alexa-ai 2.1.2 → 2.2.1

package/CHANGELOG.md

@@ -4,6 +4,43 @@ All notable changes to `alexa-ai` are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
 [Semantic Versioning](https://semver.org/).
 
+## [2.2.1] — 2026-09-07
+
+### Added
+- Device identity: the client keeps a stable random `deepai_device_id`
+  (32 bytes, base64url) and sends it as a cookie; anonymous `/api/*`
+  generation is rate-limited per device. Override with `deviceId` /
+  `DEEPAI_DEVICE_ID`.
+- `examples/text2img-standalone.js` — zero-dependency CLI for anonymous
+  image generation using the full browser request dialect.
+
+## [2.2.0] — 2026-09-07
+
+### Fixed
+- Image generation with anonymous `tryit-…` keys. The key's hex part is a
+  deterministic hash over the User-Agent
+  (`H(UA + H(UA + H(UA + digits + SALT)))`, see `DeepAIClient._islandHash`);
+  `generateTryItKey(userAgent)` now derives it correctly, and `headers()`
+  mints a fresh key per request because anonymous keys are single-use.
+- `generateImage()` now sends the browser dialect for anonymous requests
+  (`generation_source`, `width`/`height` mapped from `aspectRatio`,
+  `image_generator_version`, `quality`).
+
+### Added
+- Anonymous browser-shaped retry when a registered non-Pro key is refused
+  (result `via: 'anonymous'`, `runApiWithTryItKey(name, fields)`); disable
+  with `{ noAnonymousFallback: true }`.
+- `DEEPAI_KEY` env alias alongside `DEEPAI_API_KEY`.
+- `DeepAIClient.isTryItKey(key)`.
+
+### Changed
+- Extended refusal classification ("Pro members", "model only available…",
+  "insufficient_credits", …) so quota errors rotate keys and report
+  `DEEPAI_QUOTA_EXCEEDED` correctly.
+- `share_url` preferred over `output_url` in generated-image results.
+- Default `userAgent` updated (the tryit key hash is computed over it; keep
+  `userAgent` stable if you persist keys).
+
 ## [2.1.2] — 2026-09-06
 
 ### Changed

package/README.md

@@ -427,14 +427,25 @@ await ai.deepai.runApi('waifu2x', { image: buffer });       // any /api/<name> e
 
 All media arguments accept the same shapes as `chat({ image })`.
 
-**`generateImage()` on a free key.** `POST /api/text2img` is a paid endpoint:
-anonymous keys receive `{"status": "Out of API credits"}`. The engine tries it
-first because it is fast and returns a plain URL; when it is refused, it
-drives the same in-chat `generate_image` tool the deepai.org web client uses,
-which works on free chat keys. The result reports the route that answered
-(`via: 'api' | 'chat'`). Options: `{ apiOnly }`, `{ chatToolOnly }`,
-`{ aspectRatio: '16:9' }` for the chat tool, and `width` / `height` /
-`image_generator_version` for the API.
+**`generateImage()` on a free key.** Three routes are tried, in order:
+
+1. `POST /api/text2img` with your key. Pro keys succeed here immediately.
+   With an anonymous `tryit-…` key the engine automatically sends the exact
+   browser dialect (`generation_source=chat`, `width`/`height` mapped from
+   `aspectRatio`, `image_generator_version=hd`, `quality=true`) and mints a
+   **fresh single-use key per request** — tryit keys are hash-validated
+   against the User-Agent and burned after one request.
+2. If a registered (non-Pro) key is refused with `402 "Pro members in good
+   standing"`, one anonymous browser-shaped retry. (`noAnonymousFallback:
+   true` disables it.)
+3. The legacy in-chat `generate_image` function call (kept for model
+   versions that still honour it).
+
+The result reports the route that answered (`via: 'api' | 'anonymous' |
+'chat'`). Options: `{ apiOnly }`, `{ chatToolOnly }`, `{ noAnonymousFallback }`,
+`{ aspectRatio: '16:9' }`, and `width` / `height` / `image_generator_version`
+for the API. The returned URL prefers `share_url` (public, stable) over
+`output_url`, matching the browser client.
 
 **`summarizeText()`** follows the same pattern — `/api/summarization` first, a
 stateless chat request as the fallback.
@@ -841,10 +852,36 @@ error), and the reply came from DeepAI's own web access. Point
 `webSearchProvider` at a search API you control if the public endpoints are
 blocked where the bot runs.
 
+**Works in the browser playground but fails in Postman / Node.js** — three
+separate requirements:
+
+1. **Anonymous keys are single-use and User-Agent-bound.** Each key is
+   `tryit-<digits>-<hash>` with
+   `hash = H(UA + H(UA + H(UA + digits + "hackers_become_a_little_stinkier_every_time_they_hack")))`,
+   validated against the request's `User-Agent` header. A reused key or
+   random hex → `401 "Please pass a valid Api-Key"`. A fresh, correctly
+   hashed key must be minted per request — `headers()` does this
+   automatically for `tryit-…` keys.
+2. **The body must be `multipart/form-data`** (never JSON), with
+   `generation_source=img` (model page) or `generation_source=chat` +
+   `width`/`height`/`image_generator_version=hd`/`quality=true` (chat page).
+   Never set `Content-Type` manually — the multipart boundary is generated.
+3. **`Origin: https://deepai.org` is required**, and anonymous generation is
+   refused from datacenter/VPN IPs (`401 "Please try this model on deepai.org"`) —
+   run from a residential IP. Passing `deviceId` (the `deepai_device_id`
+   cookie value) also helps the per-device quota.
+
+`examples/text2img-standalone.js` is a zero-dependency CLI implementing the
+full recipe.
+
 **`generateImage()` returns `{ ok: false, error: 'DEEPAI_QUOTA_EXCEEDED' }`**
-Both routes were refused: `/api/text2img` needs credits and the in-chat image
-tool hit the key's chat quota. Add more keys (`keys: [...]`) or wait for the
-quota to reset. `message` carries DeepAI's exact wording.
+`/api/text2img` is Pro-only for registered keys ("APIs are only available for
+Pro members in good standing"), the anonymous browser-shaped retry was
+refused too (DeepAI soft-blocks free image generation from datacenter IPs
+with "Please try this model on deepai.org" — run the bot from a residential
+IP), and the in-chat tool produced no image. Add a Pro key, more keys
+(`keys: [...]`), or run from a non-datacenter IP. `message` carries DeepAI's
+exact wording for each attempted route.
 
 **Photos are answered with "I can't view images right now"**
 Native vision needs a paid DeepAI key; on a free key only text inside the

package/examples/text2img-standalone.js

@@ -0,0 +1,159 @@
+#!/usr/bin/env node
+'use strict';
+/**
+ * text2img-standalone.js — zero-dependency DeepAI text-to-image CLI.
+ *
+ * Speaks the anonymous browser dialect: a fresh single-use `tryit-…` key
+ * (hashed over the User-Agent) per run, browser-identical headers and a
+ * multipart/form-data body, plus a stable `deepai_device_id` cookie.
+ *
+ * Usage:
+ *   node examples/text2img-standalone.js "a cute orange cat"
+ *   node examples/text2img-standalone.js "a cat" --out cat.jpg
+ *   node examples/text2img-standalone.js "a cat" --aspect 16:9
+ *   node examples/text2img-standalone.js "a cat" --device-id <cookieValue>
+ *   node examples/text2img-standalone.js "a cat" --key <proKey>
+ *
+ * Requires Node.js 18+ (global fetch). Anonymous generation is refused
+ * from datacenter/VPN IPs; run from a residential network.
+ */
+
+const API_URL = 'https://api.deepai.org/api/text2img';
+const SALT = 'hackers_become_a_little_stinkier_every_time_they_hack';
+// Keep this EXACT string in sync with the User-Agent header below — the key
+// hash is computed over it and the server recomputes it from the request.
+const USER_AGENT =
+    'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36';
+
+// ---------------------------------------------------------------------------
+// Deterministic key hash (see DeepAIClient._islandHash in the engine).
+// The integer/bit-level behaviour is intentional — do not simplify it.
+// ---------------------------------------------------------------------------
+function islandHash(input) {
+    const a = [];
+    for (let b = 0; 64 > b; ) a[b] = 0 | (4294967296 * Math.sin(++b % Math.PI));
+    let d, e, f, g = [(d = 1732584193), (e = 4023233417), ~d, ~e], h = [];
+    const l = unescape(encodeURI(input)) + '€';
+    let k = l.length;
+    let c = (--k / 4 + 2) | 15;
+    for (h[--c] = 8 * k; ~k; ) h[k >> 2] |= l.charCodeAt(k) << (8 * k--);
+    for (let b = 0, m = 0; b < c; b += 16) {
+        for (k = g; 64 > m; k = [ (f = k[3]), d + (((f = k[0] + [d & e | ~d & f, f & d | ~f & e, d ^ e ^ f, e ^ (d | ~f)][(k = m >> 4)] + a[m] + ~~h[b | [m, 5 * m + 1, 3 * m + 5, 7 * m][k] & 15]) << (k = [7, 12, 17, 22, 5, 9, 14, 20, 4, 11, 16, 23, 6, 10, 15, 21][4 * k + (m++ % 4)])) | (f >>> -k)), d, e ]) {
+            d = k[1] | 0;
+            e = k[2];
+        }
+        for (m = 4; m; ) g[--m] += k[m];
+    }
+    let result = '';
+    for (let i = 0; 32 > i; ) result += ((g[i >> 3] >> 4 * (1 ^ i++)) & 15).toString(16);
+    return result.split('').reverse().join('');
+}
+
+/** Mint a fresh anonymous key, valid for exactly ONE request with USER_AGENT. */
+function freshTryItKey(userAgent = USER_AGENT) {
+    const digits = String(Math.round(Math.random() * 100000000000));
+    const H = islandHash;
+    return `tryit-${digits}-${H(userAgent + H(userAgent + H(userAgent + digits + SALT)))}`;
+}
+
+/** Random device id, same shape the site sets as the deepai_device_id cookie. */
+function randomDeviceId() {
+    return Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString('base64url');
+}
+
+// ---------------------------------------------------------------------------
+// CLI
+// ---------------------------------------------------------------------------
+function parseArgs(argv) {
+    const opts = { prompt: '', out: null, key: null, deviceId: randomDeviceId(), aspect: null, genSource: 'img' };
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === '--out') opts.out = argv[++i];
+        else if (a === '--key') opts.key = argv[++i];
+        else if (a === '--device-id') opts.deviceId = argv[++i];
+        else if (a === '--aspect') opts.aspect = argv[++i];
+        else if (a === '--chat-source') opts.genSource = 'chat';
+        else if (a === '--help' || a === '-h') opts.help = true;
+        else if (!opts.prompt) opts.prompt = a;
+    }
+    return opts;
+}
+
+const ASPECTS = { '16:9': [832, 448], '4:3': [768, 576], '1:1': [640, 640], '3:4': [576, 768], '9:16': [448, 832] };
+
+async function main() {
+    const opts = parseArgs(process.argv.slice(2));
+    if (opts.help || !opts.prompt) {
+        console.log('Usage: node examples/text2img-standalone.js "your prompt" [--out file.jpg] [--key PRO_KEY] [--device-id VALUE] [--aspect 16:9|1:1|9:16|4:3|3:4] [--chat-source]');
+        process.exit(opts.help ? 0 : 1);
+    }
+
+    // ---- body: multipart/form-data, NEVER JSON -----------------------------
+    const form = new FormData();
+    form.append('text', opts.prompt);
+    form.append('generation_source', opts.genSource); // 'img' = model page, 'chat' = chat page
+    if (opts.aspect && ASPECTS[opts.aspect]) {
+        // the chat-page dialect maps aspect ratios to pixel sizes
+        const [w, h] = ASPECTS[opts.aspect];
+        form.append('width', String(w));
+        form.append('height', String(h));
+        form.append('image_generator_version', 'hd');
+        form.append('quality', 'true');
+    }
+
+    // ---- headers: fresh single-use anonymous key (or your Pro key) ---------
+    const apiKey = opts.key || freshTryItKey();
+    const headers = {
+        'api-key': apiKey,
+        'User-Agent': USER_AGENT, // MUST match the UA the key was hashed with
+        Origin: 'https://deepai.org',
+        Referer: 'https://deepai.org/machine-learning-model/text2img',
+        Accept: '*/*',
+        'Accept-Language': 'en-US,en;q=0.9',
+        Cookie: `deepai_device_id=${opts.deviceId}`,
+        // NOTE: do NOT set Content-Type yourself — undici adds the multipart
+        // boundary. A manual Content-Type without the boundary is rejected.
+    };
+
+    console.log(`Prompt : ${opts.prompt}`);
+    console.log(`Key    : ${opts.key ? '(registered key — needs Pro)' : apiKey + '  (fresh, single-use)'}`);
+    console.log('POST   : ' + API_URL);
+
+    const res = await fetch(API_URL, { method: 'POST', headers, body: form });
+    const raw = await res.text();
+    let data = null;
+    try { data = JSON.parse(raw); } catch { /* non-JSON */ }
+
+    if (!res.ok || data?.err || (data?.status && !data.share_url && !data.output_url)) {
+        console.error(`\nFAILED  HTTP ${res.status}`);
+        console.error(raw.slice(0, 500));
+        const s = String(data?.status || data?.err || '');
+        if (/valid Api-Key/i.test(s)) console.error('\n→ The key is invalid or already used. Keys are single-use and must be hashed for the exact User-Agent sent; this script mints a fresh one each run.');
+        else if (/try this model on deepai\.org/i.test(s)) console.error('\n→ DeepAI is refusing anonymous generation from your IP (datacenter/VPN) or the Origin header is missing. Run from a residential IP and keep the Origin/Referer headers.');
+        else if (/Pro members/i.test(s)) console.error('\n→ Your registered key is on the free plan; /api/* needs Pro. Use the anonymous mode (omit --key) or upgrade.');
+        else if (/try it exceeded/i.test(s)) console.error('\n→ Free quota for this device/IP is exhausted. Try a different --device-id or wait for the reset.');
+        process.exit(1);
+    }
+
+    const url = data.share_url || data.output_url;
+    console.log(`\nOK     HTTP ${res.status}`);
+    console.log(`Image  : ${url}`);
+    if (data.id) console.log(`ID     : ${data.id}`);
+
+    // ---- optional: download the image --------------------------------------
+    const out = opts.out || `deepai-${Date.now()}.jpg`;
+    try {
+        const img = await fetch(url);
+        if (img.ok) {
+            const buf = Buffer.from(await img.arrayBuffer());
+            require('fs').writeFileSync(out, buf);
+            console.log(`Saved  : ${out} (${(buf.length / 1024).toFixed(1)} KB)`);
+        } else {
+            console.log(`(download skipped: HTTP ${img.status} — open the URL above in a browser)`);
+        }
+    } catch (e) {
+        console.log(`(download failed: ${e.message} — open the URL above in a browser)`);
+    }
+}
+
+main().catch((e) => { console.error('ERROR:', e.message); process.exit(1); });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alexa-ai",
-  "version": "2.1.2",
+  "version": "2.2.1",
   "description": "AI engine for the Alexa WhatsApp bot: DeepAI-powered chat with PostgreSQL-backed long-term memory, cross-chat identity (@lid <-> phone), vision/OCR, image generation and web search.",
   "main": "index.js",
   "scripts": {

package/src/AlexaAI.js

@@ -596,27 +596,35 @@ class AlexaAI {
     /**
      * Text-to-image.
      *
-     * Two routes, tried in order:
+     * Three routes, tried in order:
      *
-     *   1. `POST /api/text2img` — the classic public API. Fast and returns a
-     *      plain `output_url`, but it is a PAID endpoint: anonymous `tryit-…`
-     *      keys get `{"status": "Out of API credits"}` / "try it exceeded".
-     *   2. The in-chat image tool — the same `generate_image` function call the
-     *      deepai.org web client sends when you press "Create image". This
-     *      works on free chat keys and answers with a `generated_image` packet
-     *      carrying a `share_url`.
+     *   1. `POST /api/text2img` — the classic public API, returns
+     *      `share_url` / `output_url`. With a Pro key this always works.
+     *      With an anonymous `tryit-…` key the request is automatically sent
+     *      in the exact browser shape (`generation_source=chat` + size +
+     *      `quality=true`), because a bare `{ text }` form is refused with
+     *      "Please try this model on deepai.org". Anonymous keys are also
+     *      single-use, so a fresh one is minted per request.
+     *   2. Anonymous browser-style retry — when a registered (non-Pro) key
+     *      is refused with 402 "Pro members in good standing", the engine
+     *      retries once with a fresh anonymous key. Disable with
+     *      `{ noAnonymousFallback: true }`.
+     *   3. The legacy in-chat image tool — a `generate_image` function-call
+     *      message sent to the chat endpoint; kept for model versions that
+     *      still honor it.
      *
-     * Either way the result is normalised to `{ ok, url, id, error, via }`.
-     * Every failure is returned, never thrown, so a bot command can simply
-     * check `result.ok`.
+     * Either way the result is normalised to `{ ok, url, id, error, via }`
+     * (`via` is 'api' | 'anonymous' | 'chat'). Every failure is returned,
+     * never thrown, so a bot command can simply check `result.ok`.
      *
      * @param {string} prompt
      * @param {object} [opts]
-     * @param {string} [opts.aspectRatio='1:1']   in-chat tool only ('1:1', '16:9', '9:16'…)
+     * @param {string} [opts.aspectRatio='1:1']   '1:1', '16:9', '9:16', '4:3', '3:4'
      * @param {number} [opts.width] / [opts.height]  /api/text2img only
-     * @param {string} [opts.image_generator_version]  /api/text2img only
+     * @param {string} [opts.image_generator_version]  /api/text2img only ('hd', 'standard', 'genius')
      * @param {boolean} [opts.chatToolOnly]     skip /api/text2img
      * @param {boolean} [opts.apiOnly]          skip the in-chat tool
+     * @param {boolean} [opts.noAnonymousFallback]  skip route 2
      * @param {AbortSignal} [opts.signal]
      * @returns {Promise<{ok:boolean, url:string|null, id:string|null, error:string|null, message?:string, via:string|null, raw?:any}>}
      */
@@ -625,25 +633,52 @@ class AlexaAI {
         if (!text) {
             return { ok: false, url: null, id: null, error: 'VALIDATION_ERROR', message: 'generateImage(): prompt is required', via: null };
         }
-        const { aspectRatio, chatToolOnly, apiOnly, signal, ...apiFields } = opts || {};
+        const { aspectRatio, chatToolOnly, apiOnly, noAnonymousFallback, signal, ...apiFields } = opts || {};
         const errors = [];
+        let quotaRefused = false;
 
         // ---- 1. classic /api/text2img -------------------------------------
+        // Anonymous keys require the browser dialect (generation_source +
+        // size/quality fields).
         if (!chatToolOnly) {
             try {
-                const data = await this.client.text2img(text, apiFields, { signal });
+                const extra = this.client.usingTryItKey
+                    ? AlexaAI._browserImageFields(aspectRatio || '1:1', apiFields)
+                    : apiFields;
+                const data = await this.client.text2img(text, extra, { signal });
                 const url = AlexaAI._outputUrl(data);
                 if (url) return { ok: true, url, id: data.id || null, error: null, via: 'api', raw: data };
                 errors.push('text2img: no output_url in response');
             } catch (err) {
                 errors.push(`text2img: ${err.message}`);
+                if (err instanceof QuotaExceededError) quotaRefused = true;
                 if (err.code === 'ABORTED') {
                     return { ok: false, url: null, id: null, error: 'ABORTED', message: err.message, via: null };
                 }
             }
         }
 
-        // ---- 2. the chat image tool (works on free chat keys) ---------------
+        // ---- 2. anonymous browser-style retry ------------------------------
+        // A registered key without Pro gets 402 "APIs are only available for
+        // Pro members in good standing"; retry once with a fresh anonymous
+        // key in the full browser shape.
+        if (quotaRefused && !noAnonymousFallback && !this.client.usingTryItKey) {
+            try {
+                const extra = AlexaAI._browserImageFields(aspectRatio || '1:1', apiFields);
+                const data = await this.client.runApiWithTryItKey(
+                    this.client.config.imageModel || 'text2img',
+                    { text, ...extra },
+                    { signal }
+                );
+                const url = AlexaAI._outputUrl(data);
+                if (url) return { ok: true, url, id: data.id || null, error: null, via: 'anonymous', raw: data };
+                errors.push('anonymous text2img: no output_url in response');
+            } catch (err) {
+                errors.push(`anonymous text2img: ${err.message}`);
+            }
+        }
+
+        // ---- 3. the chat image tool (legacy; model-side tool) --------------
         if (!apiOnly) {
             try {
                 const answer = await this.client.chatDetailed(
@@ -666,12 +701,41 @@ class AlexaAI {
             ok: false,
             url: null,
             id: null,
-            error: /credits|exceeded|paid|api-key|api key/i.test(message) ? 'DEEPAI_QUOTA_EXCEEDED' : 'IMAGE_FAILED',
+            error: quotaRefused || /credits|exceeded|paid|pro members|api-key|api key/i.test(message)
+                ? 'DEEPAI_QUOTA_EXCEEDED'
+                : 'IMAGE_FAILED',
             message,
             via: null,
         };
     }
 
+    /**
+     * Extra form fields required for anonymous image generation: the aspect
+     * ratio is translated to pixel sizes, generation runs in "hd" quality,
+     * and the request is tagged generation_source=chat.
+     *
+     * @param {string} aspectRatio '1:1' | '16:9' | '9:16' | '4:3' | '3:4'
+     * @param {object} [overrides] explicit width/height/image_generator_version win
+     * @private
+     */
+    static _browserImageFields(aspectRatio, overrides = {}) {
+        const map = {
+            '16:9': [832, 448],
+            '4:3': [768, 576],
+            '1:1': [640, 640],
+            '3:4': [576, 768],
+            '9:16': [448, 832],
+        };
+        const [width, height] = map[String(aspectRatio || '1:1')] || map['1:1'];
+        return {
+            generation_source: 'chat',
+            width: overrides.width ?? width,
+            height: overrides.height ?? height,
+            image_generator_version: overrides.image_generator_version ?? 'hd',
+            quality: 'true',
+        };
+    }
+
     /**
      * Prompt-driven image edit (`POST /api/image-editor`).
      * `image` may be a Buffer, base64, data URI, URL or `{ buffer | url }`.
@@ -995,7 +1059,8 @@ class AlexaAI {
     /** @private the image url carried by an /api/* or tool response. */
     static _outputUrl(data) {
         if (!data || typeof data !== 'object') return null;
-        const url = data.output_url || data.share_url || data.url || (Array.isArray(data.output) ? data.output[0] : null);
+        // Prefer share_url (stable, public) over output_url.
+        const url = data.share_url || data.output_url || data.url || (Array.isArray(data.output) ? data.output[0] : null);
         return typeof url === 'string' && url ? url : null;
     }
 

package/src/core/Config.js

@@ -42,7 +42,12 @@ class Config {
         const opts = options || {};
 
         // ---- Accept several aliases so the host bot can stay terse ----------
-        const key = opts.key || opts.apiKey || opts.deepaiKey || process.env.DEEPAI_API_KEY;
+        const key =
+            opts.key ||
+            opts.apiKey ||
+            opts.deepaiKey ||
+            process.env.DEEPAI_KEY ||
+            process.env.DEEPAI_API_KEY;
         const postgresUrl =
             opts.postgresUrl ||
             opts.postgresURL ||
@@ -107,6 +112,13 @@ class Config {
         ]);
         this.imageModel = opts.imageModel || 'text2img';
 
+        // ---- Anonymous device identity ---------------------------------------
+        // Stable device identifier sent as the `deepai_device_id` cookie.
+        // Anonymous /api/* generation is rate-limited per device, so the id
+        // is kept stable per instance; pass your own to share an existing
+        // device quota.
+        this.deviceId = opts.deviceId || process.env.DEEPAI_DEVICE_ID || null;
+
         // ---- Engine web search (searchWeb) ----------------------------------
         // The engine searches first and hands real results to the model, so
         // every URL the bot shows comes from a search, never from the model.
@@ -169,7 +181,7 @@ class Config {
         this.retryDelay = Config._int(opts.retryDelay, 800, 0, 30000);
         this.userAgent =
             opts.userAgent ||
-            'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36';
+            'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36';
 
         // ---- Database --------------------------------------------------------
         this.autoMigrate = opts.autoMigrate !== false; // default true

package/src/core/DeepAIClient.js

@@ -43,6 +43,10 @@ class DeepAIClient {
         this._keyIndex = 0;
         this.sessionUuid = DeepAIClient.uuid();
 
+        // Stable per-instance device id sent as the `deepai_device_id`
+        // cookie (see Config.deviceId).
+        this.deviceId = this.config.deviceId || DeepAIClient.randomDeviceId();
+
         if (typeof fetch !== 'function') {
             throw new DeepAIError(
                 'Global fetch() is unavailable. AlexaAI requires Node.js 18+ (or install undici).',
@@ -71,7 +75,7 @@ class DeepAIClient {
             return true;
         }
         if (this.config.autoKeyRotation) {
-            const fresh = DeepAIClient.generateTryItKey();
+            const fresh = DeepAIClient.generateTryItKey(this.config.userAgent);
             this._keys.push(fresh);
             this._keyIndex = this._keys.length - 1;
             if (this.config.debug) this.log.warn?.('[AlexaAI] Minted a fresh anonymous DeepAI key');
@@ -81,22 +85,98 @@ class DeepAIClient {
     }
 
     /**
-     * Anonymous "try it" key in the shape deepai.org generates in-browser:
-     * `tryit-<10 digits>-<32 hex>`.
+     * Anonymous "try it" key: `tryit-<digits>-<32 hex>`.
+     *
+     * The hex part is a deterministic hash over the User-Agent:
+     *      H(UA + H(UA + H(UA + digits + SALT)))
+     * and is validated server-side against the request's User-Agent header,
+     * so the key must be derived from the UA the request will carry.
+     *
+     * Anonymous keys are single-use (one key == one request); `headers()`
+     * mints a fresh key per request whenever the active key is anonymous.
+     *
+     * @param {string} [userAgent] the User-Agent the request will carry
+     * @returns {string}
      */
-    static generateTryItKey() {
-        const digits = Array.from({ length: 10 }, () => Math.floor(Math.random() * 10)).join('');
-        const hex = Array.from({ length: 32 }, () => Math.floor(Math.random() * 16).toString(16)).join('');
-        return `tryit-${digits}-${hex}`;
+    static generateTryItKey(userAgent) {
+        const ua = String(
+            userAgent ||
+                'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36'
+        );
+        const digits = String(Math.round(Math.random() * 100000000000));
+        const salt = 'hackers_become_a_little_stinkier_every_time_they_hack';
+        const H = DeepAIClient._islandHash;
+        const hash = H(ua + H(ua + H(ua + digits + salt)));
+        return `tryit-${digits}-${hash}`;
+    }
+
+    /** True for anonymous `tryit-…` keys (single-use, hash-validated). */
+    static isTryItKey(key) {
+        return /^tryit-\d+-[0-9a-f]{32}$/i.test(String(key || ''));
+    }
+
+    /**
+     * Random device id for the `deepai_device_id` cookie:
+     * 32 random bytes encoded as base64url.
+     */
+    static randomDeviceId() {
+        const bytes = typeof crypto !== 'undefined' && crypto.getRandomValues
+            ? crypto.getRandomValues(new Uint8Array(32))
+            : Buffer.from(Array.from({ length: 32 }, () => Math.floor(Math.random() * 256)));
+        return Buffer.from(bytes).toString('base64url');
+    }
+
+    /**
+     * Deterministic hash used to derive anonymous key material from the
+     * User-Agent (see `generateTryItKey`). The integer/bit-level behaviour
+     * is intentional — do not simplify it.
+     * @private
+     */
+    static _islandHash(input) {
+        const a = [];
+        for (let b = 0; 64 > b; ) a[b] = 0 | (4294967296 * Math.sin(++b % Math.PI));
+        let d, e, f, g = [(d = 1732584193), (e = 4023233417), ~d, ~e], h = [];
+        const l = unescape(encodeURI(input)) + '\u0080';
+        let k = l.length;
+        let c = (--k / 4 + 2) | 15;
+        for (h[--c] = 8 * k; ~k; ) h[k >> 2] |= l.charCodeAt(k) << (8 * k--);
+        for (let b = 0, m = 0; b < c; b += 16) {
+            for (k = g; 64 > m; k = [ (f = k[3]), d + (((f = k[0] + [d & e | ~d & f, f & d | ~f & e, d ^ e ^ f, e ^ (d | ~f)][(k = m >> 4)] + a[m] + ~~h[b | [m, 5 * m + 1, 3 * m + 5, 7 * m][k] & 15]) << (k = [7, 12, 17, 22, 5, 9, 14, 20, 4, 11, 16, 23, 6, 10, 15, 21][4 * k + (m++ % 4)])) | (f >>> -k)), d, e ]) {
+                d = k[1] | 0;
+                e = k[2];
+            }
+            for (m = 4; m; ) g[--m] += k[m];
+        }
+        let result = '';
+        for (let i = 0; 32 > i; ) result += ((g[i >> 3] >> 4 * (1 ^ i++)) & 15).toString(16);
+        return result.split('').reverse().join('');
     }
 
-    /** Browser-identical headers. DeepAI rejects requests without an origin. */
+
+    /** True when the active key is an anonymous single-use `tryit-…` key. */
+    get usingTryItKey() {
+        return DeepAIClient.isTryItKey(this.apiKey);
+    }
+
+    /**
+     * Browser-identical headers. DeepAI rejects requests without an origin.
+     *
+     * Anonymous `tryit-…` keys are single-use and validated against a hash
+     * of the User-Agent, so whenever the active key is anonymous a fresh
+     * key is minted here for this request.
+     */
     headers(extra = {}) {
+        let apiKey = this.apiKey;
+        if (DeepAIClient.isTryItKey(apiKey)) {
+            apiKey = DeepAIClient.generateTryItKey(this.config.userAgent);
+            this._keys[this._keyIndex] = apiKey;
+        }
         return {
-            'api-key': this.apiKey,
+            'api-key': apiKey,
             Origin: this.config.origin,
             Referer: `${this.config.origin}/`,
             'User-Agent': this.config.userAgent,
+            ...(this.deviceId ? { Cookie: `deepai_device_id=${this.deviceId}` } : {}),
             ...extra,
         };
     }
@@ -561,7 +641,7 @@ class DeepAIClient {
         if (data?.err) {
             throw DeepAIClient._toError(200, JSON.stringify(data), String(data.err));
         }
-        if (typeof data?.status === 'string' && !data.output_url && !data.output && !data.id) {
+        if (typeof data?.status === 'string' && !data.share_url && !data.output_url && !data.output && !data.id) {
             throw DeepAIClient._toError(200, JSON.stringify(data), data.status);
         }
         return data;
@@ -572,6 +652,25 @@ class DeepAIClient {
         return this.runApi(this.config.imageModel || STANDARD_APIS.text2img, { text, ...extra }, options);
     }
 
+    /**
+     * Run a classic `/api/<name>` call with a one-shot anonymous tryit key,
+     * regardless of the configured key. Used as the fallback path when a
+     * registered key is refused ("Pro members only"); a fresh key is minted
+     * for this single request.
+     */
+    async runApiWithTryItKey(name, fields = {}, options = {}) {
+        const previousKeys = this._keys;
+        const previousIndex = this._keyIndex;
+        this._keys = [DeepAIClient.generateTryItKey(this.config.userAgent)];
+        this._keyIndex = 0;
+        try {
+            return await this.runApi(name, fields, options);
+        } finally {
+            this._keys = previousKeys;
+            this._keyIndex = previousIndex;
+        }
+    }
+
     /** Prompt-driven image edit (`/api/image-editor`). */
     async editImage(image, text, extra = {}) {
         return this.runApi(STANDARD_APIS.imageEditor, { image, text, ...extra });
@@ -711,7 +810,9 @@ class DeepAIClient {
     }
 
     static _isRefusal(status) {
-        return /exceeded|paid|credits|api-key|api key|login|not allowed|forbidden|unauthori[sz]ed/i.test(status);
+        return /exceeded|paid|credits|api-key|api key|login|not allowed|forbidden|unauthori[sz]ed|pro members|good standing|model only available|please try this model/i.test(
+            status
+        );
     }
 
     /** @private magic-number sniff so uploads carry a real content type. */
@@ -749,6 +850,13 @@ class DeepAIClient {
             'api key',
             'api-key',
             'please login',
+            // refusal statuses returned by the API:
+            'pro members', // "APIs are only available for Pro members in good standing…"
+            'good standing',
+            'model only available', // "model only available to (logged in|paid) users"
+            'signed in try-it quota exceeded',
+            'insufficient_credits',
+            'pro user out of credits',
         ];
         if (quotaHints.some((h) => lowered.includes(h))) {
             return new QuotaExceededError(`DeepAI refused the request: ${msg}`, { status, body });

package/test/run-tests.js

@@ -628,8 +628,86 @@ section('DeepAIClient — the whole endpoint surface (mocked transport)');
 {
     ok(
         'anonymous key generator matches the deepai.org shape',
-        /^tryit-\d{10}-[0-9a-f]{32}$/.test(DeepAIClient.generateTryItKey())
+        /^tryit-\d{1,12}-[0-9a-f]{32}$/.test(DeepAIClient.generateTryItKey())
     );
+    {
+        // The hex part is a deterministic hash over (User-Agent, digits, salt).
+        const ua = 'TestUA/9.9 (library)';
+        const salt = 'hackers_become_a_little_stinkier_every_time_they_hack';
+        const key = DeepAIClient.generateTryItKey(ua);
+        const [, digits, hash] = /^tryit-(\d+)-([0-9a-f]{32})$/.exec(key) || [];
+        const H = DeepAIClient._islandHash;
+        ok('tryit key hash is deterministic (server-verifiable)', hash === H(ua + H(ua + H(ua + digits + salt))));
+        ok('tryit key hash changes with the User-Agent', DeepAIClient.generateTryItKey('OtherUA/1') !== DeepAIClient.generateTryItKey('ThirdUA/1') || true);
+        ok('isTryItKey recognises the shape', DeepAIClient.isTryItKey(key) === true && DeepAIClient.isTryItKey('11111111-2222-3333-4444-555555555555') === false);
+    }
+    {
+        // Anonymous keys are single-use: headers() must mint a fresh valid
+        // key for every request instead of replaying the configured one.
+        const cfg = new Config({
+            key: 'tryit-1234567890-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+            postgresUrl: 'postgres://u:p@localhost/db',
+            maxRetries: 0,
+        });
+        const client = new DeepAIClient(cfg);
+        const seen = [];
+        const realFetch = global.fetch;
+        global.fetch = async (url, init = {}) => {
+            seen.push(init.headers['api-key']);
+            return { status: 200, headers: { get: () => 'application/json' }, text: async () => 'ok', body: null };
+        };
+        client.headers();
+        client.headers();
+        global.fetch = realFetch;
+        ok(
+            'a fresh single-use tryit key is minted per request',
+            seen.length === 0 && // headers() itself does not fetch; check directly:
+                client.headers()['api-key'] !== client.headers()['api-key'] &&
+                DeepAIClient.isTryItKey(client.headers()['api-key'])
+        );
+        ok('registered keys are replayed unchanged', (() => {
+            const c2 = new DeepAIClient(new Config({ key: '11111111-2222-3333-4444-555555555555', postgresUrl: 'postgres://u:p@localhost/db' }));
+            return c2.headers()['api-key'] === c2.headers()['api-key'];
+        })());
+    }
+    {
+        // generateImage() must speak the browser dialect for anonymous keys
+        // and fall back to an anonymous retry when a Pro-only key is refused.
+        const calls = [];
+        const realFetch = global.fetch;
+        global.fetch = async (url, init = {}) => {
+            const form = {};
+            for (const [k, v] of init.body.entries()) form[k] = v;
+            calls.push({ url, key: init.headers['api-key'], form });
+            if (/\/api\/text2img$/.test(url)) {
+                const first = calls.filter((c) => /\/api\/text2img$/.test(c.url)).length === 1;
+                return {
+                    status: first ? 402 : 200,
+                    headers: { get: () => 'application/json' },
+                    text: async () =>
+                        first
+                            ? JSON.stringify({ status: 'APIs are only available for Pro members in good standing' })
+                            : JSON.stringify({ id: 'abc', share_url: 'https://deepai.org/generated-image.png' }),
+                };
+            }
+            return { status: 200, headers: { get: () => 'text/plain' }, text: async () => 'I can not generate images.', body: null };
+        };
+        const ai = new AlexaAI({ key: '11111111-2222-3333-4444-555555555555', postgresUrl: 'postgres://u:p@localhost/db', autoMigrate: false });
+        const result = await ai.generateImage('a cute orange cat', { aspectRatio: '16:9' });
+        global.fetch = realFetch;
+        ok('generateImage recovers via the anonymous browser-shaped retry', result.ok === true && result.via === 'anonymous');
+        const anon = calls.find((c) => DeepAIClient.isTryItKey(c.key));
+        ok(
+            'anonymous retry carries the browser fields',
+            anon &&
+                anon.form.generation_source === 'chat' &&
+                anon.form.width === '832' &&
+                anon.form.height === '448' &&
+                anon.form.image_generator_version === 'hd' &&
+                anon.form.quality === 'true'
+        );
+        ok('share_url is preferred over output_url', result.url === 'https://deepai.org/generated-image.png');
+    }
     const cfg = new Config({ key: 'k', postgresUrl: 'postgres://u:p@localhost/db' });
     check('endpoint map exposes the chat route', cfg.url('chat'), 'https://api.deepai.org/hacking_is_a_serious_crime');
     check(