@mininglamp-oss/octo-runtime 0.0.0-stage → 1.0.0

package/node_modules/@mininglamp-oss/octo-runtime-extra-channel-gateway/dist/transport/api/conversations.js

@@ -0,0 +1,130 @@
+import { DEFAULT_TIMEOUT_MS, postJson, getJson } from "./client.js";
+// Fetch the groups the bot belongs to
+export async function fetchBotGroups(params) {
+    const url = `${params.apiUrl}/v1/bot/groups`;
+    const resp = await fetch(url, {
+        method: "GET",
+        headers: {
+            Authorization: `Bearer ${params.botToken}`
+        },
+        signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS)
+    });
+    if (!resp.ok) {
+        params.log?.error?.(`octo: fetchBotGroups failed: ${resp.status}`);
+        return [];
+    }
+    const data = (await resp.json());
+    return Array.isArray(data) ? data : [];
+}
+export async function getGroupMembers(params) {
+    const data = await getJson(params.apiUrl, params.botToken, `/v1/bot/groups/${encodeURIComponent(params.groupNo)}/members`, AbortSignal.any([AbortSignal.timeout(5000), ...(params.signal ? [params.signal] : [])]), { maxResponseBytes: 1 << 20, logRateLimit: false });
+    // Normalize to strict array to prevent silent failures
+    const members = !Array.isArray(data) && Array.isArray(data?.members)
+        ? data.members
+        : Array.isArray(data)
+            ? data
+            : [];
+    return members;
+}
+/**
+ * 获取频道历史消息（用于注入上下文）
+ * @param params.log - Optional logger for consistent logging with OpenClaw log system
+ */
+export async function getChannelMessages(params) {
+    const limit = params.limit ?? 20;
+    const data = await postJson(params.apiUrl, params.botToken, "/v1/bot/messages/sync", {
+        channel_id: params.channelId,
+        channel_type: params.channelType,
+        limit,
+        start_message_seq: params.startMessageSeq ?? 0,
+        end_message_seq: params.endMessageSeq ?? 0,
+        pull_mode: params.pullMode ?? 1
+    }, AbortSignal.any([
+        AbortSignal.timeout(DEFAULT_TIMEOUT_MS),
+        ...(params.signal ? [params.signal] : [])
+    ]), { maxResponseBytes: 1 << 20, logRateLimit: false });
+    if (!Array.isArray(data?.messages))
+        throw new Error("IM_HISTORY_PROTOCOL_INVALID");
+    const messages = data.messages;
+    return messages.map((m) => {
+        // payload is base64-encoded JSON string
+        let payload = {};
+        if (m.payload) {
+            try {
+                if (typeof m.payload !== "string")
+                    throw new Error("IM_HISTORY_OBJECT_PAYLOAD");
+                const decoded = Buffer.from(m.payload, "base64").toString("utf-8");
+                payload = JSON.parse(decoded);
+            }
+            catch (decodeErr) {
+                if (typeof m.payload !== "object" || Array.isArray(m.payload))
+                    throw new Error("IM_HISTORY_PROTOCOL_INVALID", { cause: decodeErr });
+                payload = m.payload;
+            }
+        }
+        return {
+            from_uid: m.from_uid ?? "unknown",
+            message_id: m.message_id ?? undefined,
+            message_seq: m.message_seq ?? undefined,
+            type: payload.type ?? undefined,
+            url: payload.url ?? undefined,
+            name: payload.name ?? undefined,
+            content: payload.content ?? "",
+            payload, // preserve full payload for types that need nested data (e.g. MultipleForward)
+            // Convert seconds to milliseconds (API returns seconds, internal standard is ms)
+            timestamp: (m.timestamp ?? Math.floor(Date.now() / 1000)) * 1000
+        };
+    });
+}
+/**
+ * Fetch user info by UID. Requires backend `/v1/bot/user/info` endpoint.
+ * Returns null if the endpoint is unavailable (404) or returns an error,
+ * so callers can gracefully degrade.
+ */
+export async function fetchUserInfo(params) {
+    const url = `${params.apiUrl.replace(/\/+$/, "")}/v1/bot/user/info?uid=${encodeURIComponent(params.uid)}`;
+    try {
+        const resp = await fetch(url, {
+            method: "GET",
+            headers: { Authorization: `Bearer ${params.botToken}` },
+            signal: AbortSignal.timeout(5000)
+        });
+        if (resp.status === 404) {
+            // Endpoint not implemented yet — silent degrade
+            return null;
+        }
+        if (!resp.ok) {
+            params.log?.error?.(`octo: fetchUserInfo(${params.uid}) failed: ${resp.status}`);
+            return null;
+        }
+        const data = (await resp.json());
+        if (data?.name) {
+            return { uid: data.uid ?? params.uid, name: data.name, avatar: data.avatar };
+        }
+        return null;
+    }
+    catch (err) {
+        params.log?.error?.(`octo: fetchUserInfo(${params.uid}) error: ${String(err)}`);
+        return null;
+    }
+}
+// ========== Space Members API ==========
+export async function searchSpaceMembers(params) {
+    const query = new URLSearchParams();
+    if (params.keyword)
+        query.set("keyword", params.keyword);
+    if (params.spaceId)
+        query.set("space_id", params.spaceId);
+    if (params.limit)
+        query.set("limit", String(params.limit));
+    const url = `${params.apiUrl.replace(/\/+$/, "")}/v1/bot/space/members?${query.toString()}`;
+    const resp = await fetch(url, {
+        headers: { Authorization: `Bearer ${params.botToken}` },
+        signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS)
+    });
+    if (!resp.ok) {
+        const text = await resp.text().catch(() => "");
+        throw new Error(`searchSpaceMembers failed (${resp.status}): ${text || resp.statusText}`);
+    }
+    return (await resp.json());
+}

package/node_modules/@mininglamp-oss/octo-runtime-extra-channel-gateway/dist/transport/api/errors.d.ts

@@ -0,0 +1,60 @@
+/**
+ * 结构化 API 错误：保留 HTTP 状态与限流提示，使投递层能判断是否重试。
+ * 区分明确拒绝与传输结果未知，避免把所有异常都当作消息未发送。
+ */
+/**
+ * Structured error for the Octo REST helpers.
+ *
+ * The status code and the server's rate-limit hints used to survive only as text inside
+ * the message, so every caller that needed them re-parsed the string. This carries them
+ * as fields while keeping the historical message wording, which an existing regex parser
+ * and its callers still depend on.
+ */
+/** Fallback wait when the server rate-limits without a usable hint. */
+export declare const DEFAULT_RETRY_AFTER_MS = 1000;
+/**
+ * Cap on the response body kept for the message and the logs. A gateway answering with a
+ * full HTML error page would otherwise put tens of KB into a single log line. Truncation
+ * is cosmetic: the status comes from the response and the retry hint is parsed from the
+ * untruncated body.
+ */
+export declare const MAX_ERROR_BODY_CHARS = 500;
+/** The subset of `Response` this module reads, so tests and non-standard bodies both fit. */
+export interface ResponseLike {
+    status: number;
+    statusText?: string;
+    headers?: {
+        get?(name: string): string | null;
+    };
+}
+export declare class OctoApiError extends Error {
+    readonly status: number;
+    readonly path: string;
+    readonly body: string;
+    /**
+     * The server's requested wait, verbatim. Deliberately not clamped here: shortening it
+     * would mean going back before the server said we could, which is the behaviour this
+     * error exists to help remove. Callers decide whether the wait is worth honouring.
+     */
+    readonly retryAfterMs: number;
+    readonly rateLimitScope?: string;
+    readonly rateLimitRemaining?: string;
+    constructor(params: {
+        status: number;
+        path: string;
+        body: string;
+        retryAfterMs: number;
+        rateLimitScope?: string;
+        rateLimitRemaining?: string;
+    });
+    get isRateLimited(): boolean;
+    static from(resp: ResponseLike, path: string, body: string): OctoApiError;
+}
+/** A successful HTTP status that violates an endpoint's delivery contract. */
+export declare class OctoApiStatusMismatchError extends OctoApiError {
+    readonly expectedStatus: number;
+    constructor(path: string, status: number, expectedStatus: number);
+}
+/** A successful HTTP response that cannot satisfy the endpoint's receipt protocol. */
+export declare class OctoApiProtocolError extends Error {
+}

package/node_modules/@mininglamp-oss/octo-runtime-extra-channel-gateway/dist/transport/api/errors.js

@@ -0,0 +1,114 @@
+/**
+ * 结构化 API 错误：保留 HTTP 状态与限流提示，使投递层能判断是否重试。
+ * 区分明确拒绝与传输结果未知，避免把所有异常都当作消息未发送。
+ */
+/**
+ * Structured error for the Octo REST helpers.
+ *
+ * The status code and the server's rate-limit hints used to survive only as text inside
+ * the message, so every caller that needed them re-parsed the string. This carries them
+ * as fields while keeping the historical message wording, which an existing regex parser
+ * and its callers still depend on.
+ */
+/** Fallback wait when the server rate-limits without a usable hint. */
+export const DEFAULT_RETRY_AFTER_MS = 1_000;
+/**
+ * Cap on the response body kept for the message and the logs. A gateway answering with a
+ * full HTML error page would otherwise put tens of KB into a single log line. Truncation
+ * is cosmetic: the status comes from the response and the retry hint is parsed from the
+ * untruncated body.
+ */
+export const MAX_ERROR_BODY_CHARS = 500;
+function header(resp, name) {
+    // Optional all the way down: a hand-rolled response object may carry no headers at
+    // all, and reading them must never turn a plain HTTP failure into a TypeError.
+    const raw = resp.headers?.get?.(name);
+    return raw == null || raw === "" ? undefined : raw;
+}
+/** Seconds → ms, rejecting anything that is not a finite non-negative number. */
+function secondsToMs(raw) {
+    if (raw === undefined || raw === "")
+        return undefined;
+    // Number("") is 0 and Number(" ") is 0, so guard the empty cases above rather than
+    // letting a blank header masquerade as "retry immediately".
+    const seconds = typeof raw === "number" ? raw : Number(raw);
+    // Zero is rejected along with the negatives: "come back immediately" is not something a
+    // rate limiter means, and taking it literally produces back-to-back retries at the exact
+    // moment the server just turned us away.
+    if (!Number.isFinite(seconds) || seconds <= 0)
+        return undefined;
+    // Re-checked after rounding: a hint like 0.0004 is positive but rounds to 0ms, which would
+    // put us straight back on the server with no wait at all.
+    const ms = Math.round(seconds * 1000);
+    return ms > 0 ? ms : undefined;
+}
+function retryAfterFromBody(body) {
+    if (!body)
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return undefined; // an HTML error page, a proxy blurb, anything non-JSON
+    }
+    const hint = parsed?.error?.details
+        ?.retry_after;
+    return typeof hint === "number" ? secondsToMs(hint) : undefined;
+}
+export class OctoApiError extends Error {
+    status;
+    path;
+    body;
+    /**
+     * The server's requested wait, verbatim. Deliberately not clamped here: shortening it
+     * would mean going back before the server said we could, which is the behaviour this
+     * error exists to help remove. Callers decide whether the wait is worth honouring.
+     */
+    retryAfterMs;
+    rateLimitScope;
+    rateLimitRemaining;
+    constructor(params) {
+        super(`Octo API ${params.path} failed (${params.status}): ${params.body}`);
+        this.name = "OctoApiError";
+        this.status = params.status;
+        this.path = params.path;
+        this.body = params.body;
+        this.retryAfterMs = params.retryAfterMs;
+        this.rateLimitScope = params.rateLimitScope;
+        this.rateLimitRemaining = params.rateLimitRemaining;
+    }
+    get isRateLimited() {
+        return this.status === 429;
+    }
+    static from(resp, path, body) {
+        const text = body || resp.statusText || "";
+        const scope = header(resp, "X-RateLimit-Scope");
+        const remaining = header(resp, "X-RateLimit-Remaining");
+        return new OctoApiError({
+            status: resp.status,
+            path,
+            body: text.length > MAX_ERROR_BODY_CHARS ? `${text.slice(0, MAX_ERROR_BODY_CHARS)}…` : text,
+            // Parsed from the untruncated body: a hint sitting past the cap must not be lost
+            // to a display concern.
+            retryAfterMs: secondsToMs(header(resp, "Retry-After")) ??
+                retryAfterFromBody(body) ??
+                DEFAULT_RETRY_AFTER_MS,
+            ...(scope !== undefined ? { rateLimitScope: scope } : {}),
+            ...(remaining !== undefined ? { rateLimitRemaining: remaining } : {})
+        });
+    }
+}
+/** A successful HTTP status that violates an endpoint's delivery contract. */
+export class OctoApiStatusMismatchError extends OctoApiError {
+    expectedStatus;
+    constructor(path, status, expectedStatus) {
+        // Do not include the response body in this protocol diagnostic.
+        super({ path, status, body: `expected ${expectedStatus}`, retryAfterMs: 0 });
+        this.name = "OctoApiStatusMismatchError";
+        this.expectedStatus = expectedStatus;
+    }
+}
+/** A successful HTTP response that cannot satisfy the endpoint's receipt protocol. */
+export class OctoApiProtocolError extends Error {
+}

package/node_modules/@mininglamp-oss/octo-runtime-extra-channel-gateway/dist/transport/api/events.d.ts

@@ -0,0 +1,51 @@
+/**
+ * 事件 API：提供有界轮询和 ACK，用于取回卡片动作等服务端事件。
+ * 只负责事件传输；消费范围、授权和动作归属由通道决定，不承接文档评论业务。
+ */
+import type { BotEvent } from "./types.js";
+/**
+ * Mirrors the server-side clamp on `wait`. Single source of truth — the JSON schemas and the
+ * poller all derive from this, so the plugin and the server cannot drift apart silently.
+ */
+export declare const MAX_EVENT_WAIT_SECONDS = 30;
+/**
+ * Smallest useful hold. Below this the loop issues *more* requests than the short polling it
+ * replaces (a 1s hold with no added delay is 60 req/min against a 29 req/min baseline), and the
+ * "did the server actually hold?" guard shrinks to a window narrower than an ordinary slow RTT.
+ * A non-zero value under this is raised to it rather than rejected.
+ */
+export declare const MIN_EVENT_WAIT_SECONDS = 5;
+/**
+ * Client timeout for one /v1/bot/events request.
+ *
+ * Must always exceed the hold the server was asked for, otherwise the client aborts mid-hold
+ * and the poll loop degrades into a timeout/retry storm that is strictly worse than plain
+ * short polling.
+ */
+export declare function eventsPollTimeoutMs(waitSeconds?: number): number;
+/**
+ * Pull typed bot events strictly after the supplied cursor.
+ *
+ * With `waitSeconds` unset or 0 this is a plain short poll: the server reads the queue once and
+ * answers, empty batch included. With `waitSeconds > 0` the server holds an empty queue open for
+ * that long and answers as soon as an event lands, which is what takes card-action latency off
+ * the poll cadence. The hold is opt-in on the wire precisely so that a client which does not
+ * raise its own timeout keeps working unchanged.
+ *
+ * An expired hold is a normal empty batch, not an error — there is no timeout status to handle.
+ */
+export declare function fetchBotEvents(params: {
+    apiUrl: string;
+    botToken: string;
+    sinceEventId?: number;
+    limit?: number;
+    waitSeconds?: number;
+    signal?: AbortSignal;
+}): Promise<BotEvent[]>;
+/** Best-effort queue pruning after a recognized bot event has been accepted locally. */
+export declare function ackBotEvent(params: {
+    apiUrl: string;
+    botToken: string;
+    eventId: number;
+    signal?: AbortSignal;
+}): Promise<void>;

package/node_modules/@mininglamp-oss/octo-runtime-extra-channel-gateway/dist/transport/api/events.js

@@ -0,0 +1,79 @@
+import { postJson } from "./client.js";
+// Card-event poll requests run in a single sequential loop; without a bound a hung
+// /v1/bot/events (or its ack) would block all callback processing for the account until the OS
+// eventually drops the socket.
+//
+// This bounds an *idle* request only. When the caller opts into the server-side long poll the
+// server deliberately holds the connection open for up to `wait` seconds, so a fixed 10s cap
+// would abort every hold longer than that and log a failure on each one — see
+// eventsPollTimeoutMs, which derives the bound from the requested hold instead.
+const EVENTS_POLL_TIMEOUT_MS = 10_000;
+// Slack added on top of a long-poll hold before the client gives up. It has to cover the
+// server rounding the final BLPOP chunk up to a whole second plus ordinary network/scheduling
+// jitter; the client must never be the side that times out first, because an abort loses the
+// batch the server was about to hand back.
+const EVENTS_POLL_WAIT_MARGIN_MS = 10_000;
+/**
+ * Mirrors the server-side clamp on `wait`. Single source of truth — the JSON schemas and the
+ * poller all derive from this, so the plugin and the server cannot drift apart silently.
+ */
+export const MAX_EVENT_WAIT_SECONDS = 30;
+/**
+ * Smallest useful hold. Below this the loop issues *more* requests than the short polling it
+ * replaces (a 1s hold with no added delay is 60 req/min against a 29 req/min baseline), and the
+ * "did the server actually hold?" guard shrinks to a window narrower than an ordinary slow RTT.
+ * A non-zero value under this is raised to it rather than rejected.
+ */
+export const MIN_EVENT_WAIT_SECONDS = 5;
+/**
+ * Client timeout for one /v1/bot/events request.
+ *
+ * Must always exceed the hold the server was asked for, otherwise the client aborts mid-hold
+ * and the poll loop degrades into a timeout/retry storm that is strictly worse than plain
+ * short polling.
+ */
+export function eventsPollTimeoutMs(waitSeconds) {
+    if (!waitSeconds || waitSeconds <= 0)
+        return EVENTS_POLL_TIMEOUT_MS;
+    return waitSeconds * 1000 + EVENTS_POLL_WAIT_MARGIN_MS;
+}
+/**
+ * Pull typed bot events strictly after the supplied cursor.
+ *
+ * With `waitSeconds` unset or 0 this is a plain short poll: the server reads the queue once and
+ * answers, empty batch included. With `waitSeconds > 0` the server holds an empty queue open for
+ * that long and answers as soon as an event lands, which is what takes card-action latency off
+ * the poll cadence. The hold is opt-in on the wire precisely so that a client which does not
+ * raise its own timeout keeps working unchanged.
+ *
+ * An expired hold is a normal empty batch, not an error — there is no timeout status to handle.
+ */
+export async function fetchBotEvents(params) {
+    const waitSeconds = params.waitSeconds && params.waitSeconds > 0
+        ? Math.min(MAX_EVENT_WAIT_SECONDS, Math.floor(params.waitSeconds))
+        : 0;
+    const response = await postJson(params.apiUrl, params.botToken, "/v1/bot/events", {
+        event_id: params.sinceEventId ?? 0,
+        limit: Math.max(1, Math.min(100, Math.floor(params.limit ?? 20))),
+        // Omitted entirely when not long-polling, so the request stays byte-identical to what
+        // servers that predate the `wait` field already accept.
+        ...(waitSeconds > 0 ? { wait: waitSeconds } : {})
+    }, params.signal ?? AbortSignal.timeout(eventsPollTimeoutMs(waitSeconds)), 
+    // The poll loop paces itself from the outcome of each request, with an exponential
+    // backoff on errors. It also infers "did the server hold?" from the time elapsed
+    // around this call, and a sleep inside it would inflate that measurement: a fast
+    // empty return after a backoff reads as an honoured hold and re-polls immediately.
+    { retryOn429: false });
+    return Array.isArray(response?.results) ? response.results : [];
+}
+/** Best-effort queue pruning after a recognized bot event has been accepted locally. */
+export async function ackBotEvent(params) {
+    await postJson(params.apiUrl, params.botToken, `/v1/bot/events/${params.eventId}/ack`, {}, params.signal ?? AbortSignal.timeout(EVENTS_POLL_TIMEOUT_MS), 
+    // An ack runs inside the poll loop's sequential drain and its failure is only
+    // logged — it never becomes a poll outcome, so nothing downstream would pace a
+    // retry. Sleeping here would just stall the events queued behind this one, and the
+    // callers normally persist the cursor before the ack, so a lost ack costs at
+    // most one redelivery. During a deliberately blocked cursor gap, the poller
+    // only ACKs recognized handlers that carry their own event-level idempotency.
+    { retryOn429: false });
+}

package/node_modules/@mininglamp-oss/octo-runtime-extra-channel-gateway/dist/transport/api/files.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Infer MIME type from filename extension. Returns a sensible default if unknown.
+ */
+export declare function inferContentType(filename: string): string;
+/**
+ * Ensure text/* content types include a charset parameter.
+ * If the content type starts with "text/" and has no charset, appends "; charset=utf-8".
+ */
+export declare function ensureTextCharset(contentType: string): string;
+/**
+ * Parse image dimensions from buffer (PNG/JPEG/GIF/WebP).
+ * Lightweight — reads only the header bytes, no external dependencies.
+ */
+export declare function parseImageDimensions(buf: Buffer, mime: string): {
+    width: number;
+    height: number;
+} | null;
+/**
+ * Parse image dimensions from a file path by reading only the first 64KB.
+ * Avoids loading the entire file into memory.
+ */
+export declare function parseImageDimensionsFromFile(filePath: string, mime: string): Promise<{
+    width: number;
+    height: number;
+} | null>;

package/node_modules/@mininglamp-oss/octo-runtime-extra-channel-gateway/dist/transport/api/files.js

@@ -0,0 +1,119 @@
+/**
+ * 文件辅助能力：保留类型与图片尺寸识别，支持原生图片输入。
+ * 上传 API 按 R02a/R02b 决策移除；不得因清理上传而删除输入解析。
+ * 决策：.octospec/tasks/pr1-yujiawei-review/brief.md
+ */
+// Adapted from Mininglamp-OSS/openclaw-channel-octo/src/api-fetch.ts.
+import path from "node:path";
+import { open } from "node:fs/promises";
+/**
+ * Infer MIME type from filename extension. Returns a sensible default if unknown.
+ */
+export function inferContentType(filename) {
+    const ext = path.extname(filename).toLowerCase();
+    const map = {
+        ".jpg": "image/jpeg",
+        ".jpeg": "image/jpeg",
+        ".png": "image/png",
+        ".gif": "image/gif",
+        ".webp": "image/webp",
+        ".svg": "image/svg+xml",
+        ".bmp": "image/bmp",
+        ".ico": "image/x-icon",
+        ".mp4": "video/mp4",
+        ".webm": "video/webm",
+        ".mov": "video/quicktime",
+        ".mp3": "audio/mpeg",
+        ".wav": "audio/wav",
+        ".ogg": "audio/ogg",
+        ".pdf": "application/pdf",
+        ".zip": "application/zip",
+        ".doc": "application/msword",
+        ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+        ".xls": "application/vnd.ms-excel",
+        ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+        ".txt": "text/plain",
+        ".md": "text/markdown",
+        ".markdown": "text/markdown",
+        ".csv": "text/csv",
+        ".html": "text/html",
+        ".htm": "text/html",
+        ".css": "text/css",
+        ".xml": "text/xml",
+        ".yaml": "text/yaml",
+        ".yml": "text/yaml",
+        ".json": "application/json"
+    };
+    return map[ext] ?? "application/octet-stream";
+}
+/**
+ * Ensure text/* content types include a charset parameter.
+ * If the content type starts with "text/" and has no charset, appends "; charset=utf-8".
+ */
+export function ensureTextCharset(contentType) {
+    if (contentType.startsWith("text/") && !contentType.includes("charset")) {
+        return contentType + "; charset=utf-8";
+    }
+    return contentType;
+}
+/**
+ * Parse image dimensions from buffer (PNG/JPEG/GIF/WebP).
+ * Lightweight — reads only the header bytes, no external dependencies.
+ */
+export function parseImageDimensions(buf, mime) {
+    try {
+        if (mime === "image/png" && buf.length > 24) {
+            // PNG: width at offset 16 (4 bytes BE), height at offset 20 (4 bytes BE)
+            return { width: buf.readUInt32BE(16), height: buf.readUInt32BE(20) };
+        }
+        if ((mime === "image/jpeg" || mime === "image/jpg") && buf.length > 2) {
+            // JPEG: scan for SOF0/SOF2 marker (0xFF 0xC0 or 0xFF 0xC2)
+            let offset = 2;
+            while (offset < buf.length - 8) {
+                if (buf[offset] !== 0xff)
+                    break;
+                const marker = buf[offset + 1];
+                if (marker === 0xc0 || marker === 0xc2) {
+                    return { width: buf.readUInt16BE(offset + 7), height: buf.readUInt16BE(offset + 5) };
+                }
+                const len = buf.readUInt16BE(offset + 2);
+                offset += 2 + len;
+            }
+        }
+        if (mime === "image/gif" && buf.length > 10) {
+            // GIF: width at offset 6 (2 bytes LE), height at offset 8 (2 bytes LE)
+            return { width: buf.readUInt16LE(6), height: buf.readUInt16LE(8) };
+        }
+        if (mime === "image/webp" && buf.length > 30) {
+            // WebP VP8: width at offset 26, height at offset 28 (both 2 bytes LE)
+            if (buf.toString("ascii", 12, 16) === "VP8 " && buf.length > 29) {
+                return { width: buf.readUInt16LE(26) & 0x3fff, height: buf.readUInt16LE(28) & 0x3fff };
+            }
+        }
+    }
+    catch {
+        /* ignore parse errors */
+    }
+    return null;
+}
+/**
+ * Parse image dimensions from a file path by reading only the first 64KB.
+ * Avoids loading the entire file into memory.
+ */
+export async function parseImageDimensionsFromFile(filePath, mime) {
+    const HEADER_SIZE = 65536; // 64KB — enough for PNG/JPEG/GIF/WebP headers
+    let fh;
+    try {
+        fh = await open(filePath, "r");
+        const buf = Buffer.alloc(HEADER_SIZE);
+        const { bytesRead } = await fh.read(buf, 0, HEADER_SIZE, 0);
+        return parseImageDimensions(buf.subarray(0, bytesRead), mime);
+    }
+    catch {
+        /* ignore read/parse errors */
+    }
+    finally {
+        await fh?.close();
+    }
+    return null;
+}

package/node_modules/@mininglamp-oss/octo-runtime-extra-channel-gateway/dist/transport/api/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Octo REST 公共入口：集中导出通道手动调用所需的接口。
+ * Channel 直接使用这些 API；LLM toolCall 使用 octo-cli，两者不互相启动或代替。
+ */
+export * from "./client.js";
+export * from "./errors.js";
+export * from "./types.js";
+export * from "./messages.js";
+export * from "./cards.js";
+export * from "./conversations.js";
+export * from "./rules.js";
+export * from "./events.js";
+export * from "./files.js";

package/node_modules/@mininglamp-oss/octo-runtime-extra-channel-gateway/dist/transport/api/index.js

@@ -0,0 +1,13 @@
+/**
+ * Octo REST 公共入口：集中导出通道手动调用所需的接口。
+ * Channel 直接使用这些 API；LLM toolCall 使用 octo-cli，两者不互相启动或代替。
+ */
+export * from "./client.js";
+export * from "./errors.js";
+export * from "./types.js";
+export * from "./messages.js";
+export * from "./cards.js";
+export * from "./conversations.js";
+export * from "./rules.js";
+export * from "./events.js";
+export * from "./files.js";