@juspay/neurolink 12.46.0 → 12.47.0

package/dist/providers/cloudflareClef.js

@@ -0,0 +1,331 @@
+import { CloudflareClefModels } from "../constants/enums.js";
+import { logger } from "../utils/logger.js";
+import { redactUrlForError } from "../utils/logSanitize.js";
+import { getProviderModel } from "../utils/providerConfig.js";
+import { isRecord, redactCredentials, SystemOneDecisionProvider, } from "./systemOneDecision.js";
+const CLOUDFLARE_DEFAULT_BASE_URL = "https://api.cloudflare.com/client/v4";
+const MODEL_PREFIX = "@cf/cloudflare/";
+/**
+ * Cloudflare account ids are 32 hex digits. The pattern is wider so that a
+ * change of format needs no release, but it still keeps `/`, `.`, `?` and
+ * whitespace out of the URL path the id is placed in.
+ */
+const ACCOUNT_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+/** The only image formats the API reads; anything else is a 422. */
+const SUPPORTED_IMAGE_TYPES = new Set([
+    "image/png",
+    "image/jpeg",
+    "image/webp",
+]);
+/**
+ * The uuid Workers AI appends to an `AiError` message, in parentheses. It starts
+ * at a literal `(`, with no leading `\s*`: that one backtracks quadratically on
+ * a long run of spaces, and the message is whatever the server sent.
+ */
+const TRAILING_REQUEST_ID = /\(([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\)\s*$/i;
+const MAX_ERROR_MESSAGE_CHARS = 500;
+/**
+ * An error message is cut to this before any pattern runs on it, so a hostile or
+ * garbled body cannot hold the event loop. Cloudflare's own messages are far
+ * shorter (the longest seen was about 350 characters).
+ */
+const MAX_PARSED_MESSAGE_CHARS = 4096;
+function normalizeBaseURL(raw) {
+    return raw.replace(/\/+$/, "");
+}
+/**
+ * A base URL that cannot work is refused up front, and its text is never
+ * repeated: `fetch` rejects a URL with userinfo and echoes it in the error, the
+ * route is appended after a query string or fragment, and any of them can hold
+ * a credential.
+ */
+function baseURLProblem(baseURL) {
+    const fix = `Set CLOUDFLARE_CLEF_BASE_URL or pass credentials.cloudflareClef.baseURL to a base URL, or leave both unset to use ${CLOUDFLARE_DEFAULT_BASE_URL}.`;
+    try {
+        const url = new URL(baseURL);
+        if (url.protocol !== "https:" && url.protocol !== "http:") {
+            return `The Cloudflare base URL must start with https:// or http://. ${fix}`;
+        }
+        // `url.search` and `url.hash` are empty for a bare trailing `?` or `#`, which
+        // would still put the route into the query or the fragment, so the text is
+        // checked as well.
+        return url.username ||
+            url.password ||
+            url.search ||
+            url.hash ||
+            /[?#]/.test(baseURL)
+            ? `The Cloudflare base URL must not carry credentials, a query string or a fragment. ${fix}`
+            : undefined;
+    }
+    catch {
+        return `The Cloudflare base URL is not a valid absolute URL. ${fix}`;
+    }
+}
+/**
+ * The name Cloudflare wants in the path and the body: `clef` or `clef-flash`,
+ * given either bare or as `@cf/cloudflare/clef`. Anything with a `/` in it is
+ * refused, so a model name cannot reach a different route.
+ */
+function wireModel(model) {
+    const bare = model.trim().replace(/^@cf\/cloudflare\//i, "");
+    return /^[a-z0-9][a-z0-9._-]*$/i.test(bare) ? bare.toLowerCase() : undefined;
+}
+/**
+ * Why this image cannot be sent, or undefined when it can. The data URL is
+ * never repeated: it is megabytes of base64. Size limits are left to the
+ * server, which refuses an oversized image at once with a clear 422.
+ */
+function imageProblem(dataUrl, position) {
+    const type = /^data:([a-z]+\/[a-z0-9.+-]+);base64,/i
+        .exec(dataUrl)?.[1]
+        ?.toLowerCase();
+    return type && SUPPORTED_IMAGE_TYPES.has(type)
+        ? undefined
+        : `Image ${position} is not a PNG, JPEG or WebP image, the only formats Cloudflare Clef reads.`;
+}
+/** The API takes a string or structured data as `state`; a number or a boolean is sent as its text. */
+function wireState(state) {
+    return typeof state === "number" || typeof state === "boolean"
+        ? String(state)
+        : state;
+}
+/**
+ * `{"success":false,"errors":[{"code","message"}],...}` is Cloudflare's own
+ * envelope. A model-side refusal nests a second one inside the message:
+ * `AiError: AiError: {"error":{"message","details":{"fieldErrors":{...}}}} (<uuid>)`.
+ * Both are flattened to one readable line, with the uuid taken out as the
+ * request id. A body that is not this envelope reads as undefined and the
+ * caller falls back to the status.
+ */
+function readCloudflareError(body) {
+    if (!isRecord(body) || !Array.isArray(body.errors)) {
+        return undefined;
+    }
+    const first = body.errors.find(isRecord);
+    if (!first || typeof first.message !== "string" || first.message === "") {
+        return undefined;
+    }
+    let text = first.message.slice(0, MAX_PARSED_MESSAGE_CHARS).trimEnd();
+    let requestId;
+    const trailing = TRAILING_REQUEST_ID.exec(text);
+    if (trailing) {
+        requestId = trailing[1];
+        text = text.slice(0, trailing.index).trimEnd();
+    }
+    text = text.replace(/^(?:AiError:\s*|Ai:\s*)+/, "").trim();
+    if (text.startsWith("{")) {
+        try {
+            const inner = JSON.parse(text);
+            if (isRecord(inner) && isRecord(inner.error)) {
+                const details = isRecord(inner.error.details)
+                    ? inner.error.details
+                    : undefined;
+                const fields = isRecord(details?.fieldErrors)
+                    ? Object.entries(details.fieldErrors).flatMap(([field, problems]) => Array.isArray(problems)
+                        ? problems
+                            .filter((p) => typeof p === "string")
+                            .map((p) => `${field}: ${p}`)
+                        : [])
+                    : [];
+                const head = typeof inner.error.message === "string" ? inner.error.message : text;
+                text = fields.length > 0 ? `${head}: ${fields.join("; ")}` : head;
+            }
+        }
+        catch {
+            // not JSON after all; keep the text as it is
+        }
+    }
+    return {
+        message: text,
+        code: typeof first.code === "number" ? first.code : undefined,
+        requestId,
+    };
+}
+/**
+ * Only 401 is `authentication`, and so only 401 trips the breaker: Cloudflare
+ * answered a token it does not know with a 401 and code 10000 (seen live). A 403
+ * was never seen, and no such token was available to provoke one; if Cloudflare
+ * uses it for a token that lacks Workers AI permission, that is fixed in the
+ * dashboard, and a breaker that latched on it would keep this instance disabled
+ * until the process restarted, even after the permission was granted. So a 403
+ * is a non-retried `invalid_request` that carries Cloudflare's own message. A
+ * request over the context window is a 413, code 5021, and a 429 is "Capacity
+ * temporarily exceeded" (code 3040, no Retry-After), which is retryable.
+ * Validation refusals are 422, and a malformed body or a wrong route is a 400;
+ * none of those is retried.
+ */
+function cloudflareErrorKind(status, code) {
+    if (status === 401) {
+        return "authentication";
+    }
+    if (status === 413 || code === 5021) {
+        return "max_tokens_exceeded";
+    }
+    if (status === 429) {
+        return "rate_limit";
+    }
+    if (status === 503) {
+        return "overloaded";
+    }
+    return status >= 500 ? "server" : "invalid_request";
+}
+/**
+ * Cloudflare Clef — the `decide` inference type only.
+ *
+ * `@cf/cloudflare/clef` (27B) and `@cf/cloudflare/clef-flash` (9B) answer the
+ * same typed `noul` / `choice` / `score` questions as the other decision
+ * providers, follow the System One wire, and read images. They are reached
+ * through the Workers AI REST API, which wraps every answer in Cloudflare's own
+ * `{ result, success, errors }` envelope and puts the model in the URL path.
+ *
+ * The token and account id are the ones the Cloudflare Workers AI text provider
+ * reads (`CLOUDFLARE_API_KEY`, `CLOUDFLARE_ACCOUNT_ID`), so a host that has
+ * configured that provider has also configured this one.
+ *
+ * The Workers AI endpoint ignores text past about 2,048 tokens, far below
+ * the documented 64K (hosted service or model: unknown). See `decisionLimits`
+ * on the descriptor for the measured figures.
+ *
+ * @see https://developers.cloudflare.com/workers-ai/models/clef/
+ */
+export class CloudflareClefProvider extends SystemOneDecisionProvider {
+    apiKey;
+    accountId;
+    baseURL;
+    constructor(modelName, sdk, _region, credentials) {
+        super(modelName, "cloudflare-clef", sdk);
+        // A slice that names its own base URL must bring its own token: the shared
+        // CLOUDFLARE_API_KEY also runs the host's Workers AI text provider, and it
+        // must never be sent as a bearer token to an endpoint a caller chose.
+        const ownEndpoint = Boolean(credentials?.baseURL?.trim());
+        this.apiKey =
+            credentials?.apiKey?.trim() ||
+                (ownEndpoint ? "" : (process.env.CLOUDFLARE_API_KEY?.trim() ?? ""));
+        this.accountId =
+            credentials?.accountId?.trim() ||
+                (process.env.CLOUDFLARE_ACCOUNT_ID?.trim() ?? "");
+        // `||`, not `??`, so a blank override counts as unset.
+        this.baseURL = normalizeBaseURL(credentials?.baseURL?.trim() ||
+            process.env.CLOUDFLARE_CLEF_BASE_URL?.trim() ||
+            CLOUDFLARE_DEFAULT_BASE_URL);
+        // A base URL that `baseURLProblem` refuses is not logged at all: it can
+        // carry `user:pass@` or a `?token=`.
+        logger.debug("Cloudflare Clef decision provider initialized (decide only)", {
+            modelName: this.modelName,
+            baseURL: baseURLProblem(this.baseURL)
+                ? "(invalid)"
+                : redactUrlForError(this.baseURL),
+            accountConfigured: this.accountId !== "",
+        });
+    }
+    getDefaultModel() {
+        return getProviderModel("CLOUDFLARE_CLEF_MODEL", CloudflareClefModels.CLEF);
+    }
+    vendorLabel() {
+        return "Cloudflare";
+    }
+    vendorDisplayName() {
+        return "Cloudflare Clef";
+    }
+    decisionApiKey() {
+        return this.apiKey;
+    }
+    missingKeyMessage() {
+        return "Cloudflare Clef requires an API token with Workers AI permission. Set CLOUDFLARE_API_KEY or pass credentials.cloudflareClef.apiKey.";
+    }
+    missingConfigMessage() {
+        if (this.accountId === "") {
+            return "Cloudflare Clef requires the account id. Set CLOUDFLARE_ACCOUNT_ID or pass credentials.cloudflareClef.accountId.";
+        }
+        if (!ACCOUNT_ID_PATTERN.test(this.accountId)) {
+            return "The Cloudflare account id may contain only letters, digits, '-' and '_'. Copy it from the Cloudflare dashboard.";
+        }
+        return baseURLProblem(this.baseURL);
+    }
+    /** The model is part of the path, so the endpoint depends on the model asked for. */
+    decisionEndpoint(model) {
+        return `${this.baseURL}/accounts/${encodeURIComponent(this.accountId)}/ai/run/${MODEL_PREFIX}${encodeURIComponent(wireModel(model) ?? model)}`;
+    }
+    decisionHeaders() {
+        return {
+            Authorization: `Bearer ${this.apiKey}`,
+            "Content-Type": "application/json",
+        };
+    }
+    /**
+     * Images travel in their own `images` array, as `data:` URLs, placed before
+     * the state by the server. `model` is sent although the path already names
+     * it: the API documents it as required, and refuses a body whose `model`
+     * differs from the path.
+     */
+    buildDecisionBody(state, questions, model, media) {
+        const wire = wireModel(model);
+        if (!wire) {
+            throw this.decisionError({
+                kind: "invalid_request",
+                message: `"${model.slice(0, 40)}" is not a Cloudflare model name. Use "clef" or "clef-flash".`,
+                retryable: false,
+            });
+        }
+        // Workers AI also accepts image/jpg; use the canonical JPEG MIME type.
+        const images = (media?.images ?? []).map((dataUrl) => dataUrl.replace(/^data:image\/jpg;base64,/i, "data:image/jpeg;base64,"));
+        images.forEach((dataUrl, index) => {
+            const problem = imageProblem(dataUrl, index + 1);
+            if (problem) {
+                throw this.decisionError({
+                    kind: "invalid_request",
+                    message: problem,
+                    retryable: false,
+                });
+            }
+        });
+        // The canonical JPEG prefix is one byte longer than image/jpg. Keep the
+        // prepared media metadata aligned with the URLs actually sent.
+        if (media) {
+            media.images = images;
+            media.bytes = images.reduce((total, image) => total + Buffer.byteLength(image), 0);
+        }
+        return {
+            model: wire,
+            state: wireState(state),
+            questions,
+            ...(images.length > 0 ? { images } : {}),
+        };
+    }
+    /** A success is `{ result: { model, answers, usage }, success: true }`. */
+    readDecisionPayload(payload) {
+        return isRecord(payload) && isRecord(payload.result)
+            ? payload.result
+            : payload;
+    }
+    parseDecisionError(status, payload, requestId) {
+        const fallback = `Cloudflare request failed with HTTP ${status}`;
+        const parsed = readCloudflareError(payload);
+        const kind = cloudflareErrorKind(status, parsed?.code);
+        let message = redactCredentials(parsed?.message ?? fallback, this.apiKey)
+            .trim()
+            .slice(0, MAX_ERROR_MESSAGE_CHARS) || fallback;
+        if (kind === "max_tokens_exceeded") {
+            message +=
+                " Cloudflare counts the whole request, image data included, at about four characters per token.";
+        }
+        else if (parsed?.code === 7000) {
+            message += `. Check the model name (Clef is served as "clef" and "clef-flash") and the base URL, which must end in /client/v4 and name your account.`;
+        }
+        return {
+            kind,
+            message,
+            status,
+            requestId: requestId ?? parsed?.requestId,
+            retryable: kind === "rate_limit" || kind === "overloaded" || kind === "server",
+        };
+    }
+    /**
+     * `cf-ai-req-id` is on every answer that reached the model, success or
+     * refusal. A 401 and a wrong-path 400 never reach it, so they carry only the
+     * edge's `cf-ray`.
+     */
+    readRequestId(headers) {
+        return headers.get("cf-ai-req-id") ?? headers.get("cf-ray") ?? undefined;
+    }
+}

package/dist/providers/ideogram.js

@@ -5,8 +5,8 @@ import { createProxyFetch } from "../proxy/proxyFetch.js";
 import { AuthenticationError, ProviderError, RateLimitError, } from "../types/index.js";
 import { logger } from "../utils/logger.js";
 import { createIdeogramConfig, getProviderModel, validateApiKey, } from "../utils/providerConfig.js";
-import { MAX_IMAGE_BYTES, readBoundedBuffer } from "../utils/sizeGuard.js";
-import { assertSafeUrl } from "../utils/ssrfGuard.js";
+import { MAX_IMAGE_BYTES } from "../utils/sizeGuard.js";
+import { safeDownload } from "../utils/safeFetch.js";
 const IDEOGRAM_DEFAULT_BASE_URL = "https://api.ideogram.ai";
 const REQUEST_TIMEOUT_MS = 120_000;
 const getIdeogramApiKey = () => validateApiKey(createIdeogramConfig());
@@ -134,34 +134,13 @@ export class IdeogramProvider extends BaseProvider {
         if (!url) {
             throw new Error("Ideogram returned no image URL");
         }
-        // Guard the API-returned URL before fetching (provider-returned URLs
-        // carry the same SSRF risk as caller-supplied ones) — matches Recraft's
-        // equivalent download path.
-        await assertSafeUrl(url);
-        // Download the image and convert to base64 to match the imageOutput
-        // contract used by other image-gen providers. Apply a 60s timeout so the
-        // download cannot hang indefinitely.
-        const dlController = new AbortController();
-        const dlTimeoutId = setTimeout(() => dlController.abort(), 60_000);
-        let dl;
-        try {
-            dl = await this.proxyFetch(url, { signal: dlController.signal });
-        }
-        catch (err) {
-            if (err instanceof Error && err.name === "AbortError") {
-                throw new Error("Ideogram image download timed out after 60s", {
-                    cause: err,
-                });
-            }
-            throw err;
-        }
-        finally {
-            clearTimeout(dlTimeoutId);
-        }
-        if (!dl.ok) {
-            throw new Error(`Failed to download Ideogram image: ${dl.status}`);
-        }
-        const buffer = await readBoundedBuffer(dl, MAX_IMAGE_BYTES, "Ideogram image");
+        // Resolve and validate once, dial only those addresses, and refuse
+        // redirects so a changing DNS answer cannot steer this download.
+        const buffer = await safeDownload(url, {
+            label: "Ideogram image",
+            maxBytes: MAX_IMAGE_BYTES,
+            timeoutMs: 60_000,
+        });
         const base64 = buffer.toString("base64");
         const generationTimeMs = Date.now() - startTime;
         logger.info(`[IdeogramProvider] Generated image (${buffer.length} bytes) in ${generationTimeMs}ms — model ${this.modelName}`);

package/dist/providers/llamaCpp.js

@@ -57,7 +57,8 @@ export class LlamaCppProvider extends OpenAIChatCompletionsProvider {
             buildLocalUnreachableErrorRule(error, () => `llama.cpp server not reachable at ${redactUrlCredentials(this.config.baseURL)}. ` +
                 "Start it with: ./llama-server -m model.gguf --port 8080"),
             {
-                match: (ctx) => /400/.test(ctx.message),
+                match: (ctx) => ctx.statusCode === 400 ||
+                    (ctx.statusCode === undefined && /\b400\b/.test(ctx.message)),
                 errorClass: ProviderError,
                 message: "llama.cpp rejected the request. Common cause: model doesn't support tools (start llama-server with --jinja for tool support).",
             },

package/dist/providers/openAI/client.js

@@ -12,7 +12,7 @@ import { assertSafeUrl } from "../../utils/ssrfGuard.js";
 import { createTimeoutController } from "../../utils/timeout.js";
 import { stripTrailingSlash } from "../openaiChatCompletionsClient.js";
 import { OpenAIChatCompletionsProvider } from "../openaiChatCompletionsBase.js";
-import { isOpenAIQuotaExhaustedError } from "../../utils/providerRetry.js";
+import { isOpenAIQuotaExhaustedError, readOpenAIBodyErrorType, } from "../../utils/providerRetry.js";
 const OPENAI_DEFAULT_BASE_URL = "https://api.openai.com/v1";
 /**
  * Resolve the effective OpenAI base URL from optional credential / env
@@ -91,13 +91,12 @@ export class OpenAIProvider extends OpenAIChatCompletionsProvider {
         return getOpenAIModel();
     }
     formatProviderError(error) {
-        // `type` isn't part of `ProviderErrorContext` (it's an OpenAI-specific
-        // error-body field), so it's read directly off the raw error here and
-        // captured by the rule closures below.
+        // Chat errors retain the JSON in responseBody; embedding errors stamp
+        // type onto the raw error. Keep both paths available to the rule closures.
         const errorObj = error;
         const errorType = errorObj?.type && typeof errorObj.type === "string"
             ? errorObj.type
-            : undefined;
+            : readOpenAIBodyErrorType(errorObj?.responseBody);
         const rules = [
             // Curator P1-1 / Reviewer Finding #4: only the explicit auth markers
             // map to AuthenticationError. Earlier we treated every

package/dist/providers/openaiChatCompletionsBase.js

@@ -1005,6 +1005,7 @@ export class OpenAIChatCompletionsProvider extends BaseProvider {
         // endpoint, the one it was written for, is a Tier-2 catalog provider on
         // this very base class, so without this the recovery would simply not
         // happen for it.
+        let promptSideFallbackRan = false;
         let loop;
         try {
             loop = await runLoop(conversation, responseFormat);
@@ -1018,6 +1019,8 @@ export class OpenAIChatCompletionsProvider extends BaseProvider {
                 throw error;
             }
             logger.warn(`[${this.providerName}] provider rejected response_format — retrying with the schema in the system prompt`, { provider: this.providerName, model: modelId });
+            // Re-asking after this fallback would bill the same request again.
+            promptSideFallbackRan = true;
             loop = await runLoop(appendJsonSchemaInstruction(conversation, responseFormat.schema), undefined);
         }
         // The vendor can also IGNORE `response_format` and answer in prose without
@@ -1027,7 +1030,8 @@ export class OpenAIChatCompletionsProvider extends BaseProvider {
         // above was reached; the native loop has no such parser, so the silent
         // case sailed through and handed the caller prose. Same recovery, keyed on
         // the result rather than on an exception.
-        if (responseFormat !== undefined &&
+        if (!promptSideFallbackRan &&
+            responseFormat !== undefined &&
             options.schema !== undefined &&
             !yieldsSchemaValidObject(loop.text, options.schema)) {
             logger.warn(`[${this.providerName}] response_format did not yield a schema-valid object — retrying with the schema in the system prompt`, { provider: this.providerName, model: modelId });
@@ -1821,12 +1825,10 @@ export class OpenAIChatCompletionsProvider extends BaseProvider {
                 // `loopPromise` is undefined when a middleware blocked the request
                 // before `doStream` ran, in which case there is no loop to surface.
                 await loopPromise;
-                // Record the terminal finish reason on the metadata object this
-                // provider returns by reference (`result.metadata`). A rejected
-                // `loopPromise` throws out of this `await` straight into the `catch`
-                // below, so reaching this line means `runStreamLoop` returned
-                // normally and already called `resolveFinish` with the wire value —
-                // `finishPromise` is settled, not pending.
+                // Native loops settle the finish promise before returning. A
+                // middleware can close its synthetic stream without calling doStream,
+                // leaving no loop to settle it. A promise settles once, so an explicit
+                // finish part already observed still wins.
                 //
                 // `rawFinishReason` is the verbatim vendor value (e.g. "stop",
                 // "length", "tool_calls", "content_filter") and is accurate the
@@ -1834,6 +1836,9 @@ export class OpenAIChatCompletionsProvider extends BaseProvider {
                 // post-stream work follows. The graded `finishReason` is set later,
                 // once that post-stream work (the structured-output re-ask below)
                 // has actually succeeded — see the assignment after that block.
+                if (!loopPromise) {
+                    resolveFinish("stop");
+                }
                 streamMetadata.rawFinishReason = await finishPromise;
                 // Structured output for a `stream({ schema })` turn. Runs HERE —
                 // after the stream is fully drained — so a tool-free re-ask (when the

package/dist/providers/openaiChatCompletionsClient.js

@@ -454,11 +454,23 @@ const SCHEMA_NODES = [
     "then",
     "else",
 ];
-// OpenAI's strict mode does not accept these composition keywords. A schema
+// OpenAI's strict mode does not accept these keywords. A schema
 // carrying one cannot be sent with `strict: true` at all, so it is not merely
 // "not yet normalised" — it must drop to non-strict, where the schema is
 // honoured as written.
-const STRICT_UNSUPPORTED = ["allOf", "not", "if", "then", "else"];
+const STRICT_UNSUPPORTED = [
+    "allOf",
+    "oneOf",
+    "not",
+    "if",
+    "then",
+    "else",
+    "dependentRequired",
+    "dependentSchemas",
+    "patternProperties",
+    "uniqueItems",
+    "prefixItems",
+];
 const mapValues = (obj, fn) => Object.fromEntries(Object.entries((obj ?? {})).map(([k, v]) => [
     k,
     fn(v),
@@ -500,7 +512,7 @@ const withClosedObjects = (node) => {
 /**
  * True when the schema can legally be sent with `strict: true`: every object
  * node lists all of its properties as required, every object is closed, and
- * no composition keyword OpenAI rejects appears anywhere.
+ * no unsupported keyword or tuple-valued items appears anywhere.
  *
  * Deliberately conservative — a false negative costs only the stronger
  * guarantee, while a false positive costs the whole request.
@@ -516,6 +528,10 @@ const satisfiesStrictRequired = (node) => {
     if (STRICT_UNSUPPORTED.some((k) => k in rec)) {
         return false;
     }
+    // Draft-07 tuples have an items array; strict mode accepts one items schema.
+    if (Array.isArray(rec.items)) {
+        return false;
+    }
     if (rec.type === "object") {
         if (rec.additionalProperties !== false) {
             return false;
@@ -532,6 +548,8 @@ const satisfiesStrictRequired = (node) => {
     const nodesOk = SCHEMA_NODES.filter((k) => k in rec).every((k) => satisfiesStrictRequired(rec[k]));
     return mapsOk && nodesOk;
 };
+const hasObjectRoot = (schema) => schema.type === "object" && !("anyOf" in schema) && !("oneOf" in schema);
+const isStrictLegal = (schema) => hasObjectRoot(schema) && satisfiesStrictRequired(schema);
 export const v3ResponseFormatToOpenAI = (rf) => {
     if (rf.type === "text") {
         return { type: "text" };
@@ -539,7 +557,7 @@ export const v3ResponseFormatToOpenAI = (rf) => {
     if (!rf.schema) {
         return { type: "json_object" };
     }
-    // Mutate as little as possible, in this order:
+    // Mutate as little as possible (root must be an object, without anyOf/oneOf):
     //
     //   1. already strict-legal  -> send it UNTOUCHED with strict: true
     //   2. legal once closed     -> send the closed copy with strict: true
@@ -559,9 +577,9 @@ export const v3ResponseFormatToOpenAI = (rf) => {
     // what it did before this change.
     const original = rf.schema;
     const closed = withClosedObjects(original);
-    const schema = satisfiesStrictRequired(original)
+    const schema = isStrictLegal(original)
         ? original
-        : satisfiesStrictRequired(closed)
+        : isStrictLegal(closed)
             ? closed
             : original;
     return {
@@ -570,7 +588,7 @@ export const v3ResponseFormatToOpenAI = (rf) => {
             name: rf.name ?? "response",
             schema: schema,
             ...(rf.description ? { description: rf.description } : {}),
-            strict: satisfiesStrictRequired(schema),
+            strict: isStrictLegal(schema),
         },
     };
 };

package/dist/providers/recraft.js

@@ -5,8 +5,8 @@ import { createProxyFetch } from "../proxy/proxyFetch.js";
 import { AuthenticationError, InvalidModelError, ProviderError, RateLimitError, } from "../types/index.js";
 import { logger } from "../utils/logger.js";
 import { createRecraftConfig, getProviderModel, validateApiKey, } from "../utils/providerConfig.js";
-import { MAX_IMAGE_BYTES, readBoundedBuffer } from "../utils/sizeGuard.js";
-import { assertSafeUrl } from "../utils/ssrfGuard.js";
+import { MAX_IMAGE_BYTES } from "../utils/sizeGuard.js";
+import { safeDownload } from "../utils/safeFetch.js";
 import { detectImageMimeType } from "../utils/imageDetection.js";
 const RECRAFT_DEFAULT_BASE_URL = "https://external.api.recraft.ai/v1";
 const REQUEST_TIMEOUT_MS = 120_000;
@@ -141,32 +141,13 @@ export class RecraftProvider extends BaseProvider {
             base64 = entry.b64_json;
         }
         else if (entry.url) {
-            // Guard the API-returned URL before fetching (provider-returned URLs
-            // carry the same SSRF risk as caller-supplied ones).
-            await assertSafeUrl(entry.url);
-            // Fallback URL download — apply a 60s timeout so it cannot hang indefinitely.
-            const dlController = new AbortController();
-            const dlTimeoutId = setTimeout(() => dlController.abort(), 60_000);
-            let dl;
-            try {
-                dl = await this.proxyFetch(entry.url, { signal: dlController.signal });
-            }
-            catch (err) {
-                if (err instanceof Error && err.name === "AbortError") {
-                    throw new Error("Recraft image download timed out after 60s", {
-                        cause: err,
-                    });
-                }
-                throw err;
-            }
-            finally {
-                clearTimeout(dlTimeoutId);
-            }
-            if (!dl.ok) {
-                throw new Error(`Failed to download Recraft image: ${dl.status}`);
-            }
-            const dlBuf = await readBoundedBuffer(dl, MAX_IMAGE_BYTES, "Recraft image");
-            base64 = dlBuf.toString("base64");
+            // See ideogram.ts: pin validated addresses and refuse redirects.
+            const buffer = await safeDownload(entry.url, {
+                label: "Recraft image",
+                maxBytes: MAX_IMAGE_BYTES,
+                timeoutMs: 60_000,
+            });
+            base64 = buffer.toString("base64");
         }
         else {
             throw new Error("Recraft response missing both b64_json and url");

package/dist/providers/systemOneDecision.d.ts

@@ -59,7 +59,11 @@ export declare abstract class SystemOneDecisionProvider extends BaseProvider {
      * nothing is missing.
      */
     protected missingConfigMessage(): string | undefined;
-    protected abstract decisionEndpoint(): string;
+    /**
+     * Where the request goes. The model asked for is passed in because one
+     * vendor names it in the URL path; every other provider ignores it.
+     */
+    protected abstract decisionEndpoint(model: string): string;
     protected abstract decisionHeaders(): Record<string, string>;
     protected abstract buildDecisionBody(state: DecisionState, questions: Record<string, Record<string, unknown>>, model: string, media?: DecisionPreparedMedia): Record<string, unknown>;
     protected abstract parseDecisionError(status: number, payload: unknown, requestId: string | undefined): DecisionError;
@@ -81,6 +85,13 @@ export declare abstract class SystemOneDecisionProvider extends BaseProvider {
      * grows with the number of questions scales the descriptor's allowance here.
      */
     protected defaultTimeoutMs(_questionCount: number): number | undefined;
+    /**
+     * The part of a successful response that holds `answers`, `usage` and
+     * `model`. The default is the response itself; a vendor that wraps every
+     * answer in an envelope returns what is inside it. Errors are not passed
+     * through here: they are read from the whole response.
+     */
+    protected readDecisionPayload(payload: unknown): unknown;
     /** Per-question confidence a transport reports outside the answer objects. */
     protected reportedConfidence(_payload: unknown): Record<string, number>;
     protected resolveResponseModel(payload: Record<string, unknown>, requestedModel: string): string;