alexa-ai 2.1.2 → 2.3.0

package/CHANGELOG.md

@@ -4,6 +4,59 @@ All notable changes to `alexa-ai` are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
 [Semantic Versioning](https://semver.org/).
 
+## [2.3.0] — 2026-09-07
+
+### Added
+- **Multiple `/api/*` transports** (`transport` option / `DEEPAI_TRANSPORT`):
+  `'auto'` (default) tries `fetch`, then system `curl`, then a
+  `curl-impersonate` binary (Chrome TLS profile) when one is available;
+  `'fetch' | 'curl' | 'impersonate'` pin a single transport. A refusal of the
+  form "Please try this model on deepai.org" can be specific to the client
+  TLS stack, so `auto` retries that error through the next transport — quota
+  and auth errors are never re-driven. `curlImpersonatePath` /
+  `DEEPAI_CURL_IMPERSONATE` locate the binary.
+- `examples/diagnose.js` — runs the browser-shaped request through every
+  transport with fresh keys and reports which one the network accepts.
+- `examples/text2img-standalone.js` gained `--transport fetch|curl|impersonate`
+  and `--imp <path>`.
+
+## [2.2.1] — 2026-09-07
+
+### Added
+- Device identity: the client keeps a stable random `deepai_device_id`
+  (32 bytes, base64url) and sends it as a cookie; anonymous `/api/*`
+  generation is rate-limited per device. Override with `deviceId` /
+  `DEEPAI_DEVICE_ID`.
+- `examples/text2img-standalone.js` — zero-dependency CLI for anonymous
+  image generation using the full browser request dialect.
+
+## [2.2.0] — 2026-09-07
+
+### Fixed
+- Image generation with anonymous `tryit-…` keys. The key's hex part is a
+  deterministic hash over the User-Agent
+  (`H(UA + H(UA + H(UA + digits + SALT)))`, see `DeepAIClient._islandHash`);
+  `generateTryItKey(userAgent)` now derives it correctly, and `headers()`
+  mints a fresh key per request because anonymous keys are single-use.
+- `generateImage()` now sends the browser dialect for anonymous requests
+  (`generation_source`, `width`/`height` mapped from `aspectRatio`,
+  `image_generator_version`, `quality`).
+
+### Added
+- Anonymous browser-shaped retry when a registered non-Pro key is refused
+  (result `via: 'anonymous'`, `runApiWithTryItKey(name, fields)`); disable
+  with `{ noAnonymousFallback: true }`.
+- `DEEPAI_KEY` env alias alongside `DEEPAI_API_KEY`.
+- `DeepAIClient.isTryItKey(key)`.
+
+### Changed
+- Extended refusal classification ("Pro members", "model only available…",
+  "insufficient_credits", …) so quota errors rotate keys and report
+  `DEEPAI_QUOTA_EXCEEDED` correctly.
+- `share_url` preferred over `output_url` in generated-image results.
+- Default `userAgent` updated (the tryit key hash is computed over it; keep
+  `userAgent` stable if you persist keys).
+
 ## [2.1.2] — 2026-09-06
 
 ### Changed

package/README.md

@@ -427,14 +427,25 @@ await ai.deepai.runApi('waifu2x', { image: buffer });       // any /api/<name> e
 
 All media arguments accept the same shapes as `chat({ image })`.
 
-**`generateImage()` on a free key.** `POST /api/text2img` is a paid endpoint:
-anonymous keys receive `{"status": "Out of API credits"}`. The engine tries it
-first because it is fast and returns a plain URL; when it is refused, it
-drives the same in-chat `generate_image` tool the deepai.org web client uses,
-which works on free chat keys. The result reports the route that answered
-(`via: 'api' | 'chat'`). Options: `{ apiOnly }`, `{ chatToolOnly }`,
-`{ aspectRatio: '16:9' }` for the chat tool, and `width` / `height` /
-`image_generator_version` for the API.
+**`generateImage()` on a free key.** Three routes are tried, in order:
+
+1. `POST /api/text2img` with your key. Pro keys succeed here immediately.
+   With an anonymous `tryit-…` key the engine automatically sends the exact
+   browser dialect (`generation_source=chat`, `width`/`height` mapped from
+   `aspectRatio`, `image_generator_version=hd`, `quality=true`) and mints a
+   **fresh single-use key per request** — tryit keys are hash-validated
+   against the User-Agent and burned after one request.
+2. If a registered (non-Pro) key is refused with `402 "Pro members in good
+   standing"`, one anonymous browser-shaped retry. (`noAnonymousFallback:
+   true` disables it.)
+3. The legacy in-chat `generate_image` function call (kept for model
+   versions that still honour it).
+
+The result reports the route that answered (`via: 'api' | 'anonymous' |
+'chat'`). Options: `{ apiOnly }`, `{ chatToolOnly }`, `{ noAnonymousFallback }`,
+`{ aspectRatio: '16:9' }`, and `width` / `height` / `image_generator_version`
+for the API. The returned URL prefers `share_url` (public, stable) over
+`output_url`, matching the browser client.
 
 **`summarizeText()`** follows the same pattern — `/api/summarization` first, a
 stateless chat request as the fallback.
@@ -841,10 +852,56 @@ error), and the reply came from DeepAI's own web access. Point
 `webSearchProvider` at a search API you control if the public endpoints are
 blocked where the bot runs.
 
+**Works in the browser playground but fails in Postman / Node.js** — three
+separate requirements:
+
+1. **Anonymous keys are single-use and User-Agent-bound.** Each key is
+   `tryit-<digits>-<hash>` with
+   `hash = H(UA + H(UA + H(UA + digits + "hackers_become_a_little_stinkier_every_time_they_hack")))`,
+   validated against the request's `User-Agent` header. A reused key or
+   random hex → `401 "Please pass a valid Api-Key"`. A fresh, correctly
+   hashed key must be minted per request — `headers()` does this
+   automatically for `tryit-…` keys.
+2. **The body must be `multipart/form-data`** (never JSON), with
+   `generation_source=img` (model page) or `generation_source=chat` +
+   `width`/`height`/`image_generator_version=hd`/`quality=true` (chat page).
+   Never set `Content-Type` manually — the multipart boundary is generated.
+3. **`Origin: https://deepai.org` is required**, and anonymous generation is
+   refused from datacenter/VPN IPs (`401 "Please try this model on deepai.org"`) —
+   run from a residential IP. Passing `deviceId` (the `deepai_device_id`
+   cookie value) also helps the per-device quota.
+
+`examples/text2img-standalone.js` is a zero-dependency CLI implementing the
+full recipe, and `examples/diagnose.js` runs the same request through every
+transport on your machine and prints which one DeepAI accepts.
+
+**`transport` option (2.3.0).** Some networks serve non-browser TLS stacks a
+refusal (`"Please try this model on deepai.org"`) even with a perfectly valid
+key. `/api/*` calls therefore support multiple transports:
+
+```js
+new AlexaAI({ key, postgresUrl, transport: 'auto' })   // default: fetch → curl → curl-impersonate
+new AlexaAI({ key, postgresUrl, transport: 'curl' })   // system curl only
+new AlexaAI({ key, postgresUrl, transport: 'impersonate', curlImpersonatePath: 'C:/tools/curl-impersonate.exe' })
+```
+
+With `transport: 'auto'` (the default) the engine starts with `fetch` and, on
+a transport-specific refusal, retries the request through system `curl`
+(shipped with Windows 10+, macOS and Linux) and then through a
+`curl-impersonate` binary if one is on PATH (a Chrome TLS profile; set
+`curlImpersonatePath` or `DEEPAI_CURL_IMPERSONATE` to point at it — builds:
+github.com/lexiforest/curl-impersonate/releases). Quota and auth errors are
+never re-driven through other transports. Run `node examples/diagnose.js` to
+see which transport your network accepts.
+
 **`generateImage()` returns `{ ok: false, error: 'DEEPAI_QUOTA_EXCEEDED' }`**
-Both routes were refused: `/api/text2img` needs credits and the in-chat image
-tool hit the key's chat quota. Add more keys (`keys: [...]`) or wait for the
-quota to reset. `message` carries DeepAI's exact wording.
+`/api/text2img` is Pro-only for registered keys ("APIs are only available for
+Pro members in good standing"), the anonymous browser-shaped retry was
+refused too (DeepAI soft-blocks free image generation from datacenter IPs
+with "Please try this model on deepai.org" — run the bot from a residential
+IP), and the in-chat tool produced no image. Add a Pro key, more keys
+(`keys: [...]`), or run from a non-datacenter IP. `message` carries DeepAI's
+exact wording for each attempted route.
 
 **Photos are answered with "I can't view images right now"**
 Native vision needs a paid DeepAI key; on a free key only text inside the

package/examples/diagnose.js

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+'use strict';
+/**
+ * diagnose.js — DeepAI text2img connectivity diagnostic.
+ *
+ * Run ON THE MACHINE where the browser playground works:
+ *
+ *   node examples/diagnose.js
+ *   node examples/diagnose.js --device-id <your deepai_device_id cookie>
+ *   node examples/diagnose.js --imp /path/to/curl-impersonate
+ *
+ * Each test sends the browser-shaped request with a FRESH single-use key
+ * through a different transport and prints the raw server response, so one
+ * run shows exactly which transport DeepAI accepts on your network:
+ *
+ *   1. Node fetch   (the library default)
+ *   2. system curl
+ *   3. curl-impersonate with a Chrome TLS profile (if the binary is found)
+ *
+ * Zero dependencies, Node 18+.
+ */
+
+const API = 'https://api.deepai.org/api/text2img';
+const UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36';
+const PROFILE_UA = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36';
+const SALT = 'hackers_become_a_little_stinkier_every_time_they_hack';
+
+// ---- key hash (same algorithm as DeepAIClient._islandHash) ----------------
+function islandHash(input) {
+    const a = [];
+    for (let b = 0; 64 > b; ) a[b] = 0 | (4294967296 * Math.sin(++b % Math.PI));
+    let d, e, f, g = [(d = 1732584193), (e = 4023233417), ~d, ~e], h = [];
+    const l = unescape(encodeURI(input)) + '\u0080';
+    let k = l.length;
+    let c = (--k / 4 + 2) | 15;
+    for (h[--c] = 8 * k; ~k; ) h[k >> 2] |= l.charCodeAt(k) << (8 * k--);
+    for (let b = 0, m = 0; b < c; b += 16) {
+        for (k = g; 64 > m; k = [ (f = k[3]), d + (((f = k[0] + [d & e | ~d & f, f & d | ~f & e, d ^ e ^ f, e ^ (d | ~f)][(k = m >> 4)] + a[m] + ~~h[b | [m, 5 * m + 1, 3 * m + 5, 7 * m][k] & 15]) << (k = [7, 12, 17, 22, 5, 9, 14, 20, 4, 11, 16, 23, 6, 10, 15, 21][4 * k + (m++ % 4)])) | (f >>> -k)), d, e ]) {
+            d = k[1] | 0;
+            e = k[2];
+        }
+        for (m = 4; m; ) g[--m] += k[m];
+    }
+    let result = '';
+    for (let i = 0; 32 > i; ) result += ((g[i >> 3] >> 4 * (1 ^ i++)) & 15).toString(16);
+    return result.split('').reverse().join('');
+}
+const freshKey = (ua) => {
+    const digits = String(Math.round(Math.random() * 100000000000));
+    return `tryit-${digits}-${islandHash(ua + islandHash(ua + islandHash(ua + digits + SALT)))}`;
+};
+
+// ---- args -------------------------------------------------------------------
+const args = process.argv.slice(2);
+const opt = {};
+for (let i = 0; i < args.length; i++) {
+    if (args[i] === '--device-id') opt.deviceId = args[++i];
+    else if (args[i] === '--imp') opt.imp = args[++i];
+}
+const deviceId = opt.deviceId || Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString('base64url');
+const cookie = `deepai_device_id=${deviceId}`;
+
+// ---- transports ---------------------------------------------------------------
+async function viaFetch() {
+    const form = new FormData();
+    form.append('text', 'a small red boat on a calm lake');
+    form.append('generation_source', 'img');
+    const res = await fetch(API, {
+        method: 'POST', body: form,
+        headers: { 'api-key': freshKey(UA), 'User-Agent': UA, Origin: 'https://deepai.org', Referer: 'https://deepai.org/machine-learning-model/text2img', Accept: '*/*', Cookie: cookie },
+    });
+    return { status: res.status, body: await res.text() };
+}
+
+function runCurl(binary, impersonate) {
+    const { execFileSync } = require('child_process');
+    const ua = impersonate ? PROFILE_UA : UA;
+    const a = impersonate ? ['--impersonate', 'chrome136'] : [];
+    a.push(API, '-sS', '--compressed', '--max-time', '60', '-X', 'POST',
+        '-H', `api-key: ${freshKey(ua)}`);
+    if (!impersonate) a.push('-H', `User-Agent: ${ua}`);
+    a.push('-H', 'Origin: https://deepai.org',
+        '-H', 'Referer: https://deepai.org/machine-learning-model/text2img',
+        '-H', 'Accept: */*',
+        '-H', `Cookie: ${cookie}`,
+        '-F', 'text=a small red boat on a calm lake',
+        '-F', 'generation_source=img',
+        '-w', '\n%{http_code}');
+    const out = execFileSync(binary, a, { encoding: 'utf8', timeout: 60000, stdio: ['ignore', 'pipe', 'pipe'] }).replace(/\r/g, '');
+    const cut = out.lastIndexOf('\n');
+    return { status: Number(out.slice(cut + 1).trim()), body: out.slice(0, cut) };
+}
+
+function label(t) {
+    const b = String(t.body).slice(0, 140).replace(/\s+/g, ' ');
+    if (t.status === 200 && /share_url|output_url/.test(t.body)) return `✅ SUCCESS — image generated (HTTP 200)`;
+    if (/valid Api-Key/i.test(b)) return `❌ key rejected (unexpected — fresh key was used)`;
+    if (/try this model/i.test(b)) return `❌ transport refused ("Please try this model on deepai.org")`;
+    if (/Pro members/i.test(b)) return `❌ account-level refusal (needs a Pro key)`;
+    if (/try it exceeded/i.test(b)) return `⚠️ free quota exhausted for this device/IP — retry later or change --device-id`;
+    return `❌ HTTP ${t.status}: ${b}`;
+}
+
+(async () => {
+    console.log(`DeepAI text2img diagnostic — device ${deviceId.slice(0, 8)}…\n`);
+    const rows = [];
+    try { rows.push(['1. Node fetch (library default)', label(await viaFetch())]); } catch (e) { rows.push(['1. Node fetch', `⚠️ ${e.message}`]); }
+    try { rows.push(['2. system curl', label(runCurl('curl', false))]); } catch (e) { rows.push(['2. system curl', `⚠️ ${e.message.split('\n')[0]}`]); }
+
+    let impBin = opt.imp;
+    if (!impBin) {
+        const { execFileSync } = require('child_process');
+        for (const name of ['curl-impersonate', 'curl-impersonate.exe']) {
+            try { execFileSync(name, ['--version'], { timeout: 5000, stdio: 'ignore' }); impBin = name; break; } catch { /* keep looking */ }
+        }
+    }
+    if (impBin) {
+        try { rows.push([`3. curl-impersonate (${impBin})`, label(runCurl(impBin, true))]); } catch (e) { rows.push(['3. curl-impersonate', `⚠️ ${e.message.split('\n')[0]}`]); }
+    } else {
+        rows.push(['3. curl-impersonate', '⏭ skipped — binary not found (see README for install)']);
+    }
+
+    for (const [name, v] of rows) console.log(`${name.padEnd(34)} ${v}`);
+    console.log(`
+Reading the results:
+- A ✅ on ANY line    → that transport works; use it (library: transport option,
+                        standalone: --transport).
+- ❌ on line 1 only   → non-browser TLS stack refused; use 'curl' or
+                        'impersonate'.
+- ❌ on lines 1+2, ✅ on 3 → strict browser-TLS matching; use 'impersonate'.
+- ❌ everywhere      → the IP is refused for anonymous generation, or the free
+                        quota is exhausted. Compare with the browser: DevTools
+                        → Network → generate → text2img request → Response.`);
+})();

package/examples/text2img-standalone.js

@@ -0,0 +1,200 @@
+#!/usr/bin/env node
+'use strict';
+/**
+ * text2img-standalone.js — zero-dependency DeepAI text-to-image CLI.
+ *
+ * Speaks the anonymous browser dialect: a fresh single-use `tryit-…` key
+ * (hashed over the User-Agent) per run, browser-identical headers and a
+ * multipart/form-data body, plus a stable `deepai_device_id` cookie.
+ *
+ * Usage:
+ *   node examples/text2img-standalone.js "a cute orange cat"
+ *   node examples/text2img-standalone.js "a cat" --out cat.jpg
+ *   node examples/text2img-standalone.js "a cat" --aspect 16:9
+ *   node examples/text2img-standalone.js "a cat" --device-id <cookieValue>
+ *   node examples/text2img-standalone.js "a cat" --key <proKey>
+ *   node examples/text2img-standalone.js "a cat" --transport curl
+ *   node examples/text2img-standalone.js "a cat" --transport impersonate --imp /path/to/curl-impersonate
+ *
+ * Transports: 'fetch' (default, Node fetch) | 'curl' (system curl) |
+ * 'impersonate' (curl-impersonate binary, Chrome TLS profile). Some
+ * networks serve non-browser TLS stacks a refusal — if 'fetch' fails with
+ * "Please try this model on deepai.org", try 'curl', then 'impersonate'.
+ *
+ * Requires Node.js 18+. Anonymous generation is refused from
+ * datacenter/VPN IPs; run from a residential network.
+ */
+
+const API_URL = 'https://api.deepai.org/api/text2img';
+const SALT = 'hackers_become_a_little_stinkier_every_time_they_hack';
+// Keep this EXACT string in sync with the User-Agent header below — the key
+// hash is computed over it and the server recomputes it from the request.
+const USER_AGENT =
+    'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36';
+
+// ---------------------------------------------------------------------------
+// Deterministic key hash (see DeepAIClient._islandHash in the engine).
+// The integer/bit-level behaviour is intentional — do not simplify it.
+// ---------------------------------------------------------------------------
+function islandHash(input) {
+    const a = [];
+    for (let b = 0; 64 > b; ) a[b] = 0 | (4294967296 * Math.sin(++b % Math.PI));
+    let d, e, f, g = [(d = 1732584193), (e = 4023233417), ~d, ~e], h = [];
+    const l = unescape(encodeURI(input)) + '€';
+    let k = l.length;
+    let c = (--k / 4 + 2) | 15;
+    for (h[--c] = 8 * k; ~k; ) h[k >> 2] |= l.charCodeAt(k) << (8 * k--);
+    for (let b = 0, m = 0; b < c; b += 16) {
+        for (k = g; 64 > m; k = [ (f = k[3]), d + (((f = k[0] + [d & e | ~d & f, f & d | ~f & e, d ^ e ^ f, e ^ (d | ~f)][(k = m >> 4)] + a[m] + ~~h[b | [m, 5 * m + 1, 3 * m + 5, 7 * m][k] & 15]) << (k = [7, 12, 17, 22, 5, 9, 14, 20, 4, 11, 16, 23, 6, 10, 15, 21][4 * k + (m++ % 4)])) | (f >>> -k)), d, e ]) {
+            d = k[1] | 0;
+            e = k[2];
+        }
+        for (m = 4; m; ) g[--m] += k[m];
+    }
+    let result = '';
+    for (let i = 0; 32 > i; ) result += ((g[i >> 3] >> 4 * (1 ^ i++)) & 15).toString(16);
+    return result.split('').reverse().join('');
+}
+
+/** Mint a fresh anonymous key, valid for exactly ONE request with USER_AGENT. */
+function freshTryItKey(userAgent = USER_AGENT) {
+    const digits = String(Math.round(Math.random() * 100000000000));
+    const H = islandHash;
+    return `tryit-${digits}-${H(userAgent + H(userAgent + H(userAgent + digits + SALT)))}`;
+}
+
+/** Random device id, same shape the site sets as the deepai_device_id cookie. */
+function randomDeviceId() {
+    return Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString('base64url');
+}
+
+// ---------------------------------------------------------------------------
+// CLI
+// ---------------------------------------------------------------------------
+function parseArgs(argv) {
+    const opts = { prompt: '', out: null, key: null, deviceId: randomDeviceId(), aspect: null, genSource: 'img', transport: 'fetch', imp: null };
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === '--out') opts.out = argv[++i];
+        else if (a === '--key') opts.key = argv[++i];
+        else if (a === '--device-id') opts.deviceId = argv[++i];
+        else if (a === '--aspect') opts.aspect = argv[++i];
+        else if (a === '--chat-source') opts.genSource = 'chat';
+        else if (a === '--transport') opts.transport = argv[++i];
+        else if (a === '--imp') opts.imp = argv[++i];
+        else if (a === '--help' || a === '-h') opts.help = true;
+        else if (!opts.prompt) opts.prompt = a;
+    }
+    return opts;
+}
+
+const ASPECTS = { '16:9': [832, 448], '4:3': [768, 576], '1:1': [640, 640], '3:4': [576, 768], '9:16': [448, 832] };
+
+async function main() {
+    const opts = parseArgs(process.argv.slice(2));
+    if (opts.help || !opts.prompt) {
+        console.log('Usage: node examples/text2img-standalone.js "your prompt" [--out file.jpg] [--key PRO_KEY] [--device-id VALUE] [--aspect 16:9|1:1|9:16|4:3|3:4] [--chat-source] [--transport fetch|curl|impersonate] [--imp PATH]');
+        process.exit(opts.help ? 0 : 1);
+    }
+
+    // ---- body: multipart/form-data, NEVER JSON -----------------------------
+    const form = new FormData();
+    form.append('text', opts.prompt);
+    form.append('generation_source', opts.genSource); // 'img' = model page, 'chat' = chat page
+    if (opts.aspect && ASPECTS[opts.aspect]) {
+        // the chat-page dialect maps aspect ratios to pixel sizes
+        const [w, h] = ASPECTS[opts.aspect];
+        form.append('width', String(w));
+        form.append('height', String(h));
+        form.append('image_generator_version', 'hd');
+        form.append('quality', 'true');
+    }
+
+    // ---- headers: fresh single-use anonymous key (or your Pro key) ---------
+    const apiKey = opts.key || freshTryItKey();
+    const headers = {
+        'api-key': apiKey,
+        'User-Agent': USER_AGENT, // MUST match the UA the key was hashed with
+        Origin: 'https://deepai.org',
+        Referer: 'https://deepai.org/machine-learning-model/text2img',
+        Accept: '*/*',
+        'Accept-Language': 'en-US,en;q=0.9',
+        Cookie: `deepai_device_id=${opts.deviceId}`,
+        // NOTE: do NOT set Content-Type yourself — undici adds the multipart
+        // boundary. A manual Content-Type without the boundary is rejected.
+    };
+
+    console.log(`Prompt : ${opts.prompt}`);
+    console.log(`Key    : ${opts.key ? '(registered key — needs Pro)' : apiKey + '  (fresh, single-use)'}`);
+    console.log('POST   : ' + API_URL);
+
+    let res;
+    if (opts.transport === 'curl' || opts.transport === 'impersonate') {
+        const { execFile } = require('child_process');
+        const binary = opts.transport === 'impersonate' ? (opts.imp || 'curl-impersonate') : 'curl';
+        // the chrome136 profile sends its own Mac Chrome UA — the anonymous
+        // key hash must be derived from exactly that UA
+        const profileUa = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36';
+        const apiKey = opts.key || freshTryItKey(opts.transport === 'impersonate' ? profileUa : USER_AGENT);
+        const curlArgs = [];
+        if (opts.transport === 'impersonate') curlArgs.push('--impersonate', 'chrome136');
+        curlArgs.push(API_URL, '-sS', '--compressed', '--max-time', '120', '-X', 'POST',
+            '-H', `api-key: ${apiKey}`);
+        if (opts.transport !== 'impersonate') curlArgs.push('-H', `User-Agent: ${USER_AGENT}`);
+        curlArgs.push(
+            '-H', `Origin: ${headers.Origin}`,
+            '-H', `Referer: ${headers.Referer}`,
+            '-H', 'Accept: */*',
+            '-H', `Cookie: deepai_device_id=${opts.deviceId}`,
+            '-w', '\n%{http_code}'
+        );
+        for (const [k, v] of form.entries()) curlArgs.push('-F', `${k}=${v}`);
+        res = await new Promise((resolve, reject) => {
+            execFile(binary, curlArgs, { timeout: 120000, maxBuffer: 32 * 1024 * 1024 }, (err, stdout) => {
+                if (err && stdout == null) return reject(err);
+                const body = String(stdout).replace(/\r/g, '');
+                const cut = body.lastIndexOf('\n');
+                const status = Number(body.slice(cut + 1).trim());
+                resolve({ status, ok: status < 300, text: async () => body.slice(0, cut) });
+            });
+        });
+    } else {
+        res = await fetch(API_URL, { method: 'POST', headers, body: form });
+    }
+    const raw = await res.text();
+    let data = null;
+    try { data = JSON.parse(raw); } catch { /* non-JSON */ }
+
+    if (!res.ok || data?.err || (data?.status && !data.share_url && !data.output_url)) {
+        console.error(`\nFAILED  HTTP ${res.status}`);
+        console.error(raw.slice(0, 500));
+        const s = String(data?.status || data?.err || '');
+        if (/valid Api-Key/i.test(s)) console.error('\n→ The key is invalid or already used. Keys are single-use and must be hashed for the exact User-Agent sent; this script mints a fresh one each run.');
+        else if (/try this model on deepai\.org/i.test(s)) console.error('\n→ DeepAI is refusing anonymous generation from your IP (datacenter/VPN) or the Origin header is missing. Run from a residential IP and keep the Origin/Referer headers.');
+        else if (/Pro members/i.test(s)) console.error('\n→ Your registered key is on the free plan; /api/* needs Pro. Use the anonymous mode (omit --key) or upgrade.');
+        else if (/try it exceeded/i.test(s)) console.error('\n→ Free quota for this device/IP is exhausted. Try a different --device-id or wait for the reset.');
+        process.exit(1);
+    }
+
+    const url = data.share_url || data.output_url;
+    console.log(`\nOK     HTTP ${res.status}`);
+    console.log(`Image  : ${url}`);
+    if (data.id) console.log(`ID     : ${data.id}`);
+
+    // ---- optional: download the image --------------------------------------
+    const out = opts.out || `deepai-${Date.now()}.jpg`;
+    try {
+        const img = await fetch(url);
+        if (img.ok) {
+            const buf = Buffer.from(await img.arrayBuffer());
+            require('fs').writeFileSync(out, buf);
+            console.log(`Saved  : ${out} (${(buf.length / 1024).toFixed(1)} KB)`);
+        } else {
+            console.log(`(download skipped: HTTP ${img.status} — open the URL above in a browser)`);
+        }
+    } catch (e) {
+        console.log(`(download failed: ${e.message} — open the URL above in a browser)`);
+    }
+}
+
+main().catch((e) => { console.error('ERROR:', e.message); process.exit(1); });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alexa-ai",
-  "version": "2.1.2",
+  "version": "2.3.0",
   "description": "AI engine for the Alexa WhatsApp bot: DeepAI-powered chat with PostgreSQL-backed long-term memory, cross-chat identity (@lid <-> phone), vision/OCR, image generation and web search.",
   "main": "index.js",
   "scripts": {