@openclaw/gradium-speech 2026.7.1 → 2026.7.2-beta.1

package/dist/shared.js

@@ -1,5 +1,6 @@
 //#region extensions/gradium/shared.ts
 const DEFAULT_GRADIUM_BASE_URL = "https://api.gradium.ai";
+const GRADIUM_API_HOSTNAME = "api.gradium.ai";
 const DEFAULT_GRADIUM_VOICE_ID = "YTpq7expH9539ERJ";
 const GRADIUM_VOICES = [
 	{
@@ -32,7 +33,20 @@ const GRADIUM_VOICES = [
 	}
 ];
 function normalizeGradiumBaseUrl(baseUrl) {
-	return (baseUrl?.trim())?.replace(/\/+$/, "") || DEFAULT_GRADIUM_BASE_URL;
+	const raw = baseUrl?.trim() || DEFAULT_GRADIUM_BASE_URL;
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		throw new Error("Gradium baseUrl must be a valid https URL");
+	}
+	url.username = "";
+	url.password = "";
+	url.search = "";
+	url.hash = "";
+	if (url.protocol !== "https:") throw new Error("Gradium baseUrl must use https");
+	if (url.hostname.toLowerCase() !== "api.gradium.ai") throw new Error("Gradium baseUrl must target api.gradium.ai");
+	return url.toString().replace(/\/+$/, "");
 }
 //#endregion
-export { DEFAULT_GRADIUM_VOICE_ID, GRADIUM_VOICES, normalizeGradiumBaseUrl };
+export { DEFAULT_GRADIUM_VOICE_ID, GRADIUM_API_HOSTNAME, GRADIUM_VOICES, normalizeGradiumBaseUrl };

package/dist/tts.js

@@ -1,4 +1,4 @@
-import { normalizeGradiumBaseUrl } from "./shared.js";
+import { GRADIUM_API_HOSTNAME, normalizeGradiumBaseUrl } from "./shared.js";
 import { assertOkOrThrowProviderError } from "openclaw/plugin-sdk/provider-http";
 import { readResponseWithLimit } from "openclaw/plugin-sdk/response-limit-runtime";
 import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
@@ -6,11 +6,8 @@ import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
 const DEFAULT_TTS_MAX_BYTES = 16 * 1024 * 1024;
 async function gradiumTTS(params) {
 	const { text, apiKey, baseUrl, voiceId, outputFormat, timeoutMs, maxBytes = DEFAULT_TTS_MAX_BYTES } = params;
-	const normalizedBaseUrl = normalizeGradiumBaseUrl(baseUrl);
-	const url = `${normalizedBaseUrl}/api/post/speech/tts`;
-	const hostname = new URL(normalizedBaseUrl).hostname;
 	const { response, release } = await fetchWithSsrFGuard({
-		url,
+		url: `${normalizeGradiumBaseUrl(baseUrl)}/api/post/speech/tts`,
 		init: {
 			method: "POST",
 			headers: {
@@ -26,7 +23,8 @@ async function gradiumTTS(params) {
 			})
 		},
 		timeoutMs,
-		policy: { hostnameAllowlist: [hostname] },
+		requireHttps: true,
+		policy: { hostnameAllowlist: [GRADIUM_API_HOSTNAME] },
 		auditContext: "gradium.tts"
 	});
 	try {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@openclaw/gradium-speech",
-  "version": "2026.7.1",
+  "version": "2026.7.2-beta.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/gradium-speech",
-      "version": "2026.7.1"
+      "version": "2026.7.2-beta.1"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/gradium-speech",
-  "version": "2026.7.1",
+  "version": "2026.7.2-beta.1",
   "description": "OpenClaw Gradium speech plugin.",
   "repository": {
     "type": "git",
@@ -18,10 +18,10 @@
       "minHostVersion": ">=2026.6.8"
     },
     "compat": {
-      "pluginApi": ">=2026.7.1"
+      "pluginApi": ">=2026.7.2-beta.1"
     },
     "build": {
-      "openclawVersion": "2026.7.1",
+      "openclawVersion": "2026.7.2-beta.1",
       "bundledDist": false
     },
     "release": {
@@ -39,7 +39,7 @@
     "README.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.7.1"
+    "openclaw": ">=2026.7.2-beta.1"
   },
   "peerDependenciesMeta": {
     "openclaw": {