7B,IAAI,QAAQ,GAAG,kBAAkB,EAAE,CAAC;gBAClC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,gBAAgB,kBAAkB,MAAM,MAAM,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAe,CAAC;IACzD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,GAAW;IAC/C,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;IACjD,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC;IACjD,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,KAAK;YACR,OAAO,WAAW,CAAC;QACrB,KAAK,KAAK,CAAC;QACX,KAAK,MAAM;YACT,OAAO,YAAY,CAAC;QACtB,KAAK,KAAK;YACR,OAAO,WAAW,CAAC;QACrB,KAAK,KAAK;YACR,OAAO,eAAe,CAAC;QACzB,KAAK,MAAM;YACT,OAAO,YAAY,CAAC;QACtB,KAAK,KAAK;YACR,OAAO,WAAW,CAAC;QACrB;YACE,OAAO,WAAW,CAAC;IACvB,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aalis/plugin-office",
-  "version": "0.9.2",
+  "version": "0.11.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -24,12 +24,12 @@
     "dist"
   ],
   "dependencies": {
-    "@aalis/schema-config": ">=0.9.0 <1.0.0",
-    "@aalis/api-process": ">=0.5.0 <1.0.0",
-    "@aalis/api-storage": ">=0.5.5 <1.0.0",
-    "@aalis/api-tools": ">=0.5.1 <1.0.0",
-    "@aalis/util-bounded-map": ">=0.5.0 <1.0.0",
-    "@aalis/util-network-guard": ">=0.5.1 <1.0.0",
+    "@aalis/schema-config": ">=0.13.0 <1.0.0",
+    "@aalis/api-process": ">=0.8.0 <1.0.0",
+    "@aalis/api-storage": ">=0.7.0 <1.0.0",
+    "@aalis/api-tools": ">=0.10.0 <1.0.0",
+    "@aalis/util-bounded-map": ">=0.6.1 <1.0.0",
+    "@aalis/util-network-guard": ">=0.6.2 <1.0.0",
     "docx": "^9.5.0",
     "exceljs": "^4.4.0",
     "pdf-lib": "^1.17.1",
@@ -38,14 +38,17 @@
   "devDependencies": {
     "@types/node": "^22.0.0",
     "typescript": "^5.7.0",
-    "@aalis/core": "0.11.0"
+    "@aalis/core": "0.18.0"
   },
   "peerDependencies": {
-    "@aalis/core": ">=0.11.0 <1.0.0"
+    "@aalis/core": ">=0.18.0 <1.0.0"
   },
   "aalis": {
     "service": {
       "required": [
+        "config",
+        "lifecycle",
+        "logger",
         "storage",
         "tools"
       ],