alexa-ai 2.1.2 → 2.3.0

package/src/AlexaAI.js

@@ -596,27 +596,35 @@ class AlexaAI {
     /**
      * Text-to-image.
      *
-     * Two routes, tried in order:
+     * Three routes, tried in order:
      *
-     *   1. `POST /api/text2img` — the classic public API. Fast and returns a
-     *      plain `output_url`, but it is a PAID endpoint: anonymous `tryit-…`
-     *      keys get `{"status": "Out of API credits"}` / "try it exceeded".
-     *   2. The in-chat image tool — the same `generate_image` function call the
-     *      deepai.org web client sends when you press "Create image". This
-     *      works on free chat keys and answers with a `generated_image` packet
-     *      carrying a `share_url`.
+     *   1. `POST /api/text2img` — the classic public API, returns
+     *      `share_url` / `output_url`. With a Pro key this always works.
+     *      With an anonymous `tryit-…` key the request is automatically sent
+     *      in the exact browser shape (`generation_source=chat` + size +
+     *      `quality=true`), because a bare `{ text }` form is refused with
+     *      "Please try this model on deepai.org". Anonymous keys are also
+     *      single-use, so a fresh one is minted per request.
+     *   2. Anonymous browser-style retry — when a registered (non-Pro) key
+     *      is refused with 402 "Pro members in good standing", the engine
+     *      retries once with a fresh anonymous key. Disable with
+     *      `{ noAnonymousFallback: true }`.
+     *   3. The legacy in-chat image tool — a `generate_image` function-call
+     *      message sent to the chat endpoint; kept for model versions that
+     *      still honor it.
      *
-     * Either way the result is normalised to `{ ok, url, id, error, via }`.
-     * Every failure is returned, never thrown, so a bot command can simply
-     * check `result.ok`.
+     * Either way the result is normalised to `{ ok, url, id, error, via }`
+     * (`via` is 'api' | 'anonymous' | 'chat'). Every failure is returned,
+     * never thrown, so a bot command can simply check `result.ok`.
      *
      * @param {string} prompt
      * @param {object} [opts]
-     * @param {string} [opts.aspectRatio='1:1']   in-chat tool only ('1:1', '16:9', '9:16'…)
+     * @param {string} [opts.aspectRatio='1:1']   '1:1', '16:9', '9:16', '4:3', '3:4'
      * @param {number} [opts.width] / [opts.height]  /api/text2img only
-     * @param {string} [opts.image_generator_version]  /api/text2img only
+     * @param {string} [opts.image_generator_version]  /api/text2img only ('hd', 'standard', 'genius')
      * @param {boolean} [opts.chatToolOnly]     skip /api/text2img
      * @param {boolean} [opts.apiOnly]          skip the in-chat tool
+     * @param {boolean} [opts.noAnonymousFallback]  skip route 2
      * @param {AbortSignal} [opts.signal]
      * @returns {Promise<{ok:boolean, url:string|null, id:string|null, error:string|null, message?:string, via:string|null, raw?:any}>}
      */
@@ -625,25 +633,52 @@ class AlexaAI {
         if (!text) {
             return { ok: false, url: null, id: null, error: 'VALIDATION_ERROR', message: 'generateImage(): prompt is required', via: null };
         }
-        const { aspectRatio, chatToolOnly, apiOnly, signal, ...apiFields } = opts || {};
+        const { aspectRatio, chatToolOnly, apiOnly, noAnonymousFallback, signal, ...apiFields } = opts || {};
         const errors = [];
+        let quotaRefused = false;
 
         // ---- 1. classic /api/text2img -------------------------------------
+        // Anonymous keys require the browser dialect (generation_source +
+        // size/quality fields).
         if (!chatToolOnly) {
             try {
-                const data = await this.client.text2img(text, apiFields, { signal });
+                const extra = this.client.usingTryItKey
+                    ? AlexaAI._browserImageFields(aspectRatio || '1:1', apiFields)
+                    : apiFields;
+                const data = await this.client.text2img(text, extra, { signal });
                 const url = AlexaAI._outputUrl(data);
                 if (url) return { ok: true, url, id: data.id || null, error: null, via: 'api', raw: data };
                 errors.push('text2img: no output_url in response');
             } catch (err) {
                 errors.push(`text2img: ${err.message}`);
+                if (err instanceof QuotaExceededError) quotaRefused = true;
                 if (err.code === 'ABORTED') {
                     return { ok: false, url: null, id: null, error: 'ABORTED', message: err.message, via: null };
                 }
             }
         }
 
-        // ---- 2. the chat image tool (works on free chat keys) ---------------
+        // ---- 2. anonymous browser-style retry ------------------------------
+        // A registered key without Pro gets 402 "APIs are only available for
+        // Pro members in good standing"; retry once with a fresh anonymous
+        // key in the full browser shape.
+        if (quotaRefused && !noAnonymousFallback && !this.client.usingTryItKey) {
+            try {
+                const extra = AlexaAI._browserImageFields(aspectRatio || '1:1', apiFields);
+                const data = await this.client.runApiWithTryItKey(
+                    this.client.config.imageModel || 'text2img',
+                    { text, ...extra },
+                    { signal }
+                );
+                const url = AlexaAI._outputUrl(data);
+                if (url) return { ok: true, url, id: data.id || null, error: null, via: 'anonymous', raw: data };
+                errors.push('anonymous text2img: no output_url in response');
+            } catch (err) {
+                errors.push(`anonymous text2img: ${err.message}`);
+            }
+        }
+
+        // ---- 3. the chat image tool (legacy; model-side tool) --------------
         if (!apiOnly) {
             try {
                 const answer = await this.client.chatDetailed(
@@ -666,12 +701,41 @@ class AlexaAI {
             ok: false,
             url: null,
             id: null,
-            error: /credits|exceeded|paid|api-key|api key/i.test(message) ? 'DEEPAI_QUOTA_EXCEEDED' : 'IMAGE_FAILED',
+            error: quotaRefused || /credits|exceeded|paid|pro members|api-key|api key/i.test(message)
+                ? 'DEEPAI_QUOTA_EXCEEDED'
+                : 'IMAGE_FAILED',
             message,
             via: null,
         };
     }
 
+    /**
+     * Extra form fields required for anonymous image generation: the aspect
+     * ratio is translated to pixel sizes, generation runs in "hd" quality,
+     * and the request is tagged generation_source=chat.
+     *
+     * @param {string} aspectRatio '1:1' | '16:9' | '9:16' | '4:3' | '3:4'
+     * @param {object} [overrides] explicit width/height/image_generator_version win
+     * @private
+     */
+    static _browserImageFields(aspectRatio, overrides = {}) {
+        const map = {
+            '16:9': [832, 448],
+            '4:3': [768, 576],
+            '1:1': [640, 640],
+            '3:4': [576, 768],
+            '9:16': [448, 832],
+        };
+        const [width, height] = map[String(aspectRatio || '1:1')] || map['1:1'];
+        return {
+            generation_source: 'chat',
+            width: overrides.width ?? width,
+            height: overrides.height ?? height,
+            image_generator_version: overrides.image_generator_version ?? 'hd',
+            quality: 'true',
+        };
+    }
+
     /**
      * Prompt-driven image edit (`POST /api/image-editor`).
      * `image` may be a Buffer, base64, data URI, URL or `{ buffer | url }`.
@@ -995,7 +1059,8 @@ class AlexaAI {
     /** @private the image url carried by an /api/* or tool response. */
     static _outputUrl(data) {
         if (!data || typeof data !== 'object') return null;
-        const url = data.output_url || data.share_url || data.url || (Array.isArray(data.output) ? data.output[0] : null);
+        // Prefer share_url (stable, public) over output_url.
+        const url = data.share_url || data.output_url || data.url || (Array.isArray(data.output) ? data.output[0] : null);
         return typeof url === 'string' && url ? url : null;
     }
 

package/src/core/Config.js

@@ -23,6 +23,8 @@ class Config {
      * @param {string} [options.visionModel]       Model used when images are attached
      * @param {string[]} [options.visionModels]    Vision fallback chain
      * @param {string} [options.imageModel]        Model used by generateImage()
+     * @param {string} [options.transport]         /api/* transport: 'auto' (default) | 'fetch' | 'curl' | 'impersonate'
+     * @param {string} [options.curlImpersonatePath] Path to a curl-impersonate binary for the 'impersonate' transport
      * @param {string} [options.assistantName]     Persona name (default 'Alexa')
      * @param {string} [options.creator]           Persona creator (default 'Hansaka')
      * @param {string} [options.systemPrompt]      Override the whole persona text
@@ -42,7 +44,12 @@ class Config {
         const opts = options || {};
 
         // ---- Accept several aliases so the host bot can stay terse ----------
-        const key = opts.key || opts.apiKey || opts.deepaiKey || process.env.DEEPAI_API_KEY;
+        const key =
+            opts.key ||
+            opts.apiKey ||
+            opts.deepaiKey ||
+            process.env.DEEPAI_KEY ||
+            process.env.DEEPAI_API_KEY;
         const postgresUrl =
             opts.postgresUrl ||
             opts.postgresURL ||
@@ -107,6 +114,26 @@ class Config {
         ]);
         this.imageModel = opts.imageModel || 'text2img';
 
+        // ---- /api/* transport -------------------------------------------------
+        // 'auto'        fetch first, then system curl, then curl-impersonate
+        //               when the binary is available (some networks serve
+        //               non-browser TLS stacks a refusal page).
+        // 'fetch'       Node global fetch only (previous behaviour)
+        // 'curl'        system curl subprocess only
+        // 'impersonate' curl-impersonate subprocess only (Chrome TLS profile)
+        this.transport = opts.transport || process.env.DEEPAI_TRANSPORT || 'auto';
+        this.curlPath = opts.curlPath || process.env.DEEPAI_CURL || 'curl';
+        this.curlImpersonatePath =
+            opts.curlImpersonatePath || process.env.DEEPAI_CURL_IMPERSONATE || null;
+        this.curlImpersonateTarget = opts.curlImpersonateTarget || 'chrome136';
+
+        // ---- Anonymous device identity ---------------------------------------
+        // Stable device identifier sent as the `deepai_device_id` cookie.
+        // Anonymous /api/* generation is rate-limited per device, so the id
+        // is kept stable per instance; pass your own to share an existing
+        // device quota.
+        this.deviceId = opts.deviceId || process.env.DEEPAI_DEVICE_ID || null;
+
         // ---- Engine web search (searchWeb) ----------------------------------
         // The engine searches first and hands real results to the model, so
         // every URL the bot shows comes from a search, never from the model.
@@ -169,7 +196,7 @@ class Config {
         this.retryDelay = Config._int(opts.retryDelay, 800, 0, 30000);
         this.userAgent =
             opts.userAgent ||
-            'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36';
+            'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36';
 
         // ---- Database --------------------------------------------------------
         this.autoMigrate = opts.autoMigrate !== false; // default true

package/src/core/DeepAIClient.js

@@ -43,6 +43,10 @@ class DeepAIClient {
         this._keyIndex = 0;
         this.sessionUuid = DeepAIClient.uuid();
 
+        // Stable per-instance device id sent as the `deepai_device_id`
+        // cookie (see Config.deviceId).
+        this.deviceId = this.config.deviceId || DeepAIClient.randomDeviceId();
+
         if (typeof fetch !== 'function') {
             throw new DeepAIError(
                 'Global fetch() is unavailable. AlexaAI requires Node.js 18+ (or install undici).',
@@ -71,7 +75,7 @@ class DeepAIClient {
             return true;
         }
         if (this.config.autoKeyRotation) {
-            const fresh = DeepAIClient.generateTryItKey();
+            const fresh = DeepAIClient.generateTryItKey(this.config.userAgent);
             this._keys.push(fresh);
             this._keyIndex = this._keys.length - 1;
             if (this.config.debug) this.log.warn?.('[AlexaAI] Minted a fresh anonymous DeepAI key');
@@ -81,22 +85,98 @@ class DeepAIClient {
     }
 
     /**
-     * Anonymous "try it" key in the shape deepai.org generates in-browser:
-     * `tryit-<10 digits>-<32 hex>`.
+     * Anonymous "try it" key: `tryit-<digits>-<32 hex>`.
+     *
+     * The hex part is a deterministic hash over the User-Agent:
+     *      H(UA + H(UA + H(UA + digits + SALT)))
+     * and is validated server-side against the request's User-Agent header,
+     * so the key must be derived from the UA the request will carry.
+     *
+     * Anonymous keys are single-use (one key == one request); `headers()`
+     * mints a fresh key per request whenever the active key is anonymous.
+     *
+     * @param {string} [userAgent] the User-Agent the request will carry
+     * @returns {string}
+     */
+    static generateTryItKey(userAgent) {
+        const ua = String(
+            userAgent ||
+                'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36'
+        );
+        const digits = String(Math.round(Math.random() * 100000000000));
+        const salt = 'hackers_become_a_little_stinkier_every_time_they_hack';
+        const H = DeepAIClient._islandHash;
+        const hash = H(ua + H(ua + H(ua + digits + salt)));
+        return `tryit-${digits}-${hash}`;
+    }
+
+    /** True for anonymous `tryit-…` keys (single-use, hash-validated). */
+    static isTryItKey(key) {
+        return /^tryit-\d+-[0-9a-f]{32}$/i.test(String(key || ''));
+    }
+
+    /**
+     * Random device id for the `deepai_device_id` cookie:
+     * 32 random bytes encoded as base64url.
+     */
+    static randomDeviceId() {
+        const bytes = typeof crypto !== 'undefined' && crypto.getRandomValues
+            ? crypto.getRandomValues(new Uint8Array(32))
+            : Buffer.from(Array.from({ length: 32 }, () => Math.floor(Math.random() * 256)));
+        return Buffer.from(bytes).toString('base64url');
+    }
+
+    /**
+     * Deterministic hash used to derive anonymous key material from the
+     * User-Agent (see `generateTryItKey`). The integer/bit-level behaviour
+     * is intentional — do not simplify it.
+     * @private
      */
-    static generateTryItKey() {
-        const digits = Array.from({ length: 10 }, () => Math.floor(Math.random() * 10)).join('');
-        const hex = Array.from({ length: 32 }, () => Math.floor(Math.random() * 16).toString(16)).join('');
-        return `tryit-${digits}-${hex}`;
+    static _islandHash(input) {
+        const a = [];
+        for (let b = 0; 64 > b; ) a[b] = 0 | (4294967296 * Math.sin(++b % Math.PI));
+        let d, e, f, g = [(d = 1732584193), (e = 4023233417), ~d, ~e], h = [];
+        const l = unescape(encodeURI(input)) + '\u0080';
+        let k = l.length;
+        let c = (--k / 4 + 2) | 15;
+        for (h[--c] = 8 * k; ~k; ) h[k >> 2] |= l.charCodeAt(k) << (8 * k--);
+        for (let b = 0, m = 0; b < c; b += 16) {
+            for (k = g; 64 > m; k = [ (f = k[3]), d + (((f = k[0] + [d & e | ~d & f, f & d | ~f & e, d ^ e ^ f, e ^ (d | ~f)][(k = m >> 4)] + a[m] + ~~h[b | [m, 5 * m + 1, 3 * m + 5, 7 * m][k] & 15]) << (k = [7, 12, 17, 22, 5, 9, 14, 20, 4, 11, 16, 23, 6, 10, 15, 21][4 * k + (m++ % 4)])) | (f >>> -k)), d, e ]) {
+                d = k[1] | 0;
+                e = k[2];
+            }
+            for (m = 4; m; ) g[--m] += k[m];
+        }
+        let result = '';
+        for (let i = 0; 32 > i; ) result += ((g[i >> 3] >> 4 * (1 ^ i++)) & 15).toString(16);
+        return result.split('').reverse().join('');
     }
 
-    /** Browser-identical headers. DeepAI rejects requests without an origin. */
+
+    /** True when the active key is an anonymous single-use `tryit-…` key. */
+    get usingTryItKey() {
+        return DeepAIClient.isTryItKey(this.apiKey);
+    }
+
+    /**
+     * Browser-identical headers. DeepAI rejects requests without an origin.
+     *
+     * Anonymous `tryit-…` keys are single-use and validated against a hash
+     * of the User-Agent, so whenever the active key is anonymous a fresh
+     * key is minted here for this request.
+     */
     headers(extra = {}) {
+        let apiKey = this.apiKey;
+        if (DeepAIClient.isTryItKey(apiKey)) {
+            apiKey = DeepAIClient.generateTryItKey(this.config.userAgent);
+            this._keys[this._keyIndex] = apiKey;
+        }
         return {
-            'api-key': this.apiKey,
+            'api-key': apiKey,
             Origin: this.config.origin,
             Referer: `${this.config.origin}/`,
             'User-Agent': this.config.userAgent,
+            ...(this.deviceId ? { Cookie: `deepai_device_id=${this.deviceId}` } : {}),
             ...extra,
         };
     }
@@ -535,36 +615,232 @@ class DeepAIClient {
      * @returns {Promise<object>} e.g. `{ id, output_url }`
      */
     async runApi(name, fields = {}, options = {}) {
-        const form = new FormData();
-        for (const [key, value] of Object.entries(fields)) {
+        const url = `${this.config.url('api')}/${String(name).replace(/^\/+/, '')}`;
+        const entries = this._buildApiFields(fields, options);
+        return this._apiFormRequest(url, entries, options);
+    }
+
+    /**
+     * Normalise API form fields into a transport-neutral entry list:
+     * `[[key, { value | buffer, mimetype, filename }], …]`.
+     * @private
+     */
+    _buildApiFields(fields, options = {}) {
+        const entries = [];
+        for (const [key, value] of Object.entries(fields || {})) {
             if (value == null) continue;
-            if (Buffer.isBuffer(value) || value instanceof Uint8Array) {
-                const mimetype = options.mimetype || DeepAIClient._sniffMime(value) || 'application/octet-stream';
-                form.append(key, new Blob([value], { type: mimetype }), options.filename || `${key}.${DeepAIClient._ext(mimetype)}`);
+            if (Buffer.isBuffer(value) || value instanceof Uint8Array || value instanceof Blob) {
+                entries.push([key, { buffer: value, mimetype: options.mimetype, filename: options.filename }]);
             } else if (typeof value === 'object' && (value.buffer || value.url)) {
                 if (value.url && !value.buffer) {
-                    form.append(key, String(value.url));
-                    continue;
+                    entries.push([key, { value: String(value.url) }]);
+                } else {
+                    entries.push([
+                        key,
+                        {
+                            buffer: Buffer.isBuffer(value.buffer) ? value.buffer : Buffer.from(value.buffer),
+                            mimetype: value.mimetype,
+                            filename: value.filename,
+                        },
+                    ]);
                 }
-                const bytes = Buffer.isBuffer(value.buffer) ? value.buffer : Buffer.from(value.buffer);
-                const mimetype = value.mimetype || DeepAIClient._sniffMime(bytes) || 'application/octet-stream';
-                form.append(key, new Blob([bytes], { type: mimetype }), value.filename || `${key}.${DeepAIClient._ext(mimetype)}`);
             } else if (typeof value === 'object') {
-                form.append(key, JSON.stringify(value));
+                entries.push([key, { value: JSON.stringify(value) }]);
             } else {
-                form.append(key, String(value));
+                entries.push([key, { value: String(value) }]);
             }
         }
-        const url = `${this.config.url('api')}/${String(name).replace(/^\/+/, '')}`;
-        const data = await this._json(url, { method: 'POST', body: form, signal: options.signal });
-        // The classic API reports failures as `{ err: "..." }` or `{ status: "..." }` with HTTP 200.
-        if (data?.err) {
-            throw DeepAIClient._toError(200, JSON.stringify(data), String(data.err));
+        return entries;
+    }
+
+    /**
+     * POST a multipart form to a `/api/*` URL across the configured transport
+     * chain. A refusal of the form "Please try this model on deepai.org" can
+     * be transport-specific (non-browser TLS stacks receive it even with a
+     * perfectly valid key), so on that error the next transport is tried;
+     * every other error (quota, auth, network) is final for this request.
+     * @private
+     */
+    async _apiFormRequest(url, entries, options = {}) {
+        const chain = await this._transportChain();
+        let lastError;
+        for (const transport of chain) {
+            try {
+                const raw = await this._runApiTransport(transport, url, entries, options);
+                const data = DeepAIClient._safeJson(raw.body);
+                if (raw.status > 299 || data === null) {
+                    throw DeepAIClient._toError(raw.status, raw.body, data?.status || data?.error);
+                }
+                if (data?.err) {
+                    throw DeepAIClient._toError(200, JSON.stringify(data), String(data.err));
+                }
+                if (typeof data?.status === 'string' && !data.share_url && !data.output_url && !data.output && !data.id) {
+                    throw DeepAIClient._toError(200, JSON.stringify(data), data.status);
+                }
+                return data;
+            } catch (err) {
+                if (DeepAIClient._isTransportRejected(err) && chain.length > 1) {
+                    lastError = err;
+                    if (this.config.debug) this.log.warn?.(`[AlexaAI] ${transport} transport refused for ${url}; trying the next`);
+                    continue;
+                }
+                if (err instanceof QuotaExceededError || err.retryable === false || err.code === 'ABORTED') throw err;
+                throw err;
+            }
         }
-        if (typeof data?.status === 'string' && !data.output_url && !data.output && !data.id) {
-            throw DeepAIClient._toError(200, JSON.stringify(data), data.status);
+        throw lastError || new DeepAIError('DeepAI request failed', { code: 'DEEPAI_ERROR' });
+    }
+
+    /** @private */
+    static _isTransportRejected(err) {
+        return /try this model on deepai\.org/i.test(String(err?.message || ''));
+    }
+
+    /** Ordered transport list for /api/* calls. @private */
+    async _transportChain() {
+        const t = this.config.transport;
+        if (t === 'fetch') return ['fetch'];
+        if (t === 'curl') return ['curl'];
+        if (t === 'impersonate') return ['impersonate'];
+        const chain = ['fetch', 'curl'];
+        if (await DeepAIClient.resolveImpersonateBinary(this.config)) chain.push('impersonate');
+        return chain;
+    }
+
+    /** @private */
+    async _runApiTransport(transport, url, entries, options) {
+        if (transport === 'fetch') return this._runApiFetch(url, entries, options);
+        const impersonate = transport === 'impersonate';
+        const binary = impersonate
+            ? await DeepAIClient.resolveImpersonateBinary(this.config)
+            : this.config.curlPath;
+        return this._runApiCurl(binary, url, entries, options, { impersonate });
+    }
+
+    /** @private global-fetch transport (previous behaviour). */
+    async _runApiFetch(url, entries, options = {}) {
+        const form = new FormData();
+        for (const [key, field] of entries) {
+            if (field.buffer != null) {
+                const bytes = field.buffer instanceof Blob ? Buffer.from(await field.buffer.arrayBuffer()) : field.buffer;
+                const mimetype = field.mimetype || DeepAIClient._sniffMime(bytes) || 'application/octet-stream';
+                form.append(key, new Blob([bytes], { type: mimetype }), field.filename || `${key}.${DeepAIClient._ext(mimetype)}`);
+            } else {
+                form.append(key, field.value);
+            }
         }
-        return data;
+        const data = await this._json(url, { method: 'POST', body: form, signal: options.signal, errorCode: 'BAD_RESPONSE' });
+        return { status: 200, body: JSON.stringify(data) };
+    }
+
+    /**
+     * The User-Agent a curl-impersonate binary sends for the configured
+     * target profile. The anonymous key hash must be derived from the exact
+     * UA the request carries, so impersonated requests use the profile's own
+     * UA instead of `config.userAgent`.
+     * @private
+     */
+    static _impersonateUserAgent(target) {
+        const m = /chrome(\d+)/i.exec(String(target || ''));
+        const v = m ? m[1] : '136';
+        return `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${v}.0.0.0 Safari/537.36`;
+    }
+
+    /** @private curl / curl-impersonate subprocess transport. */
+    async _runApiCurl(binary, url, entries, options = {}, { impersonate = false } = {}) {
+        const ua = impersonate ? DeepAIClient._impersonateUserAgent(this.config.curlImpersonateTarget) : this.config.userAgent;
+        const apiKey = DeepAIClient.isTryItKey(this.apiKey)
+            ? DeepAIClient.generateTryItKey(ua)
+            : this.apiKey;
+
+        const args = impersonate ? ['--impersonate', this.config.curlImpersonateTarget] : [];
+        args.push(
+            url,
+            '-sS', '--compressed',
+            '--max-time', String(Math.max(1, Math.round(this.config.timeout / 1000))),
+            '-X', 'POST',
+            '-H', `api-key: ${apiKey}`,
+            '-H', `User-Agent: ${ua}`,
+            '-H', `Origin: ${this.config.origin}`,
+            '-H', `Referer: ${this.config.origin}/machine-learning-model/${this.config.imageModel}`,
+            '-H', 'Accept: */*',
+            '-H', 'Accept-Language: en-US,en;q=0.9',
+            '-w', '\n%{http_code}'
+        );
+        if (this.deviceId) args.push('-H', `Cookie: deepai_device_id=${this.deviceId}`);
+
+        const tmpFiles = [];
+        try {
+            for (const [key, field] of entries) {
+                if (field.buffer != null) {
+                    const bytes = field.buffer instanceof Blob ? Buffer.from(await field.buffer.arrayBuffer()) : field.buffer;
+                    const mimetype = field.mimetype || DeepAIClient._sniffMime(bytes) || 'application/octet-stream';
+                    const ext = DeepAIClient._ext(mimetype);
+                    const tmp = require('fs').mkdtempSync(require('path').join(require('os').tmpdir(), 'alexa-')) + `/${key}.${ext}`;
+                    require('fs').writeFileSync(tmp, bytes);
+                    tmpFiles.push(tmp);
+                    args.push('-F', `${key}=@${tmp};type=${mimetype}`);
+                } else {
+                    args.push('-F', `${key}=${field.value}`);
+                }
+            }
+            const out = await DeepAIClient.execCurl(binary, args, this.config.timeout, options.signal);
+            const body = String(out).replace(/\r/g, '');
+            const idx = body.lastIndexOf('\n');
+            const status = Number(body.slice(idx + 1).trim());
+            if (!Number.isFinite(status)) {
+                throw new DeepAIError(`curl transport failed for ${url}: ${body.slice(0, 200)}`, {
+                    code: 'DEEPAI_NETWORK', retryable: true,
+                });
+            }
+            return { status, body: body.slice(0, idx) };
+        } finally {
+            for (const f of tmpFiles) { try { require('fs').unlinkSync(f); } catch { /* best effort */ } try { require('fs').rmSync(require('path').dirname(f), { recursive: true, force: true }); } catch { /* best effort */ } }
+        }
+    }
+
+    /**
+     * Locate a curl-impersonate binary: explicit path, then the usual
+     * executable names on PATH. Cached per path. Tests may override.
+     * @private
+     */
+    static async resolveImpersonateBinary(config) {
+        if (config.curlImpersonatePath) return config.curlImpersonatePath;
+        if (config._noImpersonateBinary) return null;
+        if (!DeepAIClient._impersonateCache) {
+            const { execFile } = require('child_process');
+            const names = process.platform === 'win32' ? ['curl-impersonate.exe', 'curl-impersonate'] : ['curl-impersonate'];
+            DeepAIClient._impersonateCache = new Promise((resolve) => {
+                let i = 0;
+                const tryNext = () => {
+                    if (i >= names.length) return resolve(null);
+                    const name = names[i++];
+                    execFile(name, ['--version'], { timeout: 5000 }, (err) => resolve(err ? tryNext() : name));
+                };
+                tryNext();
+            });
+        }
+        return DeepAIClient._impersonateCache;
+    }
+
+    /**
+     * Run a curl-compatible binary and capture stdout. Separated so tests
+     * can stub the subprocess layer.
+     * @private
+     */
+    static async execCurl(binary, args, timeoutMs, signal) {
+        const { execFile } = require('child_process');
+        return new Promise((resolve, reject) => {
+            const child = execFile(binary, args, { timeout: timeoutMs, maxBuffer: 32 * 1024 * 1024, windowsHide: true }, (err, stdout, stderr) => {
+                if (err && stdout == null) return reject(new DeepAIError(`curl transport error: ${err.message}`, { code: 'DEEPAI_NETWORK', retryable: true }));
+                resolve(stdout != null ? stdout : '');
+                void stderr;
+            });
+            if (signal) {
+                if (signal.aborted) child.kill();
+                else signal.addEventListener('abort', () => child.kill(), { once: true });
+            }
+        });
     }
 
     /** Text-to-image (`/api/text2img`). Returns `{ id, output_url }`. */
@@ -572,6 +848,25 @@ class DeepAIClient {
         return this.runApi(this.config.imageModel || STANDARD_APIS.text2img, { text, ...extra }, options);
     }
 
+    /**
+     * Run a classic `/api/<name>` call with a one-shot anonymous tryit key,
+     * regardless of the configured key. Used as the fallback path when a
+     * registered key is refused ("Pro members only"); a fresh key is minted
+     * for this single request.
+     */
+    async runApiWithTryItKey(name, fields = {}, options = {}) {
+        const previousKeys = this._keys;
+        const previousIndex = this._keyIndex;
+        this._keys = [DeepAIClient.generateTryItKey(this.config.userAgent)];
+        this._keyIndex = 0;
+        try {
+            return await this.runApi(name, fields, options);
+        } finally {
+            this._keys = previousKeys;
+            this._keyIndex = previousIndex;
+        }
+    }
+
     /** Prompt-driven image edit (`/api/image-editor`). */
     async editImage(image, text, extra = {}) {
         return this.runApi(STANDARD_APIS.imageEditor, { image, text, ...extra });
@@ -711,7 +1006,9 @@ class DeepAIClient {
     }
 
     static _isRefusal(status) {
-        return /exceeded|paid|credits|api-key|api key|login|not allowed|forbidden|unauthori[sz]ed/i.test(status);
+        return /exceeded|paid|credits|api-key|api key|login|not allowed|forbidden|unauthori[sz]ed|pro members|good standing|model only available|please try this model/i.test(
+            status
+        );
     }
 
     /** @private magic-number sniff so uploads carry a real content type. */
@@ -749,6 +1046,13 @@ class DeepAIClient {
             'api key',
             'api-key',
             'please login',
+            // refusal statuses returned by the API:
+            'pro members', // "APIs are only available for Pro members in good standing…"
+            'good standing',
+            'model only available', // "model only available to (logged in|paid) users"
+            'signed in try-it quota exceeded',
+            'insufficient_credits',
+            'pro user out of credits',
         ];
         if (quotaHints.some((h) => lowered.includes(h))) {
             return new QuotaExceededError(`DeepAI refused the request: ${msg}`, { status, body });