@minaim/openclaw-channel 0.0.0-stage → 0.2.0

package/vendor/mina_agent.py

@@ -0,0 +1,363 @@
+#!/usr/bin/env python3
+"""Mina Bot protocol v1 reference adapter. Python 3.9+, standard library only.
+
+A host adapter supplies handle(event) -> final text. This program never turns
+message text into a command, changes the destination, or retries an Agent run.
+"""
+import argparse
+import fcntl
+import hashlib
+import hmac
+import importlib
+import json
+import os
+import pathlib
+import re
+import secrets
+import sqlite3
+import threading
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+
+
+class ConfigurationError(Exception):
+    pass
+
+
+class ProtocolError(Exception):
+    def __init__(self, status, code):
+        self.status, self.code = status, code
+        super().__init__('Bot API %s: %s' % (status, code))
+
+
+def sign(secret, route, app_id, version, timestamp, nonce, body):
+    canonical = '\n'.join(('POST', route, app_id, str(version), str(timestamp),
+                           nonce, hashlib.sha256(body).hexdigest()))
+    return hmac.new(secret.encode('utf-8'), canonical.encode('utf-8'), hashlib.sha256).hexdigest()
+
+
+def encode(value):
+    return json.dumps(value, ensure_ascii=False, separators=(',', ':'), sort_keys=True)
+
+
+class NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None
+
+
+class HttpGateway:
+    def __init__(self, url, app_id, secret, version, *, allow_loopback_http=False):
+        parsed = urllib.parse.urlsplit(url)
+        local = parsed.hostname in ('127.0.0.1', '::1', 'localhost')
+        if (parsed.scheme != 'https' and not (allow_loopback_http and local and parsed.scheme == 'http')
+                or not parsed.hostname or parsed.username or parsed.password or parsed.query or parsed.fragment
+                or not re.fullmatch(r'(/[A-Za-z0-9_-]+)*/?', parsed.path)):
+            raise ConfigurationError('gateway must be an HTTPS base URL without credentials or query')
+        self.url = url.rstrip('/')
+        self.app_id, self.secret, self.version = app_id, secret, version
+        self.opener = urllib.request.build_opener(NoRedirect())
+
+    def post(self, route, body):
+        if not re.fullmatch(r'/bot/v1/[A-Za-z0-9_/-]+', route) or '//' in route:
+            raise ConfigurationError('invalid protocol route')
+        raw = encode(body).encode('utf-8')
+        timestamp, nonce = int(time.time() * 1000), secrets.token_urlsafe(24)
+        headers = {'Content-Type': 'application/json', 'X-Mina-App-Id': self.app_id,
+                   'X-Mina-Credential-Version': str(self.version), 'X-Mina-Timestamp': str(timestamp),
+                   'X-Mina-Nonce': nonce,
+                   'X-Mina-Signature': sign(self.secret, route, self.app_id, self.version, timestamp, nonce, raw)}
+        request = urllib.request.Request(self.url + route, data=raw, headers=headers, method='POST')
+        try:
+            with self.opener.open(request, timeout=75 if '/media/' in route else 30) as response:
+                limit=28*1024*1024 if re.fullmatch(r'/bot/v1/events/evt_[a-f0-9]{32}/media/att_[a-f0-9]{32}/download',route) else 1048576
+                data = response.read(limit+1)
+                if len(data) > limit:
+                    raise ProtocolError(502, 'oversized_response')
+                return json.loads(data)
+        except urllib.error.HTTPError as error:
+            # Never print URLs, headers, response bodies or remote diagnostic text.
+            try:
+                code = json.loads(error.read(4096)).get('error', 'http_error')
+            except (ValueError, AttributeError):
+                code = 'http_error'
+            if not isinstance(code, str) or not re.fullmatch(r'[a-z_]{1,64}', code):
+                code = 'http_error'
+            raise ProtocolError(error.code, code) from None
+
+
+class Journal:
+    """Durable local inbox; scope and run decision survive process crashes."""
+    def __init__(self, path, app_id, credential_version):
+        path = pathlib.Path(path)
+        path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+        if path.is_symlink():
+            raise ConfigurationError('state file must not be a symbolic link')
+        fd = os.open(path, os.O_CREAT | os.O_RDWR | getattr(os, 'O_NOFOLLOW', 0), 0o600)
+        try:
+            if os.fstat(fd).st_mode & 0o077:
+                raise ConfigurationError('state file permissions must be 0600')
+            try:
+                fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+            except BlockingIOError:
+                raise ConfigurationError('another adapter is already using this journal') from None
+        except BaseException:
+            os.close(fd)
+            raise
+        self.file_lock = fd
+        self.lock = threading.RLock()
+        self.db = sqlite3.connect(str(path), check_same_thread=False)
+        self.db.row_factory = sqlite3.Row
+        self.db.execute('PRAGMA synchronous=FULL')
+        self.db.execute('PRAGMA journal_mode=DELETE')
+        with self.db:
+            self.db.execute('CREATE TABLE IF NOT EXISTS meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)')
+            self.db.execute('''CREATE TABLE IF NOT EXISTS events (id TEXT PRIMARY KEY, payload TEXT NOT NULL,
+                generation INTEGER NOT NULL, state TEXT NOT NULL, execution_id TEXT NOT NULL DEFAULT '',
+                result TEXT NOT NULL DEFAULT '', created_ms INTEGER NOT NULL)''')
+        if 'result_format' not in {row[1] for row in self.db.execute('PRAGMA table_info(events)')}:
+            with self.db:self.db.execute("ALTER TABLE events ADD COLUMN result_format TEXT NOT NULL DEFAULT 'text'")
+        identity = encode([app_id, credential_version])
+        old = self.meta('identity')
+        if old is not None and old != identity:
+            self.close()
+            raise ConfigurationError('use a new state file for different credentials')
+        with self.db:
+            for key, value in [('identity', identity), ('consumer_id', secrets.token_urlsafe(24)),
+                               ('lease_token', secrets.token_urlsafe(32))]:
+                self.db.execute('INSERT OR IGNORE INTO meta VALUES (?,?)', (key, value))
+            # The external side effect may have happened. A restart is never permission to rerun it.
+            self.db.execute("UPDATE events SET state='unknown' WHERE state IN ('start_requested','running')")
+
+    def meta(self, key):
+        with self.lock:
+            row = self.db.execute('SELECT value FROM meta WHERE key=?', (key,)).fetchone()
+            return row['value'] if row else None
+
+    def event(self, event_id):
+        with self.lock:
+            row = self.db.execute('SELECT * FROM events WHERE id=?', (event_id,)).fetchone()
+            return dict(row) if row else None
+
+    def put_event(self, event, generation):
+        event_id = event.get('event_id', '')
+        if not re.fullmatch(r'evt_[A-Za-z0-9_-]{1,40}', event_id):
+            raise ConfigurationError('invalid event ID')
+        payload = encode(event)
+        with self.lock, self.db:
+            existing = self.event(event_id)
+            if existing and (existing['payload'] != payload or existing['generation'] != generation):
+                raise ConfigurationError('event scope or content conflict')
+            self.db.execute('INSERT OR IGNORE INTO events(id,payload,generation,state,created_ms) VALUES (?,?,?,?,?)',
+                            (event_id, payload, generation, 'stored', int(time.time() * 1000)))
+        return self.event(event_id)
+
+    def transition(self, event_id, state, *, execution_id=None, result=None, result_format=None):
+        with self.lock, self.db:
+            self.db.execute('UPDATE events SET state=?,execution_id=COALESCE(?,execution_id),'
+                            'result=COALESCE(?,result),result_format=COALESCE(?,result_format) WHERE id=?', (state, execution_id, result, result_format, event_id))
+
+    def pending(self, generation):
+        with self.lock:
+            return [json.loads(row['payload']) for row in self.db.execute(
+                "SELECT payload FROM events WHERE generation=? AND state IN ('stored','acked','result_ready') ORDER BY rowid",
+                (generation,)).fetchall()]
+
+    def fence(self, generation):
+        with self.lock, self.db:
+            self.db.execute("UPDATE events SET state='fenced' WHERE generation<>? AND state NOT IN ('submitted','fenced')", (generation,))
+
+    def close(self):
+        with self.lock:
+            self.db.close()
+            if self.file_lock is not None:
+                os.close(self.file_lock)
+                self.file_lock = None
+
+
+class Runner:
+    def __init__(self, gateway, journal, handler, client_type='Generic Agent'):
+        self.gateway, self.journal, self.handler = gateway, journal, handler
+        self.client_type = client_type
+        self.generation = None
+        self.stop = threading.Event()
+
+    def connect(self, takeover=False):
+        response = self.gateway.post('/bot/v1/connect', {
+            'protocol_version': '1', 'consumer_id': self.journal.meta('consumer_id'),
+            'lease_token': self.journal.meta('lease_token'), 'client_type': self.client_type, 'takeover': takeover,
+            **({'capabilities':self.capabilities} if hasattr(self,'capabilities') else {})})
+        self.generation = response['lease_generation']
+        self.journal.fence(self.generation)
+        return response
+
+    def request(self, route, **body):
+        return self.gateway.post(route, dict(body, lease_generation=self.generation,
+                                             lease_token=self.journal.meta('lease_token')))
+
+    def handle(self, event):
+        try:
+            self._handle(event)
+            self.report_status("connected")
+        except ProtocolError as error:
+            if error.code == 'event_expired':
+                self.journal.transition(event['event_id'], 'expired')
+            elif error.code in ('execution_unknown', 'invalid_state', 'stale_execution',
+                                'recovery_required', 'content_conflict', 'event_not_found', 'invalid_result'):
+                self.journal.transition(event['event_id'], 'unknown')
+            elif error.code in ('stale_lease', 'authorization_revoked') or error.status in (401, 403, 404):
+                self.journal.transition(event['event_id'], 'fenced')
+                self.stop.set()
+            elif error.status in (400, 413):
+                self.journal.transition(event['event_id'], 'unknown')
+                self.stop.set()
+            raise
+
+    def _handle(self, event):
+        row = self.journal.put_event(event, self.generation)
+        event_id = event['event_id']
+        task = '/bot/v1/tasks/' + event_id
+        if row['state'] in ('submitted', 'unknown', 'fenced', 'expired'):
+            return
+        if row['state'] == 'stored':
+            self.request('/bot/v1/events/' + event_id + '/ack')
+            self.journal.transition(event_id, 'acked')
+            row['state'] = 'acked'
+        if row['state'] == 'acked':
+            if self.stop.is_set():
+                return
+            self.before_start(dict(event))
+            self.journal.transition(event_id, 'start_requested')
+            try:
+                permit = self.request(task + '/start')
+            except ProtocolError as error:
+                # A definitive rejection did not grant permission; keep serial ordering for a later poll.
+                if error.code == 'session_busy':
+                    self.journal.transition(event_id, 'acked')
+                else:
+                    self.journal.transition(event_id, 'unknown')
+                raise
+            except Exception:
+                self.journal.transition(event_id, 'unknown')
+                raise
+            execution = permit.get('execution_id', '')
+            if permit.get('allow_execute') is not True:
+                self.journal.transition(event_id, 'unknown', execution_id=execution)
+                return
+            self.journal.transition(event_id, 'running', execution_id=execution)
+            try:
+                if self.stop.is_set():
+                    raise RuntimeError('connection no longer valid')
+                result = self.store_result(dict(event), self.invoke_handler(dict(event)))
+            except BaseException:
+                self.journal.transition(event_id, 'unknown')
+                try:
+                    self.request(task + '/fail', execution_id=execution)
+                except Exception:
+                    pass
+                raise
+            self.journal.transition(event_id, 'result_ready', result=result, result_format=self.result_format(dict(event)))
+            row = self.journal.event(event_id)
+        if row['state'] == 'result_ready':
+            self.submit_result(dict(event),row)
+            self.journal.transition(event_id, 'submitted')
+
+    def report_status(self,code):
+        pass
+
+    def before_start(self,event):
+        pass
+
+    def invoke_handler(self,event):
+        return self.handler(event)
+
+    def store_result(self,event,result):
+        if not isinstance(result,str) or not result or len(result.encode('utf-8'))>32768:
+            raise ConfigurationError('handler result must be 1..32768 UTF-8 bytes')
+        return result
+
+    def result_format(self,event):
+        return 'text'
+
+    def submit_result(self,event,row):
+        self.request('/bot/v1/tasks/'+event['event_id']+'/reply',execution_id=row['execution_id'],content=row['result'])
+
+    def heartbeat(self):
+        while not self.stop.wait(20):
+            try:
+                self.request('/bot/v1/heartbeat')
+            except ProtocolError as error:
+                self.report_status(error.code)
+                if error.status in (401, 403, 404, 409):
+                    self.stop.set()
+            except Exception:
+                self.report_status("network_unavailable")
+                # Main loop reconnects before accepting further execution after a prolonged outage.
+                self.stop.set()
+
+    def run(self, takeover=False):
+        self.connect(takeover)
+        heart = threading.Thread(target=self.heartbeat, name='mina-heartbeat', daemon=True)
+        heart.start()
+        try:
+            backoff = 1
+            while not self.stop.is_set():
+                try:
+                    pending = self.journal.pending(self.generation)
+                    if pending:
+                        for event in pending:
+                            self.handle(event)
+                        self.stop.wait(1)
+                        continue
+                    response = self.request('/bot/v1/events/poll', wait_ms=20000)
+                    self.report_status('connected')
+                    if response['lease_generation'] != self.generation:
+                        raise ConfigurationError('lease generation mismatch')
+                    # Persist the whole batch before any ACK; ACK each event only when ready to process it.
+                    for event in response['events']:
+                        self.journal.put_event(event, self.generation)
+                    backoff = 1
+                except ProtocolError as error:
+                    self.report_status(error.code)
+                    if error.status in (401, 403, 404) or error.code in ('stale_lease', 'authorization_revoked'):
+                        raise
+                    self.stop.wait(min(backoff, 20))
+                    backoff = min(backoff * 2, 20)
+                except OSError:
+                    self.report_status('network_unavailable')
+                    self.stop.wait(min(backoff, 20))
+                    backoff = min(backoff * 2, 20)
+        finally:
+            self.stop.set()
+            heart.join(timeout=2)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--config', required=True, help='private JSON file (mode 0600)')
+    parser.add_argument('--takeover', action='store_true', help='explicitly replace another active consumer')
+    args = parser.parse_args()
+    config_path = pathlib.Path(args.config)
+    if config_path.stat().st_mode & 0o077:
+        raise ConfigurationError('config file permissions must be 0600')
+    config = json.loads(config_path.read_text(encoding='utf-8'))
+    module, function = config['handler'].split(':', 1)
+    handler = getattr(importlib.import_module(module), function)
+    gateway = HttpGateway(config['gateway'], config['app_id'], config['app_secret'], config['credential_version'])
+    journal = Journal(config['state_file'], config['app_id'], config['credential_version'])
+    try:
+        Runner(gateway, journal, handler, config.get('client_type', 'Generic Agent')).run(args.takeover)
+    finally:
+        journal.close()
+
+
+if __name__ == '__main__':
+    try:
+        main()
+    except KeyboardInterrupt:
+        pass
+    except ProtocolError as error:
+        raise SystemExit(str(error)) from None
+    except Exception:
+        raise SystemExit('Adapter stopped; check local configuration and connection. No task was automatically re-executed.') from None

package/vendor/mina_media.py

@@ -0,0 +1,172 @@
+"""Bounded, durable media snapshots; only explicit host attachments become uploads."""
+import hashlib
+import http.client
+import ipaddress
+import json
+import os
+from pathlib import Path
+import socket
+import ssl
+import stat
+import urllib.parse
+if __package__:
+    from .mina_agent import ConfigurationError
+else:
+    from mina_agent import ConfigurationError
+
+MAX_FILE = 20*1024*1024
+MAX_IMAGE = 8*1024*1024
+
+class PublicHTTPS(http.client.HTTPSConnection):
+    def connect(self):
+        # Resolve once, reject the entire answer if any address is non-public,
+        # and connect to that IP while retaining TLS hostname verification.
+        infos = socket.getaddrinfo(self.host, self.port, type=socket.SOCK_STREAM)
+        if not infos or any(not ipaddress.ip_address(info[4][0]).is_global for info in infos):
+            raise ConfigurationError('remote attachment must use public HTTPS')
+        sock = socket.create_connection(infos[0][4][:2], timeout=self.timeout)
+        try:
+            self.sock = self._context.wrap_socket(sock, server_hostname=self.host)
+        except BaseException:
+            sock.close()
+            raise
+
+class MediaFiles:
+    def __init__(self, config):
+        self.config = config
+        identity = hashlib.sha256((config['app_id']+':'+str(config['credential_version'])).encode()).hexdigest()[:24]
+        self.root = Path(config['state_file']).parent / ('mina-media-'+identity)
+        self.root.mkdir(mode=0o700, parents=True, exist_ok=True)
+        if self.root.is_symlink() or self.root.stat().st_mode & 0o077:
+            raise ConfigurationError('media directory must be private')
+        self.roots = [Path(p).resolve(strict=True) for p in config.get('media_roots', [])]
+        if any(not p.is_dir() or p == Path('/') for p in self.roots):
+            raise ConfigurationError('media roots must be explicit directories')
+        self.hosts = config.get('media_hosts', [])
+
+    @staticmethod
+    def _check_name(name):
+        if (not isinstance(name,str) or not name or name != name.strip() or len(name.encode())>180
+                or name in ('.','..') or any(c in name for c in '/\\:') or any(ord(c)<32 or ord(c)==127 for c in name)):
+            raise ConfigurationError('unsafe attachment name')
+        return name
+
+    def _local(self, path, limit):
+        candidate = Path(path)
+        if not candidate.is_absolute() or '..' in candidate.parts:
+            raise ConfigurationError('attachment path must be inside a configured root')
+        for forbidden in [self.config['state_file'], self.config.get('_config_path','')]:
+            if forbidden and (candidate == Path(forbidden) or str(candidate).startswith(str(forbidden)+'-')):
+                raise ConfigurationError('credential/state files cannot be attachments')
+        for root in self.roots:
+            try: relative = candidate.relative_to(root)
+            except ValueError: continue
+            if not relative.parts: continue
+            fd = os.open(root, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)
+            try:
+                for part in relative.parts[:-1]:
+                    next_fd = os.open(part, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW, dir_fd=fd)
+                    os.close(fd); fd = next_fd
+                file_fd = os.open(relative.parts[-1], os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=fd)
+                with os.fdopen(file_fd,'rb') as stream:
+                    info = os.fstat(stream.fileno())
+                    if not stat.S_ISREG(info.st_mode) or not 1 <= info.st_size <= limit:
+                        raise ConfigurationError('attachment is not a bounded regular file')
+                    data = stream.read(limit+1)
+                    if len(data)!=info.st_size or len(data)>limit:
+                        raise ConfigurationError('attachment changed while being read')
+                    return data
+            except OSError:
+                raise ConfigurationError('attachment cannot be opened safely') from None
+            finally: os.close(fd)
+        raise ConfigurationError('attachment path is outside configured media roots')
+
+    def _remote(self, url, limit):
+        parsed = urllib.parse.urlsplit(url)
+        if (parsed.scheme!='https' or parsed.username or parsed.password or parsed.fragment
+                or parsed.hostname not in self.hosts or parsed.port not in (None,443)):
+            raise ConfigurationError('remote attachment host is not allowed')
+        connection = PublicHTTPS(parsed.hostname,443,timeout=30,context=ssl.create_default_context())
+        try:
+            target = urllib.parse.urlunsplit(('', '', parsed.path or '/', parsed.query, ''))
+            connection.request('GET',target,headers={'Accept-Encoding':'identity'})
+            response = connection.getresponse()
+            if response.status!=200 or response.getheader('Content-Encoding','identity')!='identity':
+                raise ConfigurationError('remote attachment response rejected')
+            length=response.getheader('Content-Length')
+            if length is not None and (not length.isdigit() or int(length)>limit):
+                raise ConfigurationError('remote attachment too large')
+            data=response.read(limit+1)
+            if not data or len(data)>limit: raise ConfigurationError('remote attachment too large')
+            return data
+        finally: connection.close()
+
+    def _write(self, area, event_id, filename, data):
+        if not isinstance(event_id,str) or not __import__('re').fullmatch('evt_[a-f0-9]{32}',event_id):
+            raise ConfigurationError('invalid media event scope')
+        (self.root/area).mkdir(mode=0o700,exist_ok=True)
+        parent=self.root/area/event_id
+        parent.mkdir(mode=0o700,exist_ok=True)
+        for p in [self.root/area,parent]:
+            if p.is_symlink() or p.stat().st_mode & 0o077: raise ConfigurationError('media scope is not private')
+        destination=parent/filename
+        if destination.exists():
+            if destination.is_symlink() or destination.read_bytes()!=data: raise ConfigurationError('media snapshot conflict')
+            return str(destination)
+        fd=os.open(destination,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600)
+        try:
+            with os.fdopen(fd,'wb',closefd=False) as stream:
+                stream.write(data);stream.flush();os.fsync(fd)
+        finally: os.close(fd)
+        directory=os.open(parent,os.O_RDONLY|os.O_DIRECTORY)
+        try: os.fsync(directory)
+        finally: os.close(directory)
+        return str(destination)
+
+    def cleanup(self,event_id,output_only=False):
+        if not __import__('re').fullmatch('evt_[a-f0-9]{32}',event_id): return
+        for area in (['out'] if output_only else ['in','out']):
+            parent=self.root/area/event_id
+            if not parent.exists() or parent.is_symlink(): continue
+            for child in parent.iterdir():
+                if child.is_file() or child.is_symlink(): child.unlink()
+            try: parent.rmdir()
+            except OSError: pass
+
+    def snapshot(self, item, event_id, index):
+        if not isinstance(item,dict) or set(item)-{'path','kind','name'}:
+            raise ConfigurationError('invalid explicit host attachment')
+        path,kind=item.get('path'),item.get('kind')
+        if not isinstance(path,str) or kind not in ('image','file'): raise ConfigurationError('invalid host attachment')
+        name=self._check_name(item.get('name') or Path(urllib.parse.urlsplit(path).path).name or 'attachment.bin')
+        limit=MAX_IMAGE if kind=='image' else MAX_FILE
+        data=self._remote(path,limit) if path.startswith('https://') else self._local(path,limit)
+        digest=hashlib.sha256(data).hexdigest()
+        saved=self._write('out',event_id,str(index)+'-'+digest,data)
+        return dict(path=saved,kind=kind,name=name,size=len(data),sha256=digest,
+                    upload_id='media_'+hashlib.sha256((event_id+':'+str(index)+':'+digest).encode()).hexdigest())
+
+    def prepare_result(self, result, event_id):
+        if isinstance(result,str): result={'text':result,'attachments':[]}
+        if not isinstance(result,dict) or set(result)-{'text','attachments'}: raise ConfigurationError('invalid native result')
+        text,items=result.get('text',''),result.get('attachments',[])
+        if (not isinstance(text,str) or len(text.encode())>32768 or not isinstance(items,list)
+                or len(items)>5 or (not text and not items)):
+            raise ConfigurationError('native result is empty or too large')
+        return dict(text=text,attachments=[self.snapshot(item,event_id,n) for n,item in enumerate(items)])
+
+    def read_snapshot(self, item, event_id):
+        path=Path(item['path'])
+        if path.parent!=self.root/'out'/event_id or path.is_symlink(): raise ConfigurationError('invalid stored output snapshot')
+        with path.open('rb') as stream: data=stream.read(MAX_FILE+1)
+        if len(data)!=item['size'] or hashlib.sha256(data).hexdigest()!=item['sha256']:
+            raise ConfigurationError('stored output snapshot corrupted')
+        return data
+
+    def save_input(self, event_id, item, data):
+        if len(data)!=item['size'] or hashlib.sha256(data).hexdigest()!=item['sha256']:
+            raise ConfigurationError('input attachment integrity mismatch')
+        self._check_name(item['name'])
+        suffix=Path(item['name']).suffix.lower()
+        if not __import__('re').fullmatch(r'\.[a-z0-9]{1,12}',suffix): suffix='.bin'
+        return self._write('in',event_id,item['attachment_id']+suffix,data)