@jeffreycao/copilot-api 2.4.1 → 2.5.1

package/dist/{server-HBeQNO83.js → server-D5XuGc4z.js}

@@ -1,21 +1,25 @@
-import { A as isResponsesApiWebSocketEnabled, C as getClaudeTokenMultiplier, D as isAlphaSearchCodexPriorityEnabled, E as getResponsesTransportConfig, N as PATHS, O as isMessagesApiEnabled, S as getClaudeAutoModel, T as getMessageApiWebSearchModel, _ as resolveMappedModel, b as getAlphaSearchModel, d as getModelResponsesApiCompactThreshold$1, f as getReasoningEffortForModel, g as isGpt56OrAbove, h as isContextManagementEnabledForResponses, i as listEnabledProviders, k as isResponsesApiWebSearchEnabled, l as getExtraPromptForModel, m as isContextManagementEnabledForMessages, n as getRawProviderConfig, o as resolveEffectiveProviderType, p as getSmallModel, s as resolveProviderAuthType, t as getProviderConfig, u as getModelMappings, v as setModelMappings, x as getAnthropicApiKey } from "./config-DVWu2hKk.js";
-import { B as fetchResponsesWithLifecycle, C as compactAutoContinuePromptStarts, D as compactTextOnlyGuard, E as compactSystemPromptStarts, F as forwardCodexResponses, G as createWebSocketUrl, H as encodePoolKeyPart, I as generateTraceId, J as forwardError, K as state, L as requestContext, N as CODEX_API_BASE_URL, O as createAuthMiddleware, P as buildCodexRequestHeaders, R as resolveTraceId$1, U as isTerminalResponsesStreamChunk, V as createResponsesSafeStream, W as createPooledWebSocketStream, b as prepareInteractionHeaders, c as getUUID, d as isResponsesStream, f as parseUserIdMetadata, g as copilotHeaders, h as copilotBaseUrl, k as getConfiguredAdminApiKeys, l as isAsyncIterable, o as generateRequestIdFromPayload, p as getCopilotUsage, q as HTTPError, r as setupCodexToken, s as getRootSessionId, u as isNullish, v as copilotWebSocketHeaders, w as compactMessageSections, x as prepareMessageProxyHeaders, y as prepareForCompact, z as createResponsesHttpEventStream } from "./token-D0GGk3E8.js";
+import { A as isResponsesApiWebSocketEnabled, C as getClaudeTokenMultiplier, D as isAlphaSearchCodexPriorityEnabled, E as getResponsesTransportConfig, N as PATHS, O as isMessagesApiEnabled, S as getClaudeAutoModel, T as getMessageApiWebSearchModel, _ as resolveMappedModel, b as getAlphaSearchModel, d as getModelResponsesApiCompactThreshold$1, f as getReasoningEffortForModel, g as isGpt56OrAbove, h as isContextManagementEnabledForResponses, i as listEnabledProviders, k as isResponsesApiWebSearchEnabled, l as getExtraPromptForModel, m as isContextManagementEnabledForMessages, n as getRawProviderConfig, o as resolveEffectiveProviderType, p as getSmallModel, s as resolveProviderAuthType, t as getProviderConfig, u as getModelMappings, v as setModelMappings, x as getAnthropicApiKey } from "./config-Cb0atQ6i.js";
+import { B as fetchResponsesWithLifecycle, C as compactAutoContinuePromptStarts, D as compactTextOnlyGuard, E as compactSystemPromptStarts, F as forwardCodexResponses, G as createWebSocketUrl, H as encodePoolKeyPart, I as generateTraceId, J as forwardError, K as state, L as requestContext, N as CODEX_API_BASE_URL, O as createAuthMiddleware, P as buildCodexRequestHeaders, R as resolveTraceId$1, U as isTerminalResponsesStreamChunk, V as createResponsesSafeStream, W as createPooledWebSocketStream, b as prepareInteractionHeaders, c as getUUID, d as isResponsesStream, f as parseUserIdMetadata, g as copilotHeaders, h as copilotBaseUrl, k as getConfiguredAdminApiKeys, l as isAsyncIterable, o as generateRequestIdFromPayload, p as getCopilotUsage, q as HTTPError, r as setupCodexToken, s as getRootSessionId, u as isNullish, v as copilotWebSocketHeaders, w as compactMessageSections, x as prepareMessageProxyHeaders, y as prepareForCompact, z as createResponsesHttpEventStream } from "./token-DYqRXNhu.js";
 import { a as isDeferredToolName, c as parseMcpToolSearchSentinel, d as shouldEnableResponsesToolSearch, i as isBridgeToolSearchName, l as resolveBridgeToolSearchName, o as listDeferredToolNames, r as formatToolSearchBridgeArguments, s as normalizeToolSearchBridgeArguments, t as BRIDGE_TOOL_SEARCH_NAME, u as selectDeferredToolsByNames } from "./tool-search-Ds1vbmGG.js";
-import { i as toClientModelId, r as normalizeSdkModelId, t as findEndpointModel } from "./models-DKNAPa_j.js";
+import { i as toClientModelId, r as normalizeSdkModelId, t as findEndpointModel } from "./models-DvNveb2V.js";
 import consola from "consola";
 import { createHash } from "node:crypto";
-import fs, { readFileSync } from "node:fs";
-import path from "node:path";
-import fs$1 from "node:fs/promises";
+import fs, { createWriteStream, readFileSync, rmSync } from "node:fs";
+import path, { join } from "node:path";
+import fs$1, { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
 import { fetch as fetch$1, getGlobalDispatcher } from "undici";
 import { events } from "fetch-event-stream";
 import { z } from "zod";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
 import { logger } from "hono/logger";
-import { decompress } from "fzstd";
 import util from "node:util";
 import { streamSSE } from "hono/streaming";
+import { Busboy } from "@fastify/busboy";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { decompress } from "fzstd";
 //#region src/lib/trace.ts
 const traceIdMiddleware = async (c, next) => {
 	const traceId = resolveTraceId$1(c.req.header("x-trace-id"));
@@ -32,58 +36,6 @@ const traceIdMiddleware = async (c, next) => {
 	});
 };
 //#endregion
-//#region src/lib/zstd-request.ts
-const ZSTD_CONTENT_ENCODING = "zstd";
-const INVALID_BODY_STATUS = 400;
-let nodeZlibPromise = null;
-const zstdDecompressionMiddleware = async (c, next) => {
-	if (c.req.header("content-encoding")?.trim().toLowerCase() !== ZSTD_CONTENT_ENCODING) return next();
-	try {
-		const decompressedBody = await decompressZstd(new Uint8Array(await c.req.raw.arrayBuffer()));
-		const headers = new Headers(c.req.raw.headers);
-		headers.delete("content-encoding");
-		headers.delete("content-length");
-		c.req.raw = new Request(c.req.raw.url, {
-			body: decompressedBody,
-			headers,
-			method: c.req.raw.method,
-			signal: c.req.raw.signal
-		});
-		c.req.bodyCache = {};
-	} catch {
-		return c.json({ error: {
-			message: "Failed to decompress zstd request body.",
-			type: "invalid_request_error"
-		} }, INVALID_BODY_STATUS);
-	}
-	return next();
-};
-const decompressZstd = async (input) => {
-	const bun = getBunRuntime();
-	if (bun?.zstdDecompress) return toUint8Array(await bun.zstdDecompress(input));
-	const nodeZlib = await getNodeZlib();
-	if (nodeZlib?.zstdDecompress) return new Promise((resolve, reject) => {
-		nodeZlib.zstdDecompress?.(input, (error, result) => {
-			if (error) {
-				reject(error);
-				return;
-			}
-			resolve(toUint8Array(result));
-		});
-	});
-	return decompress(input);
-};
-const getBunRuntime = () => globalThis.Bun;
-const getNodeZlib = async () => {
-	nodeZlibPromise ??= import("node:zlib").then((module) => module).catch(() => null);
-	return nodeZlibPromise;
-};
-const toUint8Array = (data) => {
-	if (data instanceof Uint8Array) return data;
-	if (data instanceof ArrayBuffer) return new Uint8Array(data);
-	return new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
-};
-//#endregion
 //#region src/lib/process-cleanup.ts
 const cleanupHandlers = /* @__PURE__ */ new Set();
 let cleanupPromise = null;
@@ -2474,7 +2426,7 @@ async function forwardProviderImages(providerConfig, request, operation) {
 }
 //#endregion
 //#region src/routes/alpha-search/alpha-search-responses.ts
-const logger$16 = createHandlerLogger("alpha-search-responses-handler");
+const logger$17 = createHandlerLogger("alpha-search-responses-handler");
 const SESSION_TTL_MS = 3600 * 1e3;
 const MAX_SESSIONS = 128;
 const MAX_URL_REFERENCES = 256;
@@ -2832,14 +2784,14 @@ function createRemoteResponsesPayload(request, model, instruction) {
 	};
 }
 async function requestProviderSearch(c, providerConfig, payload, model, sessionId) {
-	debugJson(logger$16, "Alpha search provider Responses request:", {
+	debugJson(logger$17, "Alpha search provider Responses request:", {
 		payload,
 		provider: providerConfig.name
 	});
 	const upstreamResponse = await forwardProviderResponses(providerConfig, payload, c.req.raw.headers, { signal: c.req.raw.signal });
 	if (!upstreamResponse.ok) throw new HTTPError(`Failed to create ${providerConfig.name} responses for alpha search`, upstreamResponse);
 	const result = await upstreamResponse.json();
-	debugJson(logger$16, "Alpha search provider Responses result:", {
+	debugJson(logger$17, "Alpha search provider Responses result:", {
 		provider: providerConfig.name,
 		result
 	});
@@ -2855,7 +2807,7 @@ async function requestProviderSearch(c, providerConfig, payload, model, sessionI
 	return result;
 }
 async function requestCopilotSearch(payload, model, requestId, sessionId, signal) {
-	debugJson(logger$16, "Alpha search Copilot Responses request:", payload);
+	debugJson(logger$17, "Alpha search Copilot Responses request:", payload);
 	const result = await alphaSearchResponsesDependencies.createResponses(payload, {
 		vision: false,
 		initiator: "agent",
@@ -2864,7 +2816,7 @@ async function requestCopilotSearch(payload, model, requestId, sessionId, signal
 		sessionId,
 		signal
 	});
-	debugJson(logger$16, "Alpha search Copilot Responses result:", result);
+	debugJson(logger$17, "Alpha search Copilot Responses result:", result);
 	alphaSearchResponsesDependencies.createUsageRecorder(model, sessionId)({
 		...normalizeResponsesUsage(result.usage),
 		total_nano_aiu: normalizeOptionalToken(result.copilot_usage?.total_nano_aiu)
@@ -2979,7 +2931,7 @@ async function forwardCodexAlphaSearch(request) {
 }
 //#endregion
 //#region src/routes/alpha-search/route.ts
-const logger$15 = createHandlerLogger("alpha-search-handler");
+const logger$16 = createHandlerLogger("alpha-search-handler");
 const alphaSearchRoutes = new Hono();
 const alphaSearchRouteDependencies = {
 	findEndpointModel,
@@ -2999,9 +2951,9 @@ function parseDebugBody(body) {
 	}
 }
 async function forwardCodexAlphaSearchRequest(request) {
-	await debugJsonAsync(logger$15, "alpha_search.codex.request", async () => ({ body: parseDebugBody(await request.clone().text()) }));
+	await debugJsonAsync(logger$16, "alpha_search.codex.request", async () => ({ body: parseDebugBody(await request.clone().text()) }));
 	const upstreamResponse = await alphaSearchRouteDependencies.forwardCodexAlphaSearch(request);
-	await debugJsonAsync(logger$15, "alpha_search.codex.response", async () => ({
+	await debugJsonAsync(logger$16, "alpha_search.codex.response", async () => ({
 		body: parseDebugBody(await upstreamResponse.clone().text()),
 		statusCode: upstreamResponse.status
 	}));
@@ -3112,7 +3064,7 @@ alphaSearchRoutes.post("/", async (c) => {
 	try {
 		return await handleAlphaSearchRequest(c);
 	} catch (error) {
-		logger$15.error("alpha_search.error", { error });
+		logger$16.error("alpha_search.error", { error });
 		return await forwardError(c, error);
 	}
 });
@@ -3240,7 +3192,7 @@ const normalizeProviderResponsesReasoningEffort = (payload, providerConfig) => {
 };
 //#endregion
 //#region src/routes/provider/chat-completions/handler.ts
-const logger$14 = createHandlerLogger("provider-chat-completions-handler");
+const logger$15 = createHandlerLogger("provider-chat-completions-handler");
 async function handleProviderChatCompletionsForProvider(c, options) {
 	const { payload, provider } = options;
 	const providerConfig = await resolveProviderConfig(provider);
@@ -3254,13 +3206,13 @@ async function handleProviderChatCompletionsForProvider(c, options) {
 	applyProviderStreamOptions(payload);
 	applyDashScopePreserveThinkingDefault(payload, providerConfig);
 	applyProviderContextCache(payload, modelConfig, providerConfig);
-	debugJson(logger$14, "provider.chat_completions.request", {
+	debugJson(logger$15, "provider.chat_completions.request", {
 		payload,
 		provider
 	});
 	const upstreamResponse = await forwardProviderChatCompletions(providerConfig, payload, c.req.raw.headers);
 	if (!upstreamResponse.ok) {
-		logger$14.error("Failed to create provider chat completions", {
+		logger$15.error("Failed to create provider chat completions", {
 			provider,
 			statusCode: upstreamResponse.status
 		});
@@ -3274,7 +3226,7 @@ async function handleProviderChatCompletionsForProvider(c, options) {
 	});
 	const responseBody = await upstreamResponse.clone().json();
 	recordUsage(normalizeOpenAIUsage(responseBody.usage));
-	debugJson(logger$14, "provider.chat_completions.response", responseBody);
+	debugJson(logger$15, "provider.chat_completions.response", responseBody);
 	return createProviderProxyResponse(upstreamResponse);
 }
 const applyProviderStreamOptions = (payload) => {
@@ -3296,12 +3248,12 @@ const createProviderChatCompletionsUsageRecorder = (payload, provider, modelConf
 	providerName: provider
 });
 const streamProviderChatCompletions = (c, upstreamResponse, options) => {
-	logger$14.debug("provider.chat_completions.streaming", { provider: options.provider });
+	logger$15.debug("provider.chat_completions.streaming", { provider: options.provider });
 	return streamSSE(c, async (stream) => {
 		let usage = {};
 		try {
 			for await (const chunk of events(upstreamResponse)) {
-				debugJson(logger$14, "provider.chat_completions.stream_chunk", chunk);
+				debugJson(logger$15, "provider.chat_completions.stream_chunk", chunk);
 				if (chunk.data && chunk.data !== "[DONE]") {
 					const parsedChunk = parseChatCompletionChunkData(chunk.data);
 					if (parsedChunk?.usage) usage = normalizeOpenAIUsage(parsedChunk.usage);
@@ -3355,7 +3307,7 @@ const createChatCompletions = async (payload, options) => {
 };
 //#endregion
 //#region src/routes/chat-completions/handler.ts
-const logger$13 = createHandlerLogger("chat-completions-handler");
+const logger$14 = createHandlerLogger("chat-completions-handler");
 async function handleCompletion$1(c) {
 	let payload = await c.req.json();
 	const requestedModel = payload.model;
@@ -3369,7 +3321,7 @@ async function handleCompletion$1(c) {
 			provider: providerModelAlias.provider
 		});
 	}
-	debugJson(logger$13, "Request payload:", payload);
+	debugJson(logger$14, "Request payload:", payload);
 	const selectedModel = findEndpointModel(payload.model);
 	payload.model = selectedModel?.id ?? payload.model;
 	if (isNullish(payload.max_tokens) && isNullish(payload.max_completion_tokens)) {
@@ -3377,16 +3329,16 @@ async function handleCompletion$1(c) {
 			...payload,
 			max_tokens: selectedModel?.capabilities.limits.max_output_tokens
 		};
-		debugJson(logger$13, "Set max_tokens to:", payload.max_tokens);
+		debugJson(logger$14, "Set max_tokens to:", payload.max_tokens);
 	}
 	if (payload.model.includes("gpt")) {
 		if (isNullish(payload.max_completion_tokens)) payload.max_completion_tokens = payload.max_tokens;
 		delete payload.max_tokens;
 	}
 	const requestId = generateRequestIdFromPayload(payload);
-	logger$13.debug("Generated request ID:", requestId);
+	logger$14.debug("Generated request ID:", requestId);
 	const sessionId = getUUID(requestId);
-	logger$13.debug("Extracted session ID:", sessionId);
+	logger$14.debug("Extracted session ID:", sessionId);
 	const recordUsage = createCopilotTokenUsageRecorder({
 		endpoint: "chat_completions",
 		fallbackSessionId: sessionId,
@@ -3397,18 +3349,18 @@ async function handleCompletion$1(c) {
 		sessionId
 	});
 	if (isNonStreaming$1(response)) {
-		debugJson(logger$13, "Non-streaming response:", response);
+		debugJson(logger$14, "Non-streaming response:", response);
 		recordUsage({
 			...normalizeOpenAIUsage(response.usage),
 			total_nano_aiu: normalizeOptionalToken(response.copilot_usage?.total_nano_aiu)
 		});
 		return c.json(response);
 	}
-	logger$13.debug("Streaming response");
+	logger$14.debug("Streaming response");
 	return streamSSE(c, async (stream) => {
 		let usage = {};
 		for await (const chunk of response) {
-			debugJson(logger$13, "Streaming chunk:", chunk);
+			debugJson(logger$14, "Streaming chunk:", chunk);
 			const parsedChunk = parseChatCompletionChunk(chunk);
 			if (parsedChunk?.usage || parsedChunk?.copilot_usage) usage = {
 				...normalizeOpenAIUsage(parsedChunk.usage),
@@ -3497,6 +3449,32 @@ embeddingRoutes.post("/", async (c) => {
 	}
 });
 //#endregion
+//#region src/routes/images/forward-provider-images.ts
+/**
+* Forwards an images request to a configured provider with debug logging.
+* Shared by the top-level images routes (model mapping) and the
+* provider-scoped images routes so both log and proxy identically.
+*/
+async function forwardProviderImagesWithLogging(providerConfig, request, operation, { logger, provider }) {
+	if (operation === "generations") await debugJsonAsync(logger, `provider.images.${operation}.request`, async () => ({
+		body: await request.clone().text(),
+		provider
+	}));
+	else debugJson(logger, `provider.images.${operation}.request`, {
+		contentType: request.headers.get("content-type"),
+		contentLength: request.headers.get("content-length"),
+		provider
+	});
+	const upstreamResponse = await forwardProviderImages(providerConfig, request, operation);
+	debugJson(logger, `provider.images.${operation}.response`, {
+		contentType: upstreamResponse.headers.get("content-type"),
+		contentLength: upstreamResponse.headers.get("content-length"),
+		provider,
+		statusCode: upstreamResponse.status
+	});
+	return createProviderProxyResponse(upstreamResponse);
+}
+//#endregion
 //#region src/services/codex/images.ts
 const CODEX_IMAGES_TIMEOUT_MS = 900 * 1e3;
 const codexImagesDispatcher = createTimeoutDispatcher(CODEX_IMAGES_TIMEOUT_MS);
@@ -3524,41 +3502,433 @@ async function forwardCodexImages(request, operation) {
 	});
 }
 //#endregion
-//#region src/routes/images/route.ts
-const logger$12 = createHandlerLogger("images-handler");
-const imageRoutes = new Hono();
-const imageRouteDependencies = { debugJsonAsync };
-function getContentMetadata$1(headers) {
+//#region src/routes/images/shared.ts
+const logger$13 = createHandlerLogger("images-handler");
+const imageRouteDependencies = {
+	debugJsonAsync,
+	resolveMappedModel,
+	resolveProviderConfig
+};
+function getContentMetadata(headers) {
 	return {
 		contentType: headers.get("content-type"),
 		contentLength: headers.get("content-length")
 	};
 }
 /**
-* Handles Codex images proxying. Pass `resolvedProviderConfig` when the
-* caller already resolved the codex provider to avoid a second resolve.
+* Snapshots request headers before the body is consumed: Bun drops
+* auto-generated body headers (like the multipart boundary) afterwards.
 */
-async function handleCodexImages(c, operation, resolvedProviderConfig) {
+function snapshotRequestHeaders(request) {
+	return new Headers(request.headers);
+}
+/**
+* Rebuilds a request from primitives instead of cloning: under Node runtimes
+* srvx wraps incoming requests in a proxy class whose prototype chain
+* satisfies `instanceof Request` without the native internals, so
+* `new Request(request)` throws.
+*/
+function createForwardRequest(request, requestHeaders, body) {
+	const init = {
+		body,
+		duplex: "half",
+		headers: requestHeaders,
+		method: request.method,
+		signal: request.signal
+	};
+	return new Request(request.url, init);
+}
+/**
+* Handles Codex images proxying. Pass a resolvedProviderConfig when the
+* caller already resolved the codex provider to avoid a second resolve, and
+* pass a request when model mapping rebuilt the request body.
+*/
+async function handleCodexImages(c, operation, resolvedProviderConfig, request = c.req.raw) {
 	try {
-		if (!(resolvedProviderConfig ?? await resolveProviderConfig("codex"))) return c.json({ error: {
+		if (!(resolvedProviderConfig ?? await imageRouteDependencies.resolveProviderConfig("codex"))) return c.json({ error: {
 			message: "Provider 'codex' not found or disabled",
 			type: "invalid_request_error"
 		} }, 404);
-		if (operation === "generations") await imageRouteDependencies.debugJsonAsync(logger$12, "images.generations.codex.request", async () => ({ body: await c.req.raw.clone().text() }));
-		else debugJson(logger$12, "images.edits.codex.request", getContentMetadata$1(c.req.raw.headers));
-		const upstreamResponse = await forwardCodexImages(c.req.raw, operation);
-		debugJson(logger$12, `images.${operation}.codex.response`, {
-			...getContentMetadata$1(upstreamResponse.headers),
+		if (operation === "generations") await imageRouteDependencies.debugJsonAsync(logger$13, "images.generations.codex.request", async () => ({ body: await request.clone().text() }));
+		else debugJson(logger$13, "images.edits.codex.request", getContentMetadata(request.headers));
+		const upstreamResponse = await forwardCodexImages(request, operation);
+		debugJson(logger$13, `images.${operation}.codex.response`, {
+			...getContentMetadata(upstreamResponse.headers),
 			statusCode: upstreamResponse.status
 		});
 		return createProviderProxyResponse(upstreamResponse);
 	} catch (error) {
-		logger$12.error(`images.${operation}.codex.error`, { error });
+		logger$13.error(`images.${operation}.codex.error`, { error });
 		return await forwardError(c, error);
 	}
 }
-imageRoutes.post("/generations", (c) => handleCodexImages(c, "generations"));
-imageRoutes.post("/edits", (c) => handleCodexImages(c, "edits"));
+/**
+* Routes a parsed images request: applies the model mapping, forwards to a
+* mapped provider when configured, and otherwise falls back to Codex.
+*/
+async function routeImagesRequest(c, operation, parsed) {
+	const requestedModel = parsed.model;
+	const mappedModel = imageRouteDependencies.resolveMappedModel(requestedModel);
+	if (mappedModel !== requestedModel) consola.debug(`Resolved model mapping: ${requestedModel} -> ${mappedModel}`);
+	const providerModelAlias = parseProviderModelAlias(mappedModel);
+	if (providerModelAlias) {
+		const providerConfig = await imageRouteDependencies.resolveProviderConfig(providerModelAlias.provider);
+		if (providerConfig) {
+			const request = parsed.createRequest(providerModelAlias.model);
+			if (providerConfig.name === "codex") return await handleCodexImages(c, operation, providerConfig, request);
+			return await forwardProviderImagesWithLogging(providerConfig, request, operation, {
+				logger: logger$13,
+				provider: providerModelAlias.provider
+			});
+		}
+		consola.debug(`Provider '${providerModelAlias.provider}' not found or disabled; forwarding the original model to Codex`);
+		return await handleCodexImages(c, operation, void 0, parsed.originalRequest ?? parsed.createRequest(requestedModel));
+	}
+	if (parsed.originalRequest && mappedModel === requestedModel) return await handleCodexImages(c, operation, void 0, parsed.originalRequest);
+	return await handleCodexImages(c, operation, void 0, parsed.createRequest(mappedModel));
+}
+//#endregion
+//#region src/routes/images/temp-form-data.ts
+const logger$12 = createHandlerLogger("images-temp-form-data");
+const multipartStagingDependencies = { createWriteStream };
+/**
+* Matches the images forwarding timeouts: an upstream upload may take that
+* long, so staged files must survive at least the whole forwarding window.
+*/
+const STAGED_FILES_TTL_MS = 900 * 1e3;
+const DEFAULT_MULTIPART_STAGING_LIMITS = {
+	maxBodySizeBytes: 128 * 1024 * 1024,
+	maxFieldSizeBytes: 10 * 1024 * 1024,
+	maxFields: 64,
+	maxFileSizeBytes: 64 * 1024 * 1024,
+	maxFiles: 16,
+	maxParts: 80
+};
+var InvalidMultipartBodyError = class extends Error {
+	constructor(options) {
+		super("Invalid multipart form data body", options);
+		this.name = "InvalidMultipartBodyError";
+	}
+};
+var MultipartBodyTooLargeError = class extends Error {
+	constructor() {
+		super("Multipart form data body exceeds the configured upload limits");
+		this.name = "MultipartBodyTooLargeError";
+	}
+};
+function sanitizeFileName(name) {
+	return name.split(/[\\/]/).pop()?.replaceAll("\0", "") || "file";
+}
+async function createDiskBackedBlob(filePath, type) {
+	if (typeof Bun !== "undefined") return Bun.file(filePath, { type });
+	const { openAsBlob } = await import("node:fs");
+	return await openAsBlob(filePath, { type });
+}
+function toError(error) {
+	return error instanceof Error ? error : new Error(String(error));
+}
+function parseMultipartBody(body, contentType, directory, entries, limits) {
+	return new Promise((resolve, reject) => {
+		let busboy;
+		try {
+			busboy = new Busboy({
+				headers: { "content-type": contentType },
+				limits: {
+					fieldSize: limits.maxFieldSizeBytes,
+					fields: limits.maxFields,
+					fileSize: limits.maxFileSizeBytes,
+					files: limits.maxFiles,
+					parts: limits.maxParts
+				}
+			});
+		} catch (error) {
+			reject(new InvalidMultipartBodyError({ cause: toError(error) }));
+			return;
+		}
+		const pendingWrites = [];
+		const activeFileStreams = /* @__PURE__ */ new Set();
+		const source = body === null ? Readable.from([]) : Readable.fromWeb(body);
+		let bodySizeBytes = 0;
+		const bodyLimiter = new Transform({ transform(chunk, _encoding, callback) {
+			bodySizeBytes += chunk.byteLength;
+			if (bodySizeBytes > limits.maxBodySizeBytes) {
+				callback(new MultipartBodyTooLargeError());
+				return;
+			}
+			callback(null, chunk);
+		} });
+		let fileIndex = 0;
+		let failure = null;
+		let inputPipeline = null;
+		let settled = false;
+		const settleStreams = () => Promise.allSettled([...inputPipeline ? [inputPipeline] : [], ...pendingWrites]);
+		const fail = (error) => {
+			if (failure || settled) return;
+			const failureError = toError(error);
+			failure = failureError;
+			source.destroy(failureError);
+			bodyLimiter.destroy(failureError);
+			busboy.destroy(failureError);
+			for (const stream of activeFileStreams) stream.destroy(failureError);
+			settleStreams().then(() => {
+				if (settled) return;
+				settled = true;
+				reject(failureError);
+			});
+		};
+		const failLimit = () => fail(new MultipartBodyTooLargeError());
+		busboy.on("field", (name, value, nameTruncated, valueTruncated) => {
+			if (nameTruncated || valueTruncated) {
+				failLimit();
+				return;
+			}
+			entries.push({
+				kind: "field",
+				name,
+				value
+			});
+		});
+		busboy.on("file", (name, stream, fileName, _transferEncoding, mimeType) => {
+			if (failure) {
+				stream.resume();
+				return;
+			}
+			const filePath = join(directory, `${fileIndex}.upload`);
+			fileIndex += 1;
+			entries.push({
+				fileName: sanitizeFileName(fileName),
+				filePath,
+				kind: "file",
+				mimeType,
+				name
+			});
+			activeFileStreams.add(stream);
+			stream.once("close", () => activeFileStreams.delete(stream));
+			stream.once("limit", failLimit);
+			const write = pipeline(stream, multipartStagingDependencies.createWriteStream(filePath));
+			pendingWrites.push(write);
+			write.catch(fail);
+		});
+		busboy.on("fieldsLimit", failLimit);
+		busboy.on("filesLimit", failLimit);
+		busboy.on("partsLimit", failLimit);
+		inputPipeline = pipeline(source, bodyLimiter, busboy);
+		inputPipeline.then(() => {
+			Promise.allSettled(pendingWrites).then((results) => {
+				if (failure || settled) return;
+				const failed = results.find((result) => result.status === "rejected");
+				if (failed) fail(failed.reason);
+				else {
+					settled = true;
+					resolve();
+				}
+			});
+		}, (error) => {
+			fail(error instanceof MultipartBodyTooLargeError ? error : new InvalidMultipartBodyError({ cause: toError(error) }));
+		});
+	});
+}
+function resolveStagingLimits(overrides) {
+	const limits = {
+		...DEFAULT_MULTIPART_STAGING_LIMITS,
+		...overrides
+	};
+	for (const [name, value] of Object.entries(limits)) if (!Number.isSafeInteger(value) || value <= 0) throw new RangeError(`${name} must be a positive safe integer`);
+	return limits;
+}
+/**
+* Streams a multipart request body through the parser, writing every file
+* part to a temporary directory as it arrives and rebuilding the form data
+* with disk-backed blobs, so forwarding streams payloads from disk instead
+* of pinning the whole upload in memory.
+*/
+async function stageMultipartBodyToDisk(body, contentType, limitOverrides = {}) {
+	const limits = resolveStagingLimits(limitOverrides);
+	const directory = await mkdtemp(join(tmpdir(), "copilot-api-images-"));
+	const entries = [];
+	try {
+		await parseMultipartBody(body, contentType, directory, entries, limits);
+	} catch (error) {
+		await rm(directory, {
+			force: true,
+			recursive: true
+		});
+		throw error;
+	}
+	const stagedFormData = new FormData();
+	try {
+		for (const entry of entries) if (entry.kind === "field") stagedFormData.append(entry.name, entry.value);
+		else stagedFormData.append(entry.name, await createDiskBackedBlob(entry.filePath, entry.mimeType), entry.fileName);
+	} catch (error) {
+		await rm(directory, {
+			force: true,
+			recursive: true
+		});
+		throw error;
+	}
+	let cleanupPromise = null;
+	let cleanupTimer = null;
+	let unregisterProcessCleanup = null;
+	const cleanup = () => {
+		cleanupPromise ??= (async () => {
+			if (cleanupTimer) {
+				clearTimeout(cleanupTimer);
+				cleanupTimer = null;
+			}
+			try {
+				await rm(directory, {
+					force: true,
+					recursive: true
+				});
+			} catch (error) {
+				logger$12.warn("Failed to remove staged images temp directory", {
+					directory,
+					error
+				});
+			} finally {
+				unregisterProcessCleanup?.();
+				unregisterProcessCleanup = null;
+			}
+		})();
+		return cleanupPromise;
+	};
+	unregisterProcessCleanup = registerProcessCleanup(() => {
+		if (cleanupTimer) {
+			clearTimeout(cleanupTimer);
+			cleanupTimer = null;
+		}
+		try {
+			rmSync(directory, {
+				force: true,
+				recursive: true
+			});
+		} catch (error) {
+			logger$12.warn("Failed to remove staged images temp directory on exit", {
+				directory,
+				error
+			});
+		} finally {
+			unregisterProcessCleanup?.();
+			unregisterProcessCleanup = null;
+		}
+	});
+	return {
+		directory,
+		formData: stagedFormData,
+		cleanup,
+		scheduleCleanup: () => {
+			if (cleanupPromise || cleanupTimer) return;
+			cleanupTimer = setTimeout(() => void cleanup(), STAGED_FILES_TTL_MS);
+			cleanupTimer.unref();
+		}
+	};
+}
+//#endregion
+//#region src/routes/images/edits-handler.ts
+const imageEditsRouteDependencies = { stageMultipartBodyToDisk };
+function createStagedFormDataRequest(request, requestHeaders, formData) {
+	const headers = new Headers(requestHeaders);
+	headers.delete("content-length");
+	headers.delete("content-type");
+	return createForwardRequest(request, headers, formData);
+}
+function createMultipartImagesRequest(request, requestHeaders, formData, model) {
+	formData.set("model", model);
+	return createStagedFormDataRequest(request, requestHeaders, formData);
+}
+/**
+* Streams an edits multipart body to disk, staging uploaded files so
+* forwarding streams them from the filesystem instead of pinning them in
+* memory. Non-multipart bodies come back as an untouched request stream;
+* malformed multipart bodies throw a typed error because the consumed stream
+* can no longer be forwarded.
+*/
+async function parseEditsRequest(request) {
+	const requestHeaders = snapshotRequestHeaders(request);
+	const contentType = requestHeaders.get("content-type");
+	if (contentType?.split(";", 1)[0]?.trim().toLowerCase() !== "multipart/form-data" || !contentType) return createForwardRequest(request, requestHeaders, request.body);
+	const staged = await imageEditsRouteDependencies.stageMultipartBodyToDisk(request.body, contentType);
+	const model = staged.formData.get("model");
+	return {
+		model: typeof model === "string" ? model : void 0,
+		requestHeaders,
+		staged
+	};
+}
+async function handleImagesEdits(c) {
+	try {
+		const parsed = await parseEditsRequest(c.req.raw);
+		if (parsed instanceof Request) return await handleCodexImages(c, "edits", void 0, parsed);
+		const { model, requestHeaders, staged } = parsed;
+		try {
+			const response = model === void 0 ? await handleCodexImages(c, "edits", void 0, createStagedFormDataRequest(c.req.raw, requestHeaders, staged.formData)) : await routeImagesRequest(c, "edits", {
+				createRequest: (mappedModel) => createMultipartImagesRequest(c.req.raw, requestHeaders, staged.formData, mappedModel),
+				model
+			});
+			staged.scheduleCleanup();
+			return response;
+		} catch (error) {
+			await staged.cleanup();
+			throw error;
+		}
+	} catch (error) {
+		if (error instanceof InvalidMultipartBodyError || error instanceof MultipartBodyTooLargeError) return c.json({ error: {
+			message: error.message,
+			type: "invalid_request_error"
+		} }, error instanceof MultipartBodyTooLargeError ? 413 : 400);
+		logger$13.error("images.edits.error", { error });
+		return await forwardError(c, error);
+	}
+}
+//#endregion
+//#region src/routes/images/generations-handler.ts
+function createJsonImagesRequest(request, requestHeaders, payload, model) {
+	const headers = new Headers(requestHeaders);
+	headers.delete("content-length");
+	return createForwardRequest(request, headers, new TextEncoder().encode(JSON.stringify({
+		...payload,
+		model
+	})));
+}
+/**
+* Parses a generations request body as JSON. Generation payloads are small
+* JSON documents, so one byte copy covers both routing on the model field
+* and forwarding an unchanged body to Codex. Rebuilt bodies stay binary so
+* Node does not synthesize a text/plain content type.
+*/
+async function parseGenerationsRequest(request) {
+	const requestHeaders = snapshotRequestHeaders(request);
+	const body = new Uint8Array(await request.arrayBuffer());
+	const originalRequest = createForwardRequest(request, requestHeaders, body);
+	let payload;
+	try {
+		const bodyText = new TextDecoder("utf-8", { fatal: true }).decode(body);
+		payload = JSON.parse(bodyText);
+	} catch {
+		return originalRequest;
+	}
+	if (payload === null || typeof payload !== "object" || Array.isArray(payload) || typeof payload.model !== "string") return originalRequest;
+	return {
+		createRequest: (mappedModel) => createJsonImagesRequest(request, requestHeaders, payload, mappedModel),
+		model: payload.model,
+		originalRequest
+	};
+}
+async function handleImagesGenerations(c) {
+	try {
+		const parsed = await parseGenerationsRequest(c.req.raw);
+		if (parsed instanceof Request) return await handleCodexImages(c, "generations", void 0, parsed);
+		return await routeImagesRequest(c, "generations", parsed);
+	} catch (error) {
+		logger$13.error("images.generations.error", { error });
+		return await forwardError(c, error);
+	}
+}
+//#endregion
+//#region src/routes/images/route.ts
+const imageRoutes = new Hono();
+imageRoutes.post("/generations", handleImagesGenerations);
+imageRoutes.post("/edits", handleImagesEdits);
 //#endregion
 //#region src/lib/tokenizer.ts
 const ENCODING_MAP = {
@@ -10032,17 +10402,6 @@ function isDeepSeekModelId(modelId) {
 function shouldInjectMessagesToolCallTips(userAgent, targetModel) {
 	return isCodexUserAgent(userAgent) && !isDeepSeekModelId(targetModel);
 }
-async function logCodexModelsResponse(response) {
-	try {
-		const models = await response.clone().json();
-		debugJson(logger$8, "models.codex.response", {
-			statusCode: response.status,
-			models
-		});
-	} catch (error) {
-		logger$8.warn("models.codex.response_log_error", { error });
-	}
-}
 /**
 * Proxies a models request to the fixed Codex upstream models endpoint.
 * Returns a 404 JSON response when the codex provider is unavailable.
@@ -10054,9 +10413,7 @@ async function handleCodexModelsProxy(c, resolvedProviderConfig) {
 		message: "Provider 'codex' not found or disabled",
 		type: "invalid_request_error"
 	} }, 404);
-	const upstreamResponse = await forwardCodexModels(c.req.url, c.req.raw.headers);
-	await logCodexModelsResponse(upstreamResponse);
-	return createProviderProxyResponse(upstreamResponse);
+	return createProviderProxyResponse(await forwardCodexModels(c.req.url, c.req.raw.headers));
 }
 async function handleMergedCodexModels(c, candidatesRequest, options = {}) {
 	const [upstreamCatalog, candidates] = await Promise.all([tryGetCodexCatalog(c), Promise.resolve(candidatesRequest).catch((error) => {
@@ -10095,12 +10452,6 @@ async function handleMergedCodexModels(c, candidatesRequest, options = {}) {
 		...upstreamCatalog ?? {},
 		models
 	};
-	debugJson(logger$8, "models.codex.merged_response", {
-		upstreamCount: upstreamModels.length,
-		codexProviderAliasCount: codexProviderAliases.length,
-		syntheticCount: syntheticModels.length,
-		models: response
-	});
 	return c.json(response);
 }
 function createCatalogAlias(model, slug, providerName) {
@@ -10543,12 +10894,6 @@ providerAlphaSearchRoutes.post("/", async (c) => {
 //#region src/routes/provider/images/route.ts
 const logger$5 = createHandlerLogger("provider-images-handler");
 const providerImageRoutes = new Hono();
-function getContentMetadata(headers) {
-	return {
-		contentType: headers.get("content-type"),
-		contentLength: headers.get("content-length")
-	};
-}
 async function handleProviderImages(c, operation) {
 	const provider = c.req.param("provider") ?? "";
 	try {
@@ -10558,21 +10903,10 @@ async function handleProviderImages(c, operation) {
 			type: "invalid_request_error"
 		} }, 404);
 		if (providerConfig.name === "codex") return await handleCodexImages(c, operation, providerConfig);
-		if (operation === "generations") await debugJsonAsync(logger$5, "provider.images.generations.request", async () => ({
-			body: await c.req.raw.clone().text(),
-			provider
-		}));
-		else debugJson(logger$5, "provider.images.edits.request", {
-			...getContentMetadata(c.req.raw.headers),
+		return await forwardProviderImagesWithLogging(providerConfig, c.req.raw, operation, {
+			logger: logger$5,
 			provider
 		});
-		const upstreamResponse = await forwardProviderImages(providerConfig, c.req.raw, operation);
-		debugJson(logger$5, `provider.images.${operation}.response`, {
-			...getContentMetadata(upstreamResponse.headers),
-			provider,
-			statusCode: upstreamResponse.status
-		});
-		return createProviderProxyResponse(upstreamResponse);
 	} catch (error) {
 		logger$5.error(`provider.images.${operation}.error`, {
 			provider,
@@ -10636,6 +10970,58 @@ providerModelRoutes.get("/", async (c) => {
 	}
 });
 //#endregion
+//#region src/lib/zstd-request.ts
+const ZSTD_CONTENT_ENCODING = "zstd";
+const INVALID_BODY_STATUS = 400;
+let nodeZlibPromise = null;
+const zstdDecompressionMiddleware = async (c, next) => {
+	if (c.req.header("content-encoding")?.trim().toLowerCase() !== ZSTD_CONTENT_ENCODING) return next();
+	try {
+		const decompressedBody = await decompressZstd(new Uint8Array(await c.req.raw.arrayBuffer()));
+		const headers = new Headers(c.req.raw.headers);
+		headers.delete("content-encoding");
+		headers.delete("content-length");
+		c.req.raw = new Request(c.req.raw.url, {
+			body: decompressedBody,
+			headers,
+			method: c.req.raw.method,
+			signal: c.req.raw.signal
+		});
+		c.req.bodyCache = {};
+	} catch {
+		return c.json({ error: {
+			message: "Failed to decompress zstd request body.",
+			type: "invalid_request_error"
+		} }, INVALID_BODY_STATUS);
+	}
+	return next();
+};
+const decompressZstd = async (input) => {
+	const bun = getBunRuntime();
+	if (bun?.zstdDecompress) return toUint8Array(await bun.zstdDecompress(input));
+	const nodeZlib = await getNodeZlib();
+	if (nodeZlib?.zstdDecompress) return new Promise((resolve, reject) => {
+		nodeZlib.zstdDecompress?.(input, (error, result) => {
+			if (error) {
+				reject(error);
+				return;
+			}
+			resolve(toUint8Array(result));
+		});
+	});
+	return decompress(input);
+};
+const getBunRuntime = () => globalThis.Bun;
+const getNodeZlib = async () => {
+	nodeZlibPromise ??= import("node:zlib").then((module) => module).catch(() => null);
+	return nodeZlibPromise;
+};
+const toUint8Array = (data) => {
+	if (data instanceof Uint8Array) return data;
+	if (data instanceof ArrayBuffer) return new Uint8Array(data);
+	return new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+};
+//#endregion
 //#region src/routes/responses/custom-tool-input-stream-decoder.ts
 const CUSTOM_TOOL_INPUT_PREFIX_TOKENS = [
 	"{",
@@ -11675,6 +12061,7 @@ const getResponsesEvents = (response, signal) => createResponsesSafeStream(creat
 //#endregion
 //#region src/routes/provider/responses/route.ts
 const providerResponsesRoutes = new Hono();
+providerResponsesRoutes.use(zstdDecompressionMiddleware);
 providerResponsesRoutes.post("/", async (c) => {
 	try {
 		const provider = c.req.param("provider") ?? "";
@@ -11926,6 +12313,7 @@ const getTrimmedHeader = (c, name) => {
 //#endregion
 //#region src/routes/responses/route.ts
 const responsesRoutes = new Hono();
+responsesRoutes.use(zstdDecompressionMiddleware);
 responsesRoutes.post("/", async (c) => {
 	try {
 		return await handleResponses(c);
@@ -11989,56 +12377,70 @@ usageRoute.get("/", async (c) => {
 });
 //#endregion
 //#region src/server.ts
-const server = new Hono();
-server.use(traceIdMiddleware);
-server.use(logger());
-server.use(cors());
-server.use("*", createAuthMiddleware({
-	allowUnauthenticatedPaths: [
-		"/",
-		"/usage-viewer",
-		"/usage-viewer/"
-	],
-	shouldSkipPath: (path) => path.startsWith("/admin/")
-}));
-server.use("/admin/*", createAuthMiddleware({
-	getApiKeys: getConfiguredAdminApiKeys,
-	allowUnauthenticatedPaths: [],
-	allowWhenNoApiKeys: false
-}));
-server.use(zstdDecompressionMiddleware);
-server.get("/", (c) => c.text("Server running"));
-server.get("/usage-viewer", (c) => {
-	const usageViewerFileUrl = new URL("../pages/index.html", import.meta.url);
-	return c.html(readFileSync(usageViewerFileUrl, "utf8"));
-});
-server.get("/usage-viewer/", (c) => c.redirect("/usage-viewer", 301));
-server.route("/chat/completions", completionRoutes);
-server.route("/admin/config", configRoutes);
-server.route("/models", modelRoutes);
-server.route("/embeddings", embeddingRoutes);
-server.route("/usage", usageRoute);
-server.route("/token-usage", tokenUsageRoute);
-server.route("/responses", responsesRoutes);
-server.route("/alpha/search", alphaSearchRoutes);
-server.route("/images", imageRoutes);
-server.route("/v1/chat/completions", completionRoutes);
-server.route("/v1/models", modelRoutes);
-server.route("/v1/embeddings", embeddingRoutes);
-server.route("/v1/responses", responsesRoutes);
-server.route("/v1/alpha/search", alphaSearchRoutes);
-server.route("/v1/images", imageRoutes);
-server.route("/v1/messages", messageRoutes);
-server.route("/:provider/v1/messages", providerMessageRoutes);
-server.route("/:provider/v1/models", providerModelRoutes);
-server.route("/:provider/v1/responses", providerResponsesRoutes);
-server.route("/:provider/v1/alpha/search", providerAlphaSearchRoutes);
-server.route("/:provider/v1/images", providerImageRoutes);
-server.route("/:provider/models", providerModelRoutes);
-server.route("/:provider/responses", providerResponsesRoutes);
-server.route("/:provider/alpha/search", providerAlphaSearchRoutes);
-server.route("/:provider/images", providerImageRoutes);
+function resolveSameOriginCorsOrigin(origin, context) {
+	if (!origin) return null;
+	try {
+		return origin === new URL(context.req.url).origin ? origin : null;
+	} catch {
+		return null;
+	}
+}
+function createServer(options = {}) {
+	const server = new Hono();
+	const networkExposed = options.networkExposed ?? false;
+	server.use(traceIdMiddleware);
+	server.use(logger());
+	server.use(networkExposed ? cors({ origin: resolveSameOriginCorsOrigin }) : cors());
+	server.use("*", createAuthMiddleware({
+		getApiKeys: options.getApiKeys,
+		allowUnauthenticatedPaths: [
+			"/",
+			"/usage-viewer",
+			"/usage-viewer/"
+		],
+		shouldSkipPath: (path) => path.startsWith("/admin/"),
+		allowWhenNoApiKeys: !networkExposed
+	}));
+	server.use("/admin/*", createAuthMiddleware({
+		getApiKeys: getConfiguredAdminApiKeys,
+		allowUnauthenticatedPaths: [],
+		allowWhenNoApiKeys: false
+	}));
+	server.get("/", (c) => c.text("Server running"));
+	server.get("/usage-viewer", (c) => {
+		const usageViewerFileUrl = new URL("../pages/index.html", import.meta.url);
+		return c.html(readFileSync(usageViewerFileUrl, "utf8"));
+	});
+	server.get("/usage-viewer/", (c) => c.redirect("/usage-viewer", 301));
+	server.route("/chat/completions", completionRoutes);
+	server.route("/admin/config", configRoutes);
+	server.route("/models", modelRoutes);
+	server.route("/embeddings", embeddingRoutes);
+	server.route("/usage", usageRoute);
+	server.route("/token-usage", tokenUsageRoute);
+	server.route("/responses", responsesRoutes);
+	server.route("/alpha/search", alphaSearchRoutes);
+	server.route("/images", imageRoutes);
+	server.route("/v1/chat/completions", completionRoutes);
+	server.route("/v1/models", modelRoutes);
+	server.route("/v1/embeddings", embeddingRoutes);
+	server.route("/v1/responses", responsesRoutes);
+	server.route("/v1/alpha/search", alphaSearchRoutes);
+	server.route("/v1/images", imageRoutes);
+	server.route("/v1/messages", messageRoutes);
+	server.route("/:provider/v1/messages", providerMessageRoutes);
+	server.route("/:provider/v1/models", providerModelRoutes);
+	server.route("/:provider/v1/responses", providerResponsesRoutes);
+	server.route("/:provider/v1/alpha/search", providerAlphaSearchRoutes);
+	server.route("/:provider/v1/images", providerImageRoutes);
+	server.route("/:provider/models", providerModelRoutes);
+	server.route("/:provider/responses", providerResponsesRoutes);
+	server.route("/:provider/alpha/search", providerAlphaSearchRoutes);
+	server.route("/:provider/images", providerImageRoutes);
+	return server;
+}
+createServer();
 //#endregion
-export { server };
+export { createServer };
 
-//# sourceMappingURL=server-HBeQNO83.js.map
+//# sourceMappingURL=server-D5XuGc4z.js.map