dreamlayer 0.1.0 → 0.2.0

package/README.md

@@ -12,10 +12,6 @@ dreamlayer generate "A glass greenhouse at dusk" --out greenhouse.png
 Get a key at [platform.dreamlayer.io](https://platform.dreamlayer.io). A new account
 starts at zero credits, and each finished image costs one.
 
-> **Not yet publishable.** This package sends an `operation` field that requires
-> the gateway build adding it to `ExecuteRequest`. Against the currently deployed
-> API every call returns `422 extra_forbidden`. Deploy that build first.
-
 ## Commands
 
 ```bash
@@ -31,6 +27,10 @@ dreamlayer capabilities                         # spends nothing
 `cutout` and `upscale` name their operation rather than hoping a sentence is read the
 way you meant, so they run a dedicated chain and never stop to ask a question.
 
+Image inputs may be PNG, JPEG, WebP, or supported camera RAW files up to 200 MB.
+DreamLayer develops RAW previews, applies camera orientation, and resizes oversized
+sources on the server before any operation runs.
+
 `upscale` doubles each side and finished images are capped at 4096 per side, so the
 longest side of your input must be 2048 or less. Anything larger is refused before it
 costs you a credit.

package/dist/cli.js

@@ -15,10 +15,12 @@
  *   6  the run ended asking a question instead of producing an image
  */
 import { randomUUID } from "node:crypto";
-import { readFile, writeFile } from "node:fs/promises";
+import { openAsBlob, readFileSync } from "node:fs";
+import { stat, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { ApiError, ManagedClient, StreamIdleError, } from "./client.js";
+import { ApiError, KNOWN_OPERATIONS, ManagedClient, StreamIdleError, UploadTimeoutError, } from "./client.js";
 import { Progress, consume } from "./render.js";
+const PACKAGE_VERSION = String(JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version);
 const USAGE = `dreamlayer - generate and edit images from your terminal
 
 USAGE
@@ -104,24 +106,21 @@ function client() {
     }
     return new ManagedClient(key, (process.env.DREAMLAYER_API_URL ?? "https://api.dreamlayer.io").trim());
 }
-/** Upload a local file and return its asset id, with size and type checked here first. */
+const MAX_SOURCE_BYTES = 200 * 1024 * 1024;
+/** Upload a local file; the server owns RAW, EXIF, alpha, and resize normalization. */
 async function upload(api, file) {
     const resolved = path.resolve(file);
-    const extension = path.extname(resolved).toLowerCase();
-    if (![".png", ".jpg", ".jpeg", ".webp"].includes(extension)) {
-        throw new UsageError(`${file} is not a PNG, JPEG, or WEBP`);
-    }
-    let bytes;
+    let fileStat;
     try {
-        bytes = await readFile(resolved);
+        fileStat = await stat(resolved);
     }
     catch {
         throw new UsageError(`cannot read ${file}`);
     }
-    if (bytes.byteLength > 20 * 1024 * 1024) {
-        throw new UsageError(`${file} is ${Math.round(bytes.byteLength / 1024 / 1024)} MB; the limit is 20 MB`);
+    if (fileStat.size > MAX_SOURCE_BYTES) {
+        throw new UsageError(`${file} is ${Math.round(fileStat.size / 1024 / 1024)} MB; the limit is 200 MB`);
     }
-    const asset = await api.uploadInput(new Blob([new Uint8Array(bytes)]), path.basename(resolved));
+    const asset = await api.uploadInput(await openAsBlob(resolved), path.basename(resolved));
     return asset.input_asset_id;
 }
 function defaultOut() {
@@ -187,6 +186,45 @@ function recoveryHint(error) {
         : null;
     return id ? `The job may still be running. Check it with:\n  dreamlayer status ${id}\n` : "";
 }
+/**
+ * Say so when this build and the server disagree about what exists.
+ *
+ * The MCP package solves this by asking the server at startup and shaping its tool
+ * schema from the answer. The CLI cannot: `ManagedOperation` is a compile-time union and
+ * `cutout` / `upscale` are compile-time commands, so deriving the list at runtime would
+ * buy consistency by giving up type safety at every call site.
+ *
+ * So it reports instead of adapting, and it does so HERE because `capabilities` is free,
+ * spends nothing, and is the command people are told to run first. Both directions are
+ * worth naming:
+ *
+ *   - the server offers something this build cannot reach -> the user is missing a
+ *     feature they are paying for and would never know
+ *   - this build names something the server will not run -> the failure that shipped on
+ *     2026-08-21, where a call looked like a client bug rather than a version skew
+ *
+ * stderr, never stdout: `dreamlayer capabilities` is piped into jq.
+ */
+function warnIfOperationsDrifted(capabilities) {
+    const listed = capabilities.operations;
+    if (!Array.isArray(listed) || listed.some((o) => typeof o !== "string"))
+        return;
+    const server = new Set(listed);
+    const mine = new Set(KNOWN_OPERATIONS);
+    const serverOnly = [...server].filter((o) => !mine.has(o));
+    const clientOnly = [...mine].filter((o) => !server.has(o));
+    if (serverOnly.length === 0 && clientOnly.length === 0)
+        return;
+    process.stderr.write("\nThis CLI and the server disagree about the operation list.\n");
+    if (serverOnly.length > 0) {
+        process.stderr.write(`  The server offers, this version cannot use: ${serverOnly.join(", ")}\n` +
+            "  Upgrade with: npm i -g dreamlayer\n");
+    }
+    if (clientOnly.length > 0) {
+        process.stderr.write(`  This version names, the server will not run: ${clientOnly.join(", ")}\n` +
+            "  Those commands will fail validation until the server catches up.\n");
+    }
+}
 function exitCodeFor(error) {
     if (error.status === 401 || error.status === 403)
         return 2;
@@ -203,7 +241,7 @@ async function main(argv) {
         return command ? 0 : 1;
     }
     if (command === "--version" || command === "-v") {
-        process.stdout.write("0.1.0\n");
+        process.stdout.write(`${PACKAGE_VERSION}\n`);
         return 0;
     }
     const { positional, options } = parseOptions(rest);
@@ -259,6 +297,7 @@ async function main(argv) {
         case "capabilities": {
             const capabilities = await client().getCapabilities();
             process.stdout.write(`${JSON.stringify(capabilities, null, 2)}\n`);
+            warnIfOperationsDrifted(capabilities);
             return 0;
         }
         default:
@@ -297,6 +336,12 @@ main(process.argv.slice(2))
         process.exitCode = 5;
         return;
     }
+    if (error instanceof UploadTimeoutError) {
+        process.stderr.write(`${error.message}\n`);
+        process.stderr.write("Temporary. Retry with --idempotency-key to avoid paying twice.\n");
+        process.exitCode = 5;
+        return;
+    }
     process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
     process.stderr.write(recoveryHint(error));
     process.exitCode = 1;

package/dist/client.d.ts

@@ -34,7 +34,17 @@ export type ManagedEvent = {
  * anyway. Confirmed against the deployment, not the source: the live /openapi.json
  * advertises exactly these four in both ExecuteRequest and ImageJobCreate.
  */
-export type ManagedOperation = "text_to_image" | "image_to_image" | "background_remove" | "upscale";
+export declare const KNOWN_OPERATIONS: readonly ["text_to_image", "image_to_image", "background_remove", "upscale"];
+/**
+ * Derived from the array above, not written twice.
+ *
+ * The first version of this declared the union by hand and pinned an array to it with
+ * `satisfies`. That catches a WRONG entry and not a MISSING one, because a shorter array
+ * still satisfies a wider union, so the exact drift this file exists to detect could
+ * slip through the check meant to prevent it. Deriving the type makes the array the
+ * single definition and the question unaskable.
+ */
+export type ManagedOperation = (typeof KNOWN_OPERATIONS)[number];
 export type ManagedExecuteInput = {
     prompt?: string;
     respond?: string;
@@ -79,6 +89,10 @@ export declare class StreamIdleError extends Error {
     readonly idleMs: number;
     constructor();
 }
+export declare class UploadTimeoutError extends Error {
+    constructor();
+}
+export declare function uploadTimeoutMs(bytes: number): number;
 /**
  * Validate one sanitized event against the published contract.
  *
@@ -90,6 +104,7 @@ export declare function managedEvent(event: string, id: string | null, value: un
 export declare class ManagedClient {
     private readonly apiKey;
     private readonly baseUrl;
+    private capabilitiesPromise;
     constructor(apiKey: string, baseUrl?: string);
     /**
      * Run or continue an execution, yielding each validated event as it arrives.

package/dist/client.js

@@ -12,6 +12,35 @@
  * client instead of the dead local-proxy class, and that timeouts and an explicit
  * redirect policy were added, which the original lacked.
  */
+/**
+ * Every operation the Agent API can execute.
+ *
+ * REQUIRES the gateway build that added `operation` to ExecuteRequest. Against an older
+ * deployment this field is rejected with 422 extra_forbidden, because the request model
+ * is closed. That is a sequencing constraint, not a reason to drop it: naming the
+ * operation is what stops a cutout or an upscale being re-read from the prompt and
+ * coming back as a clarifying question instead of an image.
+ *
+ * SATISFIED 2026-08-21. prodbeta176 carries the field in the gateway AND the dispatch
+ * in the workflow engine, which had been split across two releases: the gateway
+ * accepted `operation` from prodbeta174 while the half that acts on it was still on
+ * prodbeta172, so naming an operation returned 200 and was then inferred from prose
+ * anyway. Confirmed against the deployment, not the source: the live /openapi.json
+ * advertises exactly these four in both ExecuteRequest and ImageJobCreate.
+ */
+export const KNOWN_OPERATIONS = [
+    "text_to_image",
+    "image_to_image",
+    "background_remove",
+    "upscale",
+];
+const DIRECT_INPUT_BYTES = 20 * 1024 * 1024;
+const RASTER_INPUT_SUFFIXES = new Set([".png", ".jpg", ".jpeg", ".webp"]);
+const LEGACY_INPUT_SUFFIXES = new Set([
+    ...RASTER_INPUT_SUFFIXES,
+    ".arw", ".cr2", ".cr3", ".crw", ".dng", ".nef", ".nrw", ".orf", ".pef",
+    ".raf", ".rw2", ".sr2", ".srw",
+]);
 export class ApiError extends Error {
     status;
     detail;
@@ -48,12 +77,27 @@ export class StreamIdleError extends Error {
         this.name = "StreamIdleError";
     }
 }
+export class UploadTimeoutError extends Error {
+    constructor() {
+        super("the staged upload stopped before it completed; no image job was started");
+        this.name = "UploadTimeoutError";
+    }
+}
 const ERROR_BODY_LIMIT = 16 * 1024;
 const ERROR_DETAIL_LIMIT = 300;
 /**
  * A plain request: send, get a body back. Bounded work, so a total cap is right.
  */
 const REQUEST_TIMEOUT_MS = 130_000;
+const UPLOAD_MIN_BYTES_PER_SECOND = 256 * 1024;
+const UPLOAD_MAX_TIMEOUT_MS = 15 * 60_000;
+export function uploadTimeoutMs(bytes) {
+    const override = Number(process.env.DREAMLAYER_UPLOAD_TIMEOUT_MS);
+    if (Number.isFinite(override) && override > 0) {
+        return Math.min(Math.max(override, 100), UPLOAD_MAX_TIMEOUT_MS);
+    }
+    return Math.min(Math.max(REQUEST_TIMEOUT_MS, 60_000 + Math.ceil(bytes / UPLOAD_MIN_BYTES_PER_SECOND) * 1000), UPLOAD_MAX_TIMEOUT_MS);
+}
 /**
  * A STREAM is different, and conflating the two shipped a broken `upscale`.
  *
@@ -292,6 +336,7 @@ function requireEventStream(response) {
 export class ManagedClient {
     apiKey;
     baseUrl;
+    capabilitiesPromise = null;
     constructor(apiKey, baseUrl = "https://api.dreamlayer.io") {
         this.apiKey = apiKey;
         if (!apiKey.trim())
@@ -326,7 +371,13 @@ export class ManagedClient {
         yield* this.parse(stream);
     }
     async getCapabilities() {
-        const capabilities = await this.request("/v1/capabilities");
+        this.capabilitiesPromise ??= this.request("/v1/capabilities").catch((error) => {
+            // Cache a successful contract for the process, but never pin a transient
+            // capabilities failure as a permanent result.
+            this.capabilitiesPromise = null;
+            throw error;
+        });
+        const capabilities = await this.capabilitiesPromise;
         if (capabilities.api_version !== "1") {
             throw new Error("Unsupported DreamLayer Agent API version");
         }
@@ -348,7 +399,57 @@ export class ManagedClient {
             method: "DELETE",
         });
     }
-    uploadInput(file, filename = "input.png") {
+    async uploadInput(file, filename = "input.png") {
+        const suffix = filename.slice(filename.lastIndexOf(".")).toLowerCase();
+        const capabilities = await this.getCapabilities();
+        const advertised = capabilities.supported_input_extensions;
+        const supported = Array.isArray(advertised)
+            ? new Set(advertised.filter((item) => typeof item === "string"))
+            : LEGACY_INPUT_SUFFIXES;
+        if (!supported.has(suffix)) {
+            throw new Error(`${filename} is not a supported image or camera RAW file`);
+        }
+        if (file.size > DIRECT_INPUT_BYTES || !RASTER_INPUT_SUFFIXES.has(suffix)) {
+            const contentType = file.type || "application/octet-stream";
+            const upload = await this.request("/v1/input-assets/uploads", {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ filename, size_bytes: file.size, content_type: contentType }),
+            });
+            const targetUrl = new URL(upload.upload_url, `${this.baseUrl}/`);
+            const headers = new Headers({ "Content-Type": upload.content_type });
+            if (upload.mode === "signed") {
+                headers.set("x-goog-content-length-range", `0,${upload.maximum_bytes}`);
+            }
+            else {
+                if (targetUrl.origin !== new URL(this.baseUrl).origin) {
+                    throw new ApiError(502, "DreamLayer input upload", "refused an off-origin upload URL");
+                }
+                headers.set("Authorization", `Bearer ${this.apiKey}`);
+                headers.set("DreamLayer-Version", "1");
+            }
+            let response;
+            try {
+                response = await fetch(targetUrl, {
+                    method: upload.http_method,
+                    headers,
+                    body: file,
+                    redirect: "manual",
+                    signal: AbortSignal.timeout(uploadTimeoutMs(file.size)),
+                });
+            }
+            catch (error) {
+                if (error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError")) {
+                    throw new UploadTimeoutError();
+                }
+                throw error;
+            }
+            if (!response.ok)
+                throw await apiError(response, "DreamLayer input upload");
+            return this.request(`/v1/input-assets/uploads/${encodeURIComponent(upload.upload_id)}/finalize`, {
+                method: "POST",
+            });
+        }
         const body = new FormData();
         body.append("file", file, filename);
         return this.request("/v1/input-assets", { method: "POST", body });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dreamlayer",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Generate and edit images from your terminal, over local files, with one API key.",
   "license": "MIT",
   "type": "module",