@xopcai/xopc 0.0.166 → 0.0.167

package/dist/src/gateway/custom-image-providers.d.ts

@@ -0,0 +1,89 @@
+import { z } from 'zod';
+import { type ModelsJsonConfig } from '../config/models-json.js';
+export declare const CustomImageProviderInputSchema: z.ZodObject<{
+    baseUrl: z.ZodString;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    imageGeneration: z.ZodObject<{
+        api: z.ZodLiteral<"openai-images">;
+        name: z.ZodString;
+        documentationUrl: z.ZodOptional<z.ZodString>;
+        apiKeyUrl: z.ZodOptional<z.ZodString>;
+        defaultModel: z.ZodString;
+        auth: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"bearer">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"header">;
+            headerName: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"none">;
+        }, z.core.$strict>], "type">;
+        paths: z.ZodOptional<z.ZodObject<{
+            generations: z.ZodOptional<z.ZodString>;
+            edits: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        network: z.ZodOptional<z.ZodObject<{
+            allowedHosts: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>>;
+        models: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodOptional<z.ZodString>;
+            capabilities: z.ZodObject<{
+                generate: z.ZodOptional<z.ZodObject<{
+                    maxCount: z.ZodOptional<z.ZodNumber>;
+                    supportsSize: z.ZodOptional<z.ZodBoolean>;
+                    supportsAspectRatio: z.ZodOptional<z.ZodBoolean>;
+                    supportsResolution: z.ZodOptional<z.ZodBoolean>;
+                }, z.core.$strict>>;
+                edit: z.ZodOptional<z.ZodObject<{
+                    enabled: z.ZodBoolean;
+                    maxInputImages: z.ZodOptional<z.ZodNumber>;
+                    supportsSize: z.ZodOptional<z.ZodBoolean>;
+                    supportsAspectRatio: z.ZodOptional<z.ZodBoolean>;
+                }, z.core.$strict>>;
+                geometry: z.ZodOptional<z.ZodObject<{
+                    sizes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    aspectRatios: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    resolutions: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                        "1K": "1K";
+                        "2K": "2K";
+                        "4K": "4K";
+                    }>>>;
+                }, z.core.$strict>>;
+                output: z.ZodOptional<z.ZodObject<{
+                    qualities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                        low: "low";
+                        high: "high";
+                        auto: "auto";
+                        medium: "medium";
+                    }>>>;
+                    formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                        png: "png";
+                        jpeg: "jpeg";
+                        webp: "webp";
+                    }>>>;
+                    backgrounds: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                        auto: "auto";
+                        transparent: "transparent";
+                        opaque: "opaque";
+                    }>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+            defaults: z.ZodOptional<z.ZodObject<{
+                count: z.ZodOptional<z.ZodNumber>;
+                size: z.ZodOptional<z.ZodString>;
+                outputFormat: z.ZodOptional<z.ZodEnum<{
+                    png: "png";
+                    jpeg: "jpeg";
+                    webp: "webp";
+                }>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type CustomImageProviderInput = z.infer<typeof CustomImageProviderInputSchema>;
+export interface CustomImageProviderRecord extends CustomImageProviderInput {
+    providerId: string;
+}
+export declare function listCustomImageProviders(config: ModelsJsonConfig): CustomImageProviderRecord[];
+export declare function upsertCustomImageProvider(config: ModelsJsonConfig, providerIdRaw: string, input: unknown): ModelsJsonConfig;
+export declare function deleteCustomImageProvider(config: ModelsJsonConfig, providerIdRaw: string): ModelsJsonConfig;

package/dist/src/gateway/custom-image-providers.js

@@ -0,0 +1,59 @@
+import { ImageGenerationProviderSchema, init_models_json, validateModelsConfig } from "../config/models-json.js";
+import { z } from "zod";
+//#region src/gateway/custom-image-providers.ts
+init_models_json();
+const PROVIDER_ID_REGEX = /^[a-z0-9]([a-z0-9-_]*[a-z0-9])?$/;
+const CustomImageProviderInputSchema = z.object({
+	baseUrl: z.string().url(),
+	headers: z.record(z.string(), z.string()).optional(),
+	imageGeneration: ImageGenerationProviderSchema
+}).strict();
+function listCustomImageProviders(config) {
+	return Object.entries(config.providers).flatMap(([providerId, provider]) => {
+		if (!provider.imageGeneration) return [];
+		return [{
+			providerId,
+			baseUrl: provider.baseUrl,
+			...provider.headers ? { headers: { ...provider.headers } } : {},
+			imageGeneration: structuredClone(provider.imageGeneration)
+		}];
+	});
+}
+function upsertCustomImageProvider(config, providerIdRaw, input) {
+	const providerId = normalizeProviderId(providerIdRaw);
+	const parsed = CustomImageProviderInputSchema.safeParse(input);
+	if (!parsed.success) throw new Error(parsed.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; "));
+	const { headers: _currentHeaders, ...currentWithoutHeaders } = config.providers[providerId] ?? {};
+	const next = structuredClone(config);
+	next.providers[providerId] = {
+		...currentWithoutHeaders,
+		baseUrl: parsed.data.baseUrl,
+		...parsed.data.headers ? { headers: parsed.data.headers } : {},
+		imageGeneration: parsed.data.imageGeneration
+	};
+	assertValid(next);
+	return next;
+}
+function deleteCustomImageProvider(config, providerIdRaw) {
+	const providerId = normalizeProviderId(providerIdRaw);
+	const current = config.providers[providerId];
+	if (!current?.imageGeneration) throw new Error(`Custom image provider not found: ${providerId}`);
+	const next = structuredClone(config);
+	if (Boolean(current.api || current.apiKey || current.authHeader !== void 0 || current.models?.length || current.modelOverrides && Object.keys(current.modelOverrides).length > 0 || current.modelDiscovery)) {
+		const { imageGeneration: _removed, ...remaining } = current;
+		next.providers[providerId] = remaining;
+	} else delete next.providers[providerId];
+	assertValid(next);
+	return next;
+}
+function normalizeProviderId(value) {
+	const providerId = value.trim();
+	if (!PROVIDER_ID_REGEX.test(providerId)) throw new Error("Provider ID must start/end with alphanumeric and contain only lowercase letters, numbers, hyphens, and underscores");
+	return providerId;
+}
+function assertValid(config) {
+	const validation = validateModelsConfig(config);
+	if (!validation.valid) throw new Error(validation.errors.filter((entry) => entry.severity === "error").map((entry) => `${entry.path}: ${entry.message}`).join("; "));
+}
+//#endregion
+export { CustomImageProviderInputSchema, deleteCustomImageProvider, listCustomImageProviders, upsertCustomImageProvider };

package/dist/src/gateway/heartbeat/service.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { shouldSilence, stripHeartbeatToken } from "../../heartbeat/tokens.js";
+import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { isWithinActiveHours } from "../../heartbeat/active-hours.js";
 import { isHeartbeatContentEmpty } from "../../heartbeat/content-check.js";
-import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { createHeartbeatWake } from "../../heartbeat/wake.js";
 import { resolveHeartbeatMdPath } from "../workspace-heartbeat-path.js";
 import { readFile } from "fs/promises";

package/dist/src/gateway/hono/routes/models.js

@@ -7,7 +7,9 @@ import { CredentialResolver, init_credentials } from "../../../auth/credentials.
 import "../../../providers/constants.js";
 import { getProviderRegistry, init_plugin_registry } from "../../../providers/plugin-registry.js";
 import { PROVIDER_META, getAllModels, getAllProviders, getAvailableModels, getProviderAuthState, init_providers, isProviderConfigured } from "../../../providers/index.js";
+import { getImageGenerationProvider, reloadImageGenerationProviders } from "../../../agent/image/generation/provider-registry.js";
 import { SessionConfigStore } from "../../../session/config-store.js";
+import { deleteCustomImageProvider, listCustomImageProviders, upsertCustomImageProvider } from "../../custom-image-providers.js";
 import { getDomesticProviderPreset, getDomesticProviderPresetIds } from "../../../providers/domestic-presets.js";
 import { getOnboardingFeaturedProviders, getProviderHint, getRecommendedModelsForProvider, isRecommendedModel, sortModelsForPicker, sortProvidersForPicker } from "../../../providers/presentation.js";
 import { getAgentImageGenerationConfig, getImageGenerationCatalog, prepareImageGenerationSetup, verifyImageGenerationCredential } from "../../image-generation-setup.js";
@@ -119,6 +121,7 @@ function registerModelsRoutes(authenticated, deps) {
 		}, 400);
 		const registry = getModelRegistry();
 		registry.refresh();
+		reloadImageGenerationProviders(config);
 		service.emit("models-json.updated", { modelCount: registry.getAll().length });
 		return c.json({
 			ok: true,
@@ -131,6 +134,7 @@ function registerModelsRoutes(authenticated, deps) {
 	authenticated.post("/api/models-json/reload", async (c) => {
 		const registry = getModelRegistry();
 		registry.refresh();
+		reloadImageGenerationProviders();
 		const error = registry.getError();
 		const models = registry.getAll();
 		service.emit("models-json.reloaded", {
@@ -239,6 +243,182 @@ function registerModelsRoutes(authenticated, deps) {
 			payload: { providers: getImageGenerationCatalog(service.currentConfig) }
 		});
 	});
+	authenticated.get("/api/image-generation/custom-providers", (c) => {
+		const loaded = loadModelsJson(resolveModelsJsonPath());
+		if (loaded.error) return c.json({
+			ok: false,
+			error: { message: loaded.error }
+		}, 409);
+		return c.json({
+			ok: true,
+			payload: { providers: listCustomImageProviders(loaded.config) }
+		});
+	});
+	authenticated.put("/api/image-generation/custom-providers/:providerId", strictRateLimitMiddleware, async (c) => {
+		const loaded = loadModelsJson(resolveModelsJsonPath());
+		if (loaded.error) return c.json({
+			ok: false,
+			error: { message: loaded.error }
+		}, 409);
+		try {
+			const body = await c.req.json();
+			const next = upsertCustomImageProvider(loaded.config, c.req.param("providerId"), body);
+			const saved = saveModelsJson(resolveModelsJsonPath(), next);
+			if (!saved.success) return c.json({
+				ok: false,
+				error: { message: saved.error }
+			}, 400);
+			getModelRegistry().refresh();
+			reloadImageGenerationProviders(next);
+			service.emit("models-json.updated", { modelCount: getModelRegistry().getAll().length });
+			return c.json({
+				ok: true,
+				payload: {
+					provider: listCustomImageProviders(next).find((entry) => entry.providerId === c.req.param("providerId")),
+					providers: getImageGenerationCatalog(service.currentConfig)
+				}
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: { message: error instanceof Error ? error.message : String(error) }
+			}, 400);
+		}
+	});
+	authenticated.delete("/api/image-generation/custom-providers/:providerId", strictRateLimitMiddleware, (c) => {
+		const loaded = loadModelsJson(resolveModelsJsonPath());
+		if (loaded.error) return c.json({
+			ok: false,
+			error: { message: loaded.error }
+		}, 409);
+		try {
+			const next = deleteCustomImageProvider(loaded.config, c.req.param("providerId"));
+			const saved = saveModelsJson(resolveModelsJsonPath(), next);
+			if (!saved.success) return c.json({
+				ok: false,
+				error: { message: saved.error }
+			}, 400);
+			getModelRegistry().refresh();
+			reloadImageGenerationProviders(next);
+			service.emit("models-json.updated", { modelCount: getModelRegistry().getAll().length });
+			return c.json({
+				ok: true,
+				payload: {
+					deleted: c.req.param("providerId"),
+					providers: getImageGenerationCatalog(service.currentConfig)
+				}
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: { message: error instanceof Error ? error.message : String(error) }
+			}, 400);
+		}
+	});
+	authenticated.put("/api/image-generation/providers/:providerId/credential", strictRateLimitMiddleware, async (c) => {
+		const providerId = c.req.param("providerId").trim();
+		const provider = getImageGenerationProvider(providerId);
+		if (!provider) return c.json({
+			ok: false,
+			error: { message: `Unknown image provider: ${providerId}` }
+		}, 404);
+		if (provider.credentialMode === "none") return c.json({
+			ok: false,
+			error: { message: "This provider does not use an API key" }
+		}, 400);
+		const body = await c.req.json().catch(() => null);
+		const apiKey = typeof body?.apiKey === "string" ? body.apiKey.trim() : "";
+		if (!apiKey) return c.json({
+			ok: false,
+			error: { message: "API key is required" }
+		}, 400);
+		await new CredentialResolver().saveApiKey(providerId, apiKey, { profileName: "default" });
+		return c.json({
+			ok: true,
+			payload: {
+				providerId,
+				saved: true
+			}
+		});
+	});
+	authenticated.post("/api/image-generation/providers/:providerId/reveal-api-key", strictRateLimitMiddleware, async (c) => {
+		const providerId = c.req.param("providerId").trim();
+		if (!getImageGenerationProvider(providerId)) return c.json({
+			ok: false,
+			error: { message: `Unknown image provider: ${providerId}` }
+		}, 404);
+		const apiKey = await new CredentialResolver().revealGatewayStoredApiKey(providerId);
+		return c.json({
+			ok: true,
+			payload: {
+				providerId,
+				apiKey: apiKey ?? null,
+				source: apiKey ? "credential" : "none"
+			}
+		});
+	});
+	authenticated.delete("/api/image-generation/providers/:providerId/credential", strictRateLimitMiddleware, async (c) => {
+		const providerId = c.req.param("providerId").trim();
+		if (!getImageGenerationProvider(providerId)) return c.json({
+			ok: false,
+			error: { message: `Unknown image provider: ${providerId}` }
+		}, 404);
+		await new CredentialResolver().deleteProviderCredential(providerId);
+		return c.json({
+			ok: true,
+			payload: {
+				providerId,
+				deleted: true
+			}
+		});
+	});
+	authenticated.post("/api/image-generation/providers/:providerId/test", strictRateLimitMiddleware, async (c) => {
+		const providerId = c.req.param("providerId").trim();
+		const provider = getImageGenerationProvider(providerId);
+		if (!provider) return c.json({
+			ok: false,
+			error: { message: `Unknown image provider: ${providerId}` }
+		}, 404);
+		if (!provider.isConfigured({ cfg: service.currentConfig })) return c.json({
+			ok: false,
+			error: { message: "Provider credential is not configured" }
+		}, 400);
+		const body = await c.req.json().catch(() => ({}));
+		const modelId = typeof body.modelId === "string" && body.modelId.trim() ? body.modelId.trim() : provider.defaultModel;
+		if (!provider.models.includes(modelId)) return c.json({
+			ok: false,
+			error: { message: `Unknown ${providerId} image model: ${modelId}` }
+		}, 400);
+		const prompt = typeof body.prompt === "string" && body.prompt.trim() ? body.prompt.trim() : "A simple blue circle centered on a white background.";
+		try {
+			const result = await provider.generateImage({
+				provider: providerId,
+				model: modelId,
+				prompt,
+				count: 1,
+				cfg: service.currentConfig,
+				timeoutMs: 12e4
+			});
+			return c.json({
+				ok: true,
+				payload: {
+					providerId,
+					modelId: result.model ?? modelId,
+					images: result.images.map((image) => ({
+						mimeType: image.mimeType,
+						fileName: image.fileName,
+						dataUrl: `data:${image.mimeType};base64,${image.buffer.toString("base64")}`,
+						...image.revisedPrompt ? { revisedPrompt: image.revisedPrompt } : {}
+					}))
+				}
+			});
+		} catch (error) {
+			return c.json({
+				ok: false,
+				error: { message: error instanceof Error ? error.message : String(error) }
+			}, 502);
+		}
+	});
 	authenticated.get("/api/agents/:agentId/image-generation", (c) => {
 		try {
 			return c.json({
@@ -271,7 +451,8 @@ function registerModelsRoutes(authenticated, deps) {
 		const resolver = new CredentialResolver();
 		const previousKey = await resolver.revealGatewayStoredApiKey(prepared.providerId);
 		const suppliedKey = typeof body.apiKey === "string" ? body.apiKey.trim() : "";
-		if (!(suppliedKey || await resolver.resolveApiKey(prepared.providerId))) return c.json({
+		const effectiveKey = suppliedKey || await resolver.resolveApiKey(prepared.providerId);
+		if (getImageGenerationProvider(prepared.providerId).credentialMode !== "none" && !effectiveKey) return c.json({
 			ok: false,
 			error: { message: "API key is required" }
 		}, 400);

package/dist/src/gateway/hono/routes/workflows.js

@@ -7,9 +7,9 @@ import { messagesToClientHistory } from "../../../session/client-history.js";
 import "../../../workflows/domain/index.js";
 import { resolveWorkflowRunArtifactsDir } from "../../../workflows/store/paths.js";
 import { WorkflowDraftService } from "../../../workflows/draft/workflow-draft-service.js";
-import "../../../workflows/draft/index.js";
 import { WorkflowDraftConflictError, WorkflowDraftStore } from "../../../workflows/authoring/workflow-draft-store.js";
 import "../../../workflows/authoring/index.js";
+import "../../../workflows/draft/index.js";
 import { basename, join } from "node:path";
 import { readFile, stat } from "node:fs/promises";
 //#region src/gateway/hono/routes/workflows.ts

package/dist/src/gateway/image-generation-setup.js

@@ -64,7 +64,13 @@ function prepareImageGenerationSetup(config, agentIdRaw, input) {
 		}
 	};
 	const entry = next.agents.list[index];
-	entry.models.imageGenerationModel = { primary: `${providerId}/${modelId}` };
+	entry.models = {
+		...entry.models ?? {
+			defaultRole: resolveEffectiveAgentManifestForAgent(config, agentId).models.defaultRole,
+			roles: {}
+		},
+		imageGenerationModel: { primary: `${providerId}/${modelId}` }
+	};
 	const parsed = ConfigSchema.safeParse(next);
 	if (!parsed.success) return {
 		ok: false,

package/dist/src/gateway/service/config-coordinator.js

@@ -3,6 +3,7 @@ import { init_logger } from "../../utils/logger.js";
 import { loadConfig, saveConfig } from "../../config/loader.js";
 import { getModelRegistry } from "../../providers/model-registry.js";
 import { init_providers } from "../../providers/index.js";
+import { reloadImageGenerationProviders } from "../../agent/image/generation/provider-registry.js";
 import { disposeAllSessionMcpRuntimes } from "../../agent/mcp/bundle-mcp-runtime.js";
 import "../../agent/mcp/bundle-mcp-tools.js";
 import { ConfigHotReloader } from "../../config/reload.js";
@@ -214,6 +215,7 @@ var GatewayConfigCoordinator = class {
 		log.debug("Reloading models config...");
 		this.opts.setConfig(newConfig);
 		getModelRegistry().refresh();
+		reloadImageGenerationProviders();
 		this.opts.emit("config.reload", { section: "models" });
 		log.debug("Models config reloaded");
 	}

package/dist/src/gateway/service.js

@@ -37,11 +37,11 @@ import { AgentService } from "../agent/service.js";
 import { ensureStarterAgentsInitialized } from "../agent/starter-agents.js";
 import { AutomationService } from "../automations/service/automation-service.js";
 import "../automations/index.js";
-import { getWorkspacePath } from "../config/workspace-path-helpers.js";
-import "../config/index.js";
 import { setPairingBroadcastSink } from "../channels/pairing/pairing-events.js";
 import { registerClarifyBridge } from "./clarify-runtime.js";
 import { ChannelManager } from "../channels/manager.js";
+import { getWorkspacePath } from "../config/workspace-path-helpers.js";
+import "../config/index.js";
 import { startConnectedKnowledgeCoordinator } from "../knowledge/coordinator.js";
 import "../knowledge/index.js";
 import { startConnectorMemorySyncCoordinator } from "../connectors/memory-sync-coordinator.js";

package/dist/src/heartbeat/index.js

@@ -1,6 +1,6 @@
 import { DEFAULT_ACK_MAX_CHARS, HEARTBEAT_OK, NO_REPLY, shouldSilence, stripHeartbeatToken } from "./tokens.js";
+import { appendCronEventLines } from "./event-prompt.js";
 import { isWithinActiveHours } from "./active-hours.js";
 import { isHeartbeatContentEmpty } from "./content-check.js";
-import { appendCronEventLines } from "./event-prompt.js";
 import { createHeartbeatWake } from "./wake.js";
 export { DEFAULT_ACK_MAX_CHARS, HEARTBEAT_OK, NO_REPLY, appendCronEventLines, createHeartbeatWake, isHeartbeatContentEmpty, isWithinActiveHours, shouldSilence, stripHeartbeatToken };

package/dist/src/media-shared/http/index.d.ts

@@ -7,5 +7,5 @@ export { TimeoutAbortError, isTimeoutAbortError, pickEffectiveTimeoutMs, pickTim
 export { BlockedPrivateNetworkError, assertNotPrivateNetwork, classifyHost, defaultPolicy as defaultPrivateNetworkPolicy, privateNetworkPolicyToSsrfGuardOptions, type HostClass, type PrivateNetworkPolicy, } from './private-network.js';
 export { resolveProviderHttpRequestConfig, type ResolvedProviderHttpDefaults, type ResolveProviderHttpRequestConfigOptions, } from './resolve-provider-http-request-config.js';
 export { ProviderHttpError, assertOk, assertOkOrThrowHttpError, assertOkOrThrowProviderError, createProviderHttpError, extractProviderErrorDetail, extractProviderRequestId, extractVendorErrorFields, formatProviderErrorPayload, formatProviderHttpErrorMessage, readResponseTextLimited, truncateErrorDetail, type ProviderHttpErrorParts, } from './provider-http-errors.js';
-export { createProviderOperationDeadline, fetchWithTimeoutGuarded, getJsonRequest, normalizeBaseUrl, postJsonRequest, postMultipartRequest, waitProviderOperationPollInterval, type FetchWithGuardOptions, type GetJsonRequestOptions, type PostJsonRequestOptions, type PostMultipartRequestOptions, type ProviderHttpRequestConfig, type ProviderOperationDeadline, } from './provider-http.js';
+export { createProviderOperationDeadline, fetchWithTimeoutGuarded, getJsonRequest, normalizeBaseUrl, postJsonRequest, postMultipartRequest, readJsonResponseLimited, waitProviderOperationPollInterval, type FetchWithGuardOptions, type GetJsonRequestOptions, type PostJsonRequestOptions, type PostMultipartRequestOptions, type ProviderHttpRequestConfig, type ProviderOperationDeadline, } from './provider-http.js';
 export { SsrfBlockedError, assertSafeUrl, isPrivateIpAddress, isPrivateIpv4, isPrivateIpv6, type ResolvedSsrfTarget, type SsrfGuardOptions, } from './ssrf-guard.js';

package/dist/src/media-shared/http/index.js

@@ -4,5 +4,5 @@ import { BlockedPrivateNetworkError, assertNotPrivateNetwork, classifyHost, defa
 import { resolveProviderHttpRequestConfig } from "./resolve-provider-http-request-config.js";
 import { ProviderHttpError, assertOk, assertOkOrThrowHttpError, assertOkOrThrowProviderError, createProviderHttpError, extractProviderErrorDetail, extractProviderRequestId, extractVendorErrorFields, formatProviderErrorPayload, formatProviderHttpErrorMessage, readResponseTextLimited, truncateErrorDetail } from "./provider-http-errors.js";
 import { SsrfBlockedError, assertSafeUrl, isPrivateIpAddress, isPrivateIpv4, isPrivateIpv6 } from "./ssrf-guard.js";
-import { createProviderOperationDeadline, fetchWithTimeoutGuarded, getJsonRequest, normalizeBaseUrl, postJsonRequest, postMultipartRequest, waitProviderOperationPollInterval } from "./provider-http.js";
-export { BlockedPrivateNetworkError, ProviderHttpError, SsrfBlockedError, TimeoutAbortError, assertNotPrivateNetwork, assertOk, assertOkOrThrowHttpError, assertOkOrThrowProviderError, assertSafeUrl, classifyHost, collectProviderApiKeysForExecution, createProviderHttpError, createProviderOperationDeadline, defaultPolicy as defaultPrivateNetworkPolicy, executeWithApiKeyRotation, extractProviderErrorDetail, extractProviderRequestId, extractVendorErrorFields, fetchWithTimeoutGuarded, formatProviderErrorPayload, formatProviderHttpErrorMessage, getJsonRequest, isPrivateIpAddress, isPrivateIpv4, isPrivateIpv6, isRotatableAuthFailure, isTimeoutAbortError, normalizeBaseUrl, pickEffectiveTimeoutMs, pickTimeoutMsOrFallback, postJsonRequest, postMultipartRequest, privateNetworkPolicyToSsrfGuardOptions, readResponseTextLimited, resolveDeadline, resolveProviderHttpRequestConfig, truncateErrorDetail, waitProviderOperationPollInterval };
+import { createProviderOperationDeadline, fetchWithTimeoutGuarded, getJsonRequest, normalizeBaseUrl, postJsonRequest, postMultipartRequest, readJsonResponseLimited, waitProviderOperationPollInterval } from "./provider-http.js";
+export { BlockedPrivateNetworkError, ProviderHttpError, SsrfBlockedError, TimeoutAbortError, assertNotPrivateNetwork, assertOk, assertOkOrThrowHttpError, assertOkOrThrowProviderError, assertSafeUrl, classifyHost, collectProviderApiKeysForExecution, createProviderHttpError, createProviderOperationDeadline, defaultPolicy as defaultPrivateNetworkPolicy, executeWithApiKeyRotation, extractProviderErrorDetail, extractProviderRequestId, extractVendorErrorFields, fetchWithTimeoutGuarded, formatProviderErrorPayload, formatProviderHttpErrorMessage, getJsonRequest, isPrivateIpAddress, isPrivateIpv4, isPrivateIpv6, isRotatableAuthFailure, isTimeoutAbortError, normalizeBaseUrl, pickEffectiveTimeoutMs, pickTimeoutMsOrFallback, postJsonRequest, postMultipartRequest, privateNetworkPolicyToSsrfGuardOptions, readJsonResponseLimited, readResponseTextLimited, resolveDeadline, resolveProviderHttpRequestConfig, truncateErrorDetail, waitProviderOperationPollInterval };

package/dist/src/media-shared/http/provider-http.d.ts

@@ -39,6 +39,8 @@ export interface GetJsonRequestOptions extends ProviderHttpRequestConfig {
     headers?: Record<string, string> | Headers;
 }
 export declare function getJsonRequest(url: string | URL, options: GetJsonRequestOptions): Promise<Response>;
+/** Read and parse a JSON response without allowing an unbounded body allocation. */
+export declare function readJsonResponseLimited(response: Response, maxBytes: number): Promise<unknown>;
 /**
  * Normalize a base URL: trim trailing slash, force http(s) scheme.
  */

package/dist/src/media-shared/http/provider-http.js

@@ -49,7 +49,8 @@ async function postJsonRequest(url, options) {
 		init: {
 			method: "POST",
 			headers,
-			body: JSON.stringify(options.body)
+			body: JSON.stringify(options.body),
+			redirect: "error"
 		}
 	});
 	await assertOkOrThrowProviderError(response, options.label);
@@ -62,7 +63,8 @@ async function postMultipartRequest(url, options) {
 		init: {
 			method: "POST",
 			headers,
-			body: options.body
+			body: options.body,
+			redirect: "error"
 		}
 	});
 	await assertOkOrThrowProviderError(response, options.label);
@@ -75,12 +77,49 @@ async function getJsonRequest(url, options) {
 		...options,
 		init: {
 			method: "GET",
-			headers
+			headers,
+			redirect: "error"
 		}
 	});
 	await assertOkOrThrowProviderError(response, options.label);
 	return response;
 }
+/** Read and parse a JSON response without allowing an unbounded body allocation. */
+async function readJsonResponseLimited(response, maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new Error("JSON response byte limit must be a positive safe integer.");
+	const declaredLength = Number.parseInt(response.headers.get("content-length") ?? "", 10);
+	if (Number.isFinite(declaredLength) && declaredLength > maxBytes) throw new Error(`Provider JSON response exceeds ${maxBytes} bytes.`);
+	const reader = response.body?.getReader();
+	if (!reader) throw new Error("Provider returned an empty JSON response.");
+	const chunks = [];
+	let total = 0;
+	try {
+		while (true) {
+			const { value, done } = await reader.read();
+			if (done) break;
+			if (!value?.byteLength) continue;
+			total += value.byteLength;
+			if (total > maxBytes) {
+				await reader.cancel().catch(() => {});
+				throw new Error(`Provider JSON response exceeds ${maxBytes} bytes.`);
+			}
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	const body = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		body.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	try {
+		return JSON.parse(new TextDecoder().decode(body));
+	} catch {
+		throw new Error("Provider returned invalid JSON.");
+	}
+}
 /**
 * Normalize a base URL: trim trailing slash, force http(s) scheme.
 */
@@ -107,4 +146,4 @@ async function waitProviderOperationPollInterval(intervalMs, signal) {
 	await setTimeout$1(intervalMs, void 0, { signal });
 }
 //#endregion
-export { createProviderOperationDeadline, fetchWithTimeoutGuarded, getJsonRequest, normalizeBaseUrl, postJsonRequest, postMultipartRequest, waitProviderOperationPollInterval };
+export { createProviderOperationDeadline, fetchWithTimeoutGuarded, getJsonRequest, normalizeBaseUrl, postJsonRequest, postMultipartRequest, readJsonResponseLimited, waitProviderOperationPollInterval };

package/dist/src/providers/model-reference-auditor.d.ts

@@ -11,4 +11,5 @@ export interface ModelReferenceHealth {
 export declare function auditModelReferences(config: Config, sessionConfigs?: ReadonlyMap<string, SessionAgentConfig>, deps?: {
     registry?: ModelRegistry;
     catalog?: ModelCatalogSnapshot;
+    resolveImageGenerationModel?: (ref: string) => boolean;
 }): ModelReferenceHealth[];

package/dist/src/providers/model-reference-auditor.js

@@ -1,22 +1,25 @@
 import { getModelCatalogStore, init_model_catalog_store } from "./model-catalog-store.js";
 import { getModelRegistry, init_model_registry } from "./model-registry.js";
+import { parseImageGenerationModelRef } from "../agent/image/generation/model-ref.js";
+import { getImageGenerationProvider } from "../agent/image/generation/provider-registry.js";
 //#region src/providers/model-reference-auditor.ts
 init_model_catalog_store();
 init_model_registry();
 function asRecord(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
-function addRef(out, value, location) {
+function addRef(out, value, location, kind = "text") {
 	if (typeof value === "string" && value.trim()) out.push({
 		ref: value.trim(),
-		location
+		location,
+		kind
 	});
 }
-function collectToolModel(out, value, location) {
+function collectToolModel(out, value, location, kind = "text") {
 	const model = asRecord(value);
 	if (!model) return;
-	addRef(out, model.primary, `${location}.primary`);
-	if (Array.isArray(model.fallbacks)) model.fallbacks.forEach((ref, index) => addRef(out, ref, `${location}.fallbacks[${index}]`));
+	addRef(out, model.primary, `${location}.primary`, kind);
+	if (Array.isArray(model.fallbacks)) model.fallbacks.forEach((ref, index) => addRef(out, ref, `${location}.fallbacks[${index}]`, kind));
 }
 function collectModelPolicy(out, value, location) {
 	const policy = asRecord(value);
@@ -29,7 +32,7 @@ function collectModelPolicy(out, value, location) {
 		if (Array.isArray(role.fallbacks)) role.fallbacks.forEach((ref, index) => addRef(out, ref, `${location}.roles.${roleId}.fallbacks[${index}]`));
 	}
 	collectToolModel(out, policy.imageModel, `${location}.imageModel`);
-	collectToolModel(out, policy.imageGenerationModel, `${location}.imageGenerationModel`);
+	collectToolModel(out, policy.imageGenerationModel, `${location}.imageGenerationModel`, "image-generation");
 }
 function collectReferences(config, sessionConfigs) {
 	const out = [];
@@ -47,22 +50,29 @@ function suggestedRef(ref, catalog) {
 	const first = source.models.find((model) => model.availability === "available");
 	return first ? `${providerId}/${first.id}` : void 0;
 }
+function hasImageGenerationModel(ref) {
+	const parsed = parseImageGenerationModelRef(ref);
+	if (!parsed) return false;
+	return getImageGenerationProvider(parsed.provider)?.models.includes(parsed.model) ?? false;
+}
 function auditModelReferences(config, sessionConfigs = /* @__PURE__ */ new Map(), deps = {}) {
 	const registry = deps.registry ?? getModelRegistry();
 	const catalog = deps.catalog ?? getModelCatalogStore().load();
+	const resolveImageGenerationModel = deps.resolveImageGenerationModel ?? hasImageGenerationModel;
 	const grouped = /* @__PURE__ */ new Map();
 	for (const reference of collectReferences(config, sessionConfigs)) {
-		const locations = grouped.get(reference.ref) ?? [];
-		locations.push(reference.location);
-		grouped.set(reference.ref, locations);
+		const references = grouped.get(reference.ref) ?? [];
+		references.push(reference);
+		grouped.set(reference.ref, references);
 	}
-	return [...grouped.entries()].map(([ref, locations]) => {
-		const availability = registry.resolve(ref) ? "available" : "unavailable";
-		const suggestion = availability === "unavailable" ? suggestedRef(ref, catalog) : void 0;
+	return [...grouped.entries()].map(([ref, references]) => {
+		const availability = references.every((reference) => reference.kind === "image-generation" ? resolveImageGenerationModel(ref) : Boolean(registry.resolve(ref))) ? "available" : "unavailable";
+		const textOnly = references.every((reference) => reference.kind === "text");
+		const suggestion = availability === "unavailable" && textOnly ? suggestedRef(ref, catalog) : void 0;
 		return {
 			ref,
 			availability,
-			locations,
+			locations: references.map((reference) => reference.location),
 			...suggestion ? { suggestedRef: suggestion } : {}
 		};
 	}).sort((a, b) => a.ref.localeCompare(b.ref));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xopcai/xopc",
-  "version": "0.0.166",
+  "version": "0.0.167",
   "description": "Local-first AI system that remembers context, coordinates AI, and sustains long-term progress.",
   "type": "module",
   "main": "dist/src/index.js",
@@ -100,7 +100,7 @@
     "semver": "^7.8.1",
     "silk-wasm": "^3.7.1",
     "thread-stream": "^4.2.0",
-    "undici": "^8.5.0",
+    "undici": "^8.9.0",
     "uuid": "^14.0.0",
     "ws": "^8.21.0",
     "zod": "^4.4.3"