@kolbo/mcp 1.0.0 → 1.2.0

package/README.md

@@ -2,7 +2,7 @@
 
 Use [Kolbo AI](https://kolbo.ai) as native tools in Claude Code and Claude Desktop via MCP (Model Context Protocol).
 
-Generate images, videos, music, speech, and sound effects — all from natural language in your coding environment.
+Generate images, videos, music, speech, sound effects, multi-scene campaigns, and conversational chat — all from natural language in your coding environment. 100+ AI models behind Smart Select routing, with reusable Visual DNA profiles for character/style consistency.
 
 ## Quick Setup
 
@@ -34,22 +34,70 @@ Just ask Claude naturally:
 
 - *"Generate an image of a sunset over mountains"*
 - *"Create a 5-second video of waves crashing"*
+- *"Build a 4-scene storyboard for a coffee shop ad"*
+- *"Remove the background from this image"*
 - *"Make a lo-fi hip hop beat"*
-- *"Convert this text to speech: Hello world"*
+- *"Read this out loud with a British female voice"*
+- *"Ask Claude about the latest AI news with web search on"*
+- *"Create a Visual DNA profile called 'Alex' from these images"*
 
-## Available Tools
+## Available Tools (30)
 
+**Generation**
 | Tool | Description |
 |------|-------------|
-| `generate_image` | Generate images from text prompts |
-| `generate_video` | Generate videos from text |
-| `generate_video_from_image` | Animate an image into video |
-| `generate_music` | Generate music from descriptions |
-| `generate_speech` | Convert text to speech |
-| `generate_sound` | Generate sound effects |
-| `list_models` | Browse available AI models |
+| `generate_image` | Text → image |
+| `generate_image_edit` | Existing image(s) + prompt → edited image |
+| `generate_video` | Text → video |
+| `generate_video_from_image` | Still image + motion prompt → video |
+| `generate_video_from_video` | Input video + prompt → restyled video (video-to-video) |
+| `generate_elements` | Reference images/videos + prompt → animated video |
+| `generate_first_last_frame` | First frame + last frame → interpolated video |
+| `generate_lipsync` | Source image/video + audio → lipsynced video |
+| `generate_creative_director` | One brief → N coordinated scenes (image or video) |
+| `generate_music` | Text (+ optional lyrics) → song |
+| `generate_speech` | Text + voice → spoken audio |
+| `generate_sound` | Text → sound effect |
+| `generate_3d` | Text or reference images → 3D model (GLB/FBX/OBJ/USDZ) |
+| `transcribe_audio` | Audio/video URL or file → text + SRT subtitles |
+
+Every image/video/creative-director tool accepts `visual_dna_ids` and `moodboard_id` for character/style consistency across outputs — you can compose `create_visual_dna` → `generate_image` (with the DNA applied server-side) in a single agent turn. `generate_creative_director` also accepts `moodboard_ids` plural for blending.
+
+**Chat**
+| Tool | Description |
+|------|-------------|
+| `chat_send_message` | Multi-turn chat with any Kolbo model; supports web search and deep think |
+| `chat_list_conversations` | List past chat threads |
+| `chat_get_messages` | Fetch messages in a conversation |
+
+**Visual DNA** (reusable character/style/product profiles)
+| Tool | Description |
+|------|-------------|
+| `create_visual_dna` | Create a profile from URLs or local files |
+| `list_visual_dnas` | List your profiles |
+| `get_visual_dna` | Fetch one profile |
+| `delete_visual_dna` | Delete a profile |
+
+**Moodboards**
+| Tool | Description |
+|------|-------------|
+| `list_moodboards` | Browse presets + your moodboards |
+| `get_moodboard` | Fetch one moodboard with all image URLs |
+
+**Media Library**
+| Tool | Description |
+|------|-------------|
+| `upload_media` | Upload a local file (or remote URL) → stable Kolbo CDN URL for reuse |
+| `list_media` | Browse your uploaded media with type filter and pagination |
+
+**Discovery & Account**
+| Tool | Description |
+|------|-------------|
+| `list_models` | Current model catalog with costs and capabilities |
+| `list_voices` | TTS voices (presets + cloned) |
+| `list_presets` | Generation presets across image/video/music/text-to-video catalogs |
 | `check_credits` | Check credit balance |
-| `get_generation_status` | Check a generation's status |
+| `get_generation_status` | Poll a generation by ID (fallback if a tool times out) |
 
 ## Environment Variables
 

package/package.json

@@ -1,13 +1,16 @@
 {
   "name": "@kolbo/mcp",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "Kolbo AI MCP Server - Generate images, videos, music, speech, and sound effects from Claude Code",
   "main": "src/index.js",
   "bin": {
     "kolbo-mcp": "./bin/kolbo-mcp.js"
   },
   "scripts": {
-    "start": "node src/index.js"
+    "start": "node src/index.js",
+    "smoke": "node scripts/smoke.js",
+    "check-parity": "node scripts/check-parity.js",
+    "prepublishOnly": "node scripts/smoke.js && node scripts/check-parity.js"
   },
   "keywords": [
     "kolbo",
@@ -24,9 +27,9 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/nicenathapong/kolbo-mcp"
+    "url": "https://github.com/Zoharvan12/kolbo-mcp"
   },
-  "homepage": "https://docs.kolbo.ai/developer-api/claude-code-mcp",
+  "homepage": "https://docs.kolbo.ai/developer-api/claude-code-skill",
   "author": "Kolbo AI <support@kolbo.ai>",
   "publishConfig": {
     "access": "public"
@@ -37,7 +40,13 @@
     "README.md"
   ],
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.12.1"
+    "@modelcontextprotocol/sdk": "^1.26.0",
+    "form-data": "^4.0.5"
+  },
+  "overrides": {
+    "hono": "^4.12.12",
+    "@hono/node-server": "^1.19.13",
+    "path-to-regexp": "^8.4.2"
   },
   "engines": {
     "node": ">=18.0.0"

package/src/client.js

@@ -1,6 +1,23 @@
 /**
  * Kolbo API HTTP client wrapper
  */
+
+/**
+ * Structured error thrown when the Kolbo API returns a non-OK response.
+ * Preserves the SDK's error code, HTTP status, and full response data so
+ * MCP tools (and the LLM consuming them) can distinguish NOT_FOUND from
+ * INSUFFICIENT_CREDITS from VALIDATION_ERROR etc.
+ */
+class KolboApiError extends Error {
+  constructor(message, { code, status, data } = {}) {
+    super(message);
+    this.name = 'KolboApiError';
+    this.code = code || null;
+    this.status = status || null;
+    this.data = data || null;
+  }
+}
+
 class KolboClient {
   constructor() {
     this.apiKey = process.env.KOLBO_API_KEY;
@@ -26,10 +43,27 @@ class KolboClient {
     }
 
     const response = await fetch(url, options);
-    const data = await response.json();
+    let data;
+    try {
+      data = await response.json();
+    } catch (_) {
+      // Non-JSON body (gateway error, HTML etc.)
+      throw new KolboApiError(`API error: ${response.status} ${response.statusText}`, {
+        status: response.status,
+        data: null
+      });
+    }
 
     if (!response.ok || data.success === false) {
-      throw new Error(data.error || data.message || `API error: ${response.status}`);
+      const message = data.error || data.message || `API error: ${response.status}`;
+      const code = data.code || null;
+      // Surface the code in the message so the LLM sees it even if it ignores the .code property
+      const fullMessage = code ? `${message} [${code}]` : message;
+      throw new KolboApiError(fullMessage, {
+        code,
+        status: response.status,
+        data
+      });
     }
 
     return data;
@@ -42,6 +76,55 @@ class KolboClient {
   async get(path) {
     return this.request('GET', path);
   }
+
+  async delete(path) {
+    return this.request('DELETE', path);
+  }
+
+  async postMultipart(path, formData) {
+    const url = `${this.baseUrl}${path}`;
+    const headers = {
+      'X-API-Key': this.apiKey,
+      ...formData.getHeaders()
+    };
+
+    // form-data exposes getLengthSync for known-size parts; set Content-Length when available.
+    try {
+      const len = formData.getLengthSync();
+      if (len) headers['Content-Length'] = String(len);
+    } catch (_) { /* streaming length unavailable — let fetch handle it */ }
+
+    const response = await fetch(url, {
+      method: 'POST',
+      headers,
+      body: formData,
+      duplex: 'half'
+    });
+
+    let data;
+    try {
+      data = await response.json();
+    } catch (_) {
+      throw new KolboApiError(`API error: ${response.status} ${response.statusText}`, {
+        status: response.status,
+        data: null
+      });
+    }
+
+    if (!response.ok || data.success === false) {
+      const message = data.error || data.message || `API error: ${response.status}`;
+      const code = data.code || null;
+      const fullMessage = code ? `${message} [${code}]` : message;
+      throw new KolboApiError(fullMessage, {
+        code,
+        status: response.status,
+        data
+      });
+    }
+
+    return data;
+  }
 }
 
 module.exports = KolboClient;
+module.exports.KolboApiError = KolboApiError;

package/src/index.js

@@ -1,8 +1,71 @@
+/* ============================================================================
+ * @kolbo/mcp — Kolbo AI MCP Server
+ *
+ *   ⛔  STOP.  READ THIS BEFORE TOUCHING ANY TOOL REGISTRATION.  ⛔
+ *
+ * This package is published to npm and installed via `npx -y @kolbo/mcp`.
+ * Thousands of users have it CACHED on their machines, pinned to old versions
+ * by npx's cache. Every tool name, every arg name, every response shape
+ * registered below is a PUBLIC CONTRACT. Breaking it silently strands users
+ * whose LLM will keep calling tool names their cached server no longer
+ * registers — or worse, calls new-style args that the old server can't parse.
+ *
+ * THE THREE COMMANDMENTS
+ *
+ *   1. NEVER RENAME AN EXISTING TOOL.
+ *      Not `generate_image` → `create_image`. Not `list_models` → `get_models`.
+ *      Not "just cleaning up the name." Old cached clients break the instant
+ *      you rename. If you must rename, keep the OLD name as an alias that
+ *      forwards to the new implementation for at least one full major version.
+ *
+ *   2. NEVER REMOVE AN EXISTING TOOL.
+ *      Deprecate it in the description ("[DEPRECATED: use X]") and keep it
+ *      working. Only remove in a major version bump with release notes.
+ *
+ *   3. NEVER CHANGE AN EXISTING TOOL'S ARG NAMES, TYPES, OR REQUIRED STATUS
+ *      IN A BACKWARD-INCOMPATIBLE WAY.
+ *      Adding a new OPTIONAL arg with a sensible default is fine. Everything
+ *      else below is forbidden in a minor release:
+ *        - renaming `prompt` to `text`
+ *        - making a previously-optional arg required
+ *        - changing `aspect_ratio: string` to `aspect_ratio: { w, h }`
+ *        - removing an arg (even one you think nobody uses)
+ *
+ * VERSION BUMPS
+ *
+ *   - minor (1.1.0 → 1.2.0): new tool, new optional arg, description tweak
+ *   - patch (1.1.0 → 1.1.1): internal refactor, bug fix with no user impact
+ *   - major (1.1.0 → 2.0.0): ANY breaking change from commandments 1–3 above,
+ *     AND only after going through the deprecation path in CLAUDE.md.
+ *
+ * WHY THIS MATTERS
+ *
+ *   Users install via `npx -y @kolbo/mcp` — npx CACHES packages. A user who
+ *   installed 3 months ago may still be running v1.0 until their cache
+ *   invalidates. When their Claude Desktop starts the MCP server, it
+ *   registers whatever tools ITS VERSION knows about. Their LLM sees that
+ *   list and calls those names. You cannot force-update them.
+ *
+ *   The matching backend SDK routes in
+ *   `kolbo-api/src/modules/sdk/index.js` are the same kind of public
+ *   contract and follow the same rules — never rename, never remove.
+ *
+ * Full rules, deprecation path, and parity-audit instructions: CLAUDE.md
+ *
+ * If you are a coding agent about to rename/remove a tool or arg: STOP and
+ * ask the human first. This is not optional.
+ * ==========================================================================*/
+
 const { McpServer } = require('@modelcontextprotocol/sdk/server/mcp.js');
 const { StdioServerTransport } = require('@modelcontextprotocol/sdk/server/stdio.js');
 const KolboClient = require('./client');
 const { registerGenerateTools } = require('./tools/generate');
 const { registerModelTools } = require('./tools/models');
+const { registerChatTools } = require('./tools/chat');
+const { registerVisualDnaTools } = require('./tools/visual_dna');
+const { registerMoodboardTools } = require('./tools/moodboards');
+const { registerMediaTools } = require('./tools/media');
+const { registerPresetTools } = require('./tools/presets');
 
 async function main() {
   const client = new KolboClient();
@@ -15,6 +78,11 @@ async function main() {
   // Register all tools
   registerGenerateTools(server, client);
   registerModelTools(server, client);
+  registerChatTools(server, client);
+  registerVisualDnaTools(server, client);
+  registerMoodboardTools(server, client);
+  registerMediaTools(server, client);
+  registerPresetTools(server, client);
 
   // Start the server with stdio transport
   const transport = new StdioServerTransport();

package/src/polling.js

@@ -1,31 +1,57 @@
 /**
  * Poll a generation until it reaches a terminal state
  */
+
+class PollingTimeoutError extends Error {
+  constructor(generationId, timeoutMs) {
+    const seconds = Math.round(timeoutMs / 1000);
+    super(
+      `Generation timed out after ${seconds}s of polling. The generation may STILL be running on the server — ` +
+      `call get_generation_status with generation_id="${generationId}" to check its current state. ` +
+      `Videos, deep-think chat, and large batches can take longer than the default polling window.`
+    );
+    this.name = 'PollingTimeoutError';
+    this.generationId = generationId;
+    this.timeoutMs = timeoutMs;
+    this.timedOut = true;
+  }
+}
+
+class GenerationFailedError extends Error {
+  constructor(generationId, reason) {
+    super(`Generation failed: ${reason || 'unknown error'} (generation_id="${generationId}")`);
+    this.name = 'GenerationFailedError';
+    this.generationId = generationId;
+  }
+}
+
 async function pollUntilDone(client, generationId, options = {}) {
   const {
     interval = 5000,
-    timeout = 300000 // 5 minutes default
+    timeout = 300000, // 5 minutes default
+    statusUrl
   } = options;
 
   const startTime = Date.now();
+  const url = statusUrl || `/v1/generate/${encodeURIComponent(generationId)}/status`;
 
   while (true) {
     if (Date.now() - startTime > timeout) {
-      throw new Error(`Generation ${generationId} timed out after ${timeout / 1000}s`);
+      throw new PollingTimeoutError(generationId, timeout);
     }
 
-    const result = await client.get(`/v1/generate/${generationId}/status`);
+    const result = await client.get(url);
 
     if (result.state === 'completed') {
       return result;
     }
 
     if (result.state === 'failed') {
-      throw new Error(result.error || 'Generation failed');
+      throw new GenerationFailedError(generationId, result.error);
     }
 
     if (result.state === 'cancelled') {
-      throw new Error('Generation was cancelled');
+      throw new GenerationFailedError(generationId, 'generation was cancelled');
     }
 
     // Wait before next poll
@@ -33,4 +59,4 @@ async function pollUntilDone(client, generationId, options = {}) {
   }
 }
 
-module.exports = { pollUntilDone };
+module.exports = { pollUntilDone, PollingTimeoutError, GenerationFailedError };

package/src/tools/_shared.js

@@ -0,0 +1,212 @@
+/* Shared helpers for MCP tools. No server.tool() registrations here.
+ *
+ * This file centralizes the URL-or-local-path → Buffer resolver used by
+ * every tool that accepts file-ish arguments (visual_dna, elements,
+ * first_last_frame, lipsync, video_from_video, transcription, media upload,
+ * future additions). It also owns the SSRF guard applied to any URL we
+ * fetch on the user's local machine.
+ *
+ * SSRF defense in depth:
+ *   1. Only http: / https: protocols.
+ *   2. Block IP literals in private / loopback / link-local / multicast /
+ *      reserved ranges (IPv4 and IPv6).
+ *   3. Block common internal hostnames (localhost, *.local, *.internal,
+ *      metadata.google.internal, metadata.goog).
+ *   4. Manual redirect following so every hop is re-validated (a crafted
+ *      public URL could 302 to 169.254.169.254 — global fetch would follow
+ *      silently).
+ *
+ * If you add a new tool that fetches URLs, import resolveToBuffer from here
+ * rather than reinventing the guard.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const net = require('net');
+
+const MAX_FILE_BYTES = 500 * 1024 * 1024; // 500 MB — larger than visual_dna because
+                                           // lipsync/v2v/transcription accept full
+                                           // videos and long audio tracks.
+const VISUAL_DNA_MAX_BYTES = 25 * 1024 * 1024; // kept for visual_dna backward-compat
+const MAX_REDIRECTS = 5;
+
+function isHttpUrl(s) {
+  return typeof s === 'string' && /^https?:\/\//i.test(s);
+}
+
+function isPrivateIPv4(ip) {
+  const parts = ip.split('.').map(Number);
+  if (parts.length !== 4 || parts.some(p => Number.isNaN(p) || p < 0 || p > 255)) return true;
+  const [a, b] = parts;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 0) return true;
+  if (a === 169 && b === 254) return true; // includes 169.254.169.254 cloud metadata
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 192 && b === 0 && parts[2] === 0) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a >= 224) return true;
+  return false;
+}
+
+function isPrivateIPv6(ip) {
+  const lower = ip.toLowerCase();
+  if (lower === '::' || lower === '::1') return true;
+  if (lower.startsWith('fe80:') || lower.startsWith('fe8') ||
+      lower.startsWith('fe9') || lower.startsWith('fea') ||
+      lower.startsWith('feb')) return true;
+  if (lower.startsWith('fc') || lower.startsWith('fd')) return true;
+  if (lower.startsWith('ff')) return true;
+  // IPv4-mapped / compat in dotted form: ::ffff:1.2.3.4 or ::1.2.3.4
+  const mappedDot = lower.match(/^::(?:ffff:)?(\d+\.\d+\.\d+\.\d+)$/);
+  if (mappedDot) return isPrivateIPv4(mappedDot[1]);
+  // IPv4-mapped in pure hex form: ::ffff:7f00:1 (Node normalizes
+  // ::ffff:127.0.0.1 → ::ffff:7f00:1). Extract last 2 hextets → 4 bytes.
+  const mappedHex = lower.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+  if (mappedHex) {
+    const hi = parseInt(mappedHex[1], 16);
+    const lo = parseInt(mappedHex[2], 16);
+    const dotted = `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
+    return isPrivateIPv4(dotted);
+  }
+  return false;
+}
+
+function isBlockedHostname(hostname) {
+  // new URL('http://[::1]/').hostname returns "[::1]" (brackets kept).
+  // Strip them so net.isIP and our private-range checks see the bare address.
+  let host = hostname.toLowerCase();
+  if (host.startsWith('[') && host.endsWith(']')) host = host.slice(1, -1);
+  const blockedNames = new Set([
+    'localhost',
+    'ip6-localhost',
+    'ip6-loopback',
+    'metadata.google.internal',
+    'metadata.goog'
+  ]);
+  if (blockedNames.has(host)) return true;
+  if (host.endsWith('.local') || host.endsWith('.internal') || host.endsWith('.localhost')) return true;
+  const ipFamily = net.isIP(host);
+  if (ipFamily === 4 && isPrivateIPv4(host)) return true;
+  if (ipFamily === 6 && isPrivateIPv6(host)) return true;
+  return false;
+}
+
+function assertSafeUrl(rawUrl) {
+  let u;
+  try { u = new URL(rawUrl); }
+  catch (_) { throw new Error(`Invalid URL: ${rawUrl}`); }
+  if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+    throw new Error(`Unsupported URL protocol "${u.protocol}" — only http/https allowed`);
+  }
+  if (isBlockedHostname(u.hostname)) {
+    throw new Error(`Refusing to fetch from private / loopback / metadata host: ${u.hostname}`);
+  }
+  return u;
+}
+
+async function safeFetch(rawUrl) {
+  let current = rawUrl;
+  for (let i = 0; i <= MAX_REDIRECTS; i++) {
+    assertSafeUrl(current);
+    const res = await fetch(current, { redirect: 'manual' });
+    if (res.status >= 300 && res.status < 400 && res.headers.get('location')) {
+      const next = new URL(res.headers.get('location'), current).toString();
+      current = next;
+      continue;
+    }
+    return res;
+  }
+  throw new Error(`Too many redirects fetching ${rawUrl}`);
+}
+
+function guessFilename(source, fallbackExt) {
+  if (isHttpUrl(source)) {
+    try {
+      const u = new URL(source);
+      const base = path.basename(u.pathname) || `upload${fallbackExt}`;
+      return base.includes('.') ? base : `${base}${fallbackExt}`;
+    } catch (_) {
+      return `upload${fallbackExt}`;
+    }
+  }
+  return path.basename(source);
+}
+
+function guessContentType(filename) {
+  const ext = path.extname(filename).toLowerCase();
+  const map = {
+    '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.png': 'image/png',
+    '.webp': 'image/webp', '.gif': 'image/gif', '.bmp': 'image/bmp',
+    '.mp4': 'video/mp4', '.mov': 'video/quicktime', '.webm': 'video/webm',
+    '.mkv': 'video/x-matroska', '.avi': 'video/x-msvideo',
+    '.mp3': 'audio/mpeg', '.wav': 'audio/wav', '.ogg': 'audio/ogg',
+    '.m4a': 'audio/mp4', '.flac': 'audio/flac', '.aac': 'audio/aac'
+  };
+  return map[ext] || 'application/octet-stream';
+}
+
+/**
+ * Resolve a URL or absolute local path into an in-memory Buffer.
+ *   - URLs: fetched via safeFetch (SSRF-guarded, manual redirect handling)
+ *   - Local paths: read via fs.readFileSync (must be absolute)
+ *
+ * @param {string} source - URL or absolute local path
+ * @param {'image'|'video'|'audio'} kind - hint for default filename extension
+ * @param {Object} [opts]
+ * @param {number} [opts.maxBytes] - override the default size cap
+ * @returns {Promise<{buffer: Buffer, filename: string, contentType: string, size: number}>}
+ */
+async function resolveToBuffer(source, kind, opts = {}) {
+  const maxBytes = opts.maxBytes || MAX_FILE_BYTES;
+  const defaultExt = kind === 'image' ? '.png' : kind === 'video' ? '.mp4' : '.mp3';
+
+  if (isHttpUrl(source)) {
+    const res = await safeFetch(source);
+    if (!res.ok) throw new Error(`Failed to fetch ${source}: ${res.status} ${res.statusText}`);
+    const contentLen = parseInt(res.headers.get('content-length') || '0', 10);
+    if (contentLen && contentLen > maxBytes) {
+      throw new Error(`File at ${source} (${contentLen} bytes) exceeds ${maxBytes}-byte limit`);
+    }
+    const arrayBuf = await res.arrayBuffer();
+    const buffer = Buffer.from(arrayBuf);
+    if (buffer.length > maxBytes) {
+      throw new Error(`File at ${source} (${buffer.length} bytes) exceeds ${maxBytes}-byte limit`);
+    }
+    const filename = guessFilename(source, defaultExt);
+    return {
+      buffer,
+      filename,
+      contentType: res.headers.get('content-type') || guessContentType(filename),
+      size: buffer.length
+    };
+  }
+
+  if (!path.isAbsolute(source)) {
+    throw new Error(`Local file paths must be absolute: ${source}`);
+  }
+  const stat = fs.statSync(source);
+  if (stat.size > maxBytes) {
+    throw new Error(`File ${source} (${stat.size} bytes) exceeds ${maxBytes}-byte limit`);
+  }
+  const buffer = fs.readFileSync(source);
+  const filename = path.basename(source);
+  return {
+    buffer,
+    filename,
+    contentType: guessContentType(filename),
+    size: buffer.length
+  };
+}
+
+module.exports = {
+  MAX_FILE_BYTES,
+  VISUAL_DNA_MAX_BYTES,
+  isHttpUrl,
+  assertSafeUrl,
+  safeFetch,
+  guessFilename,
+  guessContentType,
+  resolveToBuffer
+};