@openclaw/gradium-speech 2026.7.1 → 2026.7.2-beta.2

package/dist/shared.js

@@ -1,5 +1,6 @@
 //#region extensions/gradium/shared.ts
 const DEFAULT_GRADIUM_BASE_URL = "https://api.gradium.ai";
+const GRADIUM_API_HOSTNAME = "api.gradium.ai";
 const DEFAULT_GRADIUM_VOICE_ID = "YTpq7expH9539ERJ";
 const GRADIUM_VOICES = [
 	{
@@ -32,7 +33,20 @@ const GRADIUM_VOICES = [
 	}
 ];
 function normalizeGradiumBaseUrl(baseUrl) {
-	return (baseUrl?.trim())?.replace(/\/+$/, "") || DEFAULT_GRADIUM_BASE_URL;
+	const raw = baseUrl?.trim() || DEFAULT_GRADIUM_BASE_URL;
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		throw new Error("Gradium baseUrl must be a valid https URL");
+	}
+	url.username = "";
+	url.password = "";
+	url.search = "";
+	url.hash = "";
+	if (url.protocol !== "https:") throw new Error("Gradium baseUrl must use https");
+	if (url.hostname.toLowerCase() !== "api.gradium.ai") throw new Error("Gradium baseUrl must target api.gradium.ai");
+	return url.toString().replace(/\/+$/, "");
 }
 //#endregion
-export { DEFAULT_GRADIUM_VOICE_ID, GRADIUM_VOICES, normalizeGradiumBaseUrl };
+export { DEFAULT_GRADIUM_VOICE_ID, GRADIUM_API_HOSTNAME, GRADIUM_VOICES, normalizeGradiumBaseUrl };

package/dist/speech-provider.js

@@ -2,6 +2,7 @@ import { GRADIUM_VOICES, normalizeGradiumBaseUrl } from "./shared.js";
 import { gradiumTTS } from "./tts.js";
 import { normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { asObject, trimToUndefined } from "openclaw/plugin-sdk/speech";
+import { resolveSpeechProviderApiKey } from "openclaw/plugin-sdk/speech-core";
 //#region extensions/gradium/speech-provider.ts
 const DEFAULT_GENERATED_AUDIO_MAX_BYTES = 16 * 1024 * 1024;
 function normalizeGradiumProviderConfig(rawConfig) {
@@ -23,6 +24,18 @@ function readGradiumProviderConfig(config) {
 		voiceId: trimToUndefined(config.voiceId) ?? defaults.voiceId
 	};
 }
+function resolveGradiumApiKey(configApiKey) {
+	return resolveSpeechProviderApiKey(trimToUndefined(configApiKey), process.env.GRADIUM_API_KEY);
+}
+function isGradiumProviderConfigured(config) {
+	if (!resolveGradiumApiKey(config.apiKey)) return false;
+	try {
+		normalizeGradiumBaseUrl(trimToUndefined(config.baseUrl));
+		return true;
+	} catch {
+		return false;
+	}
+}
 function resolveGeneratedAudioMaxBytes(req) {
 	const configured = req.cfg.agents?.defaults?.mediaMaxMb;
 	if (typeof configured === "number" && Number.isFinite(configured) && configured > 0) return Math.floor(configured * 1024 * 1024);
@@ -58,11 +71,11 @@ function buildGradiumSpeechProvider() {
 			id: v.id,
 			name: v.name
 		})),
-		isConfigured: ({ providerConfig }) => Boolean(readGradiumProviderConfig(providerConfig).apiKey || process.env.GRADIUM_API_KEY),
+		isConfigured: ({ providerConfig }) => isGradiumProviderConfigured(providerConfig),
 		synthesize: async (req) => {
 			const config = readGradiumProviderConfig(req.providerConfig);
 			const overrides = req.providerOverrides ?? {};
-			const apiKey = config.apiKey || process.env.GRADIUM_API_KEY;
+			const apiKey = resolveGradiumApiKey(config.apiKey);
 			if (!apiKey) throw new Error("Gradium API key missing");
 			const wantsVoiceNote = req.target === "voice-note";
 			const outputFormat = wantsVoiceNote ? "opus" : "wav";
@@ -84,7 +97,7 @@ function buildGradiumSpeechProvider() {
 		synthesizeTelephony: async (req) => {
 			const config = readGradiumProviderConfig(req.providerConfig);
 			const overrides = req.providerOverrides ?? {};
-			const apiKey = config.apiKey || process.env.GRADIUM_API_KEY;
+			const apiKey = resolveGradiumApiKey(config.apiKey);
 			if (!apiKey) throw new Error("Gradium API key missing");
 			const outputFormat = "ulaw_8000";
 			return {

package/dist/tts.js

@@ -1,4 +1,4 @@
-import { normalizeGradiumBaseUrl } from "./shared.js";
+import { GRADIUM_API_HOSTNAME, normalizeGradiumBaseUrl } from "./shared.js";
 import { assertOkOrThrowProviderError } from "openclaw/plugin-sdk/provider-http";
 import { readResponseWithLimit } from "openclaw/plugin-sdk/response-limit-runtime";
 import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
@@ -6,11 +6,8 @@ import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
 const DEFAULT_TTS_MAX_BYTES = 16 * 1024 * 1024;
 async function gradiumTTS(params) {
 	const { text, apiKey, baseUrl, voiceId, outputFormat, timeoutMs, maxBytes = DEFAULT_TTS_MAX_BYTES } = params;
-	const normalizedBaseUrl = normalizeGradiumBaseUrl(baseUrl);
-	const url = `${normalizedBaseUrl}/api/post/speech/tts`;
-	const hostname = new URL(normalizedBaseUrl).hostname;
 	const { response, release } = await fetchWithSsrFGuard({
-		url,
+		url: `${normalizeGradiumBaseUrl(baseUrl)}/api/post/speech/tts`,
 		init: {
 			method: "POST",
 			headers: {
@@ -26,7 +23,8 @@ async function gradiumTTS(params) {
 			})
 		},
 		timeoutMs,
-		policy: { hostnameAllowlist: [hostname] },
+		requireHttps: true,
+		policy: { hostnameAllowlist: [GRADIUM_API_HOSTNAME] },
 		auditContext: "gradium.tts"
 	});
 	try {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@openclaw/gradium-speech",
-  "version": "2026.7.1",
+  "version": "2026.7.2-beta.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/gradium-speech",
-      "version": "2026.7.1"
+      "version": "2026.7.2-beta.2"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/gradium-speech",
-  "version": "2026.7.1",
+  "version": "2026.7.2-beta.2",
   "description": "OpenClaw Gradium speech plugin.",
   "repository": {
     "type": "git",
@@ -18,10 +18,10 @@
       "minHostVersion": ">=2026.6.8"
     },
     "compat": {
-      "pluginApi": ">=2026.7.1"
+      "pluginApi": ">=2026.7.2-beta.2"
     },
     "build": {
-      "openclawVersion": "2026.7.1",
+      "openclawVersion": "2026.7.2-beta.2",
       "bundledDist": false
     },
     "release": {
@@ -39,7 +39,7 @@
     "README.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.7.1"
+    "openclaw": ">=2026.7.2-beta.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {