@ai-sdk/black-forest-labs 2.0.0-beta.5 → 2.0.0-beta.52

package/src/black-forest-labs-image-model-options.ts

@@ -0,0 +1,51 @@
+import {
+  lazySchema,
+  zodSchema,
+  type InferSchema,
+} from '@ai-sdk/provider-utils';
+import { z } from 'zod/v4';
+
+export const blackForestLabsImageModelOptionsSchema = lazySchema(() =>
+  zodSchema(
+    z.object({
+      imagePrompt: z.string().optional(),
+      imagePromptStrength: z.number().min(0).max(1).optional(),
+      /** @deprecated use prompt.images instead */
+      inputImage: z.string().optional(),
+      /** @deprecated use prompt.images instead */
+      inputImage2: z.string().optional(),
+      /** @deprecated use prompt.images instead */
+      inputImage3: z.string().optional(),
+      /** @deprecated use prompt.images instead */
+      inputImage4: z.string().optional(),
+      /** @deprecated use prompt.images instead */
+      inputImage5: z.string().optional(),
+      /** @deprecated use prompt.images instead */
+      inputImage6: z.string().optional(),
+      /** @deprecated use prompt.images instead */
+      inputImage7: z.string().optional(),
+      /** @deprecated use prompt.images instead */
+      inputImage8: z.string().optional(),
+      /** @deprecated use prompt.images instead */
+      inputImage9: z.string().optional(),
+      /** @deprecated use prompt.images instead */
+      inputImage10: z.string().optional(),
+      steps: z.number().int().positive().optional(),
+      guidance: z.number().min(0).optional(),
+      width: z.number().int().min(256).max(1920).optional(),
+      height: z.number().int().min(256).max(1920).optional(),
+      outputFormat: z.enum(['jpeg', 'png']).optional(),
+      promptUpsampling: z.boolean().optional(),
+      raw: z.boolean().optional(),
+      safetyTolerance: z.number().int().min(0).max(6).optional(),
+      webhookSecret: z.string().optional(),
+      webhookUrl: z.url().optional(),
+      pollIntervalMillis: z.number().int().positive().optional(),
+      pollTimeoutMillis: z.number().int().positive().optional(),
+    }),
+  ),
+);
+
+export type BlackForestLabsImageModelOptions = InferSchema<
+  typeof blackForestLabsImageModelOptionsSchema
+>;

package/src/black-forest-labs-image-model.ts

@@ -1,7 +1,5 @@
 import type { ImageModelV4, SharedV4Warning } from '@ai-sdk/provider';
-import type { InferSchema, Resolvable } from '@ai-sdk/provider-utils';
 import {
-  FetchFunction,
   combineHeaders,
   createBinaryResponseHandler,
   createJsonErrorResponseHandler,
@@ -9,15 +7,22 @@ import {
   createStatusCodeErrorResponseHandler,
   delay,
   getFromApi,
-  lazySchema,
+  isSameOrigin,
   parseProviderOptions,
   postJsonToApi,
   resolve,
-  zodSchema,
+  serializeModelOptions,
+  WORKFLOW_SERIALIZE,
+  WORKFLOW_DESERIALIZE,
+  type Resolvable,
+  type FetchFunction,
 } from '@ai-sdk/provider-utils';
 import { z } from 'zod/v4';
-import type { BlackForestLabsAspectRatio } from './black-forest-labs-image-settings';
-import { BlackForestLabsImageModelId } from './black-forest-labs-image-settings';
+import { blackForestLabsImageModelOptionsSchema } from './black-forest-labs-image-model-options';
+import type {
+  BlackForestLabsAspectRatio,
+  BlackForestLabsImageModelId,
+} from './black-forest-labs-image-settings';
 
 const DEFAULT_POLL_INTERVAL_MILLIS = 500;
 const DEFAULT_POLL_TIMEOUT_MILLIS = 60000;
@@ -48,6 +53,20 @@ export class BlackForestLabsImageModel implements ImageModelV4 {
     return this.config.provider;
   }
 
+  static [WORKFLOW_SERIALIZE](model: BlackForestLabsImageModel) {
+    return serializeModelOptions({
+      modelId: model.modelId,
+      config: model.config,
+    });
+  }
+
+  static [WORKFLOW_DESERIALIZE](options: {
+    modelId: BlackForestLabsImageModelId;
+    config: BlackForestLabsImageModelConfig;
+  }) {
+    return new BlackForestLabsImageModel(options.modelId, options.config);
+  }
+
   constructor(
     readonly modelId: BlackForestLabsImageModelId,
     private readonly config: BlackForestLabsImageModelConfig,
@@ -108,10 +127,12 @@ export class BlackForestLabsImageModel implements ImageModelV4 {
       throw new Error('Black Forest Labs supports up to 10 input images.');
     }
 
+    const inputImageField =
+      this.modelId === 'flux-pro-1.0-fill' ? 'image' : 'input_image';
     const inputImagesObj: Record<string, string> = inputImages.reduce<
       Record<string, string>
     >((acc, img, index) => {
-      acc[`input_image${index === 0 ? '' : `_${index + 1}`}`] = img;
+      acc[`${inputImageField}${index === 0 ? '' : `_${index + 1}`}`] = img;
       return acc;
     }, {});
 
@@ -148,7 +169,7 @@ export class BlackForestLabsImageModel implements ImageModelV4 {
       webhook_url: bflOptions?.webhookUrl,
     };
 
-    return { body, warnings };
+    return { body, warnings, bflOptions };
   }
 
   async doGenerate({
@@ -164,7 +185,7 @@ export class BlackForestLabsImageModel implements ImageModelV4 {
   }: Parameters<ImageModelV4['doGenerate']>[0]): Promise<
     Awaited<ReturnType<ImageModelV4['doGenerate']>>
   > {
-    const { body, warnings } = await this.getArgs({
+    const { body, warnings, bflOptions } = await this.getArgs({
       prompt,
       files,
       mask,
@@ -177,12 +198,6 @@ export class BlackForestLabsImageModel implements ImageModelV4 {
       abortSignal,
     } as Parameters<ImageModelV4['doGenerate']>[0]);
 
-    const bflOptions = await parseProviderOptions({
-      provider: 'blackForestLabs',
-      providerOptions,
-      schema: blackForestLabsImageModelOptionsSchema,
-    });
-
     const currentDate = this.config._internal?.currentDate?.() ?? new Date();
     const combinedHeaders = combineHeaders(
       await resolve(this.config.headers),
@@ -221,7 +236,12 @@ export class BlackForestLabsImageModel implements ImageModelV4 {
 
     const { value: imageBytes, responseHeaders } = await getFromApi({
       url: imageUrl,
-      headers: combinedHeaders,
+      // Only send credentials if the response-supplied URL points back at the
+      // provider; the image is typically delivered from a CDN, so the API key
+      // must not travel to a foreign host.
+      headers: isTrustedUrl(imageUrl, this.config.baseURL)
+        ? combinedHeaders
+        : undefined,
       abortSignal,
       failedResponseHandler: createStatusCodeErrorResponseHandler(),
       successfulResponseHandler: createBinaryResponseHandler(),
@@ -300,7 +320,11 @@ export class BlackForestLabsImageModel implements ImageModelV4 {
     for (let i = 0; i < maxPollAttempts; i++) {
       const { value } = await getFromApi({
         url: url.toString(),
-        headers,
+        // The polling URL comes from the provider response; only send
+        // credentials when it stays on a trusted provider host.
+        headers: isTrustedUrl(url.toString(), this.config.baseURL)
+          ? headers
+          : undefined,
         failedResponseHandler: bflFailedResponseHandler,
         successfulResponseHandler: createJsonResponseHandler(bflPollSchema),
         abortSignal,
@@ -333,50 +357,28 @@ export class BlackForestLabsImageModel implements ImageModelV4 {
   }
 }
 
-export const blackForestLabsImageModelOptionsSchema = lazySchema(() =>
-  zodSchema(
-    z.object({
-      imagePrompt: z.string().optional(),
-      imagePromptStrength: z.number().min(0).max(1).optional(),
-      /** @deprecated use prompt.images instead */
-      inputImage: z.string().optional(),
-      /** @deprecated use prompt.images instead */
-      inputImage2: z.string().optional(),
-      /** @deprecated use prompt.images instead */
-      inputImage3: z.string().optional(),
-      /** @deprecated use prompt.images instead */
-      inputImage4: z.string().optional(),
-      /** @deprecated use prompt.images instead */
-      inputImage5: z.string().optional(),
-      /** @deprecated use prompt.images instead */
-      inputImage6: z.string().optional(),
-      /** @deprecated use prompt.images instead */
-      inputImage7: z.string().optional(),
-      /** @deprecated use prompt.images instead */
-      inputImage8: z.string().optional(),
-      /** @deprecated use prompt.images instead */
-      inputImage9: z.string().optional(),
-      /** @deprecated use prompt.images instead */
-      inputImage10: z.string().optional(),
-      steps: z.number().int().positive().optional(),
-      guidance: z.number().min(0).optional(),
-      width: z.number().int().min(256).max(1920).optional(),
-      height: z.number().int().min(256).max(1920).optional(),
-      outputFormat: z.enum(['jpeg', 'png']).optional(),
-      promptUpsampling: z.boolean().optional(),
-      raw: z.boolean().optional(),
-      safetyTolerance: z.number().int().min(0).max(6).optional(),
-      webhookSecret: z.string().optional(),
-      webhookUrl: z.url().optional(),
-      pollIntervalMillis: z.number().int().positive().optional(),
-      pollTimeoutMillis: z.number().int().positive().optional(),
-    }),
-  ),
-);
-
-export type BlackForestLabsImageModelOptions = InferSchema<
-  typeof blackForestLabsImageModelOptionsSchema
->;
+/**
+ * Black Forest Labs returns response-supplied URLs (polling and delivery) on
+ * sibling cluster hosts of the API origin (e.g. `api.us1.bfl.ai` for a base
+ * URL on `api.bfl.ai`), so a strict same-origin check against the configured
+ * base URL is not enough. Credentials may also be sent to any https host under
+ * the official `bfl.ai` domain.
+ */
+function isTrustedUrl(url: string, baseUrl: string): boolean {
+  if (isSameOrigin(url, baseUrl)) {
+    return true;
+  }
+
+  try {
+    const { protocol, hostname } = new URL(url);
+    return (
+      protocol === 'https:' &&
+      (hostname === 'bfl.ai' || hostname.endsWith('.bfl.ai'))
+    );
+  } catch {
+    return false;
+  }
+}
 
 function convertSizeToAspectRatio(
   size: string,

package/src/black-forest-labs-provider.ts

@@ -1,12 +1,16 @@
-import { ImageModelV4, NoSuchModelError, ProviderV4 } from '@ai-sdk/provider';
-import type { FetchFunction } from '@ai-sdk/provider-utils';
+import {
+  NoSuchModelError,
+  type ImageModelV4,
+  type ProviderV4,
+} from '@ai-sdk/provider';
 import {
   loadApiKey,
   withoutTrailingSlash,
   withUserAgentSuffix,
+  type FetchFunction,
 } from '@ai-sdk/provider-utils';
 import { BlackForestLabsImageModel } from './black-forest-labs-image-model';
-import { BlackForestLabsImageModelId } from './black-forest-labs-image-settings';
+import type { BlackForestLabsImageModelId } from './black-forest-labs-image-settings';
 import { VERSION } from './version';
 
 export interface BlackForestLabsProviderSettings {

package/src/index.ts

@@ -14,5 +14,5 @@ export type {
   BlackForestLabsImageModelOptions,
   /** @deprecated Use `BlackForestLabsImageModelOptions` instead. */
   BlackForestLabsImageModelOptions as BlackForestLabsImageProviderOptions,
-} from './black-forest-labs-image-model';
+} from './black-forest-labs-image-model-options';
 export { VERSION } from './version';

package/dist/index.d.mts

@@ -1,82 +0,0 @@
-import { ProviderV4, ImageModelV4 } from '@ai-sdk/provider';
-import * as _ai_sdk_provider_utils from '@ai-sdk/provider-utils';
-import { FetchFunction, InferSchema } from '@ai-sdk/provider-utils';
-
-type BlackForestLabsImageModelId = 'flux-kontext-pro' | 'flux-kontext-max' | 'flux-pro-1.1-ultra' | 'flux-pro-1.1' | 'flux-pro-1.0-fill' | (string & {});
-type BlackForestLabsAspectRatio = `${number}:${number}`;
-
-interface BlackForestLabsProviderSettings {
-    /**
-     * Black Forest Labs API key. Default value is taken from the `BFL_API_KEY` environment variable.
-     */
-    apiKey?: string;
-    /**
-     * Base URL for the API calls. Defaults to `https://api.bfl.ai/v1`.
-     */
-    baseURL?: string;
-    /**
-     * Custom headers to include in the requests.
-     */
-    headers?: Record<string, string>;
-    /**
-     * Custom fetch implementation. You can use it as a middleware to intercept
-     * requests, or to provide a custom fetch implementation for e.g. testing.
-     */
-    fetch?: FetchFunction;
-    /**
-     * Poll interval in milliseconds between status checks. Defaults to 500ms.
-     */
-    pollIntervalMillis?: number;
-    /**
-     * Overall timeout in milliseconds for polling before giving up. Defaults to 60s.
-     */
-    pollTimeoutMillis?: number;
-}
-interface BlackForestLabsProvider extends ProviderV4 {
-    /**
-     * Creates a model for image generation.
-     */
-    image(modelId: BlackForestLabsImageModelId): ImageModelV4;
-    /**
-     * Creates a model for image generation.
-     */
-    imageModel(modelId: BlackForestLabsImageModelId): ImageModelV4;
-    /**
-     * @deprecated Use `embeddingModel` instead.
-     */
-    textEmbeddingModel(modelId: string): never;
-}
-declare function createBlackForestLabs(options?: BlackForestLabsProviderSettings): BlackForestLabsProvider;
-declare const blackForestLabs: BlackForestLabsProvider;
-
-declare const blackForestLabsImageModelOptionsSchema: _ai_sdk_provider_utils.LazySchema<{
-    imagePrompt?: string | undefined;
-    imagePromptStrength?: number | undefined;
-    inputImage?: string | undefined;
-    inputImage2?: string | undefined;
-    inputImage3?: string | undefined;
-    inputImage4?: string | undefined;
-    inputImage5?: string | undefined;
-    inputImage6?: string | undefined;
-    inputImage7?: string | undefined;
-    inputImage8?: string | undefined;
-    inputImage9?: string | undefined;
-    inputImage10?: string | undefined;
-    steps?: number | undefined;
-    guidance?: number | undefined;
-    width?: number | undefined;
-    height?: number | undefined;
-    outputFormat?: "jpeg" | "png" | undefined;
-    promptUpsampling?: boolean | undefined;
-    raw?: boolean | undefined;
-    safetyTolerance?: number | undefined;
-    webhookSecret?: string | undefined;
-    webhookUrl?: string | undefined;
-    pollIntervalMillis?: number | undefined;
-    pollTimeoutMillis?: number | undefined;
-}>;
-type BlackForestLabsImageModelOptions = InferSchema<typeof blackForestLabsImageModelOptionsSchema>;
-
-declare const VERSION: string;
-
-export { type BlackForestLabsAspectRatio, type BlackForestLabsImageModelId, type BlackForestLabsImageModelOptions, type BlackForestLabsImageModelOptions as BlackForestLabsImageProviderOptions, type BlackForestLabsProvider, type BlackForestLabsProviderSettings, VERSION, blackForestLabs, createBlackForestLabs };