@qwen-code/qwen-code 0.23.5-preview.0 → 0.24.0

package/chunks/{chunk-B6RMK4ED.js → chunk-UHBYCY7U.js}

@@ -2,22 +2,24 @@
 "use strict";
 import {
   JsonFormatter
-} from "./chunk-347O2YZJ.js";
+} from "./chunk-CNG7ILRW.js";
 import {
   parseAndFormatApiError
-} from "./chunk-KAYC5FBN.js";
+} from "./chunk-SNPYTKXI.js";
 import {
   stripAnsiAndControl
-} from "./chunk-6USYH3EU.js";
+} from "./chunk-B3XJFEEH.js";
+import {
+  createDebugLogger
+} from "./chunk-ZYDMQCQP.js";
 import {
   FatalBudgetExceededError,
   FatalCancellationError,
-  FatalTurnLimitedError,
-  createDebugLogger
-} from "./chunk-ZAFYHRVY.js";
+  FatalTurnLimitedError
+} from "./chunk-S34QJ6IR.js";
 import {
   runExitCleanup
-} from "./chunk-H6L4NEAT.js";
+} from "./chunk-GVMXFXQG.js";
 import {
   writeStderrLine
 } from "./chunk-7FA2II6K.js";

package/chunks/{chunk-Y53DG2HA.js → chunk-UIWUFHRJ.js}

@@ -2,7 +2,7 @@
 "use strict";
 import {
   expandHomeDir
-} from "./chunk-ZAFYHRVY.js";
+} from "./chunk-ZYDMQCQP.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/chunk-UQRDQCWF.js

@@ -0,0 +1,102 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  DashScopeOpenAICompatibleProvider
+} from "./chunk-2VWXODMY.js";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/core/src/omni/upload-config.ts
+init_esbuild_shims();
+var QWEN_OAUTH_PLACEHOLDER_API_KEY = "QWEN_OAUTH_DYNAMIC_TOKEN";
+var ENV_VAR_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var OmniUploadConfigError = class extends Error {
+  static {
+    __name(this, "OmniUploadConfigError");
+  }
+  constructor(message) {
+    super(message);
+    this.name = "OmniUploadConfigError";
+  }
+};
+function normalizeDedicatedOmniUploadConfig(raw, env = process.env) {
+  const configured = raw.baseUrl !== void 0 || raw.apiKeyEnv !== void 0 || raw.model !== void 0;
+  if (!configured) return void 0;
+  const baseUrl = raw.baseUrl?.trim();
+  const apiKeyEnv = raw.apiKeyEnv?.trim();
+  const model = raw.model?.trim();
+  if (!baseUrl || !apiKeyEnv || !model) {
+    throw new OmniUploadConfigError(
+      "omni.delivery.upload.baseUrl, apiKeyEnv, and model must all be set when a dedicated upload channel is configured."
+    );
+  }
+  if (!ENV_VAR_NAME_PATTERN.test(apiKeyEnv)) {
+    throw new OmniUploadConfigError(
+      "omni.delivery.upload.apiKeyEnv must be a valid environment variable name."
+    );
+  }
+  if (!DashScopeOpenAICompatibleProvider.isDashScopeProvider({
+    authType: "openai" /* USE_OPENAI */,
+    baseUrl
+  })) {
+    throw new OmniUploadConfigError(
+      "omni.delivery.upload.baseUrl must be a DashScope-compatible endpoint."
+    );
+  }
+  const apiKey = env[apiKeyEnv]?.trim();
+  if (!apiKey) {
+    throw new OmniUploadConfigError(
+      `omni.delivery.upload.apiKeyEnv names ${apiKeyEnv}, but that environment variable is not set or is empty.`
+    );
+  }
+  return { baseUrl, apiKey, model };
+}
+__name(normalizeDedicatedOmniUploadConfig, "normalizeDedicatedOmniUploadConfig");
+function resolveLegacyOmniUploadConfig(contentGeneratorConfig, model) {
+  if (!contentGeneratorConfig || contentGeneratorConfig.authType === "qwen-oauth" /* QWEN_OAUTH */ || !contentGeneratorConfig.apiKey || contentGeneratorConfig.apiKey === QWEN_OAUTH_PLACEHOLDER_API_KEY || !contentGeneratorConfig.baseUrl || !model || !DashScopeOpenAICompatibleProvider.isDashScopeProvider(
+    contentGeneratorConfig
+  )) {
+    return void 0;
+  }
+  return {
+    baseUrl: contentGeneratorConfig.baseUrl,
+    apiKey: contentGeneratorConfig.apiKey,
+    model
+  };
+}
+__name(resolveLegacyOmniUploadConfig, "resolveLegacyOmniUploadConfig");
+function getEffectiveOmniUploadConfig(config) {
+  const dedicated = config.getOmniUploadConfig?.();
+  if (dedicated) return dedicated;
+  return resolveLegacyOmniUploadConfig(
+    config.getContentGeneratorConfig?.(),
+    config.getModel?.()
+  );
+}
+__name(getEffectiveOmniUploadConfig, "getEffectiveOmniUploadConfig");
+function requireEffectiveOmniUploadConfig(config) {
+  const upload = getEffectiveOmniUploadConfig(config);
+  if (!upload) {
+    throw new OmniUploadConfigError(
+      "Omni upload is not configured. Set all of omni.delivery.upload.baseUrl, apiKeyEnv, and model, or use a static DashScope inference configuration."
+    );
+  }
+  return upload;
+}
+__name(requireEffectiveOmniUploadConfig, "requireEffectiveOmniUploadConfig");
+
+export {
+  OmniUploadConfigError,
+  normalizeDedicatedOmniUploadConfig,
+  getEffectiveOmniUploadConfig,
+  requireEffectiveOmniUploadConfig
+};
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/{chunk-NKTMUPHJ.js → chunk-UVMU7DDP.js}

@@ -13,15 +13,17 @@ import {
 } from "./chunk-6OTF7TTE.js";
 import {
   isWorkspaceTrusted
-} from "./chunk-NQ272MQG.js";
+} from "./chunk-5XK2YELE.js";
 import {
   require_main
 } from "./chunk-65I7S4Z3.js";
 import {
   QWEN_DIR,
-  Storage,
+  Storage
+} from "./chunk-ZYDMQCQP.js";
+import {
   getErrorMessage
-} from "./chunk-ZAFYHRVY.js";
+} from "./chunk-S34QJ6IR.js";
 import {
   init_esbuild_shims
 } from "./chunk-5O2XNYP6.js";

package/chunks/chunk-UXEI7POA.js

@@ -0,0 +1,273 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  projectMediaPolicyToolDeclaration
+} from "./chunk-MNU36NGH.js";
+import {
+  isPlainRecord
+} from "./chunk-BQMSZSG6.js";
+import {
+  BaseDeclarativeTool,
+  BaseToolInvocation
+} from "./chunk-VPGRGNNH.js";
+import {
+  SchemaValidator
+} from "./chunk-ERIBG3BX.js";
+import {
+  getErrorMessage
+} from "./chunk-S34QJ6IR.js";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/core/src/omni/policy/tools/media-policy-tool.ts
+init_esbuild_shims();
+import fs from "node:fs/promises";
+import path from "node:path";
+var DEFAULT_POLICY_TOOL_TIMEOUT_MS = 6e5;
+var MEDIA_POLICY_IO_SCHEMA_PROPERTIES = {
+  inputPath: {
+    type: "string",
+    description: "Absolute path of the source media file \u2014 including the path shown in a \u3010\u5A92\u4F53\u8DEF\u5F84\u3011 annotation for a local file you read. Provide exactly one of inputPath or resourceId."
+  },
+  resourceId: {
+    type: "string",
+    description: "Opaque session media handle (the media-<n>-<hex> form from a \u3010\u5A92\u4F53\u8D44\u6E90\u3011 annotation or a recall result) naming the source media. When the annotation instead shows an absolute path, pass that path as inputPath. Provide exactly one of inputPath or resourceId."
+  },
+  outputDir: {
+    type: "string",
+    description: "Absolute path of an existing directory the output file is written into; it is not created automatically."
+  }
+};
+function resolvePolicyToolTimeoutMs(config, toolName) {
+  const entry = config.getOmniPolicyToolsSettings?.()?.[toolName];
+  const runtime = isPlainRecord(entry) && isPlainRecord(entry["runtime"]) ? entry["runtime"] : void 0;
+  const timeoutMs = runtime?.["timeoutMs"];
+  return typeof timeoutMs === "number" && Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : DEFAULT_POLICY_TOOL_TIMEOUT_MS;
+}
+__name(resolvePolicyToolTimeoutMs, "resolvePolicyToolTimeoutMs");
+function resolvePolicyToolSettings(config, toolName) {
+  const entry = config.getOmniPolicyToolsSettings?.()?.[toolName];
+  const settings = isPlainRecord(entry) ? entry["settings"] : void 0;
+  return isPlainRecord(settings) ? settings : {};
+}
+__name(resolvePolicyToolSettings, "resolvePolicyToolSettings");
+function createPolicyToolTimeoutBudget(totalMs) {
+  let deadline;
+  return () => {
+    const now = Date.now();
+    deadline ??= now + totalMs;
+    return Math.max(1, deadline - now);
+  };
+}
+__name(createPolicyToolTimeoutBudget, "createPolicyToolTimeoutBudget");
+function sharpTimeoutSeconds(timeoutMs) {
+  return Math.max(1, Math.ceil(timeoutMs / 1e3));
+}
+__name(sharpTimeoutSeconds, "sharpTimeoutSeconds");
+var BaseMediaPolicyToolInvocation = class extends BaseToolInvocation {
+  static {
+    __name(this, "BaseMediaPolicyToolInvocation");
+  }
+  getDefaultPermission() {
+    return Promise.resolve("ask");
+  }
+};
+var BaseMediaPolicyTool = class extends BaseDeclarativeTool {
+  constructor(name, displayName, description, kind, parameterSchema, configView = {}) {
+    super(name, displayName, description, kind, parameterSchema);
+    this.configView = configView;
+  }
+  static {
+    __name(this, "BaseMediaPolicyTool");
+  }
+  /** Memoized projection result, keyed on the settings-object identity it
+   * was computed from ({@link schema}). */
+  projectedSchema;
+  /**
+   * Model-visible declaration (decision D6): the single projection point
+   * every declaration surface reads — the native schema minus
+   * `modelAccess.lockedArguments` keys, narrowed to
+   * `modelAccess.parameterSchema` when configured, with the optional
+   * description override applied. Validation deliberately does NOT use
+   * this projection (see {@link validateToolParams}).
+   *
+   * The projection is pure over (native schema, settings object), and the
+   * config stores one normalized settings object per initialize() — so the
+   * result is memoized on that object's identity, and a re-initialize
+   * (which swaps the object) recomputes naturally.
+   */
+  get schema() {
+    const settings = this.configView.getOmniPolicyToolsSettings?.();
+    if (!this.projectedSchema || this.projectedSchema.settings !== settings) {
+      this.projectedSchema = {
+        settings,
+        declaration: projectMediaPolicyToolDeclaration(this.configView, {
+          name: this.name,
+          description: this.description,
+          parametersJsonSchema: this.parameterSchema,
+          operatorOnlyParams: this.mediaPolicyDescriptor.operatorOnlyParams
+        })
+      };
+    }
+    return this.projectedSchema.declaration;
+  }
+  /**
+   * Validate against the tool's NATIVE parameter schema, never the
+   * model-visible `schema` getter: Stage B's modelAccess projection makes
+   * `schema` a narrowed view (lockedArguments removed), while validation
+   * must keep accepting the harness-injected arguments the projection
+   * hides (policy design §9.4).
+   */
+  validateToolParams(params) {
+    const errors = SchemaValidator.validate(this.parameterSchema, params);
+    if (errors) {
+      return errors;
+    }
+    return this.validateToolParamValues(params);
+  }
+  /** Every media-policy tool shares the io params; tools with extra
+   * value-level rules override this and layer them on top. */
+  validateToolParamValues(params) {
+    return validateMediaPolicyIoParams(params);
+  }
+  /**
+   * The other half of the Write/Edit permission posture these tools adopt:
+   * without this override, the AUTO-mode classifier sees the empty-string
+   * sentinel (`Arguments: {}`) and its path-based block rules can never
+   * fire on a model-origin call. Project exactly the fields those rules
+   * key on — the two filesystem paths carry no secrets.
+   */
+  toAutoClassifierInput(params) {
+    return { inputPath: params.inputPath, outputDir: params.outputDir };
+  }
+};
+var MAX_OUTPUT_STEM_LENGTH = 48;
+function policyOutputStem(inputPath) {
+  const raw = path.basename(inputPath, path.extname(inputPath));
+  return raw.replace(/[^A-Za-z0-9._+-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, MAX_OUTPUT_STEM_LENGTH) || "media";
+}
+__name(policyOutputStem, "policyOutputStem");
+function policyOutputFileName(params) {
+  const stem = policyOutputStem(params.inputPath);
+  const variant = params.variant ? `-${params.variant}` : "";
+  return `${stem}-${params.operation}${variant}${params.extension}`;
+}
+__name(policyOutputFileName, "policyOutputFileName");
+function validateMediaPolicyIoParams(params) {
+  if (params.inputPath === void 0) {
+    return "provide exactly one of inputPath (absolute path) or resourceId (opaque session media handle)";
+  }
+  if (!path.isAbsolute(params.inputPath)) {
+    return `inputPath must be an absolute path (got ${JSON.stringify(params.inputPath)})`;
+  }
+  if (!path.isAbsolute(params.outputDir)) {
+    return `outputDir must be an absolute path (got ${JSON.stringify(params.outputDir)})`;
+  }
+  return null;
+}
+__name(validateMediaPolicyIoParams, "validateMediaPolicyIoParams");
+async function assertMediaPolicyIo(params) {
+  let inputStat;
+  try {
+    inputStat = await fs.lstat(params.inputPath);
+  } catch {
+    throw new Error(`input file not found: ${path.basename(params.inputPath)}`);
+  }
+  if (!inputStat.isFile()) {
+    throw new Error(
+      `input is not a regular file: ${path.basename(params.inputPath)}`
+    );
+  }
+  let outStat;
+  try {
+    outStat = await fs.lstat(params.outputDir);
+  } catch {
+    throw new Error(`output directory not found: ${params.outputDir}`);
+  }
+  if (!outStat.isDirectory()) {
+    throw new Error(`output path is not a real directory: ${params.outputDir}`);
+  }
+  return { inputSizeBytes: inputStat.size };
+}
+__name(assertMediaPolicyIo, "assertMediaPolicyIo");
+function formatBytesShort(bytes) {
+  const trim = /* @__PURE__ */ __name((n) => (Math.round(n * 10) / 10).toString().replace(/\.0$/, ""), "trim");
+  if (bytes >= 1024 ** 3) return `${trim(bytes / 1024 ** 3)}GB`;
+  if (bytes >= 1024 ** 2) return `${trim(bytes / 1024 ** 2)}MB`;
+  if (bytes >= 1024) return `${trim(bytes / 1024)}KB`;
+  return `${bytes}B`;
+}
+__name(formatBytesShort, "formatBytesShort");
+function describeChannels(channels) {
+  if (channels === void 0) return "";
+  if (channels === 1) return " \u5355\u58F0\u9053";
+  if (channels === 2) return " \u7ACB\u4F53\u58F0";
+  return ` ${channels}\u58F0\u9053`;
+}
+__name(describeChannels, "describeChannels");
+function mediaPolicyToolError(message) {
+  return {
+    llmContent: `Error: ${message}`,
+    returnDisplay: message,
+    error: { message, type: "execution_failed" /* EXECUTION_FAILED */ }
+  };
+}
+__name(mediaPolicyToolError, "mediaPolicyToolError");
+function mediaPolicyToolFailure(error) {
+  return mediaPolicyToolError(getErrorMessage(error));
+}
+__name(mediaPolicyToolFailure, "mediaPolicyToolFailure");
+function ffmpegFailureMessage(run, action, inputPath) {
+  return `ffmpeg failed (exit ${run.code}) ${action} ${path.basename(inputPath)}: ${run.stderr.slice(-500)}`;
+}
+__name(ffmpegFailureMessage, "ffmpegFailureMessage");
+function mediaPolicyToolSuccess(args) {
+  const outputPath = path.join(args.outputDir, args.outputFileName);
+  const artifact = {
+    kind: args.artifactKind,
+    storage: "workspace",
+    title: args.title,
+    // Relative to the invocation's staging directory — the orchestrator
+    // resolves and re-validates containment before promotion.
+    workspacePath: args.outputFileName,
+    mimeType: args.mimeType,
+    sizeBytes: args.sizeBytes,
+    metadata: args.role === void 0 ? { omniDisclosure: args.disclosure } : { omniDisclosure: args.disclosure, omniRole: args.role }
+  };
+  return {
+    llmContent: `${args.title}: ${args.disclosure}
+Output file: ${outputPath}
+Use read_file with this absolute path to inspect the result.`,
+    returnDisplay: args.disclosure,
+    artifacts: [artifact]
+  };
+}
+__name(mediaPolicyToolSuccess, "mediaPolicyToolSuccess");
+
+export {
+  MEDIA_POLICY_IO_SCHEMA_PROPERTIES,
+  resolvePolicyToolTimeoutMs,
+  resolvePolicyToolSettings,
+  createPolicyToolTimeoutBudget,
+  sharpTimeoutSeconds,
+  BaseMediaPolicyToolInvocation,
+  BaseMediaPolicyTool,
+  policyOutputStem,
+  policyOutputFileName,
+  assertMediaPolicyIo,
+  formatBytesShort,
+  describeChannels,
+  mediaPolicyToolError,
+  mediaPolicyToolFailure,
+  ffmpegFailureMessage,
+  mediaPolicyToolSuccess
+};
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/chunk-V2XJJTAB.js

@@ -0,0 +1,228 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  combineAbortSignals
+} from "./chunk-DJ2GSRLV.js";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/core/src/omni/upload.ts
+init_esbuild_shims();
+import { createHash, randomUUID } from "node:crypto";
+import { openAsBlob } from "node:fs";
+import path from "node:path";
+var OSS_URL_PREFIX = "oss://";
+var DEFAULT_ORIGIN = "https://dashscope.aliyuncs.com";
+var GET_POLICY_TIMEOUT_MS = 3e4;
+var UPLOAD_TIMEOUT_MS = 15 * 6e4;
+var CREDENTIAL_TTL_MS = 24e4;
+var credentialCache = /* @__PURE__ */ new Map();
+function resetCredentialCacheForTests() {
+  credentialCache.clear();
+}
+__name(resetCredentialCacheForTests, "resetCredentialCacheForTests");
+function sanitizeFileName(name) {
+  const cleaned = name.replace(/[^\w.-]+/g, "_").replace(/^\.+/, "");
+  return cleaned.length > 0 ? cleaned.slice(-100) : "file";
+}
+__name(sanitizeFileName, "sanitizeFileName");
+function uploadsOriginFromBaseUrl(baseUrl) {
+  if (!baseUrl) return DEFAULT_ORIGIN;
+  try {
+    return new URL(baseUrl).origin;
+  } catch {
+    return DEFAULT_ORIGIN;
+  }
+}
+__name(uploadsOriginFromBaseUrl, "uploadsOriginFromBaseUrl");
+async function summarizeHttpFailure(res) {
+  const body = await res.text().catch(() => "");
+  try {
+    const parsed = JSON.parse(body);
+    const code = parsed.code ?? parsed.error?.code;
+    const message = parsed.message ?? parsed.error?.message;
+    const detail = [code, message].filter((v) => typeof v === "string" && v.length > 0).join(": ").slice(0, 160);
+    if (detail) return `HTTP ${res.status} (${detail})`;
+  } catch {
+  }
+  return `HTTP ${res.status}`;
+}
+__name(summarizeHttpFailure, "summarizeHttpFailure");
+function rethrowIfAborted(err, signal) {
+  if (signal?.aborted) throw err;
+}
+__name(rethrowIfAborted, "rethrowIfAborted");
+function abortReason(signal) {
+  return signal.reason ?? new DOMException("This operation was aborted", "AbortError");
+}
+__name(abortReason, "abortReason");
+function raceWithSignal(shared, signal) {
+  if (!signal) return shared;
+  if (signal.aborted) return Promise.reject(abortReason(signal));
+  return new Promise((resolve, reject) => {
+    const onAbort = /* @__PURE__ */ __name(() => reject(abortReason(signal)), "onAbort");
+    signal.addEventListener("abort", onAbort, { once: true });
+    shared.then(
+      (value) => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(value);
+      },
+      (err) => {
+        signal.removeEventListener("abort", onAbort);
+        reject(err);
+      }
+    );
+  });
+}
+__name(raceWithSignal, "raceWithSignal");
+var DashScopeUploader = class {
+  static {
+    __name(this, "DashScopeUploader");
+  }
+  apiKey;
+  origin;
+  fetchFn;
+  constructor(options) {
+    this.apiKey = options.apiKey;
+    this.origin = uploadsOriginFromBaseUrl(options.baseUrl);
+    this.fetchFn = options.fetchFn ?? fetch;
+  }
+  /** Fetch a short-lived upload policy bound to `model`, reusing a cached
+   * credential within its validity window. */
+  async getPolicy(model, signal) {
+    const keyDigest = createHash("sha256").update(this.apiKey).digest("hex").slice(0, 16);
+    const cacheKey = `${this.origin}|${model}|${keyDigest}`;
+    const cached = credentialCache.get(cacheKey);
+    if (cached && Date.now() - cached.fetchedAt < CREDENTIAL_TTL_MS) {
+      return raceWithSignal(cached.policy, signal);
+    }
+    const entry = {
+      fetchedAt: Date.now(),
+      policy: this.fetchPolicy(model)
+    };
+    credentialCache.set(cacheKey, entry);
+    entry.policy.catch(() => {
+      if (credentialCache.get(cacheKey) === entry) {
+        credentialCache.delete(cacheKey);
+      }
+    });
+    return raceWithSignal(entry.policy, signal);
+  }
+  /** Uncached policy fetch. Runs solely under the internal timeout; caller
+   * signals are handled per-caller in getPolicy so one caller's abort never
+   * contaminates the shared cached promise. */
+  async fetchPolicy(model) {
+    const url = new URL("/api/v1/uploads", this.origin);
+    url.searchParams.set("action", "getPolicy");
+    url.searchParams.set("model", model);
+    const combined = combineAbortSignals([], {
+      timeoutMs: GET_POLICY_TIMEOUT_MS
+    });
+    let failureSummary;
+    let payload;
+    try {
+      const res = await this.fetchFn(url, {
+        method: "GET",
+        headers: { Authorization: `Bearer ${this.apiKey}` },
+        signal: combined.signal
+      });
+      if (res.ok) {
+        try {
+          payload = await res.json();
+        } catch (err) {
+          if (combined.signal.aborted) throw err;
+          payload = void 0;
+        }
+      } else {
+        failureSummary = await summarizeHttpFailure(res);
+      }
+    } catch (err) {
+      throw new Error(
+        `DashScope upload getPolicy request failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+    } finally {
+      combined.cleanup();
+    }
+    if (failureSummary) {
+      throw new Error(`DashScope upload getPolicy failed: ${failureSummary}`);
+    }
+    const data = payload?.data;
+    if (!data?.policy || !data.signature || !data.upload_dir || !data.upload_host || !data.oss_access_key_id || !data.x_oss_object_acl || !data.x_oss_forbid_overwrite) {
+      throw new Error(
+        "DashScope upload getPolicy returned an incomplete policy payload."
+      );
+    }
+    return data;
+  }
+  /**
+   * Upload a local file under a fresh policy for `model`. Returns the
+   * `oss://` URL DashScope resolves at inference time.
+   */
+  async uploadFile(params) {
+    const { filePath, model, mimeType, signal } = params;
+    const policy = await this.getPolicy(model, signal);
+    const key = `${policy.upload_dir}/${randomUUID().slice(0, 8)}-${sanitizeFileName(
+      path.basename(filePath)
+    )}`;
+    const form = new FormData();
+    form.append("OSSAccessKeyId", policy.oss_access_key_id);
+    form.append("Signature", policy.signature);
+    form.append("policy", policy.policy);
+    form.append("x-oss-object-acl", policy.x_oss_object_acl);
+    form.append("x-oss-forbid-overwrite", policy.x_oss_forbid_overwrite);
+    form.append("key", key);
+    form.append("success_action_status", "200");
+    let blob;
+    try {
+      blob = await openAsBlob(filePath, { type: mimeType });
+    } catch (err) {
+      throw new Error(
+        `Failed to open file for upload: ${path.basename(filePath)}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    form.append("file", blob, path.basename(filePath));
+    const combined = combineAbortSignals([signal], {
+      timeoutMs: UPLOAD_TIMEOUT_MS
+    });
+    let failureSummary;
+    try {
+      const res = await this.fetchFn(policy.upload_host, {
+        method: "POST",
+        body: form,
+        signal: combined.signal
+      });
+      if (res.ok) {
+        await res.body?.cancel().catch(() => {
+        });
+      } else {
+        failureSummary = await summarizeHttpFailure(res);
+      }
+    } catch (err) {
+      rethrowIfAborted(err, signal);
+      throw new Error(
+        `DashScope media upload failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+    } finally {
+      combined.cleanup();
+    }
+    if (failureSummary) {
+      throw new Error(`DashScope media upload failed: ${failureSummary}`);
+    }
+    return `${OSS_URL_PREFIX}${key}`;
+  }
+};
+
+export {
+  OSS_URL_PREFIX,
+  resetCredentialCacheForTests,
+  DashScopeUploader
+};
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/chunks/chunk-VDNCKE2O.js

@@ -0,0 +1,24 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/core/src/omni/policy/tools/sharp-module.ts
+init_esbuild_shims();
+async function loadSharp() {
+  return (await import("sharp")).default;
+}
+__name(loadSharp, "loadSharp");
+
+export {
+  loadSharp
+};
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */