@poolzin/pool-bot 2026.1.39 → 2026.2.1

package/dist/media-understanding/apply.js

@@ -1,9 +1,390 @@
+import path from "node:path";
 import { finalizeInboundContext } from "../auto-reply/reply/inbound-context.js";
-import { extractMediaUserText, formatAudioTranscripts, formatMediaUnderstandingBody, } from "./format.js";
+import { logVerbose, shouldLogVerbose } from "../globals.js";
+import { DEFAULT_INPUT_FILE_MAX_BYTES, DEFAULT_INPUT_FILE_MAX_CHARS, DEFAULT_INPUT_FILE_MIMES, DEFAULT_INPUT_MAX_REDIRECTS, DEFAULT_INPUT_PDF_MAX_PAGES, DEFAULT_INPUT_PDF_MAX_PIXELS, DEFAULT_INPUT_PDF_MIN_TEXT_CHARS, DEFAULT_INPUT_TIMEOUT_MS, extractFileContentFromSource, normalizeMimeList, normalizeMimeType, } from "../media/input-files.js";
+import { resolveAttachmentKind } from "./attachments.js";
 import { runWithConcurrency } from "./concurrency.js";
+import { extractMediaUserText, formatAudioTranscripts, formatMediaUnderstandingBody, } from "./format.js";
 import { resolveConcurrency } from "./resolve.js";
 import { buildProviderRegistry, createMediaAttachmentCache, normalizeMediaAttachments, runCapability, } from "./runner.js";
 const CAPABILITY_ORDER = ["image", "audio", "video"];
+const EXTRA_TEXT_MIMES = [
+    "application/xml",
+    "text/xml",
+    "application/x-yaml",
+    "text/yaml",
+    "application/yaml",
+    "application/javascript",
+    "text/javascript",
+    "text/tab-separated-values",
+];
+const TEXT_EXT_MIME = new Map([
+    [".csv", "text/csv"],
+    [".tsv", "text/tab-separated-values"],
+    [".txt", "text/plain"],
+    [".md", "text/markdown"],
+    [".log", "text/plain"],
+    [".ini", "text/plain"],
+    [".cfg", "text/plain"],
+    [".conf", "text/plain"],
+    [".env", "text/plain"],
+    [".json", "application/json"],
+    [".yaml", "text/yaml"],
+    [".yml", "text/yaml"],
+    [".xml", "application/xml"],
+]);
+const XML_ESCAPE_MAP = {
+    "<": "&lt;",
+    ">": "&gt;",
+    "&": "&amp;",
+    '"': "&quot;",
+    "'": "&apos;",
+};
+/**
+ * Escapes special XML characters in attribute values to prevent injection.
+ */
+function xmlEscapeAttr(value) {
+    return value.replace(/[<>&"']/g, (char) => XML_ESCAPE_MAP[char] ?? char);
+}
+function escapeFileBlockContent(value) {
+    return value.replace(/<\s*\/\s*file\s*>/gi, "&lt;/file&gt;").replace(/<\s*file\b/gi, "&lt;file");
+}
+function sanitizeMimeType(value) {
+    if (!value) {
+        return undefined;
+    }
+    const trimmed = value.trim().toLowerCase();
+    if (!trimmed) {
+        return undefined;
+    }
+    const match = trimmed.match(/^([a-z0-9!#$&^_.+-]+\/[a-z0-9!#$&^_.+-]+)/);
+    return match?.[1];
+}
+function resolveFileLimits(cfg) {
+    const files = cfg.gateway?.http?.endpoints?.responses?.files;
+    const allowedMimesConfigured = Boolean(files?.allowedMimes && files.allowedMimes.length > 0);
+    return {
+        allowUrl: files?.allowUrl ?? true,
+        allowedMimes: normalizeMimeList(files?.allowedMimes, DEFAULT_INPUT_FILE_MIMES),
+        allowedMimesConfigured,
+        maxBytes: files?.maxBytes ?? DEFAULT_INPUT_FILE_MAX_BYTES,
+        maxChars: files?.maxChars ?? DEFAULT_INPUT_FILE_MAX_CHARS,
+        maxRedirects: files?.maxRedirects ?? DEFAULT_INPUT_MAX_REDIRECTS,
+        timeoutMs: files?.timeoutMs ?? DEFAULT_INPUT_TIMEOUT_MS,
+        pdf: {
+            maxPages: files?.pdf?.maxPages ?? DEFAULT_INPUT_PDF_MAX_PAGES,
+            maxPixels: files?.pdf?.maxPixels ?? DEFAULT_INPUT_PDF_MAX_PIXELS,
+            minTextChars: files?.pdf?.minTextChars ?? DEFAULT_INPUT_PDF_MIN_TEXT_CHARS,
+        },
+    };
+}
+function appendFileBlocks(body, blocks) {
+    if (!blocks || blocks.length === 0) {
+        return body ?? "";
+    }
+    const base = typeof body === "string" ? body.trim() : "";
+    const suffix = blocks.join("\n\n").trim();
+    if (!base) {
+        return suffix;
+    }
+    return `${base}\n\n${suffix}`.trim();
+}
+function resolveUtf16Charset(buffer) {
+    if (!buffer || buffer.length < 2) {
+        return undefined;
+    }
+    const b0 = buffer[0];
+    const b1 = buffer[1];
+    if (b0 === 0xff && b1 === 0xfe) {
+        return "utf-16le";
+    }
+    if (b0 === 0xfe && b1 === 0xff) {
+        return "utf-16be";
+    }
+    const sampleLen = Math.min(buffer.length, 2048);
+    let zeroEven = 0;
+    let zeroOdd = 0;
+    for (let i = 0; i < sampleLen; i += 1) {
+        if (buffer[i] !== 0) {
+            continue;
+        }
+        if (i % 2 === 0) {
+            zeroEven += 1;
+        }
+        else {
+            zeroOdd += 1;
+        }
+    }
+    const zeroCount = zeroEven + zeroOdd;
+    if (zeroCount / sampleLen > 0.2) {
+        return zeroOdd >= zeroEven ? "utf-16le" : "utf-16be";
+    }
+    return undefined;
+}
+const WORDISH_CHAR = /[\p{L}\p{N}]/u;
+const CP1252_MAP = [
+    "\u20ac",
+    undefined,
+    "\u201a",
+    "\u0192",
+    "\u201e",
+    "\u2026",
+    "\u2020",
+    "\u2021",
+    "\u02c6",
+    "\u2030",
+    "\u0160",
+    "\u2039",
+    "\u0152",
+    undefined,
+    "\u017d",
+    undefined,
+    undefined,
+    "\u2018",
+    "\u2019",
+    "\u201c",
+    "\u201d",
+    "\u2022",
+    "\u2013",
+    "\u2014",
+    "\u02dc",
+    "\u2122",
+    "\u0161",
+    "\u203a",
+    "\u0153",
+    undefined,
+    "\u017e",
+    "\u0178",
+];
+function decodeLegacyText(buffer) {
+    let output = "";
+    for (const byte of buffer) {
+        if (byte >= 0x80 && byte <= 0x9f) {
+            const mapped = CP1252_MAP[byte - 0x80];
+            output += mapped ?? String.fromCharCode(byte);
+            continue;
+        }
+        output += String.fromCharCode(byte);
+    }
+    return output;
+}
+function getTextStats(text) {
+    if (!text) {
+        return { printableRatio: 0, wordishRatio: 0 };
+    }
+    let printable = 0;
+    let control = 0;
+    let wordish = 0;
+    for (const char of text) {
+        const code = char.codePointAt(0) ?? 0;
+        if (code === 9 || code === 10 || code === 13 || code === 32) {
+            printable += 1;
+            wordish += 1;
+            continue;
+        }
+        if (code < 32 || (code >= 0x7f && code <= 0x9f)) {
+            control += 1;
+            continue;
+        }
+        printable += 1;
+        if (WORDISH_CHAR.test(char)) {
+            wordish += 1;
+        }
+    }
+    const total = printable + control;
+    if (total === 0) {
+        return { printableRatio: 0, wordishRatio: 0 };
+    }
+    return { printableRatio: printable / total, wordishRatio: wordish / total };
+}
+function isMostlyPrintable(text) {
+    return getTextStats(text).printableRatio > 0.85;
+}
+function looksLikeLegacyTextBytes(buffer) {
+    if (buffer.length === 0) {
+        return false;
+    }
+    const text = decodeLegacyText(buffer);
+    const { printableRatio, wordishRatio } = getTextStats(text);
+    return printableRatio > 0.95 && wordishRatio > 0.3;
+}
+function looksLikeUtf8Text(buffer) {
+    if (!buffer || buffer.length === 0) {
+        return false;
+    }
+    const sample = buffer.subarray(0, Math.min(buffer.length, 4096));
+    try {
+        const text = new TextDecoder("utf-8", { fatal: true }).decode(sample);
+        return isMostlyPrintable(text);
+    }
+    catch {
+        return looksLikeLegacyTextBytes(sample);
+    }
+}
+function decodeTextSample(buffer) {
+    if (!buffer || buffer.length === 0) {
+        return "";
+    }
+    const sample = buffer.subarray(0, Math.min(buffer.length, 8192));
+    const utf16Charset = resolveUtf16Charset(sample);
+    if (utf16Charset === "utf-16be") {
+        const swapped = Buffer.alloc(sample.length);
+        for (let i = 0; i + 1 < sample.length; i += 2) {
+            swapped[i] = sample[i + 1];
+            swapped[i + 1] = sample[i];
+        }
+        return new TextDecoder("utf-16le").decode(swapped);
+    }
+    if (utf16Charset === "utf-16le") {
+        return new TextDecoder("utf-16le").decode(sample);
+    }
+    return new TextDecoder("utf-8").decode(sample);
+}
+function guessDelimitedMime(text) {
+    if (!text) {
+        return undefined;
+    }
+    const line = text.split(/\r?\n/)[0] ?? "";
+    const tabs = (line.match(/\t/g) ?? []).length;
+    const commas = (line.match(/,/g) ?? []).length;
+    if (commas > 0) {
+        return "text/csv";
+    }
+    if (tabs > 0) {
+        return "text/tab-separated-values";
+    }
+    return undefined;
+}
+function resolveTextMimeFromName(name) {
+    if (!name) {
+        return undefined;
+    }
+    const ext = path.extname(name).toLowerCase();
+    return TEXT_EXT_MIME.get(ext);
+}
+function isBinaryMediaMime(mime) {
+    if (!mime) {
+        return false;
+    }
+    return mime.startsWith("image/") || mime.startsWith("audio/") || mime.startsWith("video/");
+}
+async function extractFileBlocks(params) {
+    const { attachments, cache, limits, skipAttachmentIndexes } = params;
+    if (!attachments || attachments.length === 0) {
+        return [];
+    }
+    const blocks = [];
+    for (const attachment of attachments) {
+        if (!attachment) {
+            continue;
+        }
+        if (skipAttachmentIndexes?.has(attachment.index)) {
+            continue;
+        }
+        const forcedTextMime = resolveTextMimeFromName(attachment.path ?? attachment.url ?? "");
+        const kind = forcedTextMime ? "document" : resolveAttachmentKind(attachment);
+        if (!forcedTextMime && (kind === "image" || kind === "video" || kind === "audio")) {
+            continue;
+        }
+        if (!limits.allowUrl && attachment.url && !attachment.path) {
+            if (shouldLogVerbose()) {
+                logVerbose(`media: file attachment skipped (url disabled) index=${attachment.index}`);
+            }
+            continue;
+        }
+        let bufferResult;
+        try {
+            bufferResult = await cache.getBuffer({
+                attachmentIndex: attachment.index,
+                maxBytes: limits.maxBytes,
+                timeoutMs: limits.timeoutMs,
+            });
+        }
+        catch (err) {
+            if (shouldLogVerbose()) {
+                logVerbose(`media: file attachment skipped (buffer): ${String(err)}`);
+            }
+            continue;
+        }
+        const nameHint = bufferResult?.fileName ?? attachment.path ?? attachment.url;
+        const forcedTextMimeResolved = forcedTextMime ?? resolveTextMimeFromName(nameHint ?? "");
+        const rawMime = bufferResult?.mime ?? attachment.mime;
+        const normalizedRawMime = normalizeMimeType(rawMime);
+        if (!forcedTextMimeResolved && isBinaryMediaMime(normalizedRawMime)) {
+            continue;
+        }
+        const utf16Charset = resolveUtf16Charset(bufferResult?.buffer);
+        const textSample = decodeTextSample(bufferResult?.buffer);
+        const textLike = Boolean(utf16Charset) || looksLikeUtf8Text(bufferResult?.buffer);
+        const guessedDelimited = textLike ? guessDelimitedMime(textSample) : undefined;
+        const textHint = forcedTextMimeResolved ?? guessedDelimited ?? (textLike ? "text/plain" : undefined);
+        const mimeType = sanitizeMimeType(textHint ?? normalizeMimeType(rawMime));
+        // Log when MIME type is overridden from non-text to text for auditability
+        if (textHint && rawMime && !rawMime.startsWith("text/")) {
+            logVerbose(`media: MIME override from "${rawMime}" to "${textHint}" for index=${attachment.index}`);
+        }
+        if (!mimeType) {
+            if (shouldLogVerbose()) {
+                logVerbose(`media: file attachment skipped (unknown mime) index=${attachment.index}`);
+            }
+            continue;
+        }
+        const allowedMimes = new Set(limits.allowedMimes);
+        if (!limits.allowedMimesConfigured) {
+            for (const extra of EXTRA_TEXT_MIMES) {
+                allowedMimes.add(extra);
+            }
+            if (mimeType.startsWith("text/")) {
+                allowedMimes.add(mimeType);
+            }
+        }
+        if (!allowedMimes.has(mimeType)) {
+            if (shouldLogVerbose()) {
+                logVerbose(`media: file attachment skipped (unsupported mime ${mimeType}) index=${attachment.index}`);
+            }
+            continue;
+        }
+        let extracted;
+        try {
+            const mediaType = utf16Charset ? `${mimeType}; charset=${utf16Charset}` : mimeType;
+            const { allowedMimesConfigured: _allowedMimesConfigured, ...baseLimits } = limits;
+            extracted = await extractFileContentFromSource({
+                source: {
+                    type: "base64",
+                    data: bufferResult.buffer.toString("base64"),
+                    mediaType,
+                    filename: bufferResult.fileName,
+                },
+                limits: {
+                    ...baseLimits,
+                    allowedMimes,
+                },
+            });
+        }
+        catch (err) {
+            if (shouldLogVerbose()) {
+                logVerbose(`media: file attachment skipped (extract): ${String(err)}`);
+            }
+            continue;
+        }
+        const text = extracted?.text?.trim() ?? "";
+        let blockText = text;
+        if (!blockText) {
+            if (extracted?.images && extracted.images.length > 0) {
+                blockText = "[PDF content rendered to images; images not forwarded to model]";
+            }
+            else {
+                blockText = "[No extractable text]";
+            }
+        }
+        const safeName = (bufferResult.fileName ?? `file-${attachment.index + 1}`)
+            .replace(/[\r\n\t]+/g, " ")
+            .trim();
+        // Escape XML special characters in attributes to prevent injection
+        blocks.push(`<file name="${xmlEscapeAttr(safeName)}" mime="${xmlEscapeAttr(mimeType)}">\n${escapeFileBlockContent(blockText)}\n</file>`);
+    }
+    return blocks;
+}
 export async function applyMediaUnderstanding(params) {
     const { ctx, cfg } = params;
     const commandCandidates = [ctx.CommandBody, ctx.RawBody, ctx.Body];
@@ -32,8 +413,9 @@ export async function applyMediaUnderstanding(params) {
         const outputs = [];
         const decisions = [];
         for (const entry of results) {
-            if (!entry)
+            if (!entry) {
                 continue;
+            }
             for (const output of entry.outputs) {
                 outputs.push(output);
             }
@@ -62,7 +444,24 @@ export async function applyMediaUnderstanding(params) {
                 ctx.RawBody = originalUserText;
             }
             ctx.MediaUnderstanding = [...(ctx.MediaUnderstanding ?? []), ...outputs];
-            finalizeInboundContext(ctx, { forceBodyForAgent: true, forceBodyForCommands: true });
+        }
+        const audioAttachmentIndexes = new Set(outputs
+            .filter((output) => output.kind === "audio.transcription")
+            .map((output) => output.attachmentIndex));
+        const fileBlocks = await extractFileBlocks({
+            attachments,
+            cache,
+            limits: resolveFileLimits(cfg),
+            skipAttachmentIndexes: audioAttachmentIndexes.size > 0 ? audioAttachmentIndexes : undefined,
+        });
+        if (fileBlocks.length > 0) {
+            ctx.Body = appendFileBlocks(ctx.Body, fileBlocks);
+        }
+        if (outputs.length > 0 || fileBlocks.length > 0) {
+            finalizeInboundContext(ctx, {
+                forceBodyForAgent: true,
+                forceBodyForCommands: outputs.length > 0 || fileBlocks.length > 0,
+            });
         }
         return {
             outputs,
@@ -70,6 +469,7 @@ export async function applyMediaUnderstanding(params) {
             appliedImage: outputs.some((output) => output.kind === "image.description"),
             appliedAudio: outputs.some((output) => output.kind === "audio.transcription"),
             appliedVideo: outputs.some((output) => output.kind === "video.description"),
+            appliedFile: fileBlocks.length > 0,
         };
     }
     finally {

package/dist/media-understanding/attachments.js

@@ -3,16 +3,18 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { logVerbose, shouldLogVerbose } from "../globals.js";
+import { isAbortError } from "../infra/unhandled-rejections.js";
 import { fetchRemoteMedia, MediaFetchError } from "../media/fetch.js";
 import { detectMime, getFileExtension, isAudioFileName, kindFromMime } from "../media/mime.js";
-import { logVerbose, shouldLogVerbose } from "../globals.js";
-import { fetchWithTimeout } from "./providers/shared.js";
 import { MediaUnderstandingSkipError } from "./errors.js";
+import { fetchWithTimeout } from "./providers/shared.js";
 const DEFAULT_MAX_ATTACHMENTS = 1;
 function normalizeAttachmentPath(raw) {
     const value = raw?.trim();
-    if (!value)
+    if (!value) {
         return undefined;
+    }
     if (value.startsWith("file://")) {
         try {
             return fileURLToPath(value);
@@ -30,8 +32,9 @@ export function normalizeAttachments(ctx) {
     const resolveMime = (count, index) => {
         const typeHint = typesFromArray?.[index];
         const trimmed = typeof typeHint === "string" ? typeHint.trim() : "";
-        if (trimmed)
+        if (trimmed) {
             return trimmed;
+        }
         return count === 1 ? ctx.MediaType : undefined;
     };
     if (pathsFromArray && pathsFromArray.length > 0) {
@@ -59,8 +62,9 @@ export function normalizeAttachments(ctx) {
     }
     const pathValue = ctx.MediaPath?.trim();
     const url = ctx.MediaUrl?.trim();
-    if (!pathValue && !url)
+    if (!pathValue && !url) {
         return [];
+    }
     return [
         {
             path: pathValue || undefined,
@@ -72,15 +76,19 @@ export function normalizeAttachments(ctx) {
 }
 export function resolveAttachmentKind(attachment) {
     const kind = kindFromMime(attachment.mime);
-    if (kind === "image" || kind === "audio" || kind === "video")
+    if (kind === "image" || kind === "audio" || kind === "video") {
         return kind;
+    }
     const ext = getFileExtension(attachment.path ?? attachment.url);
-    if (!ext)
+    if (!ext) {
         return "unknown";
-    if ([".mp4", ".mov", ".mkv", ".webm", ".avi", ".m4v"].includes(ext))
+    }
+    if ([".mp4", ".mov", ".mkv", ".webm", ".avi", ".m4v"].includes(ext)) {
         return "video";
-    if (isAudioFileName(attachment.path ?? attachment.url))
+    }
+    if (isAudioFileName(attachment.path ?? attachment.url)) {
         return "audio";
+    }
     if ([".png", ".jpg", ".jpeg", ".webp", ".gif", ".bmp", ".tiff", ".tif"].includes(ext)) {
         return "image";
     }
@@ -95,25 +103,22 @@ export function isAudioAttachment(attachment) {
 export function isImageAttachment(attachment) {
     return resolveAttachmentKind(attachment) === "image";
 }
-function isAbortError(err) {
-    if (!err)
-        return false;
-    if (err instanceof Error && err.name === "AbortError")
-        return true;
-    return false;
-}
 function resolveRequestUrl(input) {
-    if (typeof input === "string")
+    if (typeof input === "string") {
         return input;
-    if (input instanceof URL)
+    }
+    if (input instanceof URL) {
         return input.toString();
+    }
     return input.url;
 }
 function orderAttachments(attachments, prefer) {
-    if (!prefer || prefer === "first")
+    if (!prefer || prefer === "first") {
         return attachments;
-    if (prefer === "last")
-        return [...attachments].reverse();
+    }
+    if (prefer === "last") {
+        return [...attachments].toReversed();
+    }
     if (prefer === "path") {
         const withPath = attachments.filter((item) => item.path);
         const withoutPath = attachments.filter((item) => !item.path);
@@ -129,14 +134,17 @@ function orderAttachments(attachments, prefer) {
 export function selectAttachments(params) {
     const { capability, attachments, policy } = params;
     const matches = attachments.filter((item) => {
-        if (capability === "image")
+        if (capability === "image") {
             return isImageAttachment(item);
-        if (capability === "audio")
+        }
+        if (capability === "audio") {
             return isAudioAttachment(item);
+        }
         return isVideoAttachment(item);
     });
-    if (matches.length === 0)
+    if (matches.length === 0) {
         return [];
+    }
     const ordered = orderAttachments(matches, policy?.prefer);
     const mode = policy?.mode ?? "first";
     const maxAttachments = policy?.maxAttachments ?? DEFAULT_MAX_ATTACHMENTS;
@@ -291,15 +299,18 @@ export class MediaAttachmentCache {
     }
     resolveLocalPath(attachment) {
         const rawPath = normalizeAttachmentPath(attachment.path);
-        if (!rawPath)
+        if (!rawPath) {
             return undefined;
+        }
         return path.isAbsolute(rawPath) ? rawPath : path.resolve(rawPath);
     }
     async ensureLocalStat(entry) {
-        if (!entry.resolvedPath)
+        if (!entry.resolvedPath) {
             return undefined;
-        if (entry.statSize !== undefined)
+        }
+        if (entry.statSize !== undefined) {
             return entry.statSize;
+        }
         try {
             const stat = await fs.stat(entry.resolvedPath);
             if (!stat.isFile()) {

package/dist/media-understanding/defaults.js

@@ -26,5 +26,21 @@ export const DEFAULT_AUDIO_MODELS = {
     openai: "gpt-4o-mini-transcribe",
     deepgram: "nova-3",
 };
+export const AUTO_AUDIO_KEY_PROVIDERS = ["openai", "groq", "deepgram", "google"];
+export const AUTO_IMAGE_KEY_PROVIDERS = [
+    "openai",
+    "anthropic",
+    "google",
+    "minimax",
+    "zai",
+];
+export const AUTO_VIDEO_KEY_PROVIDERS = ["google"];
+export const DEFAULT_IMAGE_MODELS = {
+    openai: "gpt-5-mini",
+    anthropic: "claude-opus-4-6",
+    google: "gemini-3-flash-preview",
+    minimax: "MiniMax-VL-01",
+    zai: "glm-4.6v",
+};
 export const CLI_OUTPUT_MAX_BUFFER = 5 * MB;
 export const DEFAULT_MEDIA_CONCURRENCY = 2;

package/dist/media-understanding/providers/deepgram/audio.js

@@ -1,4 +1,4 @@
-import { fetchWithTimeout, normalizeBaseUrl, readErrorResponse } from "../shared.js";
+import { fetchWithTimeoutGuarded, normalizeBaseUrl, readErrorResponse } from "../shared.js";
 export const DEFAULT_DEEPGRAM_AUDIO_BASE_URL = "https://api.deepgram.com/v1";
 export const DEFAULT_DEEPGRAM_AUDIO_MODEL = "nova-3";
 function resolveModel(model) {
@@ -8,15 +8,18 @@ function resolveModel(model) {
 export async function transcribeDeepgramAudio(params) {
     const fetchFn = params.fetchFn ?? fetch;
     const baseUrl = normalizeBaseUrl(params.baseUrl, DEFAULT_DEEPGRAM_AUDIO_BASE_URL);
+    const allowPrivate = Boolean(params.baseUrl?.trim());
     const model = resolveModel(params.model);
     const url = new URL(`${baseUrl}/listen`);
     url.searchParams.set("model", model);
-    if (params.language?.trim())
+    if (params.language?.trim()) {
         url.searchParams.set("language", params.language.trim());
+    }
     if (params.query) {
         for (const [key, value] of Object.entries(params.query)) {
-            if (value === undefined)
+            if (value === undefined) {
                 continue;
+            }
             url.searchParams.set(key, String(value));
         }
     }
@@ -28,20 +31,25 @@ export async function transcribeDeepgramAudio(params) {
         headers.set("content-type", params.mime ?? "application/octet-stream");
     }
     const body = new Uint8Array(params.buffer);
-    const res = await fetchWithTimeout(url.toString(), {
+    const { response: res, release } = await fetchWithTimeoutGuarded(url.toString(), {
         method: "POST",
         headers,
         body,
-    }, params.timeoutMs, fetchFn);
-    if (!res.ok) {
-        const detail = await readErrorResponse(res);
-        const suffix = detail ? `: ${detail}` : "";
-        throw new Error(`Audio transcription failed (HTTP ${res.status})${suffix}`);
+    }, params.timeoutMs, fetchFn, allowPrivate ? { ssrfPolicy: { allowPrivateNetwork: true } } : undefined);
+    try {
+        if (!res.ok) {
+            const detail = await readErrorResponse(res);
+            const suffix = detail ? `: ${detail}` : "";
+            throw new Error(`Audio transcription failed (HTTP ${res.status})${suffix}`);
+        }
+        const payload = (await res.json());
+        const transcript = payload.results?.channels?.[0]?.alternatives?.[0]?.transcript?.trim();
+        if (!transcript) {
+            throw new Error("Audio transcription response missing transcript");
+        }
+        return { text: transcript, model };
     }
-    const payload = (await res.json());
-    const transcript = payload.results?.channels?.[0]?.alternatives?.[0]?.transcript?.trim();
-    if (!transcript) {
-        throw new Error("Audio transcription response missing transcript");
+    finally {
+        await release();
     }
-    return { text: transcript, model };
 }