@anuma/sdk 9.1.6 → 9.1.7

package/dist/index.mjs

@@ -511,7 +511,7 @@ var mergeHeaders = (...headers) => {
     if (!header || typeof header !== "object") {
       continue;
     }
-    const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+    const iterator = Array.isArray(header) || header instanceof Headers ? headersEntries(new Headers(header)) : Object.entries(header);
     for (const [key, value] of iterator) {
       if (value === null) {
         mergedHeaders.delete(key);
@@ -786,6 +786,18 @@ var createClient = (config = {}) => {
 // src/client/client.gen.ts
 var client = createClient(createClientConfig(createConfig()));
 
+// src/clientHeaders.ts
+function normalizeHeaders(headers) {
+  if (headers instanceof Headers || Array.isArray(headers)) {
+    const normalized = /* @__PURE__ */ Object.create(null);
+    new Headers(headers).forEach((value, name) => {
+      normalized[name] = value;
+    });
+    return normalized;
+  }
+  return headers;
+}
+
 // src/client/sdk.gen.ts
 var deleteApiV1Account = (options) => (options?.client ?? client).delete({ url: "/api/v1/account", ...options });
 var postApiV1AdminAddCredits = (options) => (options.client ?? client).post({
@@ -793,7 +805,7 @@ var postApiV1AdminAddCredits = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1AdminAgents = (options) => (options.client ?? client).post({
@@ -801,7 +813,7 @@ var postApiV1AdminAgents = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var deleteApiV1AdminAgentsById = (options) => (options.client ?? client).delete({ url: "/api/v1/admin/agents/{id}", ...options });
@@ -810,7 +822,7 @@ var putApiV1AdminAgentsById = (options) => (options.client ?? client).put({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1AdminApps = (options) => (options.client ?? client).get({ url: "/api/v1/admin/apps", ...options });
@@ -819,7 +831,7 @@ var postApiV1AdminApps = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1AdminAppsByAppIdApiKeys = (options) => (options.client ?? client).get({ url: "/api/v1/admin/apps/{app_id}/api-keys", ...options });
@@ -828,7 +840,7 @@ var postApiV1AdminAppsByAppIdApiKeys = (options) => (options.client ?? client).p
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var deleteApiV1AdminAppsByAppIdApiKeysById = (options) => (options.client ?? client).delete({ url: "/api/v1/admin/apps/{app_id}/api-keys/{id}", ...options });
@@ -838,7 +850,7 @@ var putApiV1AdminAppsByAppIdApiKeysById = (options) => (options.client ?? client
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var deleteApiV1AdminAppsById = (options) => (options.client ?? client).delete({ url: "/api/v1/admin/apps/{id}", ...options });
@@ -848,7 +860,7 @@ var putApiV1AdminAppsById = (options) => (options.client ?? client).put({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1AdminPersonas = (options) => (options.client ?? client).post({
@@ -856,7 +868,7 @@ var postApiV1AdminPersonas = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var deleteApiV1AdminPersonasById = (options) => (options.client ?? client).delete({ url: "/api/v1/admin/personas/{id}", ...options });
@@ -865,7 +877,7 @@ var putApiV1AdminPersonasById = (options) => (options.client ?? client).put({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1AdminSeedApps = (options) => (options.client ?? client).post({
@@ -873,7 +885,7 @@ var postApiV1AdminSeedApps = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1AdminSubscriptionTier = (options) => (options.client ?? client).post({
@@ -881,7 +893,7 @@ var postApiV1AdminSubscriptionTier = (options) => (options.client ?? client).pos
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var deleteApiV1AdminTextReset = (options) => (options.client ?? client).delete({ url: "/api/v1/admin/text/reset", ...options });
@@ -894,7 +906,7 @@ var putApiV1AgentsByIdPreference = (options) => (options.client ?? client).put({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1ChatCompletions = (options) => (options.client ?? client).post({
@@ -902,7 +914,7 @@ var postApiV1ChatCompletions = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1Config = (options) => (options?.client ?? client).get({ url: "/api/v1/config", ...options });
@@ -913,7 +925,7 @@ var postApiV1CreditsPurchase = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1CreditsRedeemTokens = (options) => (options.client ?? client).post({
@@ -921,7 +933,7 @@ var postApiV1CreditsRedeemTokens = (options) => (options.client ?? client).post(
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1DeveloperApps = (options) => (options?.client ?? client).get({ url: "/api/v1/developer/apps", ...options });
@@ -930,7 +942,7 @@ var postApiV1DeveloperApps = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var deleteApiV1DeveloperAppsByAppUuid = (options) => (options.client ?? client).delete({ url: "/api/v1/developer/apps/{app_uuid}", ...options });
@@ -940,7 +952,7 @@ var patchApiV1DeveloperAppsByAppUuid = (options) => (options.client ?? client).p
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1DeveloperAppsByAppUuidApiKeys = (options) => (options.client ?? client).get({ url: "/api/v1/developer/apps/{app_uuid}/api-keys", ...options });
@@ -949,7 +961,7 @@ var postApiV1DeveloperAppsByAppUuidApiKeys = (options) => (options.client ?? cli
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var deleteApiV1DeveloperAppsByAppUuidApiKeysByKeyId = (options) => (options.client ?? client).delete({ url: "/api/v1/developer/apps/{app_uuid}/api-keys/{key_id}", ...options });
@@ -958,7 +970,7 @@ var postApiV1DeveloperAppsByAppUuidFund = (options) => (options.client ?? client
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var deleteApiV1DeveloperAppsByAppUuidPrivy = (options) => (options.client ?? client).delete({ url: "/api/v1/developer/apps/{app_uuid}/privy", ...options });
@@ -967,7 +979,7 @@ var postApiV1DeveloperAppsByAppUuidPrivy = (options) => (options.client ?? clien
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1DeveloperAppsByAppUuidUsage = (options) => (options.client ?? client).get({ url: "/api/v1/developer/apps/{app_uuid}/usage", ...options });
@@ -979,7 +991,7 @@ var patchApiV1DeveloperAppsByAppUuidUsersByAddress = (options) => (options.clien
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1DeveloperAppsByAppUuidUsersByAddressTopUp = (options) => (options.client ?? client).post({
@@ -987,7 +999,7 @@ var postApiV1DeveloperAppsByAppUuidUsersByAddressTopUp = (options) => (options.c
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1DeveloperBilling = (options) => (options?.client ?? client).get({ url: "/api/v1/developer/billing", ...options });
@@ -997,7 +1009,7 @@ var postApiV1Embeddings = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1Models = (options) => (options?.client ?? client).get({ url: "/api/v1/models", ...options });
@@ -1008,7 +1020,7 @@ var postApiV1PhoneCalls = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1PhoneCallsByCallId = (options) => (options.client ?? client).get({ url: "/api/v1/phone-calls/{call_id}", ...options });
@@ -1017,7 +1029,7 @@ var postApiV1Responses = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1SubscriptionsCancel = (options) => (options?.client ?? client).post({
@@ -1025,7 +1037,7 @@ var postApiV1SubscriptionsCancel = (options) => (options?.client ?? client).post
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options?.headers
+    ...normalizeHeaders(options?.headers)
   }
 });
 var postApiV1SubscriptionsCancelScheduledDowngrade = (options) => (options?.client ?? client).post({ url: "/api/v1/subscriptions/cancel-scheduled-downgrade", ...options });
@@ -1034,7 +1046,7 @@ var postApiV1SubscriptionsCreateCheckoutSession = (options) => (options.client ?
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1SubscriptionsCustomerPortal = (options) => (options.client ?? client).post({
@@ -1042,7 +1054,7 @@ var postApiV1SubscriptionsCustomerPortal = (options) => (options.client ?? clien
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1SubscriptionsPlans = (options) => (options?.client ?? client).get({ url: "/api/v1/subscriptions/plans", ...options });
@@ -1052,7 +1064,7 @@ var postApiV1SubscriptionsScheduleDowngrade = (options) => (options.client ?? cl
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1SubscriptionsStatus = (options) => (options?.client ?? client).get({ url: "/api/v1/subscriptions/status", ...options });
@@ -1061,7 +1073,7 @@ var postApiV1SubscriptionsUpgrade = (options) => (options.client ?? client).post
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1SubscriptionsWebhook = (options) => (options.client ?? client).post({
@@ -1069,7 +1081,7 @@ var postApiV1SubscriptionsWebhook = (options) => (options.client ?? client).post
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1Tools = (options) => (options?.client ?? client).get({ url: "/api/v1/tools", ...options });
@@ -1081,7 +1093,7 @@ var postApiV1UserApiKeys = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var deleteApiV1UserApiKeysByKeyId = (options) => (options.client ?? client).delete({ url: "/api/v1/user/api-keys/{key_id}", ...options });
@@ -1091,7 +1103,7 @@ var postApiV1WalletsBinding = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1WalletsBindingNonce = (options) => (options?.client ?? client).post({ url: "/api/v1/wallets/binding/nonce", ...options });
@@ -1101,7 +1113,7 @@ var postApiV1WebhooksRevenuecat = (options) => (options?.client ?? client).post(
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options?.headers
+    ...normalizeHeaders(options?.headers)
   }
 });
 var getApiV1ZetaCreditRate = (options) => (options?.client ?? client).get({ url: "/api/v1/zeta/credit-rate", ...options });

package/dist/react/index.cjs

@@ -3575,7 +3575,14 @@ function cosineSimilarity(a, b) {
 
 // src/lib/processors/encoding.ts
 var B64_ENCODE_CHUNK = 32768 * 3;
+function assertFileUrlAllowed(dataUrl) {
+  const isNode = typeof process !== "undefined" && Boolean(process.versions?.node);
+  if (isNode && !dataUrl.startsWith("data:") && !dataUrl.startsWith("blob:")) {
+    throw new Error("Server file preprocessing requires a data URL or blob URL.");
+  }
+}
 async function dataUrlToArrayBuffer(dataUrl) {
+  assertFileUrlAllowed(dataUrl);
   if (dataUrl.startsWith("blob:") || dataUrl.startsWith("http://") || dataUrl.startsWith("https://")) {
     const response = await fetch(dataUrl);
     return response.arrayBuffer();
@@ -6237,7 +6244,7 @@ var mergeHeaders = (...headers) => {
     if (!header || typeof header !== "object") {
       continue;
     }
-    const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+    const iterator = Array.isArray(header) || header instanceof Headers ? headersEntries(new Headers(header)) : Object.entries(header);
     for (const [key, value] of iterator) {
       if (value === null) {
         mergedHeaders.delete(key);
@@ -6513,6 +6520,18 @@ var createClient = (config = {}) => {
 init_clientConfig();
 var client = createClient(createClientConfig(createConfig()));
 
+// src/clientHeaders.ts
+function normalizeHeaders(headers) {
+  if (headers instanceof Headers || Array.isArray(headers)) {
+    const normalized = /* @__PURE__ */ Object.create(null);
+    new Headers(headers).forEach((value, name) => {
+      normalized[name] = value;
+    });
+    return normalized;
+  }
+  return headers;
+}
+
 // src/client/sdk.gen.ts
 var getApiV1Config = (options) => (options?.client ?? client).get({ url: "/api/v1/config", ...options });
 var getApiV1CreditsBalance = (options) => (options?.client ?? client).get({ url: "/api/v1/credits/balance", ...options });
@@ -6522,7 +6541,7 @@ var postApiV1CreditsPurchase = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1Embeddings = (options) => (options.client ?? client).post({
@@ -6530,7 +6549,7 @@ var postApiV1Embeddings = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1Models = (options) => (options?.client ?? client).get({ url: "/api/v1/models", ...options });
@@ -6539,7 +6558,7 @@ var postApiV1PhoneCalls = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1PhoneCallsByCallId = (options) => (options.client ?? client).get({ url: "/api/v1/phone-calls/{call_id}", ...options });
@@ -6548,7 +6567,7 @@ var postApiV1SubscriptionsCancel = (options) => (options?.client ?? client).post
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options?.headers
+    ...normalizeHeaders(options?.headers)
   }
 });
 var postApiV1SubscriptionsCreateCheckoutSession = (options) => (options.client ?? client).post({
@@ -6556,7 +6575,7 @@ var postApiV1SubscriptionsCreateCheckoutSession = (options) => (options.client ?
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1SubscriptionsCustomerPortal = (options) => (options.client ?? client).post({
@@ -6564,7 +6583,7 @@ var postApiV1SubscriptionsCustomerPortal = (options) => (options.client ?? clien
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1SubscriptionsRenew = (options) => (options?.client ?? client).post({ url: "/api/v1/subscriptions/renew", ...options });
@@ -6575,7 +6594,7 @@ var postApiV1WalletsBinding = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1WalletsBindingNonce = (options) => (options?.client ?? client).post({ url: "/api/v1/wallets/binding/nonce", ...options });
@@ -29619,6 +29638,7 @@ async function getPdfjs() {
   return pdfjsModule;
 }
 async function withPdfDocument(pdfDataUrl, fn) {
+  assertFileUrlAllowed(pdfDataUrl);
   const pdfjs = await getPdfjs();
   const loadingTask = pdfjs.getDocument(pdfDataUrl);
   let pdf;
@@ -30421,6 +30441,7 @@ async function preprocessFiles(files, options = {}) {
         skip("no_data");
         continue;
       }
+      assertFileUrlAllowed(file.url);
       const fileWithData = {
         ...file,
         dataUrl: file.url

package/dist/react/index.mjs

@@ -1748,7 +1748,14 @@ function cosineSimilarity(a, b) {
 
 // src/lib/processors/encoding.ts
 var B64_ENCODE_CHUNK = 32768 * 3;
+function assertFileUrlAllowed(dataUrl) {
+  const isNode = typeof process !== "undefined" && Boolean(process.versions?.node);
+  if (isNode && !dataUrl.startsWith("data:") && !dataUrl.startsWith("blob:")) {
+    throw new Error("Server file preprocessing requires a data URL or blob URL.");
+  }
+}
 async function dataUrlToArrayBuffer(dataUrl) {
+  assertFileUrlAllowed(dataUrl);
   if (dataUrl.startsWith("blob:") || dataUrl.startsWith("http://") || dataUrl.startsWith("https://")) {
     const response = await fetch(dataUrl);
     return response.arrayBuffer();
@@ -4404,7 +4411,7 @@ var mergeHeaders = (...headers) => {
     if (!header || typeof header !== "object") {
       continue;
     }
-    const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+    const iterator = Array.isArray(header) || header instanceof Headers ? headersEntries(new Headers(header)) : Object.entries(header);
     for (const [key, value] of iterator) {
       if (value === null) {
         mergedHeaders.delete(key);
@@ -4679,6 +4686,18 @@ var createClient = (config = {}) => {
 // src/client/client.gen.ts
 var client = createClient(createClientConfig(createConfig()));
 
+// src/clientHeaders.ts
+function normalizeHeaders(headers) {
+  if (headers instanceof Headers || Array.isArray(headers)) {
+    const normalized = /* @__PURE__ */ Object.create(null);
+    new Headers(headers).forEach((value, name) => {
+      normalized[name] = value;
+    });
+    return normalized;
+  }
+  return headers;
+}
+
 // src/client/sdk.gen.ts
 var getApiV1Config = (options) => (options?.client ?? client).get({ url: "/api/v1/config", ...options });
 var getApiV1CreditsBalance = (options) => (options?.client ?? client).get({ url: "/api/v1/credits/balance", ...options });
@@ -4688,7 +4707,7 @@ var postApiV1CreditsPurchase = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1Embeddings = (options) => (options.client ?? client).post({
@@ -4696,7 +4715,7 @@ var postApiV1Embeddings = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1Models = (options) => (options?.client ?? client).get({ url: "/api/v1/models", ...options });
@@ -4705,7 +4724,7 @@ var postApiV1PhoneCalls = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1PhoneCallsByCallId = (options) => (options.client ?? client).get({ url: "/api/v1/phone-calls/{call_id}", ...options });
@@ -4714,7 +4733,7 @@ var postApiV1SubscriptionsCancel = (options) => (options?.client ?? client).post
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options?.headers
+    ...normalizeHeaders(options?.headers)
   }
 });
 var postApiV1SubscriptionsCreateCheckoutSession = (options) => (options.client ?? client).post({
@@ -4722,7 +4741,7 @@ var postApiV1SubscriptionsCreateCheckoutSession = (options) => (options.client ?
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1SubscriptionsCustomerPortal = (options) => (options.client ?? client).post({
@@ -4730,7 +4749,7 @@ var postApiV1SubscriptionsCustomerPortal = (options) => (options.client ?? clien
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1SubscriptionsRenew = (options) => (options?.client ?? client).post({ url: "/api/v1/subscriptions/renew", ...options });
@@ -4741,7 +4760,7 @@ var postApiV1WalletsBinding = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1WalletsBindingNonce = (options) => (options?.client ?? client).post({ url: "/api/v1/wallets/binding/nonce", ...options });
@@ -27701,6 +27720,7 @@ async function getPdfjs() {
   return pdfjsModule;
 }
 async function withPdfDocument(pdfDataUrl, fn) {
+  assertFileUrlAllowed(pdfDataUrl);
   const pdfjs = await getPdfjs();
   const loadingTask = pdfjs.getDocument(pdfDataUrl);
   let pdf;
@@ -28497,6 +28517,7 @@ async function preprocessFiles(files, options = {}) {
         skip("no_data");
         continue;
       }
+      assertFileUrlAllowed(file.url);
       const fileWithData = {
         ...file,
         dataUrl: file.url

package/dist/server/index.cjs

@@ -17686,7 +17686,14 @@ function cosineSimilarity(a, b) {
 
 // src/lib/processors/encoding.ts
 var B64_ENCODE_CHUNK = 32768 * 3;
+function assertFileUrlAllowed(dataUrl) {
+  const isNode = typeof process !== "undefined" && Boolean(process.versions?.node);
+  if (isNode && !dataUrl.startsWith("data:") && !dataUrl.startsWith("blob:")) {
+    throw new Error("Server file preprocessing requires a data URL or blob URL.");
+  }
+}
 async function dataUrlToArrayBuffer(dataUrl) {
+  assertFileUrlAllowed(dataUrl);
   if (dataUrl.startsWith("blob:") || dataUrl.startsWith("http://") || dataUrl.startsWith("https://")) {
     const response = await fetch(dataUrl);
     return response.arrayBuffer();
@@ -20016,7 +20023,7 @@ var mergeHeaders = (...headers) => {
     if (!header || typeof header !== "object") {
       continue;
     }
-    const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+    const iterator = Array.isArray(header) || header instanceof Headers ? headersEntries(new Headers(header)) : Object.entries(header);
     for (const [key, value] of iterator) {
       if (value === null) {
         mergedHeaders.delete(key);
@@ -20292,13 +20299,25 @@ var createClient = (config = {}) => {
 init_clientConfig();
 var client = createClient(createClientConfig(createConfig()));
 
+// src/clientHeaders.ts
+function normalizeHeaders(headers) {
+  if (headers instanceof Headers || Array.isArray(headers)) {
+    const normalized = /* @__PURE__ */ Object.create(null);
+    new Headers(headers).forEach((value, name) => {
+      normalized[name] = value;
+    });
+    return normalized;
+  }
+  return headers;
+}
+
 // src/client/sdk.gen.ts
 var postApiV1Embeddings = (options) => (options.client ?? client).post({
   url: "/api/v1/embeddings",
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 
@@ -39071,6 +39090,7 @@ async function getPdfjs() {
   return pdfjsModule;
 }
 async function withPdfDocument(pdfDataUrl, fn) {
+  assertFileUrlAllowed(pdfDataUrl);
   const pdfjs = await getPdfjs();
   const loadingTask = pdfjs.getDocument(pdfDataUrl);
   let pdf;
@@ -39865,6 +39885,7 @@ async function preprocessFiles(files, options = {}) {
         skip("no_data");
         continue;
       }
+      assertFileUrlAllowed(file.url);
       const fileWithData = {
         ...file,
         dataUrl: file.url