@yiarce/dsh-chat 0.0.0-stage → 0.1.0

package/login.js

@@ -0,0 +1,250 @@
+import { createHash, randomUUID } from 'node:crypto'
+
+const CREDENTIAL_KEY_PATTERN = /^[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/
+export function profileCredentialKey(profile = 'default') {
+  const profileId = createHash('sha256').update(profile).digest('hex').slice(0, 24)
+  return `yiarce-chat/profile-${profileId}`
+}
+
+const API = 'https://api.search.yiarce.cn'
+const RESOURCE = 'https://resource.yiarce.cn/'
+export class AccountError extends Error {
+  constructor(code, diagnostic) { super(code); this.code = code; if (diagnostic) this.diagnostic = diagnostic }
+}
+const string = value => typeof value === 'string' ? value : ''
+const payloadOf = record => record?.kind === 'grant' && typeof record.payload?.token === 'string' && record.payload.token ? record.payload : null
+
+const imageUrl = value => {
+  const raw = string(value).trim()
+  try { const url = new URL(raw, RESOURCE); return raw && url.protocol === 'https:' ? url.href : '' } catch { return '' }
+}
+export function profileOf(data) {
+  if (!data || typeof data !== 'object' || !string(data.username)) throw new AccountError('invalid-response')
+  return { username: data.username, nickname: string(data.nickname), avatar: imageUrl(data.avatar), status: string(data.status), city: string(data.city) }
+}
+
+/** Standalone chat login. Credentials use a separate profile key; only chatCredential exposes the token. */
+export class AccountService {
+  constructor(credentials, { key = 'yiarce-chat/default', fetcher = fetch, pollMs = 2000, leaseMs = 300000, now = Date.now } = {}) {
+    if (typeof key !== 'string' || !CREDENTIAL_KEY_PATTERN.test(key)) throw new TypeError('Invalid business account credential key')
+    this.credentials = credentials
+    this.key = key
+    this.fetcher = fetcher
+    this.pollMs = pollMs
+    this.leaseMs = leaseMs
+    this.now = now
+    this.life = new AbortController()
+    this.listeners = new Set()
+    this.epoch = 0
+    this.revision = 0
+    this.tail = Promise.resolve()
+    this.jobs = new Set()
+    this.attempt = null
+    this.state = { phase: 'restoring', credentialConfigured: false, profile: null, error: null }
+  }
+  view() {
+    const a = this.attempt
+    return { ...this.state, revision: this.revision, attempt: a ? { id: a.id, phase: a.phase, qrcode: a.qrcode, error: a.error } : null }
+  }
+  publish(patch = {}) {
+    if (this.life.signal.aborted) return
+    Object.assign(this.state, patch)
+    this.revision++
+    const view = this.view()
+    for (const listener of this.listeners) listener(view)
+  }
+  subscribe(listener) { this.listeners.add(listener); return () => this.listeners.delete(listener) }
+  serial(operation) {
+    const result = this.tail.then(operation)
+    this.tail = result.catch(() => {})
+    return result
+  }
+  track(promise) {
+    this.jobs.add(promise)
+    promise.finally(() => this.jobs.delete(promise)).catch(() => {})
+    return promise
+  }
+  isCurrent(epoch) { return !this.life.signal.aborted && epoch === this.epoch }
+  // 聊天服务用的凭据：只把业务 token 交出去，身份由聊天服务自己调 /user/info 查。
+  chatCredential() {
+    const epoch = this.epoch
+    return this.track(this.serial(async () => {
+      if (!this.isCurrent(epoch)) throw new AccountError('cancelled')
+      if (this.state.phase !== 'signed-in' || !this.state.profile) throw new AccountError('auth-expired')
+      let payload
+      try { payload = payloadOf(await this.credentials.readRecord(this.key)) } catch { throw new AccountError('storage') }
+      if (!this.isCurrent(epoch)) throw new AccountError('cancelled')
+      if (!payload) throw new AccountError('auth-expired')
+      return { token: payload.token }
+    }))
+  }
+  async request(path, { token, body, signal, query = {} } = {}) {
+    const url = new URL(path, API)
+    for (const [key, value] of Object.entries(query)) url.searchParams.set(key, String(value))
+    if (token) url.searchParams.set('token', token)
+    try {
+      const response = await this.fetcher(url, {
+        method: body ? 'POST' : 'GET',
+        headers: { 'Content-Type': 'text/plain' },
+        ...(body ? { body: JSON.stringify(body) } : {}),
+        signal: AbortSignal.any([this.life.signal, AbortSignal.timeout(15000), ...(signal ? [signal] : [])]),
+        redirect: 'error',
+      })
+      if (response.status === 401) throw new AccountError('auth-expired')
+      if (!response.ok) throw new AccountError('network')
+      const result = await response.json()
+      if (!result || !Number.isFinite(result.code)) throw new AccountError('invalid-response')
+      if (result.code < 0) {
+        // The backend does not document a stable expiry code. Never clear credentials on an arbitrary error.
+        const expired = /(?:token|凭据).*(?:失效|过期|无效)|未登录|登录.*(?:失效|过期)|unauthorized/i.test(string(result.msg))
+        throw new AccountError(expired ? 'auth-expired' : 'business')
+      }
+      return result.data
+    } catch (error) {
+      if (error instanceof AccountError) throw error
+      if (this.life.signal.aborted || signal?.aborted) throw new AccountError('cancelled')
+      throw new AccountError('network')
+    }
+  }
+  async loadProfile(epoch, token) {
+    const profile = profileOf(await this.request('/user/info', { token }))
+    if (this.isCurrent(epoch)) this.publish({ phase: 'signed-in', profile, error: null, credentialConfigured: true })
+  }
+  restore() {
+    const epoch = this.epoch
+    return this.track(this.serial(async () => {
+      if (!this.isCurrent(epoch)) return this.view()
+      this.publish({ phase: 'restoring', error: null })
+      let payload
+      try {
+        payload = payloadOf(await this.credentials.readRecord(this.key))
+        if (!this.isCurrent(epoch)) return this.view()
+        if (!payload) { this.publish({ phase: 'signed-out', profile: null, credentialConfigured: false }); return this.view() }
+        this.publish({ credentialConfigured: true })
+        if (!payload.refreshedAt || this.now() - payload.refreshedAt >= 86400000) {
+          let nextPayload = payload
+          await this.credentials.modifyRecord(this.key, async record => {
+            const current = payloadOf(record)
+            if (!current || !this.isCurrent(epoch)) return undefined
+            if (current.refreshedAt && this.now() - current.refreshedAt < 86400000) { nextPayload = current; return undefined }
+            const res = await this.request('/user/refreshToken', { token: current.token })
+            if (!string(res?.token)) throw new AccountError('invalid-response')
+            if (!this.isCurrent(epoch)) return undefined
+            nextPayload = { token: res.token, refreshedAt: this.now() }
+            return { kind: 'grant', payload: nextPayload }
+          })
+          payload = nextPayload
+        }
+        if (this.isCurrent(epoch)) await this.loadProfile(epoch, payload.token)
+      } catch (error) {
+        if (!this.isCurrent(epoch)) return this.view()
+        if (error.code === 'auth-expired') {
+          try { await this.credentials.deleteRecord(this.key) } catch { this.publish({ phase: 'unavailable', error: 'storage' }); return this.view() }
+          if (this.isCurrent(epoch)) this.publish({ phase: 'signed-out', profile: null, credentialConfigured: false, error: 'auth-expired' })
+        } else this.publish({ phase: this.state.profile ? 'signed-in' : 'unavailable', error: error.code || 'storage' })
+      }
+      return this.view()
+    }))
+  }
+  cancelAttempt(id) {
+    const a = this.attempt
+    if (!a || (id && a.id !== id)) return this.view()
+    a.controller.abort()
+    clearTimeout(a.timer)
+    this.attempt = null
+    this.publish()
+    return this.view()
+  }
+  beginSignIn() {
+    this.cancelAttempt()
+    const epoch = ++this.epoch
+    const a = { id: randomUUID(), epoch, controller: new AbortController(), phase: 'loading', qrcode: '', error: null, scene: '', timer: null }
+    this.attempt = a
+    a.timer = setTimeout(() => {
+      if (this.attempt !== a) return
+      a.controller.abort()
+      a.phase = 'expired'
+      a.qrcode = ''
+      this.publish()
+    }, this.leaseMs)
+    a.timer.unref?.()
+    this.publish({ error: null, phase: this.state.profile ? 'signed-in' : 'signed-out' })
+    this.track(this.runAttempt(a))
+    return this.view()
+  }
+  async wait(signal) {
+    await new Promise((resolve, reject) => {
+      if (signal.aborted) { reject(new AccountError('cancelled')); return }
+      const onAbort = () => { clearTimeout(timer); reject(new AccountError('cancelled')) }
+      const timer = setTimeout(() => { signal.removeEventListener('abort', onAbort); resolve() }, this.pollMs)
+      signal.addEventListener('abort', onAbort, { once: true })
+    })
+  }
+  async runAttempt(a) {
+    const current = () => this.attempt === a && this.isCurrent(a.epoch) && !a.controller.signal.aborted
+    try {
+      const qr = await this.request('/login/wechatQrcode', { signal: a.controller.signal })
+      if (!current()) return
+      if (!string(qr?.scene) || !string(qr?.qrcode) || !/^[A-Za-z0-9+/=\r\n]+$/.test(qr.qrcode) || qr.qrcode.length > 1048576) throw new AccountError('invalid-response')
+      a.scene = qr.scene
+      a.qrcode = 'data:image/png;base64,' + qr.qrcode
+      a.phase = 'ready'
+      this.publish()
+      while (current()) {
+        await this.wait(a.controller.signal)
+        const result = await this.request('/login/wechat', { body: { scene: a.scene }, signal: a.controller.signal })
+        if (!current()) return
+        if (result?.status === 'expire') { a.phase = 'expired'; a.qrcode = ''; clearTimeout(a.timer); this.publish(); return }
+        if (result?.status === 'success') { a.phase = 'scanned'; this.publish(); continue }
+        if (result?.status !== 'ok') continue
+        if (!string(result.token)) throw new AccountError('invalid-response')
+        await this.serial(async () => {
+          if (!current()) return
+          let previous
+          try {
+            previous = await this.credentials.readRecord(this.key)
+            if (!current()) return
+            await this.credentials.modifyRecord(this.key, async () => current() ? { kind: 'grant', payload: { token: result.token, refreshedAt: this.now() } } : undefined)
+            // Closing the UI while the provider commits must not leave a cancelled login behind.
+            if (!current()) {
+              if (previous) await this.credentials.modifyRecord(this.key, async record => payloadOf(record)?.token === result.token ? previous : undefined)
+              else if (payloadOf(await this.credentials.readRecord(this.key))?.token === result.token) await this.credentials.deleteRecord(this.key)
+              return
+            }
+          } catch { throw new AccountError('storage') }
+          clearTimeout(a.timer)
+          this.attempt = null
+          a.controller.abort()
+          this.publish({ phase: 'signed-in', profile: null, credentialConfigured: true, error: null })
+          try { await this.loadProfile(a.epoch, result.token) }
+          catch (error) { if (this.isCurrent(a.epoch)) this.publish({ error: error.code || 'network' }) }
+        })
+        return
+      }
+    } catch (error) {
+      if (!current()) return
+      clearTimeout(a.timer)
+      a.phase = 'error'
+      a.error = error.code || 'network'
+      a.qrcode = ''
+      this.publish()
+    }
+  }
+  signOut() {
+    ++this.epoch
+    this.cancelAttempt()
+    return this.track(this.serial(async () => {
+      try { await this.credentials.deleteRecord(this.key) }
+      catch { throw new AccountError('storage') }
+      this.publish({ phase: 'signed-out', profile: null, credentialConfigured: false, error: null })
+      return this.view()
+    }))
+  }
+  async dispose() {
+    this.life.abort()
+    this.cancelAttempt()
+    await Promise.allSettled([...this.jobs, this.tail])
+    this.listeners.clear()
+  }
+}
+

package/media-client.js

@@ -0,0 +1,46 @@
+// One browser adapter for both the plugin panel and standalone plugin page.
+export function createMediaClient({ baseURL, fetcher = window.fetch.bind(window) }) {
+  const endpoint = name => new URL(name, baseURL).href
+  async function call(name, body, signal, timeout) {
+    const response = await fetcher(endpoint(name), { method: "POST", credentials: "same-origin", cache: "no-store", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body), signal: AbortSignal.any([signal, AbortSignal.timeout(timeout)]) })
+    const data = await response.json()
+    if (!response.ok) throw new Error(data.error || "请求失败")
+    return data
+  }
+  return {
+    searchStickers: (keyword, signal, page = 1) => call("stickers", { keyword, page }, signal, 25000),
+    loadStickerImage: async (url, signal) => (await call("sticker-image", { url }, signal, 60000)).dataURL,
+    async uploadImage(file, signal, onProgress) {
+      if (!file.size || file.size > 7 * 1024 * 1024) throw new Error("单张图片不能超过 7MB")
+      const uploadSignal = AbortSignal.any([signal, AbortSignal.timeout(120000)])
+      const response = await fetcher(endpoint("upload-image"), { method: "POST", credentials: "same-origin", cache: "no-store", headers: { "Content-Type": file.type || "application/octet-stream" }, body: file, signal: uploadSignal })
+      if (!response.ok) { const data = await response.json(); throw new Error(data.error || "图片上传失败") }
+      if (!response.body || !response.headers.get("content-type")?.includes("text/event-stream")) throw new Error("上传响应无效")
+      const reader = response.body.getReader(), decoder = new TextDecoder()
+      let buffer = ""
+      try {
+        for (;;) {
+          uploadSignal.throwIfAborted()
+          const { value, done } = await reader.read()
+          buffer += done ? decoder.decode() : decoder.decode(value, { stream: true })
+          if (buffer.length > 65536) throw new Error("上传进度响应过大")
+          let boundary
+          while ((boundary = buffer.indexOf(String.fromCharCode(10, 10))) >= 0) {
+            const block = buffer.slice(0, boundary); buffer = buffer.slice(boundary + 2)
+            const line = block.split(String.fromCharCode(10)).find(line => line.startsWith("data: "))
+            if (!line) continue
+            const event = JSON.parse(line.slice(6))
+            if (event.type === "progress" && Number.isFinite(event.loaded) && Number.isFinite(event.total) && event.total > 0) onProgress?.(event.loaded, event.total)
+            if (event.type === "error") throw new Error(event.error || "图片上传失败")
+            if (event.type === "complete") {
+              const url = new URL(event.url)
+              if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.href.length > 2048) throw new Error("图片地址无效")
+              return { url: url.href }
+            }
+          }
+          if (done) throw new Error("上传已中断，未收到成功确认")
+        }
+      } finally { await reader.cancel().catch(() => {}); reader.releaseLock() }
+    },
+  }
+}

package/media.js

@@ -0,0 +1,197 @@
+import { request as requestHTTP } from 'node:http'
+import { request as requestHTTPS } from 'node:https'
+import { randomUUID } from 'node:crypto'
+
+const IMAGE_LIMIT = 7 * 1024 * 1024
+const RESULT_LIMIT = 2 * 1024 * 1024
+const UPLOAD_SITE = 'https://www.boltp.com/'
+const json = (value, status = 200) => Response.json(value, { status, headers: { 'Cache-Control': 'no-store' } })
+const errorText = error => error?.name === 'TimeoutError' ? '请求超时，请稍后重试' : error?.message || '请求失败'
+
+function imageURL(value) {
+  if (typeof value !== 'string' || value.length > 2048) throw new Error('图片地址无效')
+  const url = new URL(value)
+  if (!['http:', 'https:'].includes(url.protocol) || !url.hostname || url.username || url.password) throw new Error('图片地址无效')
+  return url
+}
+function imageType(bytes) {
+  if (bytes.length >= 3 && bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) return ['image/jpeg', 'jpg']
+  if (bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))) return ['image/png', 'png']
+  if (['GIF87a', 'GIF89a'].includes(bytes.subarray(0, 6).toString())) return ['image/gif', 'gif']
+  if (bytes.subarray(0, 4).toString() === 'RIFF' && bytes.subarray(8, 12).toString() === 'WEBP') return ['image/webp', 'webp']
+  throw new Error('仅支持 JPG、PNG、GIF、WebP 图片')
+}
+async function readBody(body, limit, signal) {
+  const chunks = []; let size = 0
+  for await (const chunk of body || []) {
+    signal.throwIfAborted(); size += chunk.byteLength
+    if (size > limit) throw new Error(limit === IMAGE_LIMIT ? '单张图片不能超过 7MB' : '响应内容过大')
+    chunks.push(Buffer.from(chunk))
+  }
+  return Buffer.concat(chunks)
+}
+// Bounded Node HTTP requests, including real write progress and upstream abort.
+function request(url, { signal, headers = {}, body = null, limit = RESULT_LIMIT, onWrite = null, method = 'GET' }) {
+  signal.throwIfAborted()
+  return new Promise((resolve, reject) => {
+    let settled = false, response
+    const finish = (error, value) => {
+      if (settled) return
+      settled = true; signal.removeEventListener('abort', abort)
+      if (error) { response?.destroy(); req.destroy(); reject(error) } else { if (!req.writableEnded) req.destroy(); resolve(value) }
+    }
+    const req = (url.protocol === 'https:' ? requestHTTPS : requestHTTP)(url, { method, headers: { 'User-Agent': 'Mozilla/5.0', ...headers }, signal }, incoming => {
+      response = incoming
+      const chunks = []; let size = 0
+      incoming.on('data', chunk => {
+        size += chunk.length
+        if (size > limit) { finish(new Error('响应内容过大')); return }
+        chunks.push(chunk)
+      })
+      incoming.on('error', error => finish(error))
+      incoming.on('aborted', () => finish(new Error('响应已中断')))
+      incoming.on('end', () => finish(null, { status: incoming.statusCode, headers: incoming.headers, body: Buffer.concat(chunks) }))
+    })
+    const abort = () => finish(signal.reason || new Error('请求已取消'))
+    signal.addEventListener('abort', abort, { once: true })
+    req.on('error', error => finish(error))
+    if (signal.aborted) { abort(); return }
+    void (async () => {
+      if (body) {
+        let written = 0
+        for (let offset = 0; offset < body.length && !settled; offset += 64 * 1024) {
+          signal.throwIfAborted()
+          const chunk = body.subarray(offset, offset + 64 * 1024)
+          await new Promise((done, fail) => req.write(chunk, error => error ? fail(error) : done()))
+          written += chunk.length
+          if (!settled) onWrite?.(written)
+        }
+      }
+      if (!settled) req.end()
+    })().catch(error => finish(error))
+  })
+}
+function parseJSON(result) {
+  try { return JSON.parse(result.body.toString('utf8')) } catch { throw new Error('上游返回了无法解析的结果') }
+}
+function imageReferer(url) {
+  if (url.hostname === 'free.boltp.com') return UPLOAD_SITE
+  if (url.hostname === 'img.adoutu.com') return 'https://www.adoutu.com/'
+  if (url.hostname === 'ps.ssl.qhimg.com') return 'https://tuchuang.zf123.cn/'
+  return url.origin + '/'
+}
+async function search(input, signal) {
+  const keyword = typeof input.keyword === 'string' ? input.keyword.trim() : ''
+  if (Array.from(keyword).length < 2 || Array.from(keyword).length > 4) throw new Error('请输入 2–4 个字符')
+  const page = input.page ?? 1
+  if (!Number.isInteger(page) || page < 1 || page > 10000) throw new Error('表情页码无效')
+  const url = new URL('https://h5api.sginput.qq.com/wxbq/search')
+  url.search = new URLSearchParams({ key: keyword, page: String(page), num: '40' }).toString()
+  const result = await request(url, { signal, headers: { Accept: 'application/json' } })
+  if (result.status !== 200) throw new Error('表情搜索返回 HTTP ' + result.status)
+  const data = parseJSON(result)
+  if (data.code !== 0 || !Array.isArray(data.data)) throw new Error(data.msg || '表情搜索结果无效')
+  const seen = new Set(), images = []
+  for (const item of data.data) {
+    try {
+      const url = imageURL(item.indexUrl).href
+      if (!seen.has(url)) { seen.add(url); images.push({ url, alt: '' }) }
+    } catch { /* Ignore malformed result URLs. */ }
+  }
+  return { images, hasMore: Boolean(data.hasMore) && !data.endFlag && images.length > 0 }
+}
+async function loadImage(input, signal) {
+  let url = imageURL(input.url)
+  for (let redirects = 0; redirects <= 3; redirects++) {
+    const result = await request(url, { signal, limit: IMAGE_LIMIT, headers: { Referer: imageReferer(url), Accept: 'image/*' } })
+    if ([301, 302, 303, 307, 308].includes(result.status) && result.headers.location) {
+      url = imageURL(new URL(result.headers.location, url).href); continue
+    }
+    if (result.status !== 200) throw new Error('图片站点返回 HTTP ' + result.status)
+    const [mime] = imageType(result.body)
+    return { dataURL: 'data:' + mime + ';base64,' + result.body.toString('base64') }
+  }
+  throw new Error('图片重定向过多')
+}
+
+async function uploadImage(bytes, signal, push) {
+  const [mime, extension] = imageType(bytes)
+  const initialized = await request(new URL(UPLOAD_SITE + "api/v2/configs"), { signal, headers: { Accept: "application/json", Referer: UPLOAD_SITE } })
+  if (initialized.status !== 200 || parseJSON(initialized).status !== "success") throw new Error("无法建立图床会话")
+  const cookies = new Map()
+  for (const header of initialized.headers["set-cookie"] || []) {
+    const pair = header.split(";", 1)[0], index = pair.indexOf("=")
+    if (index > 0) cookies.set(pair.slice(0, index), pair.slice(index + 1))
+  }
+  const token = cookies.get("XSRF-TOKEN")
+  if (!token) throw new Error("图床未返回上传令牌")
+  const boundary = "----yiarce-chat-" + randomUUID()
+  const quote = String.fromCharCode(34), crlf = String.fromCharCode(13, 10)
+  const prefix = Buffer.from(["--" + boundary, "Content-Disposition: form-data; name=" + quote + "file" + quote + "; filename=" + quote + "chat-image." + extension + quote, "Content-Type: " + mime, "", ""].join(crlf))
+  const suffix = Buffer.from(["", "--" + boundary, "Content-Disposition: form-data; name=" + quote + "storage_id" + quote, "", "4", "--" + boundary, "Content-Disposition: form-data; name=" + quote + "is_public" + quote, "", "0", "--" + boundary + "--", ""].join(crlf))
+  const body = Buffer.concat([prefix, bytes, suffix])
+  let last = 0
+  push({ type: "progress", loaded: 0, total: bytes.length })
+  const result = await request(new URL(UPLOAD_SITE + "api/v2/upload"), {
+    method: "POST", signal, body, headers: {
+      "Content-Type": "multipart/form-data; boundary=" + boundary, "Content-Length": String(body.length),
+      Accept: "application/json", Referer: UPLOAD_SITE, Origin: new URL(UPLOAD_SITE).origin,
+      Cookie: [...cookies].map(([key, value]) => key + "=" + value).join("; "), "X-XSRF-TOKEN": decodeURIComponent(token),
+    },
+    onWrite(written) {
+      const loaded = Math.max(0, Math.min(bytes.length, written - prefix.length))
+      if (loaded === bytes.length || Date.now() - last >= 100) { last = Date.now(); push({ type: "progress", loaded, total: bytes.length }) }
+    },
+  })
+  const reply = parseJSON(result)
+  if (result.status !== 200 || reply.status !== "success") throw new Error(String(reply.message || "图床上传失败").slice(0, 200))
+  return imageURL(reply.data?.public_url).href
+}
+
+export function registerMedia(ctx) {
+  const life = new AbortController()
+  ctx.effect(() => () => life.abort())
+  for (const [path, timeout, handler] of [["stickers", 20000, search], ["sticker-image", 45000, loadImage]]) {
+    ctx.effect(() => ctx.connection.fetch.register({
+      path: "/api/yiarce-chat/" + path, methods: ["POST"], requestBody: "streaming",
+      async fetch(incoming) {
+        try {
+          const signal = AbortSignal.any([life.signal, incoming.signal, AbortSignal.timeout(timeout)])
+          const body = await readBody(incoming.body, 4096, signal)
+          let input
+          try { input = JSON.parse(body.toString()) } catch { return json({ error: "请求格式无效" }, 400) }
+          if (!input || typeof input !== "object" || Array.isArray(input)) return json({ error: "请求格式无效" }, 400)
+          return json(await handler(input, signal))
+        } catch (error) { return json({ error: errorText(error) }, 502) }
+      },
+    }))
+  }
+  ctx.effect(() => ctx.connection.fetch.register({
+    path: "/api/yiarce-chat/upload-image", methods: ["POST"], requestBody: "streaming",
+    async fetch(incoming) {
+      const controller = new AbortController()
+      const signal = AbortSignal.any([life.signal, incoming.signal, controller.signal, AbortSignal.timeout(90000)])
+      let bytes
+      try {
+        const length = Number(incoming.headers.get("content-length") || 0)
+        if (length > IMAGE_LIMIT) return json({ error: "单张图片不能超过 7MB" }, 413)
+        bytes = await readBody(incoming.body, IMAGE_LIMIT, signal)
+        if (!bytes.length) throw new Error("图片内容为空")
+        imageType(bytes)
+      } catch (error) { return json({ error: errorText(error) }, 400) }
+      const encoder = new TextEncoder()
+      const stream = new ReadableStream({
+        start(output) {
+          let closed = false
+          const close = () => { if (closed) return; closed = true; signal.removeEventListener("abort", close); try { output.close() } catch {} }
+          const push = value => { if (!closed) try { output.enqueue(encoder.encode("data: " + JSON.stringify(value) + String.fromCharCode(10, 10))) } catch { controller.abort() } }
+          signal.addEventListener("abort", close, { once: true })
+          if (signal.aborted) { close(); return }
+          void uploadImage(bytes, signal, push).then(url => push({ type: "complete", url }), error => push({ type: "error", error: errorText(error) })).finally(close)
+        },
+        cancel() { controller.abort() },
+      })
+      return new Response(stream, { headers: { "Content-Type": "text/event-stream", "Cache-Control": "no-store", "X-Accel-Buffering": "no" } })
+    },
+  }))
+}

package/package.json

@@ -1,6 +1,52 @@
-{
-  "name": "@yiarce/dsh-chat",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+{
+  "name": "@yiarce/dsh-chat",
+  "version": "0.1.0",
+  "description": "独立聊天插件：共享聊天页面、图片上传、表情搜索；可选桌面独立窗口。",
+  "type": "module",
+  "main": "./host.js",
+  "exports": {
+    ".": "./host.js",
+    "./client": "./client.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "host.js",
+    "login.js",
+    "media.js",
+    "client.js",
+    "chat.html",
+    "page.js",
+    "page.css",
+    "context-menu.js",
+    "media-client.js",
+    "window-client.js",
+    "standalone.js",
+    "appearance.js",
+    "cordis.patch.yml",
+    "README.md",
+    "history-model.js",
+    "history-store.js",
+    "history-host.js",
+    "history-client.js"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true
+    }
+  },
+  "keywords": [
+    "dsh",
+    "deepseek-harness",
+    "dsh-plugin",
+    "chat",
+    "websocket"
+  ],
+  "license": "MIT",
+  "engines": {
+    "node": ">=22.13.0"
+  }
+}