abelien-harness 0.7.1 → 0.9.0

package/skills/abelien-hardware/scripts/tos-object-store.mjs

@@ -1,202 +0,0 @@
-import crypto from "node:crypto";
-
-const EMPTY = Buffer.alloc(0);
-
-function tosError(code, message, details) {
-  const error = new Error(message);
-  error.code = code;
-  if (details !== undefined) error.details = details;
-  return error;
-}
-
-export function sha256(value) {
-  return crypto.createHash("sha256").update(value).digest("hex");
-}
-
-function hmac(key, value, encoding) {
-  return crypto.createHmac("sha256", key).update(value).digest(encoding);
-}
-
-function first(env, primary, alias) {
-  return env[primary] || env[alias] || "";
-}
-
-export function normalizeTosEnv(env = {}) {
-  return {
-    ...env,
-    TOS_REGION: first(env, "TOS_REGION", "CAD_STORAGE_REGION"),
-    TOS_ENDPOINT: first(env, "TOS_ENDPOINT", "CAD_STORAGE_ENDPOINT"),
-    TOS_BUCKET: first(env, "TOS_BUCKET", "CAD_STORAGE_BUCKET"),
-    TOS_ACCESS_KEY_ID: first(env, "TOS_ACCESS_KEY_ID", "CAD_STORAGE_ACCESS_KEY"),
-    TOS_SECRET_ACCESS_KEY: first(env, "TOS_SECRET_ACCESS_KEY", "CAD_STORAGE_SECRET_KEY"),
-    TOS_ADDRESSING_STYLE: first(env, "TOS_ADDRESSING_STYLE", "CAD_STORAGE_ADDRESSING_STYLE") || "virtual",
-  };
-}
-
-function normalizePrefix(value) {
-  const cleaned = String(value || "hardware_profile_wiki/").replace(/^\/+|\/+$/g, "");
-  if (!cleaned || cleaned.split("/").some(part => part === "." || part === "..")) {
-    throw tosError("VALIDATION", "invalid TOS Wiki prefix");
-  }
-  return `${cleaned}/`;
-}
-
-function positiveIntegerEnv(env, name, fallback) {
-  if (env[name] === undefined || env[name] === "") return fallback;
-  const value = Number(env[name]);
-  if (!Number.isInteger(value) || value <= 0) throw tosError("VALIDATION", `${name} must be a positive integer`, { name });
-  return value;
-}
-
-export function createTosConfig(inputEnv = {}) {
-  const env = normalizeTosEnv(inputEnv);
-  const required = ["TOS_REGION", "TOS_ENDPOINT", "TOS_BUCKET", "TOS_ACCESS_KEY_ID", "TOS_SECRET_ACCESS_KEY"];
-  const missing = required.filter(name => !env[name]);
-  if (missing.length) throw tosError("ENV_MISSING", `env var not set: ${missing[0]}`, { name: missing[0], missing });
-  let endpoint;
-  try { endpoint = new URL(env.TOS_ENDPOINT); }
-  catch { throw tosError("VALIDATION", "TOS_ENDPOINT must be an absolute URL"); }
-  if (!['http:', 'https:'].includes(endpoint.protocol)) throw tosError("VALIDATION", "TOS_ENDPOINT must use http or https");
-  if (endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {
-    throw tosError("VALIDATION", "TOS_ENDPOINT must not contain credentials, query or fragment");
-  }
-  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{1,62}$/.test(env.TOS_BUCKET)) throw tosError("VALIDATION", "invalid TOS_BUCKET");
-  if (!['virtual', 'path'].includes(env.TOS_ADDRESSING_STYLE)) throw tosError("VALIDATION", "TOS_ADDRESSING_STYLE must be virtual or path");
-  return {
-    region: env.TOS_REGION,
-    endpoint,
-    bucket: env.TOS_BUCKET,
-    accessKeyId: env.TOS_ACCESS_KEY_ID,
-    secretAccessKey: env.TOS_SECRET_ACCESS_KEY,
-    sessionToken: env.TOS_SESSION_TOKEN || "",
-    addressingStyle: env.TOS_ADDRESSING_STYLE,
-    prefix: normalizePrefix(env.TOS_WIKI_PREFIX),
-    // 网络读取的两道边界。此前 module adapter 路径既无超时也无体积上限：一个不响应的
-    // 对象存储会把召回挂到进程结束，一个超大对象会被整段读进内存（召回本身还并发 8 路）。
-    // 默认值取"够宽但有限"——Wiki 与分类分片都是小对象，写读都要走这两道闸。
-    timeoutMs: positiveIntegerEnv(env, "TOS_REQUEST_TIMEOUT_MS", 30000),
-    maxObjectBytes: positiveIntegerEnv(env, "TOS_MAX_OBJECT_BYTES", 16 * 1024 * 1024),
-  };
-}
-
-// 先按声明的 content-length 拦一道（能在读之前拒），再在读的过程中边读边数——
-// arrayBuffer() 是先整段进内存再回看长度，对"超大对象"这个失败形态等于没拦。
-async function readObjectBytes(response, maxBytes, key, method) {
-  const declared = Number(response.headers?.get?.("content-length"));
-  if (Number.isFinite(declared) && declared > maxBytes) {
-    throw tosError("TOS_OBJECT_TOO_LARGE", `TOS object exceeds TOS_MAX_OBJECT_BYTES (${maxBytes})`, { key, method, maxBytes, contentLength: declared });
-  }
-  if (response.body && typeof response.body.getReader === "function") {
-    const reader = response.body.getReader();
-    const chunks = [];
-    let total = 0;
-    for (;;) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      total += value.byteLength;
-      if (total > maxBytes) {
-        await reader.cancel().catch(() => {});
-        throw tosError("TOS_OBJECT_TOO_LARGE", `TOS object exceeds TOS_MAX_OBJECT_BYTES (${maxBytes})`, { key, method, maxBytes });
-      }
-      chunks.push(Buffer.from(value));
-    }
-    return Buffer.concat(chunks);
-  }
-  const bytes = typeof response.arrayBuffer === "function"
-    ? Buffer.from(await response.arrayBuffer())
-    : Buffer.from(await response.text(), "utf8");
-  if (bytes.length > maxBytes) {
-    throw tosError("TOS_OBJECT_TOO_LARGE", `TOS object exceeds TOS_MAX_OBJECT_BYTES (${maxBytes})`, { key, method, maxBytes, contentLength: bytes.length });
-  }
-  return bytes;
-}
-
-function encodePath(value) {
-  return String(value).split("/").map(part => encodeURIComponent(part).replace(/[!'()*]/g, char => `%${char.charCodeAt(0).toString(16).toUpperCase()}`)).join("/");
-}
-
-function objectLocation(config, key) {
-  const cleanKey = String(key).replace(/^\/+/, "");
-  if (!cleanKey || cleanKey.split("/").some(part => part === "." || part === "..")) throw tosError("VALIDATION", "invalid TOS object key", { key });
-  const parts = [config.endpoint.pathname.replace(/^\/+|\/+$/g, "")].filter(Boolean);
-  let host = config.endpoint.host;
-  if (config.addressingStyle === "path") parts.push(config.bucket);
-  else host = `${config.bucket}.${host}`;
-  parts.push(cleanKey);
-  const uri = `/${encodePath(parts.join("/"))}`;
-  return { host, uri, url: `${config.endpoint.protocol}//${host}${uri}` };
-}
-
-export function signTosObjectRequest(config, key, { method = "GET", body = EMPTY, headers = {}, now = new Date() } = {}) {
-  const payload = Buffer.isBuffer(body) ? body : Buffer.from(body ?? "");
-  const location = objectLocation(config, key);
-  const timestamp = now.toISOString().replace(/[:-]|\.\d{3}/g, "");
-  const date = timestamp.slice(0, 8);
-  const signed = {
-    host: location.host,
-    "x-amz-content-sha256": sha256(payload),
-    "x-amz-date": timestamp,
-  };
-  for (const [name, value] of Object.entries(headers)) signed[name.toLowerCase()] = String(value).trim();
-  if (config.sessionToken) signed["x-amz-security-token"] = config.sessionToken;
-  const names = Object.keys(signed).sort();
-  const canonicalHeaders = names.map(name => `${name}:${signed[name]}\n`).join("");
-  const signedHeaders = names.join(";");
-  const canonicalRequest = [method.toUpperCase(), location.uri, "", canonicalHeaders, signedHeaders, sha256(payload)].join("\n");
-  const scope = `${date}/${config.region}/s3/aws4_request`;
-  const stringToSign = ["AWS4-HMAC-SHA256", timestamp, scope, sha256(canonicalRequest)].join("\n");
-  const dateKey = hmac(`AWS4${config.secretAccessKey}`, date);
-  const regionKey = hmac(dateKey, config.region);
-  const serviceKey = hmac(regionKey, "s3");
-  const signingKey = hmac(serviceKey, "aws4_request");
-  const signature = hmac(signingKey, stringToSign, "hex");
-  signed.authorization = `AWS4-HMAC-SHA256 Credential=${config.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
-  return { url: location.url, method: method.toUpperCase(), headers: signed, body: payload };
-}
-
-export async function requestTosObject(config, key, { method = "GET", body = EMPTY, headers = {}, optional = false, fetchImpl = fetch } = {}) {
-  const request = signTosObjectRequest(config, key, { method, body, headers });
-  let response;
-  try {
-    response = await fetchImpl(request.url, {
-      method: request.method,
-      headers: request.headers,
-      // 超时覆盖到响应体读完（undici 把 signal 一路带到 body 流）：否则一个连上就不发完的
-      // 对端同样能挂死召回。既有桩 fetch 忽略 signal，行为不变。
-      signal: AbortSignal.timeout(config.timeoutMs),
-      ...(request.method === "GET" || request.method === "HEAD" ? {} : { body: request.body }),
-    });
-  } catch (cause) {
-    if (cause?.name === "TimeoutError" || cause?.code === "ABORT_ERR") {
-      throw tosError("TOS_REQUEST_TIMEOUT", `TOS request timed out after ${config.timeoutMs}ms`, { key, method: request.method, timeout_ms: config.timeoutMs });
-    }
-    throw tosError("TOS_REQUEST_FAILED", `TOS request failed: ${cause.message}`, { key, method: request.method });
-  }
-  if (!response.ok) {
-    if (optional && response.status === 404) return null;
-    throw tosError("TOS_HTTP_STATUS", `TOS returned HTTP ${response.status}`, { key, method: request.method, status: response.status });
-  }
-  const bytes = request.method === "HEAD"
-    ? EMPTY
-    : await readObjectBytes(response, config.maxObjectBytes, key, request.method);
-  return {
-    key,
-    bytes,
-    etag: response.headers?.get?.("etag")?.replace(/^"|"$/g, "") || sha256(bytes),
-    lastModified: response.headers?.get?.("last-modified") || null,
-    contentLength: Number(response.headers?.get?.("content-length")) || null,
-    metadataSha256: response.headers?.get?.("x-amz-meta-sha256") || response.headers?.get?.("x-tos-meta-sha256") || null,
-  };
-}
-
-export function getTosObject(config, key, options = {}) {
-  return requestTosObject(config, key, { ...options, method: "GET" });
-}
-
-export function putTosObject(config, key, body, options = {}) {
-  return requestTosObject(config, key, { ...options, method: "PUT", body });
-}
-
-export function headTosObject(config, key, options = {}) {
-  return requestTosObject(config, key, { ...options, method: "HEAD" });
-}