alexa-ai 2.3.0 → 2.4.0

package/CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to `alexa-ai` are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
 [Semantic Versioning](https://semver.org/).
 
+## [2.4.0] — 2026-09-07
+
+### Fixed
+- **`detectNsfw()` (and every other `/api/*` helper) now works on free keys.**
+  A registered key refused with "Pro members in good standing" gets one
+  anonymous browser-dialect retry (`anonymousApiFallback`, on by default) —
+  the same mechanism that made `generateImage()` work. Applies to
+  `generateImage`, `editImage`, `upscaleImage`, `colorizeImage`,
+  `detectNsfw`, `summarizeText` and `deepai.runApi()`.
+- `detectNsfw()` dropped its `opts` argument instead of passing it through.
+- CLI output of the bundled examples is plain ASCII now — emoji and
+  typographic dashes rendered as mojibake in Windows consoles with a
+  non-UTF-8 codepage.
+- When both the registered and the anonymous attempt fail, the error message
+  reports both refusals.
+
+### Changed
+- `generateImage()` route 1 carries the browser fields into its built-in
+  anonymous retry, so a Pro refusal recovers directly with `via: 'api'`.
+- Client media helpers accept an `options` argument (third/fourth parameter)
+  and default their anonymous dialect per endpoint (`generation_source=img`
+  for model pages; none for image-editor/torch-srgan, matching the site).
+
 ## [2.3.0] — 2026-09-07
 
 ### Added

package/README.md

@@ -894,6 +894,20 @@ github.com/lexiforest/curl-impersonate/releases). Quota and auth errors are
 never re-driven through other transports. Run `node examples/diagnose.js` to
 see which transport your network accepts.
 
+**`anonymousApiFallback` (2.4.0).** Every `/api/*` helper — `generateImage`,
+`editImage`, `upscaleImage`, `colorizeImage`, `detectNsfw`, `summarizeText`
+and plain `deepai.runApi()` — automatically retries once with a fresh
+anonymous key (browser dialect per endpoint) when the registered key is
+refused with "Pro members in good standing". This is what the website does
+for free visitors, so all of these now work on free keys from a residential
+IP. Disable globally with `anonymousApiFallback: false` in the constructor.
+On failure both refusals are reported (`<registered refusal> | anonymous
+retry: <anonymous refusal>`).
+
+**Windows consoles.** CLI output from the bundled examples is plain ASCII on
+purpose — emoji and typographic dashes render as garbage (Chinese-looking
+mojibake) in cmd.exe/PowerShell with a non-UTF-8 codepage.
+
 **`generateImage()` returns `{ ok: false, error: 'DEEPAI_QUOTA_EXCEEDED' }`**
 `/api/text2img` is Pro-only for registered keys ("APIs are only available for
 Pro members in good standing"), the anonymous browser-shaped retry was

package/examples/diagnose.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 /**
- * diagnose.js — DeepAI text2img connectivity diagnostic.
+ * diagnose.js - DeepAI text2img connectivity diagnostic.
  *
  * Run ON THE MACHINE where the browser playground works:
  *
@@ -93,19 +93,19 @@ function runCurl(binary, impersonate) {
 
 function label(t) {
     const b = String(t.body).slice(0, 140).replace(/\s+/g, ' ');
-    if (t.status === 200 && /share_url|output_url/.test(t.body)) return `✅ SUCCESS — image generated (HTTP 200)`;
-    if (/valid Api-Key/i.test(b)) return `❌ key rejected (unexpected — fresh key was used)`;
-    if (/try this model/i.test(b)) return `❌ transport refused ("Please try this model on deepai.org")`;
-    if (/Pro members/i.test(b)) return `❌ account-level refusal (needs a Pro key)`;
-    if (/try it exceeded/i.test(b)) return `⚠️ free quota exhausted for this device/IP — retry later or change --device-id`;
-    return `❌ HTTP ${t.status}: ${b}`;
+    if (t.status === 200 && /share_url|output_url/.test(t.body)) return `[OK] SUCCESS - image generated (HTTP 200)`;
+    if (/valid Api-Key/i.test(b)) return `[FAIL] key rejected (unexpected - fresh key was used)`;
+    if (/try this model/i.test(b)) return `[FAIL] transport refused ("Please try this model on deepai.org")`;
+    if (/Pro members/i.test(b)) return `[FAIL] account-level refusal (needs a Pro key)`;
+    if (/try it exceeded/i.test(b)) return `[WARN] free quota exhausted for this device/IP - retry later or change --device-id`;
+    return `[FAIL] HTTP ${t.status}: ${b}`;
 }
 
 (async () => {
-    console.log(`DeepAI text2img diagnostic — device ${deviceId.slice(0, 8)}…\n`);
+    console.log(`DeepAI text2img diagnostic - device ${deviceId.slice(0, 8)}...\n`);
     const rows = [];
-    try { rows.push(['1. Node fetch (library default)', label(await viaFetch())]); } catch (e) { rows.push(['1. Node fetch', `⚠️ ${e.message}`]); }
-    try { rows.push(['2. system curl', label(runCurl('curl', false))]); } catch (e) { rows.push(['2. system curl', `⚠️ ${e.message.split('\n')[0]}`]); }
+    try { rows.push(['1. Node fetch (library default)', label(await viaFetch())]); } catch (e) { rows.push(['1. Node fetch', `[WARN] ${e.message}`]); }
+    try { rows.push(['2. system curl', label(runCurl('curl', false))]); } catch (e) { rows.push(['2. system curl', `[WARN] ${e.message.split('\n')[0]}`]); }
 
     let impBin = opt.imp;
     if (!impBin) {
@@ -115,20 +115,20 @@ function label(t) {
         }
     }
     if (impBin) {
-        try { rows.push([`3. curl-impersonate (${impBin})`, label(runCurl(impBin, true))]); } catch (e) { rows.push(['3. curl-impersonate', `⚠️ ${e.message.split('\n')[0]}`]); }
+        try { rows.push([`3. curl-impersonate (${impBin})`, label(runCurl(impBin, true))]); } catch (e) { rows.push(['3. curl-impersonate', `[WARN] ${e.message.split('\n')[0]}`]); }
     } else {
-        rows.push(['3. curl-impersonate', '⏭ skipped — binary not found (see README for install)']);
+        rows.push(['3. curl-impersonate', '[SKIP] skipped - binary not found (see README for install)']);
     }
 
     for (const [name, v] of rows) console.log(`${name.padEnd(34)} ${v}`);
     console.log(`
 Reading the results:
-- A ✅ on ANY line    → that transport works; use it (library: transport option,
+- A [OK] on ANY line    -> that transport works; use it (library: transport option,
                         standalone: --transport).
-- ❌ on line 1 only   → non-browser TLS stack refused; use 'curl' or
+- [FAIL] on line 1 only   -> non-browser TLS stack refused; use 'curl' or
                         'impersonate'.
-- ❌ on lines 1+2, ✅ on 3 → strict browser-TLS matching; use 'impersonate'.
-- ❌ everywhere      → the IP is refused for anonymous generation, or the free
+- [FAIL] on lines 1+2, [OK] on 3 -> strict browser-TLS matching; use 'impersonate'.
+- [FAIL] everywhere      -> the IP is refused for anonymous generation, or the free
                         quota is exhausted. Compare with the browser: DevTools
-                        → Network → generate → text2img request → Response.`);
+                        -> Network -> generate -> text2img request -> Response.`);
 })();

package/examples/text2img-standalone.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 'use strict';
 /**
- * text2img-standalone.js — zero-dependency DeepAI text-to-image CLI.
+ * text2img-standalone.js - zero-dependency DeepAI text-to-image CLI.
  *
- * Speaks the anonymous browser dialect: a fresh single-use `tryit-…` key
+ * Speaks the anonymous browser dialect: a fresh single-use `tryit-...` key
  * (hashed over the User-Agent) per run, browser-identical headers and a
  * multipart/form-data body, plus a stable `deepai_device_id` cookie.
  *
@@ -18,7 +18,7 @@
  *
  * Transports: 'fetch' (default, Node fetch) | 'curl' (system curl) |
  * 'impersonate' (curl-impersonate binary, Chrome TLS profile). Some
- * networks serve non-browser TLS stacks a refusal — if 'fetch' fails with
+ * networks serve non-browser TLS stacks a refusal - if 'fetch' fails with
  * "Please try this model on deepai.org", try 'curl', then 'impersonate'.
  *
  * Requires Node.js 18+. Anonymous generation is refused from
@@ -27,20 +27,20 @@
 
 const API_URL = 'https://api.deepai.org/api/text2img';
 const SALT = 'hackers_become_a_little_stinkier_every_time_they_hack';
-// Keep this EXACT string in sync with the User-Agent header below — the key
+// Keep this EXACT string in sync with the User-Agent header below - the key
 // hash is computed over it and the server recomputes it from the request.
 const USER_AGENT =
     'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36';
 
 // ---------------------------------------------------------------------------
 // Deterministic key hash (see DeepAIClient._islandHash in the engine).
-// The integer/bit-level behaviour is intentional — do not simplify it.
+// The integer/bit-level behaviour is intentional - do not simplify it.
 // ---------------------------------------------------------------------------
 function islandHash(input) {
     const a = [];
     for (let b = 0; 64 > b; ) a[b] = 0 | (4294967296 * Math.sin(++b % Math.PI));
     let d, e, f, g = [(d = 1732584193), (e = 4023233417), ~d, ~e], h = [];
-    const l = unescape(encodeURI(input)) + '€';
+    const l = unescape(encodeURI(input)) + '\u0080';
     let k = l.length;
     let c = (--k / 4 + 2) | 15;
     for (h[--c] = 8 * k; ~k; ) h[k >> 2] |= l.charCodeAt(k) << (8 * k--);
@@ -120,19 +120,19 @@ async function main() {
         Accept: '*/*',
         'Accept-Language': 'en-US,en;q=0.9',
         Cookie: `deepai_device_id=${opts.deviceId}`,
-        // NOTE: do NOT set Content-Type yourself — undici adds the multipart
+        // NOTE: do NOT set Content-Type yourself - undici adds the multipart
         // boundary. A manual Content-Type without the boundary is rejected.
     };
 
     console.log(`Prompt : ${opts.prompt}`);
-    console.log(`Key    : ${opts.key ? '(registered key — needs Pro)' : apiKey + '  (fresh, single-use)'}`);
+    console.log(`Key    : ${opts.key ? '(registered key - needs Pro)' : apiKey + '  (fresh, single-use)'}`);
     console.log('POST   : ' + API_URL);
 
     let res;
     if (opts.transport === 'curl' || opts.transport === 'impersonate') {
         const { execFile } = require('child_process');
         const binary = opts.transport === 'impersonate' ? (opts.imp || 'curl-impersonate') : 'curl';
-        // the chrome136 profile sends its own Mac Chrome UA — the anonymous
+        // the chrome136 profile sends its own Mac Chrome UA - the anonymous
         // key hash must be derived from exactly that UA
         const profileUa = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36';
         const apiKey = opts.key || freshTryItKey(opts.transport === 'impersonate' ? profileUa : USER_AGENT);
@@ -169,10 +169,10 @@ async function main() {
         console.error(`\nFAILED  HTTP ${res.status}`);
         console.error(raw.slice(0, 500));
         const s = String(data?.status || data?.err || '');
-        if (/valid Api-Key/i.test(s)) console.error('\n→ The key is invalid or already used. Keys are single-use and must be hashed for the exact User-Agent sent; this script mints a fresh one each run.');
-        else if (/try this model on deepai\.org/i.test(s)) console.error('\n→ DeepAI is refusing anonymous generation from your IP (datacenter/VPN) or the Origin header is missing. Run from a residential IP and keep the Origin/Referer headers.');
-        else if (/Pro members/i.test(s)) console.error('\n→ Your registered key is on the free plan; /api/* needs Pro. Use the anonymous mode (omit --key) or upgrade.');
-        else if (/try it exceeded/i.test(s)) console.error('\n→ Free quota for this device/IP is exhausted. Try a different --device-id or wait for the reset.');
+        if (/valid Api-Key/i.test(s)) console.error('\n-> The key is invalid or already used. Keys are single-use and must be hashed for the exact User-Agent sent; this script mints a fresh one each run.');
+        else if (/try this model on deepai\.org/i.test(s)) console.error('\n-> DeepAI is refusing anonymous generation from your IP (datacenter/VPN) or the Origin header is missing. Run from a residential IP and keep the Origin/Referer headers.');
+        else if (/Pro members/i.test(s)) console.error('\n-> Your registered key is on the free plan; /api/* needs Pro. Use the anonymous mode (omit --key) or upgrade.');
+        else if (/try it exceeded/i.test(s)) console.error('\n-> Free quota for this device/IP is exhausted. Try a different --device-id or wait for the reset.');
         process.exit(1);
     }
 
@@ -190,10 +190,10 @@ async function main() {
             require('fs').writeFileSync(out, buf);
             console.log(`Saved  : ${out} (${(buf.length / 1024).toFixed(1)} KB)`);
         } else {
-            console.log(`(download skipped: HTTP ${img.status} — open the URL above in a browser)`);
+            console.log(`(download skipped: HTTP ${img.status} - open the URL above in a browser)`);
         }
     } catch (e) {
-        console.log(`(download failed: ${e.message} — open the URL above in a browser)`);
+        console.log(`(download failed: ${e.message} - open the URL above in a browser)`);
     }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alexa-ai",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "description": "AI engine for the Alexa WhatsApp bot: DeepAI-powered chat with PostgreSQL-backed long-term memory, cross-chat identity (@lid <-> phone), vision/OCR, image generation and web search.",
   "main": "index.js",
   "scripts": {

package/src/AlexaAI.js

@@ -642,10 +642,14 @@ class AlexaAI {
         // size/quality fields).
         if (!chatToolOnly) {
             try {
-                const extra = this.client.usingTryItKey
-                    ? AlexaAI._browserImageFields(aspectRatio || '1:1', apiFields)
-                    : apiFields;
-                const data = await this.client.text2img(text, extra, { signal });
+                const browserFields = AlexaAI._browserImageFields(aspectRatio || '1:1', apiFields);
+                const extra = this.client.usingTryItKey ? browserFields : apiFields;
+                const data = await this.client.text2img(text, extra, {
+                    signal,
+                    // used when a registered key is refused and runApi()
+                    // retries anonymously
+                    anonymousExtraFields: browserFields,
+                });
                 const url = AlexaAI._outputUrl(data);
                 if (url) return { ok: true, url, id: data.id || null, error: null, via: 'api', raw: data };
                 errors.push('text2img: no output_url in response');
@@ -784,7 +788,7 @@ class AlexaAI {
         if (!field) return { ...AlexaAI._mediaError('detectNsfw', 'NSFW_FAILED'), score: null, nsfw: null };
         const threshold = typeof opts.threshold === 'number' ? opts.threshold : 0.7;
         try {
-            const data = await this.client.detectNsfw(field);
+            const data = await this.client.detectNsfw(field, {}, opts);
             const score = typeof data?.output?.nsfw_score === 'number' ? data.output.nsfw_score : null;
             return { ok: true, score, nsfw: score == null ? null : score >= threshold, error: null, raw: data };
         } catch (err) {

package/src/core/Config.js

@@ -126,6 +126,12 @@ class Config {
         this.curlImpersonatePath =
             opts.curlImpersonatePath || process.env.DEEPAI_CURL_IMPERSONATE || null;
         this.curlImpersonateTarget = opts.curlImpersonateTarget || 'chrome136';
+        // ---- /api/* anonymous fallback ----------------------------------------
+        // When a registered key is refused ("Pro members in good standing"),
+        // retry once with a fresh anonymous key in the browser dialect
+        // (options.anonymousExtraFields). Mirrors how the website keeps
+        // working for free visitors. Disable with anonymousApiFallback:false.
+        this.anonymousApiFallback = opts.anonymousApiFallback !== false;
 
         // ---- Anonymous device identity ---------------------------------------
         // Stable device identifier sent as the `deepai_device_id` cookie.

package/src/core/DeepAIClient.js

@@ -615,9 +615,48 @@ class DeepAIClient {
      * @returns {Promise<object>} e.g. `{ id, output_url }`
      */
     async runApi(name, fields = {}, options = {}) {
-        const url = `${this.config.url('api')}/${String(name).replace(/^\/+/, '')}`;
-        const entries = this._buildApiFields(fields, options);
-        return this._apiFormRequest(url, entries, options);
+        try {
+            const url = `${this.config.url('api')}/${String(name).replace(/^\/+/, '')}`;
+            const entries = this._buildApiFields(fields, options);
+            return await this._apiFormRequest(url, entries, options);
+        } catch (err) {
+            // A registered key refused for plan reasons ("Pro members in
+            // good standing") gets one anonymous browser-shaped retry, the
+            // same way the website keeps serving free visitors.
+            if (
+                err instanceof QuotaExceededError &&
+                this.config.anonymousApiFallback !== false &&
+                !options._anonymous &&
+                !this.usingTryItKey
+            ) {
+                const anonFields = { ...(options.anonymousExtraFields || {}), ...fields };
+                if (this.config.debug) this.log.warn?.(`[AlexaAI] ${name} refused for the registered key; retrying anonymously`);
+                return this._runAnonymousApi(name, anonFields, options).catch((anonErr) => {
+                    anonErr.message = `${err.message} | anonymous retry: ${anonErr.message}`;
+                    throw anonErr;
+                });
+            }
+            throw err;
+        }
+    }
+
+    /**
+     * Run one `/api/<name>` call with a one-shot anonymous key regardless of
+     * the configured key. The active keys are swapped out for the duration
+     * of the call and restored afterwards.
+     * @private
+     */
+    async _runAnonymousApi(name, fields, options = {}) {
+        const previousKeys = this._keys;
+        const previousIndex = this._keyIndex;
+        this._keys = [DeepAIClient.generateTryItKey(this.config.userAgent)];
+        this._keyIndex = 0;
+        try {
+            return await this.runApi(name, fields, { ...options, _anonymous: true });
+        } finally {
+            this._keys = previousKeys;
+            this._keyIndex = previousIndex;
+        }
     }
 
     /**
@@ -849,47 +888,45 @@ class DeepAIClient {
     }
 
     /**
-     * Run a classic `/api/<name>` call with a one-shot anonymous tryit key,
-     * regardless of the configured key. Used as the fallback path when a
-     * registered key is refused ("Pro members only"); a fresh key is minted
-     * for this single request.
+     * Run a classic `/api/<name>` call with a one-shot anonymous key,
+     * regardless of the configured key (public wrapper).
      */
     async runApiWithTryItKey(name, fields = {}, options = {}) {
-        const previousKeys = this._keys;
-        const previousIndex = this._keyIndex;
-        this._keys = [DeepAIClient.generateTryItKey(this.config.userAgent)];
-        this._keyIndex = 0;
-        try {
-            return await this.runApi(name, fields, options);
-        } finally {
-            this._keys = previousKeys;
-            this._keyIndex = previousIndex;
-        }
+        return this._runAnonymousApi(name, { ...(options.anonymousExtraFields || {}), ...fields }, { ...options, _anonymous: true });
     }
 
     /** Prompt-driven image edit (`/api/image-editor`). */
-    async editImage(image, text, extra = {}) {
-        return this.runApi(STANDARD_APIS.imageEditor, { image, text, ...extra });
+    async editImage(image, text, extra = {}, options = {}) {
+        return this.runApi(STANDARD_APIS.imageEditor, { image, text, ...extra }, options);
     }
 
     /** 4x upscale (`/api/torch-srgan`). */
-    async upscaleImage(image, extra = {}) {
-        return this.runApi(STANDARD_APIS.superResolution, { image, ...extra });
+    async upscaleImage(image, extra = {}, options = {}) {
+        return this.runApi(STANDARD_APIS.superResolution, { image, ...extra }, options);
     }
 
     /** Colourise a black-and-white photo (`/api/colorizer`). */
-    async colorizeImage(image, extra = {}) {
-        return this.runApi(STANDARD_APIS.colorizer, { image, ...extra });
+    async colorizeImage(image, extra = {}, options = {}) {
+        return this.runApi(STANDARD_APIS.colorizer, { image, ...extra }, {
+            anonymousExtraFields: { generation_source: 'img' },
+            ...options,
+        });
     }
 
     /** NSFW score (`/api/nsfw-detector`). */
-    async detectNsfw(image, extra = {}) {
-        return this.runApi(STANDARD_APIS.nsfwDetector, { image, ...extra });
+    async detectNsfw(image, extra = {}, options = {}) {
+        return this.runApi(STANDARD_APIS.nsfwDetector, { image, ...extra }, {
+            anonymousExtraFields: { generation_source: 'img' },
+            ...options,
+        });
     }
 
     /** Abstractive summary (`/api/summarization`). */
-    async summarize(text, extra = {}) {
-        return this.runApi(STANDARD_APIS.summarization, { text, ...extra });
+    async summarize(text, extra = {}, options = {}) {
+        return this.runApi(STANDARD_APIS.summarization, { text, ...extra }, {
+            anonymousExtraFields: { generation_source: 'img' },
+            ...options,
+        });
     }
 
     /** Sentiment labels (`/api/sentiment-analysis`). */

package/src/services/ImageDescriber.js

@@ -154,7 +154,7 @@ class ImageDescriber {
                     sawRefusal = true;
                     this._modelsRefused.add(model);
                     if (this.config.debug) {
-                        this.log.warn?.(`[AlexaAI] ${model} cannot see attachments — trying the next model`);
+                        this.log.warn?.(`[AlexaAI] ${model} cannot see attachments - trying the next model`);
                     }
                     continue;
                 }

package/test/run-tests.js

@@ -695,7 +695,7 @@ section('DeepAIClient — the whole endpoint surface (mocked transport)');
         const ai = new AlexaAI({ key: '11111111-2222-3333-4444-555555555555', postgresUrl: 'postgres://u:p@localhost/db', autoMigrate: false });
         const result = await ai.generateImage('a cute orange cat', { aspectRatio: '16:9' });
         global.fetch = realFetch;
-        ok('generateImage recovers via the anonymous browser-shaped retry', result.ok === true && result.via === 'anonymous');
+        ok('generateImage recovers through the built-in anonymous fallback', result.ok === true && result.via === 'api');
         const anon = calls.find((c) => DeepAIClient.isTryItKey(c.key));
         ok(
             'anonymous retry carries the browser fields',
@@ -707,6 +707,41 @@ section('DeepAIClient — the whole endpoint surface (mocked transport)');
                 anon.form.quality === 'true'
         );
         ok('share_url is preferred over output_url', result.url === 'https://deepai.org/generated-image.png');
+
+        // detectNsfw: same Pro refusal, same anonymous recovery
+        calls.length = 0;
+        global.fetch = async (url, init = {}) => {
+            const form = {};
+            for (const [k, v] of init.body.entries()) form[k] = v;
+            calls.push({ url, key: init.headers['api-key'], form });
+            const first = calls.filter((c) => /nsfw-detector$/.test(c.url)).length === 1;
+            return {
+                status: first ? 402 : 200,
+                headers: { get: () => 'application/json' },
+                text: async () =>
+                    first
+                        ? JSON.stringify({ status: 'APIs are only available for Pro members in good standing' })
+                        : JSON.stringify({ id: 'n1', output: { nsfw_score: 0.13 } }),
+            };
+        };
+        const nsfw = await ai.detectNsfw(Buffer.from('fake-image-bytes'));
+        global.fetch = realFetch;
+        ok('detectNsfw recovers through the anonymous fallback', nsfw.ok === true && nsfw.score === 0.13 && nsfw.nsfw === false);
+        const anonNsfw = calls.find((c) => DeepAIClient.isTryItKey(c.key));
+        ok('anonymous nsfw retry uses the model-page dialect', anonNsfw && anonNsfw.form.generation_source === 'img');
+
+        // anonymousApiFallback:false keeps the refusal
+        const strict = new AlexaAI({ key: '11111111-2222-3333-4444-555555555555', postgresUrl: 'postgres://u:p@localhost/db', autoMigrate: false, anonymousApiFallback: false });
+        calls.length = 0;
+        let fetchCalls = 0;
+        global.fetch = async (url, init = {}) => {
+            fetchCalls++;
+            return { status: 402, headers: { get: () => 'application/json' }, text: async () => JSON.stringify({ status: 'APIs are only available for Pro members in good standing' }) };
+        };
+        const refused = await strict.detectNsfw(Buffer.from('fake-image-bytes'));
+        global.fetch = realFetch;
+        ok('anonymousApiFallback:false surfaces the refusal', refused.ok === false && refused.error === 'DEEPAI_QUOTA_EXCEEDED');
+        ok('no anonymous retry was made', fetchCalls === 1);
     }
     
 {