@gaodefa/daocore 2026.5.29 → 2026.5.30

package/dist/apply-S_75Py4Y.js

@@ -0,0 +1,41 @@
+import { v as summarizeMigrationItems } from "./migration-DGUrqTK8.js";
+import { i as writeMigrationReport, n as copyMigrationFileItem, r as withCachedMigrationConfigRuntime, t as archiveMigrationItem } from "./migration-runtime-90Qf6vxF.js";
+import { t as appendItem } from "./helpers-xQou1j8g.js";
+import { n as applyManualItem, t as applyConfigItem } from "./config-rXQcYybF.js";
+import { t as applyGeneratedSkillItem } from "./skills-CIpJIsm1.js";
+import { t as buildClaudePlan } from "./plan-BQUkjBMY.js";
+import path from "node:path";
+//#region extensions/migrate-claude/apply.ts
+async function applyClaudePlan(params) {
+	const plan = params.plan ?? await buildClaudePlan(params.ctx);
+	const reportDir = params.ctx.reportDir ?? path.join(params.ctx.stateDir, "migration", "claude");
+	const runtime = withCachedMigrationConfigRuntime(params.ctx.runtime ?? params.runtime, params.ctx.config);
+	const applyCtx = {
+		...params.ctx,
+		runtime
+	};
+	const items = [];
+	for (const item of plan.items) {
+		if (item.status !== "planned") {
+			items.push(item);
+			continue;
+		}
+		if (item.kind === "config") items.push(await applyConfigItem(applyCtx, item));
+		else if (item.kind === "manual") items.push(applyManualItem(item));
+		else if (item.action === "archive") items.push(await archiveMigrationItem(item, reportDir));
+		else if (item.action === "append") items.push(await appendItem(item));
+		else if (item.action === "create" && item.kind === "skill") items.push(await applyGeneratedSkillItem(item, { overwrite: params.ctx.overwrite }));
+		else items.push(await copyMigrationFileItem(item, reportDir, { overwrite: params.ctx.overwrite }));
+	}
+	const result = {
+		...plan,
+		items,
+		summary: summarizeMigrationItems(items),
+		backupPath: params.ctx.backupPath,
+		reportDir
+	};
+	await writeMigrationReport(result, { title: "Claude Migration Report" });
+	return result;
+}
+//#endregion
+export { applyClaudePlan as t };

package/dist/approval-handler.runtime-Cthxrstu.js

@@ -0,0 +1,130 @@
+import { c as normalizeOptionalString } from "./string-coerce-DyL154ka.js";
+import { t as createSubsystemLogger } from "./subsystem-CppbuBPw.js";
+import { t as buildChannelApprovalNativeTargetKey } from "./approval-native-target-key-D2RQhpuG.js";
+import "./runtime-env-BSECk1Nm.js";
+import "./string-coerce-runtime-DcopKqDR.js";
+import { c as buildExecApprovalPendingReplyPayload, i as buildApprovalPresentationFromActionDescriptors } from "./exec-approval-reply-C55wf2Le.js";
+import { r as createChannelApprovalNativeRuntimeAdapter } from "./approval-handler-runtime-prQTgPuS.js";
+import "./approval-handler-runtime-yqyUv6e3.js";
+import "./approval-native-runtime-UafzK2xu.js";
+import { r as buildPluginApprovalPendingReplyPayload } from "./approval-renderers-BYwKQNbO.js";
+import "./approval-reply-runtime-DDfe9Pyl.js";
+import { a as isTelegramExecApprovalHandlerConfigured, u as shouldHandleTelegramExecApprovalRequest } from "./exec-approvals-ArHHjoE-.js";
+import { t as resolveTelegramInlineButtons } from "./button-types-C0Gyj4Tz.js";
+import { i as editMessageReplyMarkupTelegram, p as sendTypingTelegram, u as sendMessageTelegram } from "./send-4dLa-BQo.js";
+//#region extensions/telegram/src/approval-handler.runtime.ts
+const log = createSubsystemLogger("telegram/approvals");
+function resolveHandlerContext(params) {
+	const context = params.context;
+	const accountId = normalizeOptionalString(params.accountId) ?? "";
+	if (!context?.token || !accountId) return null;
+	return {
+		accountId,
+		context
+	};
+}
+function buildPendingPayload(params) {
+	return {
+		text: (params.approvalKind === "plugin" ? buildPluginApprovalPendingReplyPayload({
+			request: params.request,
+			nowMs: params.nowMs
+		}) : buildExecApprovalPendingReplyPayload({
+			approvalId: params.request.id,
+			approvalSlug: params.request.id.slice(0, 8),
+			approvalCommandId: params.request.id,
+			warningText: params.view.approvalKind === "exec" ? params.view.warningText ?? void 0 : void 0,
+			command: params.view.approvalKind === "exec" ? params.view.commandText : "",
+			cwd: params.view.approvalKind === "exec" ? params.view.cwd ?? void 0 : void 0,
+			host: params.view.approvalKind === "exec" && params.view.host === "node" ? "node" : "gateway",
+			nodeId: params.view.approvalKind === "exec" ? params.view.nodeId ?? void 0 : void 0,
+			allowedDecisions: params.view.actions.map((action) => action.decision),
+			expiresAtMs: params.request.expiresAtMs,
+			nowMs: params.nowMs
+		})).text ?? "",
+		buttons: resolveTelegramInlineButtons({ presentation: buildApprovalPresentationFromActionDescriptors(params.view.actions) })
+	};
+}
+const telegramApprovalNativeRuntime = createChannelApprovalNativeRuntimeAdapter({
+	eventKinds: ["exec", "plugin"],
+	availability: {
+		isConfigured: (params) => {
+			const resolved = resolveHandlerContext(params);
+			return resolved ? isTelegramExecApprovalHandlerConfigured({
+				cfg: params.cfg,
+				accountId: resolved.accountId
+			}) : false;
+		},
+		shouldHandle: (params) => {
+			const resolved = resolveHandlerContext(params);
+			return resolved ? shouldHandleTelegramExecApprovalRequest({
+				cfg: params.cfg,
+				accountId: resolved.accountId,
+				request: params.request
+			}) : false;
+		}
+	},
+	presentation: {
+		buildPendingPayload: ({ request, approvalKind, nowMs, view }) => buildPendingPayload({
+			request,
+			approvalKind,
+			nowMs,
+			view
+		}),
+		buildResolvedResult: () => ({ kind: "clear-actions" }),
+		buildExpiredResult: () => ({ kind: "clear-actions" })
+	},
+	transport: {
+		prepareTarget: ({ plannedTarget }) => ({
+			dedupeKey: buildChannelApprovalNativeTargetKey(plannedTarget.target),
+			target: {
+				chatId: plannedTarget.target.to,
+				messageThreadId: typeof plannedTarget.target.threadId === "number" ? plannedTarget.target.threadId : void 0
+			}
+		}),
+		deliverPending: async ({ cfg, accountId, context, preparedTarget, pendingPayload }) => {
+			const resolved = resolveHandlerContext({
+				cfg,
+				accountId,
+				context
+			});
+			if (!resolved) return null;
+			const sendTyping = resolved.context.deps?.sendTyping ?? sendTypingTelegram;
+			const sendMessage = resolved.context.deps?.sendMessage ?? sendMessageTelegram;
+			await sendTyping(preparedTarget.chatId, {
+				cfg,
+				token: resolved.context.token,
+				accountId: resolved.accountId,
+				...preparedTarget.messageThreadId != null ? { messageThreadId: preparedTarget.messageThreadId } : {}
+			}).catch(() => {});
+			const result = await sendMessage(preparedTarget.chatId, pendingPayload.text, {
+				cfg,
+				token: resolved.context.token,
+				accountId: resolved.accountId,
+				buttons: pendingPayload.buttons,
+				...preparedTarget.messageThreadId != null ? { messageThreadId: preparedTarget.messageThreadId } : {}
+			});
+			return {
+				chatId: result.chatId,
+				messageId: result.messageId
+			};
+		}
+	},
+	interactions: { clearPendingActions: async ({ cfg, accountId, context, entry }) => {
+		const resolved = resolveHandlerContext({
+			cfg,
+			accountId,
+			context
+		});
+		if (!resolved) return;
+		await (resolved.context.deps?.editReplyMarkup ?? editMessageReplyMarkupTelegram)(entry.chatId, entry.messageId, [], {
+			cfg,
+			token: resolved.context.token,
+			accountId: resolved.accountId
+		});
+	} },
+	observe: { onDeliveryError: ({ error, request }) => {
+		log.error(`telegram approvals: failed to send request ${request.id}: ${String(error)}`);
+	} }
+});
+//#endregion
+export { telegramApprovalNativeRuntime };

package/dist/assistant-Cp9pGaBw.js

@@ -0,0 +1,291 @@
+import "./agent-scope-Dx1S0aWX.js";
+import { c as resolveDefaultAgentId } from "./agent-scope-config-CJUQxn7u.js";
+import { u as readConfigFileSnapshot } from "./io-Ct2JqgbR.js";
+import "./config-CLrwLpl0.js";
+import { n as extractAssistantText } from "./pi-embedded-utils-B5v2j1CN.js";
+import { r as prepareSimpleCompletionModelForAgent, t as completeWithPreparedSimpleCompletionModel } from "./simple-completion-runtime-CJFmCkYk.js";
+import path from "node:path";
+import fs from "node:fs/promises";
+import os from "node:os";
+import { randomUUID } from "node:crypto";
+//#region src/crestodian/assistant-backends.ts
+const CRESTODIAN_CLAUDE_CLI_MODEL = "claude-opus-4-7";
+const CRESTODIAN_CODEX_MODEL = "gpt-5.5";
+const CLAUDE_CLI_BACKEND = {
+	kind: "claude-cli",
+	label: `claude-cli/${CRESTODIAN_CLAUDE_CLI_MODEL}`,
+	runner: "cli",
+	provider: "claude-cli",
+	model: CRESTODIAN_CLAUDE_CLI_MODEL,
+	buildConfig: (workspaceDir) => buildCliPlannerConfig(workspaceDir, `claude-cli/${CRESTODIAN_CLAUDE_CLI_MODEL}`)
+};
+const CODEX_APP_SERVER_BACKEND = {
+	kind: "codex-app-server",
+	label: `openai/${CRESTODIAN_CODEX_MODEL} via codex`,
+	runner: "embedded",
+	provider: "openai",
+	model: CRESTODIAN_CODEX_MODEL,
+	buildConfig: buildCodexAppServerPlannerConfig
+};
+function selectCrestodianLocalPlannerBackends(overview) {
+	const backends = [];
+	if (overview.tools.claude.found) backends.push(CLAUDE_CLI_BACKEND);
+	if (overview.tools.codex.found) backends.push(CODEX_APP_SERVER_BACKEND);
+	return backends;
+}
+function buildCliPlannerConfig(workspaceDir, modelRef) {
+	return { agents: { defaults: {
+		workspace: workspaceDir,
+		model: { primary: modelRef }
+	} } };
+}
+function buildCodexAppServerPlannerConfig(workspaceDir) {
+	return {
+		agents: { defaults: {
+			workspace: workspaceDir,
+			model: { primary: `openai/${CRESTODIAN_CODEX_MODEL}` }
+		} },
+		plugins: { entries: { codex: { enabled: true } } }
+	};
+}
+//#endregion
+//#region src/crestodian/assistant-prompts.ts
+const CRESTODIAN_ASSISTANT_TIMEOUT_MS = 1e4;
+const CRESTODIAN_ASSISTANT_SYSTEM_PROMPT = [
+	"You are Crestodian, DaoCore's ring-zero setup helper.",
+	"Turn the user's request into exactly one safe DaoCore Crestodian command.",
+	"Return only compact JSON with keys reply and command.",
+	"Do not invent commands. Do not claim a write was applied.",
+	"Do not use tools, shell commands, file edits, or network lookups; plan only from the supplied overview.",
+	"Use the provided DaoCore docs/source references when the user's request needs behavior, config, or architecture details.",
+	"If local source is available, prefer inspecting it. Otherwise point to GitHub and strongly recommend reviewing source when docs are not enough.",
+	"Allowed commands:",
+	"- setup",
+	"- status",
+	"- health",
+	"- doctor",
+	"- doctor fix",
+	"- gateway status",
+	"- restart gateway",
+	"- start gateway",
+	"- stop gateway",
+	"- agents",
+	"- models",
+	"- plugins list",
+	"- plugins search <query>",
+	"- plugin install <npm-or-clawhub-spec>",
+	"- plugin uninstall <id>",
+	"- audit",
+	"- validate config",
+	"- set default model <provider/model>",
+	"- config set <path> <value>",
+	"- config set-ref <path> env <ENV_VAR>",
+	"- create agent <id> workspace <path> model <provider/model>",
+	"- talk to <id> agent",
+	"- talk to agent",
+	"If unsure, choose overview."
+].join("\n");
+function buildCrestodianAssistantUserPrompt(params) {
+	const agents = params.overview.agents.map((agent) => {
+		return `- ${[
+			`id=${agent.id}`,
+			agent.name ? `name=${agent.name}` : void 0,
+			agent.workspace ? `workspace=${agent.workspace}` : void 0,
+			agent.model ? `model=${agent.model}` : void 0,
+			agent.isDefault ? "default=true" : void 0
+		].filter(Boolean).join(", ")}`;
+	}).join("\n");
+	return [
+		`User request: ${params.input}`,
+		"",
+		`Default agent: ${params.overview.defaultAgentId}`,
+		`Default model: ${params.overview.defaultModel ?? "not configured"}`,
+		`Config valid: ${params.overview.config.valid}`,
+		`Gateway reachable: ${params.overview.gateway.reachable}`,
+		`Codex binary: ${params.overview.tools.codex.found ? "found" : "not found"}`,
+		`Claude Code CLI: ${params.overview.tools.claude.found ? "found" : "not found"}`,
+		`OpenAI API key: ${params.overview.tools.apiKeys.openai ? "found" : "not found"}`,
+		`Anthropic API key: ${params.overview.tools.apiKeys.anthropic ? "found" : "not found"}`,
+		`DaoCore docs: ${params.overview.references.docsPath ?? params.overview.references.docsUrl}`,
+		`DaoCore source: ${params.overview.references.sourcePath ?? params.overview.references.sourceUrl}`,
+		params.overview.references.sourcePath ? "Source mode: local git checkout; inspect source directly when docs are insufficient." : "Source mode: package/install; use GitHub source when docs are insufficient.",
+		"",
+		"Agents:",
+		agents || "- none"
+	].join("\n");
+}
+function parseCrestodianAssistantPlanText(rawText) {
+	const text = rawText?.trim();
+	if (!text) return null;
+	const jsonText = extractFirstJsonObject(text);
+	if (!jsonText) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(jsonText);
+	} catch {
+		return null;
+	}
+	if (!parsed || typeof parsed !== "object") return null;
+	const record = parsed;
+	const command = typeof record.command === "string" ? record.command.trim() : "";
+	if (!command) return null;
+	const reply = typeof record.reply === "string" ? record.reply.trim() : void 0;
+	return {
+		command,
+		...reply ? { reply } : {}
+	};
+}
+function extractFirstJsonObject(text) {
+	const start = text.indexOf("{");
+	const end = text.lastIndexOf("}");
+	if (start < 0 || end <= start) return null;
+	return text.slice(start, end + 1);
+}
+//#endregion
+//#region src/crestodian/assistant.ts
+async function planCrestodianCommand(params) {
+	const configured = await planCrestodianCommandWithConfiguredModel(params);
+	if (configured) return configured;
+	return await planCrestodianCommandWithLocalRuntime(params);
+}
+async function planCrestodianCommandWithConfiguredModel(params) {
+	const input = params.input.trim();
+	if (!input) return null;
+	const snapshot = await (params.deps?.readConfigFileSnapshot ?? readConfigFileSnapshot)();
+	if (!snapshot.exists || !snapshot.valid) return null;
+	const cfg = snapshot.runtimeConfig ?? snapshot.config;
+	const agentId = resolveDefaultAgentId(cfg);
+	const prepared = await (params.deps?.prepareSimpleCompletionModelForAgent ?? prepareSimpleCompletionModelForAgent)({
+		cfg,
+		agentId,
+		allowMissingApiKeyModes: ["aws-sdk"]
+	});
+	if ("error" in prepared) return null;
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), CRESTODIAN_ASSISTANT_TIMEOUT_MS);
+	try {
+		const parsed = parseCrestodianAssistantPlanText(extractAssistantText(await (params.deps?.completeWithPreparedSimpleCompletionModel ?? completeWithPreparedSimpleCompletionModel)({
+			model: prepared.model,
+			auth: prepared.auth,
+			context: {
+				systemPrompt: CRESTODIAN_ASSISTANT_SYSTEM_PROMPT,
+				messages: [{
+					role: "user",
+					content: buildCrestodianAssistantUserPrompt({
+						input,
+						overview: params.overview
+					}),
+					timestamp: Date.now()
+				}]
+			},
+			options: {
+				maxTokens: 512,
+				signal: controller.signal
+			}
+		})));
+		if (!parsed) return null;
+		return {
+			...parsed,
+			modelLabel: `${prepared.selection.provider}/${prepared.selection.modelId}`
+		};
+	} catch {
+		return null;
+	} finally {
+		clearTimeout(timer);
+	}
+}
+async function planCrestodianCommandWithLocalRuntime(params) {
+	const input = params.input.trim();
+	if (!input) return null;
+	const backends = selectCrestodianLocalPlannerBackends(params.overview);
+	if (backends.length === 0) return null;
+	const prompt = buildCrestodianAssistantUserPrompt({
+		input,
+		overview: params.overview
+	});
+	for (const backend of backends) try {
+		const parsed = parseCrestodianAssistantPlanText(await runLocalRuntimePlanner(backend, {
+			prompt,
+			deps: params.deps
+		}));
+		if (parsed) return {
+			...parsed,
+			modelLabel: backend.label
+		};
+	} catch {}
+	return null;
+}
+async function runLocalRuntimePlanner(backend, params) {
+	const tempDir = await (params.deps?.createTempDir ?? createTempPlannerDir)();
+	try {
+		const runId = `crestodian-planner-${randomUUID()}`;
+		const sessionFile = path.join(tempDir, "session.jsonl");
+		const sessionId = `${runId}-session`;
+		const sessionKey = `temp:crestodian-planner:${runId}`;
+		switch (backend.runner) {
+			case "cli": return extractPlannerResultText(await (params.deps?.runCliAgent ?? await loadRunCliAgent())({
+				sessionId,
+				sessionKey,
+				agentId: "crestodian",
+				trigger: "manual",
+				sessionFile,
+				workspaceDir: tempDir,
+				config: backend.buildConfig(tempDir),
+				prompt: params.prompt,
+				provider: backend.provider,
+				model: backend.model,
+				timeoutMs: CRESTODIAN_ASSISTANT_TIMEOUT_MS,
+				runId,
+				extraSystemPrompt: CRESTODIAN_ASSISTANT_SYSTEM_PROMPT,
+				extraSystemPromptStatic: CRESTODIAN_ASSISTANT_SYSTEM_PROMPT,
+				messageChannel: "crestodian",
+				messageProvider: "crestodian",
+				cleanupCliLiveSessionOnRunEnd: true
+			}));
+			case "embedded": return extractPlannerResultText(await (params.deps?.runEmbeddedPiAgent ?? await loadRunEmbeddedPiAgent())({
+				sessionId,
+				sessionKey,
+				agentId: "crestodian",
+				trigger: "manual",
+				sessionFile,
+				workspaceDir: tempDir,
+				config: backend.buildConfig(tempDir),
+				prompt: params.prompt,
+				provider: backend.provider,
+				model: backend.model,
+				agentHarnessId: "codex",
+				disableTools: true,
+				toolsAllow: [],
+				timeoutMs: CRESTODIAN_ASSISTANT_TIMEOUT_MS,
+				runId,
+				extraSystemPrompt: CRESTODIAN_ASSISTANT_SYSTEM_PROMPT,
+				messageChannel: "crestodian",
+				messageProvider: "crestodian",
+				cleanupBundleMcpOnRunEnd: true
+			}));
+		}
+		return;
+	} finally {
+		await (params.deps?.removeTempDir ?? removeTempPlannerDir)(tempDir);
+	}
+}
+async function createTempPlannerDir() {
+	return await fs.mkdtemp(path.join(os.tmpdir(), "daocore-crestodian-planner-"));
+}
+async function removeTempPlannerDir(dir) {
+	await fs.rm(dir, {
+		recursive: true,
+		force: true
+	});
+}
+async function loadRunCliAgent() {
+	return (await import("./cli-runner-CTm8K6s8.js")).runCliAgent;
+}
+async function loadRunEmbeddedPiAgent() {
+	return (await import("./pi-embedded-BRfDncVO.js")).runEmbeddedPiAgent;
+}
+function extractPlannerResultText(result) {
+	return result.meta?.finalAssistantVisibleText ?? result.meta?.finalAssistantRawText ?? result.payloads?.map((payload) => payload.text?.trim()).filter(Boolean).join("\n");
+}
+//#endregion
+export { planCrestodianCommand };

package/dist/attachment-normalize-5R0bLLOj.js

@@ -0,0 +1,225 @@
+import { s as normalizeOptionalLowercaseString } from "./string-coerce-DyL154ka.js";
+import { i as formatErrorMessage } from "./errors-D_oyTIw2.js";
+import { l as mimeTypeFromFilePath, m as MAX_IMAGE_BYTES, r as extensionForMime } from "./mime-DppuT-pZ.js";
+import { C as sniffMimeFromBase64 } from "./daocore-tools-BMdF8RwK.js";
+import { n as estimateBase64DecodedBytes } from "./base64-D03BM6T6.js";
+import { i as deleteMediaBuffer, u as saveMediaBuffer } from "./store-53qCOCD8.js";
+//#region src/gateway/chat-attachments.ts
+const OFFLOAD_THRESHOLD_BYTES = 2e6;
+const TEXT_ONLY_OFFLOAD_LIMIT = 10;
+function resolveChatAttachmentMaxBytes(cfg) {
+	const configured = cfg.agents?.defaults?.mediaMaxMb;
+	return Math.floor((typeof configured === "number" && Number.isFinite(configured) && configured > 0 ? configured : 20) * 1024 * 1024);
+}
+var UnsupportedAttachmentError = class extends Error {
+	constructor(reason, message) {
+		super(message);
+		this.name = "UnsupportedAttachmentError";
+		this.reason = reason;
+	}
+};
+var MediaOffloadError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "MediaOffloadError";
+		this.cause = options?.cause;
+	}
+};
+function normalizeMime(mime) {
+	if (!mime) return;
+	return normalizeOptionalLowercaseString(mime.split(";")[0]) || void 0;
+}
+function isImageMime(mime) {
+	return typeof mime === "string" && mime.startsWith("image/");
+}
+function isGenericContainerMime(mime) {
+	return mime === "application/zip" || mime === "application/octet-stream";
+}
+function shouldIgnoreImageMimeHint(params) {
+	return isGenericContainerMime(params.sniffedMime) && isImageMime(params.hintedMime);
+}
+function isSpecificMime(mime) {
+	return Boolean(mime && !isGenericContainerMime(mime));
+}
+function resolveAttachmentMime(params) {
+	const trustedProvidedMime = shouldIgnoreImageMimeHint({
+		sniffedMime: params.sniffedMime,
+		hintedMime: params.providedMime
+	}) ? void 0 : params.providedMime;
+	const trustedLabelMime = shouldIgnoreImageMimeHint({
+		sniffedMime: params.sniffedMime,
+		hintedMime: params.labelMime
+	}) ? void 0 : params.labelMime;
+	return isSpecificMime(params.sniffedMime) && params.sniffedMime || isSpecificMime(trustedProvidedMime) && trustedProvidedMime || isSpecificMime(trustedLabelMime) && trustedLabelMime || params.sniffedMime || trustedProvidedMime || trustedLabelMime || "application/octet-stream";
+}
+function isValidBase64(value) {
+	if (value.length === 0 || value.length % 4 !== 0) return false;
+	return /^[A-Za-z0-9+/]+={0,2}$/.test(value);
+}
+function verifyDecodedSize(buffer, estimatedBytes, label) {
+	if (Math.abs(buffer.byteLength - estimatedBytes) > 3) throw new Error(`attachment ${label}: base64 contains invalid characters (expected ~${estimatedBytes} bytes decoded, got ${buffer.byteLength})`);
+}
+function ensureExtension(label, mime) {
+	if (/\.[a-zA-Z0-9]+$/.test(label)) return label;
+	const ext = extensionForMime(mime) ?? "";
+	return ext ? `${label}${ext}` : label;
+}
+function assertSavedMedia(value, label) {
+	if (value === null || typeof value !== "object" || !("id" in value) || typeof value.id !== "string") throw new Error(`attachment ${label}: saveMediaBuffer returned an unexpected shape`);
+	const id = value.id;
+	if (id.length === 0) throw new Error(`attachment ${label}: saveMediaBuffer returned an empty media ID`);
+	if (id.includes("/") || id.includes("\\") || id.includes("\0")) throw new Error(`attachment ${label}: saveMediaBuffer returned an unsafe media ID (contains path separator or null byte)`);
+	const path = value.path;
+	if (typeof path !== "string" || path.length === 0) throw new Error(`attachment ${label}: saveMediaBuffer returned no on-disk path`);
+	return {
+		id,
+		path
+	};
+}
+function normalizeAttachment(att, idx, opts) {
+	const mime = att.mimeType ?? "";
+	const content = att.content;
+	const label = att.fileName || att.type || `attachment-${idx + 1}`;
+	if (typeof content !== "string") throw new Error(`attachment ${label}: content must be base64 string`);
+	if (opts.requireImageMime && !mime.startsWith("image/")) throw new Error(`attachment ${label}: only image/* supported`);
+	let base64 = content.trim();
+	if (opts.stripDataUrlPrefix) {
+		const dataUrlMatch = /^data:[^;]+;base64,(.*)$/.exec(base64);
+		if (dataUrlMatch) base64 = dataUrlMatch[1];
+	}
+	return {
+		label,
+		mime,
+		base64
+	};
+}
+async function parseMessageWithAttachments(message, attachments, opts) {
+	const maxBytes = opts?.maxBytes ?? 20 * 1024 * 1024;
+	const log = opts?.log;
+	const shouldForceImageOffload = opts?.supportsImages === false;
+	const supportsInlineImages = opts?.supportsInlineImages !== false;
+	const acceptNonImage = opts?.acceptNonImage !== false;
+	if (!attachments || attachments.length === 0) return {
+		message,
+		images: [],
+		imageOrder: [],
+		offloadedRefs: []
+	};
+	const images = [];
+	const imageOrder = [];
+	const offloadedRefs = [];
+	let updatedMessage = message;
+	let textOnlyImageOffloadCount = 0;
+	const savedMediaIds = [];
+	try {
+		for (const [idx, att] of attachments.entries()) {
+			if (!att) continue;
+			const { base64: b64, label, mime } = normalizeAttachment(att, idx, {
+				stripDataUrlPrefix: true,
+				requireImageMime: false
+			});
+			if (b64.length === 0) throw new UnsupportedAttachmentError("empty-payload", `attachment ${label}: empty payload`);
+			if (!isValidBase64(b64)) throw new Error(`attachment ${label}: invalid base64 content`);
+			const sizeBytes = estimateBase64DecodedBytes(b64);
+			if (sizeBytes > maxBytes) throw new Error(`attachment ${label}: exceeds size limit (${sizeBytes} > ${maxBytes} bytes)`);
+			const providedMime = normalizeMime(mime);
+			const sniffedMime = normalizeMime(await sniffMimeFromBase64(b64));
+			const finalMime = resolveAttachmentMime({
+				sniffedMime,
+				providedMime,
+				labelMime: normalizeMime(mimeTypeFromFilePath(label))
+			});
+			if (sniffedMime && providedMime && !isGenericContainerMime(providedMime) && sniffedMime !== providedMime) {
+				const usedSource = finalMime === sniffedMime ? "sniffed" : finalMime === providedMime ? "provided" : "label-derived";
+				log?.warn(`attachment ${label}: mime mismatch (${providedMime} -> ${sniffedMime}), using ${usedSource}`);
+			}
+			const isImage = isImageMime(finalMime);
+			if (isImage && !supportsInlineImages && !shouldForceImageOffload) throw new UnsupportedAttachmentError("text-only-image", `attachment ${label}: active model does not accept image inputs`);
+			if (!isImage && !acceptNonImage) throw new UnsupportedAttachmentError("unsupported-non-image", `attachment ${label}: non-image attachments (${finalMime}) are not supported on this entrypoint`);
+			if (isImage && sizeBytes > 6291456) throw new Error(`attachment ${label}: image exceeds size limit (${sizeBytes} > ${MAX_IMAGE_BYTES} bytes)`);
+			if (shouldForceImageOffload && isImage && textOnlyImageOffloadCount >= TEXT_ONLY_OFFLOAD_LIMIT) {
+				log?.warn(`attachment ${label}: dropping image because text-only offload limit ${TEXT_ONLY_OFFLOAD_LIMIT} was reached`);
+				updatedMessage += "\n[image attachment omitted: text-only attachment limit reached]";
+				continue;
+			}
+			if (!(shouldForceImageOffload || !isImage || sizeBytes > OFFLOAD_THRESHOLD_BYTES)) {
+				images.push({
+					type: "image",
+					data: b64,
+					mimeType: finalMime
+				});
+				imageOrder.push("inline");
+				continue;
+			}
+			const buffer = Buffer.from(b64, "base64");
+			verifyDecodedSize(buffer, sizeBytes, label);
+			let savedMedia;
+			try {
+				savedMedia = assertSavedMedia(await saveMediaBuffer(buffer, finalMime, "inbound", maxBytes, ensureExtension(label, finalMime)), label);
+			} catch (err) {
+				throw new MediaOffloadError(`[Gateway Error] Failed to save intercepted media to disk: ${formatErrorMessage(err)}`, { cause: err });
+			}
+			savedMediaIds.push(savedMedia.id);
+			const mediaRef = `media://inbound/${savedMedia.id}`;
+			if (isImage) updatedMessage += `\n[media attached: ${mediaRef}]`;
+			log?.info?.(shouldForceImageOffload && isImage ? `[Gateway] Offloaded image for text-only model. Saved: ${mediaRef}` : `[Gateway] Offloaded attachment (${finalMime}). Saved: ${mediaRef}`);
+			offloadedRefs.push({
+				mediaRef,
+				id: savedMedia.id,
+				path: savedMedia.path,
+				mimeType: finalMime,
+				label,
+				sizeBytes
+			});
+			if (isImage) {
+				imageOrder.push("offloaded");
+				if (shouldForceImageOffload) textOnlyImageOffloadCount++;
+			}
+		}
+	} catch (err) {
+		if (savedMediaIds.length > 0) await Promise.allSettled(savedMediaIds.map((id) => deleteMediaBuffer(id, "inbound")));
+		throw err;
+	}
+	return {
+		message: updatedMessage !== message ? updatedMessage.trimEnd() : message,
+		images,
+		imageOrder,
+		offloadedRefs
+	};
+}
+async function resolveChatAttachmentLooksLikeImage(attachment, index = 0) {
+	const normalized = normalizeAttachment(attachment, index, {
+		stripDataUrlPrefix: true,
+		requireImageMime: false
+	});
+	if (!isValidBase64(normalized.base64)) throw new Error(`attachment ${normalized.label}: invalid base64 content`);
+	const providedMime = normalizeMime(normalized.mime);
+	return isImageMime(resolveAttachmentMime({
+		sniffedMime: normalizeMime(await sniffMimeFromBase64(normalized.base64)),
+		providedMime,
+		labelMime: normalizeMime(mimeTypeFromFilePath(normalized.label))
+	}));
+}
+//#endregion
+//#region src/gateway/server-methods/attachment-normalize.ts
+function normalizeAttachmentContent(content) {
+	if (typeof content === "string") return content;
+	if (ArrayBuffer.isView(content)) return Buffer.from(content.buffer, content.byteOffset, content.byteLength).toString("base64");
+	if (content instanceof ArrayBuffer) return Buffer.from(content).toString("base64");
+}
+function normalizeRpcAttachmentsToChatAttachments(attachments) {
+	return attachments?.map((a) => {
+		const sourceRecord = a?.source && typeof a.source === "object" ? a.source : void 0;
+		const sourceType = typeof sourceRecord?.type === "string" ? sourceRecord.type : void 0;
+		const sourceMimeType = typeof sourceRecord?.media_type === "string" ? sourceRecord.media_type : void 0;
+		const sourceContent = sourceType === "base64" ? normalizeAttachmentContent(sourceRecord?.data) : void 0;
+		return {
+			type: typeof a?.type === "string" ? a.type : void 0,
+			mimeType: typeof a?.mimeType === "string" ? a.mimeType : sourceMimeType,
+			fileName: typeof a?.fileName === "string" ? a.fileName : void 0,
+			content: normalizeAttachmentContent(a?.content) ?? sourceContent
+		};
+	}).filter((a) => a.content) ?? [];
+}
+//#endregion
+export { resolveChatAttachmentLooksLikeImage as a, parseMessageWithAttachments as i, MediaOffloadError as n, resolveChatAttachmentMaxBytes as o, UnsupportedAttachmentError as r, normalizeRpcAttachmentsToChatAttachments as t };