openyida 2026.9.11 → 2026.9.13

package/lib/asset/asset-status.js

@@ -1,30 +1,17 @@
 
-/**
- * asset-status.js - 素材能力检测（CDN 配置 + 推荐素材策略）
- *
- * P3 素材工具化的第一步：在生成官网/落地页前，先诚实地回答
- * “当前环境能提供什么样的素材能力”，据此选择素材策略，绝不在
- * 无 CDN / 无素材时假装已上传或已交付最终版。
- *
- * 用法：
- *   const { getAssetStatus } = require('./asset-status');
- *   const s = getAssetStatus();
- *   // { cdnConfigured, canUpload, canGenerate, recommendedStrategy, reasons, cdn }
- */
-
 'use strict';
 
 const { loadCdnConfig, validateCdnConfig, getCdnConfigPath } = require('../cdn/cdn-config');
 const { detectImageGenerator } = require('./ai-image');
+const { buildHostAssetCapabilities } = require('./host-capabilities');
+const { detectRuntimeCapabilities } = require('../core/utils');
 
 /**
- * 素材策略枚举
- * - cdn-upload      : 有 CDN，可把本地/生成的图片转存为稳定 CDN URL
- * - external-url    : 无 CDN，外链素材由 asset resolve 统一处理
- * - low-fidelity    : 既无 CDN 也无可用素材 → 只能交付低保真草稿并标注素材缺口
+ * 素材策略枚举。
  */
 const STRATEGY = {
   CDN_UPLOAD: 'cdn-upload',
+  YIDA_ATTACHMENT: 'yida-attachment',
   EXTERNAL_URL: 'external-url',
   LOW_FIDELITY: 'low-fidelity-draft',
 };
@@ -36,41 +23,43 @@ const STRATEGY = {
  * @returns {{
  *   cdnConfigured: boolean,
  *   canUpload: boolean,
- *   canGenerate: boolean,
+ *   canGenerate: boolean|null,
  *   recommendedStrategy: string,
  *   reasons: string[],
  *   cdn: { configPath: string, missing: string[], domain: string }
  * }}
  */
 function getAssetStatus(options = {}) {
-  const online = options.online !== false; // 默认认为可联网处理外链素材
+  const online = options.online !== false;
   const config = loadCdnConfig();
   const { valid, missing } = validateCdnConfig(config);
 
-  const generator = detectImageGenerator();
+  const runtime = options.runtime || detectRuntimeCapabilities({ env: options.env });
+  const hostCapabilities = buildHostAssetCapabilities({ env: options.env, runtime });
+  const generator = detectImageGenerator({ hostCapabilities });
   const reasons = [];
 
   let recommendedStrategy;
-  if (valid) {
-    recommendedStrategy = STRATEGY.CDN_UPLOAD;
-    reasons.push('CDN 已配置：本地或 AI 生成图片可转存为稳定 CDN URL 并回填 spec。');
-  } else if (online) {
-    recommendedStrategy = STRATEGY.EXTERNAL_URL;
-    reasons.push('未配置 CDN：外链素材交给 `openyida asset resolve` 统一处理，或交付草稿。');
-    reasons.push('缺失 CDN 字段：' + (missing.join(', ') || '(未知)') + '，运行 `openyida cdn-config` 可开启上传能力。');
+  if (online) {
+    recommendedStrategy = STRATEGY.YIDA_ATTACHMENT;
+    reasons.push('图片默认上传宜搭附件，需要登录态和 appType；超过 20 MiB 的外链保留原链接。');
   } else {
     recommendedStrategy = STRATEGY.LOW_FIDELITY;
-    reasons.push('未配置 CDN 且无法处理外链素材：只能交付低保真草稿并标注素材缺口。');
+    reasons.push('离线模式不校验外链，也不上传图片。');
   }
 
-  if (!generator.available) {
-    reasons.push('AI 图片生成不可用：' + generator.reason + '（不会伪造图片 URL）。');
+  if (generator.available !== true) {
+    reasons.push(generator.reason);
   }
 
   return {
     cdnConfigured: valid,
-    canUpload: valid,
+    canUpload: online,
+    uploadTarget: 'yida-attachment',
+    requiresLogin: true,
+    requiresAppType: true,
     canGenerate: generator.available,
+    hostCapabilities,
     recommendedStrategy,
     reasons,
     cdn: {

package/lib/asset/attachment-upload.js

@@ -0,0 +1,29 @@
+'use strict';
+
+const fs = require('fs');
+const { CliError } = require('../core/cli-error');
+const MAX_IMAGE_BYTES = 20 * 1024 * 1024;
+
+async function uploadAttachment(files, options = {}) {
+  // Reuse the ImageField upload/sign/public-URL flow, without invoking recognition.
+  const { inferAppType, getAuthRef, uploadImageForAI } = require('../ai/ai');
+  const appType = inferAppType(options);
+  if (!appType) {throw new CliError('ASSET_APP_TYPE_REQUIRED', { code: 'ASSET_APP_TYPE_REQUIRED' });}
+  for (const file of files) {
+    if (fs.statSync(file).size > MAX_IMAGE_BYTES) {
+      throw new CliError('ASSET_TOO_LARGE', { code: 'ASSET_TOO_LARGE' });
+    }
+  }
+  const authRef = getAuthRef(options);
+  const results = [];
+  for (const file of files) {
+    const upload = await uploadImageForAI(file, { appType }, authRef);
+    if (typeof upload.imageUrl !== 'string' || !/^https?:\/\//i.test(upload.imageUrl)) {
+      throw new CliError('ASSET_ATTACHMENT_URL_INVALID', { code: 'ASSET_ATTACHMENT_URL_INVALID' });
+    }
+    results.push({ success: true, originalPath: file, cdnUrl: upload.imageUrl });
+  }
+  return results;
+}
+
+module.exports = { MAX_IMAGE_BYTES, uploadAttachment };

package/lib/asset/host-capabilities.js

@@ -0,0 +1,91 @@
+'use strict';
+
+const CAPABILITY_ENV = Object.freeze({
+  onlineSearch: 'OPENYIDA_AGENT_ONLINE_SEARCH',
+  imageSearch: 'OPENYIDA_AGENT_IMAGE_SEARCH',
+  imageGeneration: 'OPENYIDA_AGENT_IMAGE_GENERATION',
+});
+
+function readDeclaredCapability(value) {
+  if (value === undefined || value === null || String(value).trim() === '') {
+    return { status: 'unknown', available: null, source: 'host_tool_inventory_required' };
+  }
+  const normalized = String(value).trim().toLowerCase();
+  if (['1', 'true', 'yes', 'available', 'enabled'].includes(normalized)) {
+    return { status: 'available', available: true, source: 'environment_declaration' };
+  }
+  if (['0', 'false', 'no', 'unavailable', 'disabled'].includes(normalized)) {
+    return { status: 'unavailable', available: false, source: 'environment_declaration' };
+  }
+  return { status: 'unknown', available: null, source: 'invalid_environment_declaration' };
+}
+
+function hasDeclaredCapability(value) {
+  return value !== undefined && value !== null && String(value).trim() !== '';
+}
+
+function availableCapability(source) {
+  return { status: 'available', available: true, source };
+}
+
+function unknownCapability() {
+  return { status: 'unknown', available: null, source: 'host_tool_inventory_required' };
+}
+
+function detectHostClass(runtime = {}, env = process.env) {
+  const managedRuntime = String(env.OPENYIDA_MANAGED_RUNTIME || '').trim().toLowerCase();
+  if (managedRuntime === 'cloud' || runtime.runtime === 'web_sandbox' || runtime.tool === 'mulerun') {
+    return 'managed_cloud';
+  }
+  if (
+    ['local', 'non_cloud', 'non-cloud'].includes(managedRuntime) ||
+    ['desktop_shell', 'agent_cli', 'local'].includes(runtime.runtime)
+  ) {
+    return 'non_cloud';
+  }
+  return 'unknown';
+}
+
+function resolveCapability(value, runtimeDefault) {
+  return hasDeclaredCapability(value) ? readDeclaredCapability(value) : runtimeDefault;
+}
+
+function buildHostAssetCapabilities(options = {}) {
+  const env = options.env || process.env;
+  const runtime = options.runtime || {};
+  const hostClass = detectHostClass(runtime, env);
+  const searchDefault = () => hostClass === 'non_cloud'
+    ? availableCapability('non_cloud_runtime_default')
+    : unknownCapability();
+  const generationDefault = runtime.tool === 'qwenwork'
+    ? availableCapability('qwenwork_runtime_default')
+    : unknownCapability();
+  const onlineSearch = resolveCapability(env[CAPABILITY_ENV.onlineSearch], searchDefault());
+  const imageSearch = resolveCapability(env[CAPABILITY_ENV.imageSearch], searchDefault());
+  const imageGeneration = resolveCapability(env[CAPABILITY_ENV.imageGeneration], generationDefault);
+  const capabilities = [onlineSearch, imageSearch, imageGeneration];
+
+  return {
+    schema_version: 1,
+    host: {
+      tool: runtime.tool || null,
+      runtime: runtime.runtime || 'unknown',
+      subtype: runtime.subtype || null,
+      class: hostClass,
+    },
+    online_search: onlineSearch,
+    image_search: imageSearch,
+    image_generation: imageGeneration,
+    requires_host_tool_inventory_check: capabilities.some(item => item.status === 'unknown'),
+    declaration_env: { ...CAPABILITY_ENV },
+    detection_policy:
+      'Explicit declarations override runtime defaults. QwenWork provides image generation, and verified non-cloud runtimes provide online and image search. Managed-cloud or unknown runtimes use the host tool inventory.',
+  };
+}
+
+module.exports = {
+  CAPABILITY_ENV,
+  readDeclaredCapability,
+  detectHostClass,
+  buildHostAssetCapabilities,
+};

package/lib/asset/image-metadata.js

@@ -0,0 +1,104 @@
+'use strict';
+
+const fs = require('fs');
+
+const MAX_HEADER_BYTES = 128 * 1024;
+
+function jpegDimensions(buffer) {
+  if (buffer.length < 4 || buffer[0] !== 0xff || buffer[1] !== 0xd8) {return null;}
+  const sof = new Set([0xc0, 0xc1, 0xc2, 0xc3, 0xc5, 0xc6, 0xc7, 0xc9, 0xca, 0xcb, 0xcd, 0xce, 0xcf]);
+  let offset = 2;
+  while (offset + 8 < buffer.length) {
+    if (buffer[offset] !== 0xff) {
+      offset += 1;
+      continue;
+    }
+    while (buffer[offset] === 0xff) {offset += 1;}
+    const marker = buffer[offset++];
+    if (marker === 0xd8 || marker === 0xd9) {continue;}
+    if (marker === 0xda || offset + 2 > buffer.length) {break;}
+    const length = buffer.readUInt16BE(offset);
+    if (length < 2 || offset + length > buffer.length) {break;}
+    if (sof.has(marker) && length >= 7) {
+      return { type: 'jpeg', width: buffer.readUInt16BE(offset + 5), height: buffer.readUInt16BE(offset + 3) };
+    }
+    offset += length;
+  }
+  return { type: 'jpeg', width: 0, height: 0 };
+}
+
+function webpDimensions(buffer) {
+  if (buffer.length < 30 || buffer.toString('ascii', 0, 4) !== 'RIFF' || buffer.toString('ascii', 8, 12) !== 'WEBP') {
+    return null;
+  }
+  const chunk = buffer.toString('ascii', 12, 16);
+  if (chunk === 'VP8X') {
+    return {
+      type: 'webp',
+      width: 1 + buffer.readUIntLE(24, 3),
+      height: 1 + buffer.readUIntLE(27, 3),
+    };
+  }
+  if (chunk === 'VP8L' && buffer[20] === 0x2f) {
+    return {
+      type: 'webp',
+      width: 1 + buffer[21] + ((buffer[22] & 0x3f) << 8),
+      height: 1 + ((buffer[22] & 0xc0) >> 6) + (buffer[23] << 2) + ((buffer[24] & 0x0f) << 10),
+    };
+  }
+  if (chunk === 'VP8 ' && buffer[23] === 0x9d && buffer[24] === 0x01 && buffer[25] === 0x2a) {
+    return {
+      type: 'webp',
+      width: buffer.readUInt16LE(26) & 0x3fff,
+      height: buffer.readUInt16LE(28) & 0x3fff,
+    };
+  }
+  return { type: 'webp', width: 0, height: 0 };
+}
+
+function svgDimensions(buffer) {
+  const text = buffer.toString('utf8', 0, Math.min(buffer.length, 8192));
+  const root = text.replace(/^\uFEFF/, '').replace(/^\s*(?:<\?xml[\s\S]*?\?>\s*)?(?:<!--[\s\S]*?-->\s*)*/, '')
+    .match(/^<svg\b([^>]*)>/i);
+  if (!root) {return null;}
+  const attributes = root[1];
+  const width = Number((attributes.match(/\swidth=["']([\d.]+)(?:px)?["']/i) || [])[1] || 0);
+  const height = Number((attributes.match(/\sheight=["']([\d.]+)(?:px)?["']/i) || [])[1] || 0);
+  if (width > 0 && height > 0) {return { type: 'svg', width, height };}
+  const viewBox = (attributes.match(/\sviewBox=["']([^"']+)["']/i) || [])[1] || '';
+  const values = viewBox.trim().split(/[\s,]+/).map(Number);
+  return { type: 'svg', width: Number(values[2] || 0), height: Number(values[3] || 0) };
+}
+
+/** 读取图片头中的格式和尺寸。 */
+function parseImageMetadata(buffer) {
+  if (!Buffer.isBuffer(buffer) || buffer.length < 10) {return { type: '', width: 0, height: 0 };}
+  if (buffer.length >= 24 && buffer.toString('hex', 0, 8) === '89504e470d0a1a0a') {
+    return { type: 'png', width: buffer.readUInt32BE(16), height: buffer.readUInt32BE(20) };
+  }
+  if (/^GIF8[79]a$/.test(buffer.toString('ascii', 0, 6))) {
+    return { type: 'gif', width: buffer.readUInt16LE(6), height: buffer.readUInt16LE(8) };
+  }
+  if (buffer.toString('ascii', 0, 2) === 'BM' && buffer.length >= 26) {
+    return { type: 'bmp', width: Math.abs(buffer.readInt32LE(18)), height: Math.abs(buffer.readInt32LE(22)) };
+  }
+  return jpegDimensions(buffer) || webpDimensions(buffer) || svgDimensions(buffer) || { type: '', width: 0, height: 0 };
+}
+
+/** 读取本地图片的格式和尺寸，不加载完整文件。 */
+function readImageMetadata(filePath) {
+  const fd = fs.openSync(filePath, 'r');
+  try {
+    const buffer = Buffer.alloc(MAX_HEADER_BYTES);
+    const bytesRead = fs.readSync(fd, buffer, 0, buffer.length, 0);
+    return parseImageMetadata(buffer.subarray(0, bytesRead));
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+module.exports = {
+  MAX_HEADER_BYTES,
+  parseImageMetadata,
+  readImageMetadata,
+};

package/lib/asset/url-verify.js

@@ -1,122 +1,93 @@
-
-/**
- * url-verify.js - 轻量公开图库 / 图片 URL 校验
- *
- * P3 素材工具化：官网/落地页在使用外部公开图片前，必须先校验该 URL 是否
- * 真实可达、且确为图片资源，避免把编造或失效的 URL 直接写进页面。
- *
- * 仅使用 Node 原生 https/http，无第三方依赖。
- *
- * 用法：
- *   const { verifyImageUrl, verifyImageUrls } = require('./url-verify');
- *   const r = await verifyImageUrl('https://example.com/a.png');
- *   // { url, ok, status, contentType, bytes, reason }
- */
-
 'use strict';
 
 const https = require('https');
 const http = require('http');
 const { URL } = require('url');
+const { MAX_HEADER_BYTES, parseImageMetadata } = require('./image-metadata');
 
 const IMAGE_CONTENT_TYPES = [
   'image/jpeg', 'image/jpg', 'image/png', 'image/gif',
   'image/webp', 'image/bmp', 'image/svg+xml', 'image/avif',
 ];
-const IMAGE_EXT = /\.(jpe?g|png|gif|webp|bmp|svg|avif)(\?|#|$)/i;
-
 const DEFAULT_TIMEOUT = 8000;
 const MAX_REDIRECTS = 4;
 
-/**
- * 判断 content-type 是否为图片
- * @param {string} contentType
- * @returns {boolean}
- */
 function isImageContentType(contentType) {
   if (!contentType) {return false;}
   const main = String(contentType).split(';')[0].trim().toLowerCase();
   return IMAGE_CONTENT_TYPES.includes(main);
 }
 
-/**
- * 发起一次请求（HEAD 或 GET），返回 { status, headers, location }
- * GET 时在拿到响应头后立即 destroy，避免下载完整图片。
- * @param {string} rawUrl
- * @param {object} opts
- * @returns {Promise<{status:number, headers:object}>}
- */
-function requestOnce(rawUrl, opts) {
-  const method = (opts && opts.method) || 'HEAD';
-  const timeout = (opts && opts.timeout) || DEFAULT_TIMEOUT;
-
+function requestOnce(rawUrl, options = {}) {
+  const method = options.method || 'GET';
+  const timeout = options.timeout || DEFAULT_TIMEOUT;
   return new Promise((resolve, reject) => {
     let parsed;
     try {
       parsed = new URL(rawUrl);
-    } catch (err) {
+    } catch {
       reject(new Error('INVALID_URL'));
       return;
     }
-
-    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+    if (!['https:', 'http:'].includes(parsed.protocol)) {
       reject(new Error('UNSUPPORTED_PROTOCOL'));
       return;
     }
 
     const client = parsed.protocol === 'https:' ? https : http;
-    const req = client.request(
-      parsed,
-      {
-        method,
-        // 部分 CDN 对无 UA 的请求返回 403，带一个常规 UA 更接近真实浏览器访问
-        headers: {
-          'User-Agent': 'Mozilla/5.0 (compatible; OpenYidaAssetVerifier/1.0)',
-          Accept: 'image/*,*/*;q=0.8',
-        },
+    const req = client.request(parsed, {
+      method,
+      headers: {
+        'User-Agent': 'Mozilla/5.0 (compatible; OpenYidaAssetVerifier/1.0)',
+        Accept: 'image/*,*/*;q=0.8',
+        ...(method === 'GET' ? { Range: `bytes=0-${MAX_HEADER_BYTES - 1}` } : {}),
       },
-      (res) => {
-        // GET 请求：拿到响应头即可，无需读 body
-        if (method === 'GET') {
+    }, (res) => {
+      if (method !== 'GET') {
+        resolve({ status: res.statusCode || 0, headers: res.headers || {}, body: Buffer.alloc(0) });
+        return;
+      }
+      const chunks = [];
+      let bytes = 0;
+      let settled = false;
+      const finish = () => {
+        if (settled) {return;}
+        settled = true;
+        resolve({
+          status: res.statusCode || 0,
+          headers: res.headers || {},
+          body: Buffer.concat(chunks, bytes),
+        });
+      };
+      res.on('data', (chunk) => {
+        const remaining = MAX_HEADER_BYTES - bytes;
+        if (remaining <= 0) {return;}
+        const part = chunk.length > remaining ? chunk.subarray(0, remaining) : chunk;
+        chunks.push(part);
+        bytes += part.length;
+        if (bytes >= MAX_HEADER_BYTES) {
+          finish();
           res.destroy();
         }
-        resolve({ status: res.statusCode || 0, headers: res.headers || {} });
-      }
-    );
-
-    req.setTimeout(timeout, () => {
-      req.destroy(new Error('TIMEOUT'));
+      });
+      res.on('end', finish);
+      res.on('error', reject);
     });
-    req.on('error', (err) => reject(err));
+    req.setTimeout(timeout, () => req.destroy(new Error('TIMEOUT')));
+    req.on('error', reject);
     req.end();
   });
 }
 
-/**
- * 跟随重定向发起请求
- * @param {string} rawUrl
- * @param {object} opts
- * @param {number} depth
- * @returns {Promise<{status:number, headers:object, finalUrl:string}>}
- */
-async function requestFollow(rawUrl, opts, depth = 0) {
-  const res = await requestOnce(rawUrl, opts);
-  const status = res.status;
-  if (status >= 300 && status < 400 && res.headers.location && depth < MAX_REDIRECTS) {
-    const next = new URL(res.headers.location, rawUrl).toString();
-    return requestFollow(next, opts, depth + 1);
+async function requestFollow(rawUrl, options, depth = 0) {
+  const response = await requestOnce(rawUrl, options);
+  if (response.status >= 300 && response.status < 400 && response.headers.location && depth < MAX_REDIRECTS) {
+    const next = new URL(response.headers.location, rawUrl).toString();
+    return requestFollow(next, options, depth + 1);
   }
-  return { ...res, finalUrl: rawUrl };
+  return { ...response, finalUrl: rawUrl };
 }
 
-/**
- * 校验单个图片 URL
- * @param {string} rawUrl
- * @param {object} [options]
- * @param {number} [options.timeout]
- * @param {number} [options.minBytes] 最小字节数（默认 0，不限制）
- * @returns {Promise<{url:string, ok:boolean, status:number, contentType:string, bytes:number, reason:string, finalUrl:string}>}
- */
 async function verifyImageUrl(rawUrl, options = {}) {
   const base = {
     url: rawUrl,
@@ -124,89 +95,78 @@ async function verifyImageUrl(rawUrl, options = {}) {
     status: 0,
     contentType: '',
     bytes: 0,
+    width: 0,
+    height: 0,
+    imageType: '',
     reason: '',
     finalUrl: rawUrl,
   };
-
-  if (!rawUrl || typeof rawUrl !== 'string') {
-    return { ...base, reason: 'EMPTY_URL' };
-  }
+  if (!rawUrl || typeof rawUrl !== 'string') {return { ...base, reason: 'EMPTY_URL' };}
   const trimmed = rawUrl.trim();
-  if (!/^https?:\/\//i.test(trimmed)) {
-    return { ...base, url: trimmed, reason: 'NOT_HTTP_URL' };
-  }
-
-  const minBytes = options.minBytes || 0;
+  if (!/^https?:\/\//i.test(trimmed)) {return { ...base, url: trimmed, reason: 'NOT_HTTP_URL' };}
+  if (options.online === false) {return { ...base, url: trimmed, reason: 'OFFLINE_EXTERNAL_URL' };}
 
-  let res;
+  let response;
   try {
-    res = await requestFollow(trimmed, { method: 'HEAD', timeout: options.timeout });
-    // 某些服务器不支持 HEAD（405/501）或返回异常 → 回退 GET
-    if (res.status === 405 || res.status === 501 || res.status === 0) {
-      res = await requestFollow(trimmed, { method: 'GET', timeout: options.timeout });
-    }
-  } catch (err) {
-    // HEAD 报错时再尝试一次 GET，避免部分 CDN 对 HEAD 直接断连
-    try {
-      res = await requestFollow(trimmed, { method: 'GET', timeout: options.timeout });
-    } catch (err2) {
-      return { ...base, url: trimmed, reason: normalizeError(err2) };
-    }
+    response = await requestFollow(trimmed, { method: 'GET', timeout: options.timeout });
+  } catch (error) {
+    return { ...base, url: trimmed, reason: normalizeError(error) };
   }
 
-  const contentType = String(res.headers['content-type'] || '').split(';')[0].trim();
-  const bytes = Number(res.headers['content-length'] || 0) || 0;
+  const contentType = String(response.headers['content-type'] || '').split(';')[0].trim();
+  const contentRange = String(response.headers['content-range'] || '');
+  const bytes = Number(contentRange.split('/')[1] || response.headers['content-length'] || 0) || 0;
+  const metadata = parseImageMetadata(response.body);
   const out = {
+    ...base,
     url: trimmed,
-    ok: false,
-    status: res.status,
+    status: response.status,
     contentType,
     bytes,
-    reason: '',
-    finalUrl: res.finalUrl || trimmed,
+    width: metadata.width,
+    height: metadata.height,
+    imageType: metadata.type,
+    finalUrl: response.finalUrl || trimmed,
   };
-
-  if (res.status < 200 || res.status >= 400) {
-    out.reason = 'HTTP_' + res.status;
+  if (response.status < 200 || response.status >= 300) {
+    out.reason = `HTTP_${response.status}`;
     return out;
   }
 
-  // content-type 优先；缺失时用扩展名兜底判断
-  const typeOk = isImageContentType(contentType);
-  const extOk = IMAGE_EXT.test(trimmed);
-  if (!typeOk && !(contentType === '' && extOk)) {
-    out.reason = contentType ? 'NOT_IMAGE_CONTENT_TYPE' : 'UNKNOWN_CONTENT_TYPE';
+  if (!metadata.type) {
+    out.reason = 'INVALID_IMAGE_CONTENT';
     return out;
   }
-
-  if (minBytes > 0 && bytes > 0 && bytes < minBytes) {
+  if (options.minBytes > 0 && bytes > 0 && bytes < options.minBytes) {
     out.reason = 'TOO_SMALL';
     return out;
   }
-
+  if (![metadata.width, metadata.height].every(value => Number.isFinite(value) && value > 0)) {
+    out.reason = 'DIMENSIONS_UNAVAILABLE';
+    return out;
+  }
+  if (options.minWidth > 0 && metadata.width < options.minWidth) {
+    out.reason = 'WIDTH_TOO_SMALL';
+    return out;
+  }
+  if (options.minHeight > 0 && metadata.height < options.minHeight) {
+    out.reason = 'HEIGHT_TOO_SMALL';
+    return out;
+  }
   out.ok = true;
   out.reason = 'OK';
   return out;
 }
 
-/**
- * 批量校验（并发）
- * @param {string[]} urls
- * @param {object} [options]
- * @returns {Promise<Array>}
- */
 async function verifyImageUrls(urls, options = {}) {
   const list = Array.isArray(urls) ? urls : [urls];
-  return Promise.all(list.map((u) => verifyImageUrl(u, options)));
+  return Promise.all(list.map(url => verifyImageUrl(url, options)));
 }
 
-function normalizeError(err) {
-  const msg = (err && err.message) || String(err);
-  if (msg === 'TIMEOUT') {return 'TIMEOUT';}
-  if (msg === 'INVALID_URL') {return 'INVALID_URL';}
-  if (msg === 'UNSUPPORTED_PROTOCOL') {return 'UNSUPPORTED_PROTOCOL';}
-  if (err && err.code) {return err.code;} // ENOTFOUND / ECONNREFUSED / CERT_...
-  return 'REQUEST_FAILED';
+function normalizeError(error) {
+  const message = (error && error.message) || String(error);
+  if (['TIMEOUT', 'INVALID_URL', 'UNSUPPORTED_PROTOCOL'].includes(message)) {return message;}
+  return (error && error.code) || 'REQUEST_FAILED';
 }
 
 module.exports = {