@anuma/sdk 9.1.6 → 9.1.8

package/dist/index.mjs

@@ -511,7 +511,7 @@ var mergeHeaders = (...headers) => {
     if (!header || typeof header !== "object") {
       continue;
     }
-    const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+    const iterator = Array.isArray(header) || header instanceof Headers ? headersEntries(new Headers(header)) : Object.entries(header);
     for (const [key, value] of iterator) {
       if (value === null) {
         mergedHeaders.delete(key);
@@ -786,6 +786,18 @@ var createClient = (config = {}) => {
 // src/client/client.gen.ts
 var client = createClient(createClientConfig(createConfig()));
 
+// src/clientHeaders.ts
+function normalizeHeaders(headers) {
+  if (headers instanceof Headers || Array.isArray(headers)) {
+    const normalized = /* @__PURE__ */ Object.create(null);
+    new Headers(headers).forEach((value, name) => {
+      normalized[name] = value;
+    });
+    return normalized;
+  }
+  return headers;
+}
+
 // src/client/sdk.gen.ts
 var deleteApiV1Account = (options) => (options?.client ?? client).delete({ url: "/api/v1/account", ...options });
 var postApiV1AdminAddCredits = (options) => (options.client ?? client).post({
@@ -793,7 +805,7 @@ var postApiV1AdminAddCredits = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1AdminAgents = (options) => (options.client ?? client).post({
@@ -801,7 +813,7 @@ var postApiV1AdminAgents = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var deleteApiV1AdminAgentsById = (options) => (options.client ?? client).delete({ url: "/api/v1/admin/agents/{id}", ...options });
@@ -810,7 +822,7 @@ var putApiV1AdminAgentsById = (options) => (options.client ?? client).put({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1AdminApps = (options) => (options.client ?? client).get({ url: "/api/v1/admin/apps", ...options });
@@ -819,7 +831,7 @@ var postApiV1AdminApps = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1AdminAppsByAppIdApiKeys = (options) => (options.client ?? client).get({ url: "/api/v1/admin/apps/{app_id}/api-keys", ...options });
@@ -828,7 +840,7 @@ var postApiV1AdminAppsByAppIdApiKeys = (options) => (options.client ?? client).p
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var deleteApiV1AdminAppsByAppIdApiKeysById = (options) => (options.client ?? client).delete({ url: "/api/v1/admin/apps/{app_id}/api-keys/{id}", ...options });
@@ -838,7 +850,7 @@ var putApiV1AdminAppsByAppIdApiKeysById = (options) => (options.client ?? client
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var deleteApiV1AdminAppsById = (options) => (options.client ?? client).delete({ url: "/api/v1/admin/apps/{id}", ...options });
@@ -848,7 +860,7 @@ var putApiV1AdminAppsById = (options) => (options.client ?? client).put({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1AdminPersonas = (options) => (options.client ?? client).post({
@@ -856,7 +868,7 @@ var postApiV1AdminPersonas = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var deleteApiV1AdminPersonasById = (options) => (options.client ?? client).delete({ url: "/api/v1/admin/personas/{id}", ...options });
@@ -865,7 +877,7 @@ var putApiV1AdminPersonasById = (options) => (options.client ?? client).put({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1AdminSeedApps = (options) => (options.client ?? client).post({
@@ -873,7 +885,7 @@ var postApiV1AdminSeedApps = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1AdminSubscriptionTier = (options) => (options.client ?? client).post({
@@ -881,7 +893,7 @@ var postApiV1AdminSubscriptionTier = (options) => (options.client ?? client).pos
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var deleteApiV1AdminTextReset = (options) => (options.client ?? client).delete({ url: "/api/v1/admin/text/reset", ...options });
@@ -894,7 +906,7 @@ var putApiV1AgentsByIdPreference = (options) => (options.client ?? client).put({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1ChatCompletions = (options) => (options.client ?? client).post({
@@ -902,7 +914,7 @@ var postApiV1ChatCompletions = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1Config = (options) => (options?.client ?? client).get({ url: "/api/v1/config", ...options });
@@ -913,7 +925,7 @@ var postApiV1CreditsPurchase = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1CreditsRedeemTokens = (options) => (options.client ?? client).post({
@@ -921,7 +933,7 @@ var postApiV1CreditsRedeemTokens = (options) => (options.client ?? client).post(
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1DeveloperApps = (options) => (options?.client ?? client).get({ url: "/api/v1/developer/apps", ...options });
@@ -930,7 +942,7 @@ var postApiV1DeveloperApps = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var deleteApiV1DeveloperAppsByAppUuid = (options) => (options.client ?? client).delete({ url: "/api/v1/developer/apps/{app_uuid}", ...options });
@@ -940,7 +952,7 @@ var patchApiV1DeveloperAppsByAppUuid = (options) => (options.client ?? client).p
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1DeveloperAppsByAppUuidApiKeys = (options) => (options.client ?? client).get({ url: "/api/v1/developer/apps/{app_uuid}/api-keys", ...options });
@@ -949,7 +961,7 @@ var postApiV1DeveloperAppsByAppUuidApiKeys = (options) => (options.client ?? cli
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var deleteApiV1DeveloperAppsByAppUuidApiKeysByKeyId = (options) => (options.client ?? client).delete({ url: "/api/v1/developer/apps/{app_uuid}/api-keys/{key_id}", ...options });
@@ -958,7 +970,7 @@ var postApiV1DeveloperAppsByAppUuidFund = (options) => (options.client ?? client
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var deleteApiV1DeveloperAppsByAppUuidPrivy = (options) => (options.client ?? client).delete({ url: "/api/v1/developer/apps/{app_uuid}/privy", ...options });
@@ -967,7 +979,7 @@ var postApiV1DeveloperAppsByAppUuidPrivy = (options) => (options.client ?? clien
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1DeveloperAppsByAppUuidUsage = (options) => (options.client ?? client).get({ url: "/api/v1/developer/apps/{app_uuid}/usage", ...options });
@@ -979,7 +991,7 @@ var patchApiV1DeveloperAppsByAppUuidUsersByAddress = (options) => (options.clien
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1DeveloperAppsByAppUuidUsersByAddressTopUp = (options) => (options.client ?? client).post({
@@ -987,7 +999,7 @@ var postApiV1DeveloperAppsByAppUuidUsersByAddressTopUp = (options) => (options.c
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1DeveloperBilling = (options) => (options?.client ?? client).get({ url: "/api/v1/developer/billing", ...options });
@@ -997,7 +1009,7 @@ var postApiV1Embeddings = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1Models = (options) => (options?.client ?? client).get({ url: "/api/v1/models", ...options });
@@ -1008,7 +1020,7 @@ var postApiV1PhoneCalls = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1PhoneCallsByCallId = (options) => (options.client ?? client).get({ url: "/api/v1/phone-calls/{call_id}", ...options });
@@ -1017,7 +1029,7 @@ var postApiV1Responses = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1SubscriptionsCancel = (options) => (options?.client ?? client).post({
@@ -1025,7 +1037,7 @@ var postApiV1SubscriptionsCancel = (options) => (options?.client ?? client).post
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options?.headers
+    ...normalizeHeaders(options?.headers)
   }
 });
 var postApiV1SubscriptionsCancelScheduledDowngrade = (options) => (options?.client ?? client).post({ url: "/api/v1/subscriptions/cancel-scheduled-downgrade", ...options });
@@ -1034,7 +1046,7 @@ var postApiV1SubscriptionsCreateCheckoutSession = (options) => (options.client ?
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1SubscriptionsCustomerPortal = (options) => (options.client ?? client).post({
@@ -1042,7 +1054,7 @@ var postApiV1SubscriptionsCustomerPortal = (options) => (options.client ?? clien
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1SubscriptionsPlans = (options) => (options?.client ?? client).get({ url: "/api/v1/subscriptions/plans", ...options });
@@ -1052,7 +1064,7 @@ var postApiV1SubscriptionsScheduleDowngrade = (options) => (options.client ?? cl
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1SubscriptionsStatus = (options) => (options?.client ?? client).get({ url: "/api/v1/subscriptions/status", ...options });
@@ -1061,7 +1073,7 @@ var postApiV1SubscriptionsUpgrade = (options) => (options.client ?? client).post
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1SubscriptionsWebhook = (options) => (options.client ?? client).post({
@@ -1069,7 +1081,7 @@ var postApiV1SubscriptionsWebhook = (options) => (options.client ?? client).post
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1Tools = (options) => (options?.client ?? client).get({ url: "/api/v1/tools", ...options });
@@ -1081,7 +1093,7 @@ var postApiV1UserApiKeys = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var deleteApiV1UserApiKeysByKeyId = (options) => (options.client ?? client).delete({ url: "/api/v1/user/api-keys/{key_id}", ...options });
@@ -1091,7 +1103,7 @@ var postApiV1WalletsBinding = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1WalletsBindingNonce = (options) => (options?.client ?? client).post({ url: "/api/v1/wallets/binding/nonce", ...options });
@@ -1101,7 +1113,7 @@ var postApiV1WebhooksRevenuecat = (options) => (options?.client ?? client).post(
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options?.headers
+    ...normalizeHeaders(options?.headers)
   }
 });
 var getApiV1ZetaCreditRate = (options) => (options?.client ?? client).get({ url: "/api/v1/zeta/credit-rate", ...options });

package/dist/react/index.cjs

@@ -3575,7 +3575,14 @@ function cosineSimilarity(a, b) {
 
 // src/lib/processors/encoding.ts
 var B64_ENCODE_CHUNK = 32768 * 3;
+function assertFileUrlAllowed(dataUrl) {
+  const isNode = typeof process !== "undefined" && Boolean(process.versions?.node);
+  if (isNode && !dataUrl.startsWith("data:") && !dataUrl.startsWith("blob:")) {
+    throw new Error("Server file preprocessing requires a data URL or blob URL.");
+  }
+}
 async function dataUrlToArrayBuffer(dataUrl) {
+  assertFileUrlAllowed(dataUrl);
   if (dataUrl.startsWith("blob:") || dataUrl.startsWith("http://") || dataUrl.startsWith("https://")) {
     const response = await fetch(dataUrl);
     return response.arrayBuffer();
@@ -6237,7 +6244,7 @@ var mergeHeaders = (...headers) => {
     if (!header || typeof header !== "object") {
       continue;
     }
-    const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+    const iterator = Array.isArray(header) || header instanceof Headers ? headersEntries(new Headers(header)) : Object.entries(header);
     for (const [key, value] of iterator) {
       if (value === null) {
         mergedHeaders.delete(key);
@@ -6513,6 +6520,18 @@ var createClient = (config = {}) => {
 init_clientConfig();
 var client = createClient(createClientConfig(createConfig()));
 
+// src/clientHeaders.ts
+function normalizeHeaders(headers) {
+  if (headers instanceof Headers || Array.isArray(headers)) {
+    const normalized = /* @__PURE__ */ Object.create(null);
+    new Headers(headers).forEach((value, name) => {
+      normalized[name] = value;
+    });
+    return normalized;
+  }
+  return headers;
+}
+
 // src/client/sdk.gen.ts
 var getApiV1Config = (options) => (options?.client ?? client).get({ url: "/api/v1/config", ...options });
 var getApiV1CreditsBalance = (options) => (options?.client ?? client).get({ url: "/api/v1/credits/balance", ...options });
@@ -6522,7 +6541,7 @@ var postApiV1CreditsPurchase = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1Embeddings = (options) => (options.client ?? client).post({
@@ -6530,7 +6549,7 @@ var postApiV1Embeddings = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1Models = (options) => (options?.client ?? client).get({ url: "/api/v1/models", ...options });
@@ -6539,7 +6558,7 @@ var postApiV1PhoneCalls = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var getApiV1PhoneCallsByCallId = (options) => (options.client ?? client).get({ url: "/api/v1/phone-calls/{call_id}", ...options });
@@ -6548,7 +6567,7 @@ var postApiV1SubscriptionsCancel = (options) => (options?.client ?? client).post
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options?.headers
+    ...normalizeHeaders(options?.headers)
   }
 });
 var postApiV1SubscriptionsCreateCheckoutSession = (options) => (options.client ?? client).post({
@@ -6556,7 +6575,7 @@ var postApiV1SubscriptionsCreateCheckoutSession = (options) => (options.client ?
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1SubscriptionsCustomerPortal = (options) => (options.client ?? client).post({
@@ -6564,7 +6583,7 @@ var postApiV1SubscriptionsCustomerPortal = (options) => (options.client ?? clien
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1SubscriptionsRenew = (options) => (options?.client ?? client).post({ url: "/api/v1/subscriptions/renew", ...options });
@@ -6575,7 +6594,7 @@ var postApiV1WalletsBinding = (options) => (options.client ?? client).post({
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 var postApiV1WalletsBindingNonce = (options) => (options?.client ?? client).post({ url: "/api/v1/wallets/binding/nonce", ...options });
@@ -16668,10 +16687,10 @@ async function getVaultRankingProjectionsOp(ctx, options) {
 function baseVaultSql(ctx, options) {
   const clauses = [
     `"_status" is not 'deleted'`,
-    '"is_deleted" = 0',
+    ...options?.includeDeleted ? [] : ['"is_deleted" = 0'],
     ...options?.includeArchived ? [] : ['"archived_at" is null'],
     ...options?.includeQuarantined ? [] : [`"trust_tier" is not 'quarantined'`],
-    '"superseded_by" is null'
+    ...options?.includeSuperseded ? [] : ['"superseded_by" is null']
   ];
   const args = [];
   if (ctx.userId !== void 0) {
@@ -16680,6 +16699,38 @@ function baseVaultSql(ctx, options) {
   }
   return { sql: clauses.join(" and "), args };
 }
+async function getVaultProfileMetadataOp(ctx, options) {
+  const mapRaw = (raw) => ({
+    uniqueId: raw.id,
+    scope: raw.scope ?? "",
+    createdAt: new Date(raw.created_at),
+    updatedAt: new Date(raw.updated_at),
+    lastObservedAt: raw.last_observed_at ?? null,
+    supersededAt: raw.superseded_at ?? null,
+    supersededBy: raw.superseded_by ?? null,
+    isDeleted: raw.is_deleted === true || raw.is_deleted === 1,
+    proofCount: raw.proof_count ?? null
+  });
+  const listOptions = { ...options, includeDeleted: true, includeSuperseded: true };
+  let rows;
+  try {
+    const base = baseVaultSql(ctx, listOptions);
+    const clauses = [base.sql, `"_status" != 'deleted'`];
+    const args = [...base.args];
+    if (options?.scopes?.length) {
+      clauses.push(`"scope" in (${options.scopes.map(() => "?").join(",")})`);
+      args.push(...options.scopes);
+    }
+    const sql = `select "id", "scope", "created_at", "updated_at", "last_observed_at", "superseded_at", "superseded_by", "is_deleted", "proof_count" from "memory_vault" where ${clauses.join(" and ")}`;
+    rows = await ctx.vaultMemoryCollection.query(import_watermelondb24.Q.unsafeSqlQuery(sql, args)).unsafeFetchRaw();
+  } catch (err) {
+    getLogger().debug(
+      "memoryVault: getVaultProfileMetadataOp uses the query fallback: " + (err instanceof Error ? err.message : String(err))
+    );
+    rows = await ctx.vaultMemoryCollection.query(...vaultListConditions(ctx, listOptions)).unsafeFetchRaw();
+  }
+  return rows.map(mapRaw);
+}
 async function getVaultCandidateKeysOp(ctx, options) {
   const mapRaw = (raw) => ({
     uniqueId: raw.id,
@@ -26892,7 +26943,7 @@ async function synthesizeProfile(ctx, options = {}) {
   };
   const previous = options.previous && options.previous.version === PROFILE_DOC_VERSION && configMatches(options.previous.config, config) ? options.previous : void 0;
   const listOptions = { scopes, includeDeleted: true, includeSuperseded: true };
-  const [memories, projections] = store ? await Promise.all([store.list(listOptions), store.listProjections(listOptions)]) : [await getAllVaultMemoriesOp(vaultCtx, listOptions), []];
+  const [memories, projections] = store ? await Promise.all([store.list(listOptions), store.listProjections(listOptions)]) : [await getVaultProfileMetadataOp(vaultCtx, { scopes }), []];
   const watermark = computeVaultWatermark(memories);
   const observationTrends = summarizeObservationTrends(
     memories.filter((m) => !m.isDeleted && m.supersededBy === null).map((m) => ({
@@ -26928,7 +26979,8 @@ async function synthesizeProfile(ctx, options = {}) {
     previous,
     watermark,
     options.reviewedMemoryIds,
-    previousUnreadable
+    previousUnreadable,
+    store ? void 0 : (ids) => getVaultEmbeddingsByIdsOp(vaultCtx, ids)
   );
   const memoriesById = new Map(memories.map((memory) => [memory.uniqueId, memory]));
   const fallbackPriors = /* @__PURE__ */ new Map();
@@ -27015,7 +27067,7 @@ function computeVaultWatermark(memories) {
   }
   return max;
 }
-async function computeStaleFacetKeys(ctx, memories, facets, previous, watermark, reviewedMemoryIds, previouslyUnreadable) {
+async function computeStaleFacetKeys(ctx, memories, facets, previous, watermark, reviewedMemoryIds, previouslyUnreadable, loadEmbeddings) {
   const allKeys = new Set(facets.map((f) => f.key));
   if (previous && watermark < previous.vaultWatermark) return allKeys;
   if (!previous) return allKeys;
@@ -27048,7 +27100,9 @@ async function computeStaleFacetKeys(ctx, memories, facets, previous, watermark,
     toAttribute = toAttribute.filter((m) => allowed.has(m.uniqueId));
   }
   if (toAttribute.length > 0) {
-    const attributed = await attributeFacts(ctx, toAttribute, facets);
+    const candidates = loadEmbeddings ? await loadEmbeddings(toAttribute.map((m) => m.uniqueId)) : toAttribute;
+    if (candidates.length !== toAttribute.length) return allKeys;
+    const attributed = await attributeFacts(ctx, candidates, facets);
     if (attributed === null) return allKeys;
     for (const k of attributed) stale.add(k);
   }
@@ -29619,6 +29673,7 @@ async function getPdfjs() {
   return pdfjsModule;
 }
 async function withPdfDocument(pdfDataUrl, fn) {
+  assertFileUrlAllowed(pdfDataUrl);
   const pdfjs = await getPdfjs();
   const loadingTask = pdfjs.getDocument(pdfDataUrl);
   let pdf;
@@ -30421,6 +30476,7 @@ async function preprocessFiles(files, options = {}) {
         skip("no_data");
         continue;
       }
+      assertFileUrlAllowed(file.url);
       const fileWithData = {
         ...file,
         dataUrl: file.url