dsh-coding-subscription-oauth 0.6.4 → 0.6.5

package/lib/grok-imagine.d.ts

@@ -5,267 +5,7 @@
  * a signed upstream URL.
  * @module dsh-coding-subscription-oauth/grok-imagine
  */
-import { IMAGINE_MEDIA_ROUTE_PREFIX, imagineMediaPath, isTrustedImaginePeer, type MediaArtifactMeta, type MediaStore, type MediaStoreVideoType, type TrustedImagineAuthz } from "./media-store.js";
-export declare const XAI_API_ORIGIN = "https://api.x.ai";
-export declare const GROK_IMAGINE_IMAGE_PATH = "/v1/images/generations";
-export declare const GROK_IMAGINE_VIDEO_START_PATH = "/v1/videos/generations";
-export declare const GROK_IMAGINE_IMAGE_MODEL = "grok-imagine-image-2.0";
-export declare const GROK_IMAGINE_VIDEO_MODEL = "grok-imagine-video-1.5";
-export declare const GROK_IMAGINE_IMAGE_TOOL = "grok_imagine_image";
-export declare const GROK_IMAGINE_VIDEO_TOOL = "grok_imagine_video";
-export declare const GROK_IMAGINE_VIDEO_STATUS_TOOL = "grok_imagine_video_status";
-export declare const IMAGINE_IMAGE_ROUTE_PREFIX = "/plugins/dsh-grok-build/imagine/images/";
-/** Frozen xAI output hosts. Callers cannot widen this list. */
-export declare const XAI_OUTPUT_HOSTS: readonly ["imgen.x.ai", "videogen.x.ai", "vidgen.x.ai"];
-export declare const IMAGINE_IMAGE_RESOLUTIONS: readonly ["1k", "2k"];
-export declare const IMAGINE_VIDEO_RESOLUTIONS: readonly ["480p", "720p", "1080p"];
-export declare const IMAGINE_IMAGE_ASPECT_RATIOS: readonly ["1:1", "3:4", "4:3", "9:16", "16:9", "2:3", "3:2", "9:19.5", "19.5:9", "9:20", "20:9", "1:2", "2:1", "auto"];
-export declare const IMAGINE_VIDEO_ASPECT_RATIOS: readonly ["1:1", "16:9", "9:16", "4:3", "3:4", "3:2", "2:3"];
-export declare const IMAGINE_VIDEO_MIN_DURATION_SECONDS = 1;
-export declare const IMAGINE_VIDEO_MAX_DURATION_SECONDS = 15;
-export declare const IMAGINE_IMAGE_MAX_N = 10;
-/**
- * Hard ceilings enforced both at the tool boundary (consumer guard) and inside
- * the Imagine client (defence-in-depth). The prompt ceiling uses UTF-16 code
- * units because that is what the JSON wire format bounds; the image-id arrays
- * are bounded so a runaway caller cannot exhaust the bounded body reader.
- */
-export declare const IMAGINE_PROMPT_MAX_LENGTH = 4000;
-export declare const IMAGINE_IMAGE_IDS_MIN = 1;
-export declare const IMAGINE_IMAGE_IDS_MAX = 5;
-export declare const DEFAULT_IMAGE_DOWNLOAD_MAX_BYTES: number;
-export declare const DEFAULT_API_TIMEOUT_MS = 30000;
-export declare const DEFAULT_IMAGE_DOWNLOAD_TIMEOUT_MS = 15000;
-export declare const DEFAULT_VIDEO_DOWNLOAD_TIMEOUT_MS = 60000;
-export declare const DEFAULT_MAX_REDIRECTS = 3;
-export declare const DEFAULT_API_JSON_MAX_BYTES: number;
-export declare const MAX_CACHED_VIDEO_JOBS = 256;
-export type ImagineOperation = "image.generate" | "video.start" | "video.status";
-export type ImagineImageResolution = (typeof IMAGINE_IMAGE_RESOLUTIONS)[number];
-export type ImagineVideoResolution = (typeof IMAGINE_VIDEO_RESOLUTIONS)[number];
-export type ImagineImageAspectRatio = (typeof IMAGINE_IMAGE_ASPECT_RATIOS)[number];
-export type ImagineVideoAspectRatio = (typeof IMAGINE_VIDEO_ASPECT_RATIOS)[number];
-export type ImagineApiKeyResolver = (operation: ImagineOperation) => Promise<string>;
-export type ImagineFetch = (input: string | URL, init?: RequestInit) => Promise<Response>;
-export type ImagineDnsLookup = (hostname: string) => Promise<readonly string[]>;
-export type ImagineImageMediaType = "image/png" | "image/jpeg" | "image/webp" | "image/gif";
-export interface ImagineMediaHopRequest {
-    timeoutMs: number;
-    maxBytes: number;
-    accept: string;
-    signal?: AbortSignal;
-}
-export interface ImagineMediaHop {
-    status: number;
-    location?: string;
-    contentType?: string;
-    data?: Uint8Array;
-}
-/** Single-hop GET. Must not follow redirects or attach credentials. */
-export interface ImagineMediaTransport {
-    get(url: URL, request: ImagineMediaHopRequest): Promise<ImagineMediaHop>;
-}
-export interface ImagineDownloadRequest {
-    url: string;
-    timeoutMs: number;
-    maxBytes: number;
-    accept: string;
-    signal?: AbortSignal;
-}
-export interface ImagineDownloadResult {
-    data: Uint8Array;
-    contentType?: string;
-}
-/** Full download including redirect revalidation. Production default is pinned. */
-export interface ImagineDownloader {
-    download(request: ImagineDownloadRequest): Promise<ImagineDownloadResult>;
-}
-export type GrokImagineErrorCode = "MISSING_CREDENTIAL" | "AUTH" | "QUOTA" | "RATE_LIMIT" | "SSRF" | "INVALID_INPUT" | "UPSTREAM" | "TIMEOUT" | "MEDIA";
-export declare class GrokImagineError extends Error {
-    readonly code: GrokImagineErrorCode;
-    readonly status?: number;
-    constructor(code: GrokImagineErrorCode, message: string, options?: {
-        cause?: unknown;
-        status?: number;
-    });
-}
-export interface ImagineImageAttachmentRef {
-    attachmentId: string;
-    mediaType: ImagineImageMediaType;
-    bytes: number;
-    width: number;
-    height: number;
-    name?: string;
-}
-export interface ImagineImageLimits {
-    maxImageBytes?: number;
-    mediaTypes?: readonly string[];
-}
-/** Structural AttachmentStore surface used by Imagine. */
-export interface ImagineAttachmentStore {
-    imageLimits?: ImagineImageLimits;
-    saveImage(input: {
-        data: Uint8Array;
-        mediaType: ImagineImageMediaType;
-        name?: string;
-    }): Promise<ImagineImageAttachmentRef>;
-    readImage?(ref: ImagineImageAttachmentRef, signal?: AbortSignal): Promise<{
-        ref: ImagineImageAttachmentRef;
-        data: Uint8Array;
-    }>;
-}
-export interface GenerateImagineImageInput {
-    prompt: string;
-    model?: string;
-    n?: number;
-    aspectRatio?: string;
-    resolution?: string;
-    name?: string;
-}
-export interface ImagineImageResult {
-    model: string;
-    images: readonly ImaginePersistedImage[];
-    attachment: ImagineImageAttachmentRef;
-    path: string;
-}
-export interface ImaginePersistedImage {
-    attachment: ImagineImageAttachmentRef;
-    path: string;
-}
-export interface StartImagineVideoInput {
-    prompt: string;
-    model?: string;
-    duration?: number;
-    aspectRatio?: string;
-    resolution?: string;
-    name?: string;
-}
-export interface ImagineVideoStartResult {
-    model: string;
-    requestId: string;
-    status: "pending";
-}
-export type ImagineVideoJobStatus = "pending" | "completed" | "failed";
-export interface ImagineVideoStatusResult {
-    requestId: string;
-    status: ImagineVideoJobStatus;
-    artifact?: MediaArtifactMeta;
-    path?: string;
-    error?: string;
-}
-export interface GrokImagineClientOptions {
-    resolveApiKey: ImagineApiKeyResolver;
-    attachments: ImagineAttachmentStore;
-    media: MediaStore;
-    /** API-only test seam. Never used for media and never a production default. */
-    fetch?: ImagineFetch;
-    /** Media downloads. Production default pins DNS at connect time via undici. */
-    downloader?: ImagineDownloader;
-    now?: () => number;
-    imageDownloadTimeoutMs?: number;
-    videoDownloadTimeoutMs?: number;
-    apiTimeoutMs?: number;
-    maxRedirects?: number;
-    imageMaxBytes?: number;
-    apiJsonMaxBytes?: number;
-}
-export interface ImagineImageDownloadHeaders {
-    "Content-Type": string;
-    "Content-Length": string;
-    "Content-Disposition": string;
-    "Cache-Control": string;
-    "X-Content-Type-Options": "nosniff";
-}
-export interface ImagineImageDownloadView {
-    ref: ImagineImageAttachmentRef;
-    body: Uint8Array;
-    headers: ImagineImageDownloadHeaders;
-}
-export declare function redactImagineMessage(error: unknown): string;
-/** True when an address is loopback, private, reserved, documentation, or an embedded special form. */
-export declare function isBlockedIp(address: string): boolean;
-export declare function isAllowlistedImagineHost(hostname: string): boolean;
-export declare function grokImagineVideoStatusPath(requestId: string): string;
-export declare function isSafeImagineAttachmentId(attachmentId: string): boolean;
-export declare function imagineImagePath(attachmentId: string): string;
-export declare function parseImagineImagePath(pathname: string): string | undefined;
-export declare function imagineImageDownloadHeaders(ref: ImagineImageAttachmentRef): ImagineImageDownloadHeaders;
-export { IMAGINE_MEDIA_ROUTE_PREFIX, imagineMediaPath, isTrustedImaginePeer };
-export declare function detectImageMediaType(data: Uint8Array): ImagineImageMediaType | undefined;
-export declare function detectVideoMediaType(data: Uint8Array): MediaStoreVideoType | undefined;
-export declare function defaultImagineLookup(hostname: string): Promise<readonly string[]>;
-export declare function assertSafeRemoteMediaUrl(raw: string, lookup: ImagineDnsLookup): Promise<URL>;
-export declare function createPinnedMediaTransport(lookup?: ImagineDnsLookup): ImagineMediaTransport;
-export declare function createPinnedApiFetch(lookup?: ImagineDnsLookup, maxBytes?: number): ImagineFetch;
-export declare function downloadRemoteImagineMedia(initialUrl: string, transport: ImagineMediaTransport, options: {
-    lookup: ImagineDnsLookup;
-    timeoutMs: number;
-    maxBytes: number;
-    accept: string;
-    maxRedirects: number;
-    signal?: AbortSignal;
-}): Promise<ImagineDownloadResult>;
-export declare function createPinnedImagineDownloader(options?: {
-    lookup?: ImagineDnsLookup;
-    maxRedirects?: number;
-}): ImagineDownloader;
-/**
- * Test-only adapter around an injected fetch. Ordinary mock fetch is not
- * production-safe: it cannot pin DNS at connect time.
- */
-export declare function createImagineDownloaderFromFetch(fetchImpl: ImagineFetch, options: {
-    trustedTestTransport: true;
-    lookup?: ImagineDnsLookup;
-    maxRedirects?: number;
-}): ImagineDownloader;
-/**
- * Validate a tool-supplied Imagine video `requestId`. Returns the id unchanged
- * on success or throws an `INVALID_INPUT` error. Exposed so capability tools
- * fail closed at the boundary instead of dispatching a malformed id to the
- * internal client.
- */
-export declare function parseVideoRequestId(value: unknown): string;
-/** Enforce min/max bounds on a candidate image-id array. */
-export declare function clampImagineImageIds(ids: readonly unknown[]): readonly string[];
-export declare class GrokImagineClient {
-    private readonly resolveApiKey;
-    private readonly attachments;
-    private readonly media;
-    private readonly apiFetch;
-    private readonly downloader;
-    private readonly imageDownloadTimeoutMs;
-    private readonly videoDownloadTimeoutMs;
-    private readonly apiTimeoutMs;
-    private readonly maxRedirects;
-    private readonly imageMaxBytes;
-    private readonly apiJsonMaxBytes;
-    private readonly videoResults;
-    private readonly videoInflight;
-    private readonly disposeController;
-    private disposed;
-    constructor(options: GrokImagineClientOptions);
-    /**
-     * Permanently retire this client. In-flight API calls, downloads, and
-     * media persistence operations are aborted; subsequent operations fail
-     * closed with an `INVALID_INPUT` error until callers construct a new client.
-     */
-    dispose(): void;
-    /** @returns true once {@link dispose} has been called. */
-    get isDisposed(): boolean;
-    private assertWritable;
-    generateImage(input: GenerateImagineImageInput, signal?: AbortSignal): Promise<ImagineImageResult>;
-    startVideo(input: StartImagineVideoInput, signal?: AbortSignal): Promise<ImagineVideoStartResult>;
-    videoStatus(requestId: string, options?: {
-        name?: string;
-        signal?: AbortSignal;
-    }): Promise<ImagineVideoStatusResult>;
-    private pollVideo;
-    private rememberVideo;
-    private persistGeneratedImage;
-    private resolveCredential;
-    private apiJson;
-}
-export declare function createGrokImagineClient(options: GrokImagineClientOptions): GrokImagineClient;
-/** Gate a same-origin image download. Requires an explicit trusted/authz token. */
-export declare function openTrustedImagineImageDownload(attachments: ImagineAttachmentStore, ref: ImagineImageAttachmentRef, authz: TrustedImagineAuthz): Promise<ImagineImageDownloadView>;
+export type { GenerateImagineImageInput, GrokImagineClientOptions, GrokImagineErrorCode, ImagineApiKeyResolver, ImagineAttachmentStore, ImagineDnsLookup, ImagineDownloader, ImagineDownloadRequest, ImagineDownloadResult, ImagineFetch, ImagineImageAspectRatio, ImagineImageAttachmentRef, ImagineImageDownloadHeaders, ImagineImageDownloadView, ImagineImageLimits, ImagineImageMediaType, ImagineImageResolution, ImagineImageResult, ImagineMediaHop, ImagineMediaHopRequest, ImagineMediaTransport, ImagineOperation, ImaginePersistedImage, ImagineVideoAspectRatio, ImagineVideoJobStatus, ImagineVideoResolution, ImagineVideoStartResult, ImagineVideoStatusResult, StartImagineVideoInput, } from "./grok-imagine/index.js";
+export { assertSafeRemoteMediaUrl, clampImagineImageIds, createGrokImagineClient, createImagineDownloaderFromFetch, createPinnedApiFetch, createPinnedImagineDownloader, createPinnedMediaTransport, DEFAULT_API_JSON_MAX_BYTES, DEFAULT_API_TIMEOUT_MS, DEFAULT_IMAGE_DOWNLOAD_MAX_BYTES, DEFAULT_IMAGE_DOWNLOAD_TIMEOUT_MS, DEFAULT_MAX_REDIRECTS, DEFAULT_VIDEO_DOWNLOAD_TIMEOUT_MS, defaultImagineLookup, detectImageMediaType, detectVideoMediaType, downloadRemoteImagineMedia, GROK_IMAGINE_IMAGE_MODEL, GROK_IMAGINE_IMAGE_PATH, GROK_IMAGINE_IMAGE_TOOL, GROK_IMAGINE_VIDEO_MODEL, GROK_IMAGINE_VIDEO_START_PATH, GROK_IMAGINE_VIDEO_STATUS_TOOL, GROK_IMAGINE_VIDEO_TOOL, GrokImagineClient, GrokImagineError, grokImagineVideoStatusPath, IMAGINE_IMAGE_ASPECT_RATIOS, IMAGINE_IMAGE_IDS_MAX, IMAGINE_IMAGE_IDS_MIN, IMAGINE_IMAGE_MAX_N, IMAGINE_IMAGE_RESOLUTIONS, IMAGINE_IMAGE_ROUTE_PREFIX, IMAGINE_PROMPT_MAX_LENGTH, IMAGINE_VIDEO_ASPECT_RATIOS, IMAGINE_VIDEO_MAX_DURATION_SECONDS, IMAGINE_VIDEO_MIN_DURATION_SECONDS, IMAGINE_VIDEO_RESOLUTIONS, imagineImageDownloadHeaders, imagineImagePath, isAllowlistedImagineHost, isBlockedIp, isSafeImagineAttachmentId, MAX_CACHED_VIDEO_JOBS, openTrustedImagineImageDownload, parseImagineImagePath, parseVideoRequestId, redactImagineMessage, XAI_API_ORIGIN, XAI_OUTPUT_HOSTS, } from "./grok-imagine/index.js";
+export { IMAGINE_MEDIA_ROUTE_PREFIX, imagineMediaPath, isTrustedImaginePeer } from "./media-store.js";
 //# sourceMappingURL=grok-imagine.d.ts.map

package/lib/grok-imagine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grok-imagine.d.ts","sourceRoot":"","sources":["../../src/grok-imagine.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAEN,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,MAAM,kBAAkB,CAAC;AAG1B,eAAO,MAAM,cAAc,qBAAqB,CAAC;AACjD,eAAO,MAAM,uBAAuB,2BAA2B,CAAC;AAChE,eAAO,MAAM,6BAA6B,2BAA2B,CAAC;AACtE,eAAO,MAAM,wBAAwB,2BAA2B,CAAC;AACjE,eAAO,MAAM,wBAAwB,2BAA2B,CAAC;AAEjE,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D,eAAO,MAAM,8BAA8B,8BAA8B,CAAC;AAE1E,eAAO,MAAM,0BAA0B,4CAA4C,CAAC;AAEpF,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,yDAA0D,CAAC;AAExF,eAAO,MAAM,yBAAyB,uBAAwB,CAAC;AAC/D,eAAO,MAAM,yBAAyB,oCAAqC,CAAC;AAC5E,eAAO,MAAM,2BAA2B,wHAe9B,CAAC;AACX,eAAO,MAAM,2BAA2B,8DAA+D,CAAC;AACxG,eAAO,MAAM,kCAAkC,IAAI,CAAC;AACpD,eAAO,MAAM,kCAAkC,KAAK,CAAC;AACrD,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC,eAAO,MAAM,gCAAgC,QAAkB,CAAC;AAChE,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C,eAAO,MAAM,iCAAiC,QAAS,CAAC;AACxD,eAAO,MAAM,iCAAiC,QAAS,CAAC;AACxD,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,0BAA0B,QAAc,CAAC;AACtD,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC,MAAM,MAAM,gBAAgB,GAAG,gBAAgB,GAAG,aAAa,GAAG,cAAc,CAAC;AACjF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAChF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAChF,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AACnF,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnF,MAAM,MAAM,qBAAqB,GAAG,CAAC,SAAS,EAAE,gBAAgB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAErF,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE1F,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAEhF,MAAM,MAAM,qBAAqB,GAAG,WAAW,GAAG,YAAY,GAAG,YAAY,GAAG,WAAW,CAAC;AAE5F,MAAM,WAAW,sBAAsB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,UAAU,CAAC;CAClB;AAED,uEAAuE;AACvE,MAAM,WAAW,qBAAqB;IACrC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACzE;AAED,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,UAAU,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CAC1E;AAED,MAAM,MAAM,oBAAoB,GAC7B,oBAAoB,GACpB,MAAM,GACN,OAAO,GACP,YAAY,GACZ,MAAM,GACN,eAAe,GACf,UAAU,GACV,SAAS,GACT,OAAO,CAAC;AAEX,qBAAa,gBAAiB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEb,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;CAMvG;AAED,MAAM,WAAW,yBAAyB;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,qBAAqB,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B;AAED,0DAA0D;AAC1D,MAAM,WAAW,sBAAsB;IACtC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,SAAS,CAAC,KAAK,EAAE;QAChB,IAAI,EAAE,UAAU,CAAC;QACjB,SAAS,EAAE,qBAAqB,CAAC;QACjC,IAAI,CAAC,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACvC,SAAS,CAAC,CACT,GAAG,EAAE,yBAAyB,EAC9B,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC;QAAE,GAAG,EAAE,yBAAyB,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,yBAAyB;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACzC,UAAU,EAAE,yBAAyB,CAAC;IACtC,IAAI,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,qBAAqB;IACrC,UAAU,EAAE,yBAAyB,CAAC;IACtC,IAAI,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,sBAAsB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,uBAAuB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,CAAC;CAClB;AAED,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEvE,MAAM,WAAW,wBAAwB;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACxC,aAAa,EAAE,qBAAqB,CAAC;IACrC,WAAW,EAAE,sBAAsB,CAAC;IACpC,KAAK,EAAE,UAAU,CAAC;IAClB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,2BAA2B;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,wBAAwB,EAAE,SAAS,CAAC;CACpC;AAED,MAAM,WAAW,wBAAwB;IACxC,GAAG,EAAE,yBAAyB,CAAC;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,2BAA2B,CAAC;CACrC;AAiDD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAM3D;AA4ED,uGAAuG;AACvG,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAWpD;AAkBD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAKpE;AAED,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAavE;AAED,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAK7D;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAc1E;AAsCD,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,yBAAyB,GAAG,2BAA2B,CAgBvG;AAED,OAAO,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;AAE9E,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,GAAG,qBAAqB,GAAG,SAAS,CA8BxF;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,GAAG,mBAAmB,GAAG,SAAS,CAQtF;AAOD,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAGvF;AAED,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,CAiClG;AA8JD,wBAAgB,0BAA0B,CAAC,MAAM,GAAE,gBAAuC,GAAG,qBAAqB,CA2CjH;AAED,wBAAgB,oBAAoB,CACnC,MAAM,GAAE,gBAAuC,EAC/C,QAAQ,SAA6B,GACnC,YAAY,CA6Cd;AAED,wBAAsB,0BAA0B,CAC/C,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,qBAAqB,EAChC,OAAO,EAAE;IACR,MAAM,EAAE,gBAAgB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB,GACC,OAAO,CAAC,qBAAqB,CAAC,CA4BhC;AAED,wBAAgB,6BAA6B,CAC5C,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GAChE,iBAAiB,CAenB;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAC/C,SAAS,EAAE,YAAY,EACvB,OAAO,EAAE;IAAE,oBAAoB,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GACvF,iBAAiB,CAqDnB;AAeD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAW1D;AAED,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,MAAM,EAAE,CAgB/E;AA0KD,qBAAa,iBAAiB;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAwB;IACtD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyB;IACrD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAC/C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA+C;IAC5E,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAwD;IACtF,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAyB;IAC3D,OAAO,CAAC,QAAQ,CAAS;gBAEb,OAAO,EAAE,wBAAwB;IAe7C;;;;OAIG;IACH,OAAO,IAAI,IAAI;IAUf,0DAA0D;IAC1D,IAAI,UAAU,IAAI,OAAO,CAExB;IAED,OAAO,CAAC,cAAc;IAShB,aAAa,CAAC,KAAK,EAAE,yBAAyB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiDlG,UAAU,CAAC,KAAK,EAAE,sBAAsB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA0BjG,WAAW,CAChB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACnD,OAAO,CAAC,wBAAwB,CAAC;YAsCtB,SAAS;IAsEvB,OAAO,CAAC,aAAa;YAOP,qBAAqB;YAgErB,iBAAiB;YAcjB,OAAO;CA2DrB;AAUD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,iBAAiB,CAE5F;AAED,mFAAmF;AACnF,wBAAsB,+BAA+B,CACpD,WAAW,EAAE,sBAAsB,EACnC,GAAG,EAAE,yBAAyB,EAC9B,KAAK,EAAE,mBAAmB,GACxB,OAAO,CAAC,wBAAwB,CAAC,CAcnC"}
+{"version":3,"file":"grok-imagine.d.ts","sourceRoot":"","sources":["../../src/grok-imagine.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,YAAY,EACX,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EACrB,YAAY,EACZ,uBAAuB,EACvB,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,wBAAwB,EACxB,oBAAoB,EACpB,uBAAuB,EACvB,gCAAgC,EAChC,oBAAoB,EACpB,6BAA6B,EAC7B,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACtB,gCAAgC,EAChC,iCAAiC,EACjC,qBAAqB,EACrB,iCAAiC,EACjC,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,0BAA0B,EAC1B,2BAA2B,EAC3B,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,2BAA2B,EAC3B,kCAAkC,EAClC,kCAAkC,EAClC,yBAAyB,EACzB,2BAA2B,EAC3B,gBAAgB,EAChB,wBAAwB,EACxB,WAAW,EACX,yBAAyB,EACzB,qBAAqB,EACrB,+BAA+B,EAC/B,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,EACd,gBAAgB,GAChB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC"}

package/lib/http-json.d.ts

@@ -1,10 +1,3 @@
-import type { IncomingMessage } from "node:http";
-export declare const JSON_BODY_LIMIT_BYTES: number;
-export declare class JsonRequestError extends Error {
-    readonly statusCode: 400 | 413;
-    constructor(statusCode: 400 | 413, message: string);
-}
-/** Read one JSON request body with a strict in-memory ceiling. */
-export declare function readJsonRequest(request: IncomingMessage, limit?: number): Promise<unknown>;
-export declare function requestErrorStatus(error: unknown, fallback: number): number;
+/** Compatibility facade — implementation lives in `src/runtime/` (mirrored from Hub vendor core). */
+export { JSON_BODY_LIMIT_BYTES, JsonRequestError, readJsonRequest, requestErrorStatus, } from "./runtime/http-json.js";
 //# sourceMappingURL=http-json.d.ts.map

package/lib/http-json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-json.d.ts","sourceRoot":"","sources":["../../src/http-json.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,eAAO,MAAM,qBAAqB,QAAY,CAAC;AAE/C,qBAAa,gBAAiB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,UAAU,EAAE,GAAG,GAAG,GAAG,CAAC;gBAEnB,UAAU,EAAE,GAAG,GAAG,GAAG,EAAE,OAAO,EAAE,MAAM;CAKlD;AASD,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,KAAK,SAAwB,GAAG,OAAO,CAAC,OAAO,CAAC,CAuDzG;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3E"}
+{"version":3,"file":"http-json.d.ts","sourceRoot":"","sources":["../../src/http-json.ts"],"names":[],"mappings":"AAAA,qGAAqG;AAErG,OAAO,EACN,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,GAClB,MAAM,wBAAwB,CAAC"}

package/lib/index.js

@@ -14906,7 +14906,7 @@ var require_dump = __commonJS({
 var require_dns = __commonJS({
   "node_modules/.pnpm/undici@7.29.0/node_modules/undici/lib/interceptor/dns.js"(exports, module) {
     "use strict";
-    var { isIP: isIP2 } = __require("node:net");
+    var { isIP: isIP3 } = __require("node:net");
     var { lookup } = __require("node:dns");
     var DecoratorHandler = require_decorator_handler();
     var { InvalidArgumentError, InformationalError } = require_errors();
@@ -15312,7 +15312,7 @@ var require_dns = __commonJS({
       return (dispatch) => {
         return function dnsInterceptor(origDispatchOpts, handler) {
           const origin = origDispatchOpts.origin.constructor === URL ? origDispatchOpts.origin : new URL(origDispatchOpts.origin);
-          if (isIP2(origin.hostname) !== 0) {
+          if (isIP3(origin.hostname) !== 0) {
             return dispatch(origDispatchOpts, handler);
           }
           instance.runLookup(origin, origDispatchOpts, (err, newOrigin) => {
@@ -26069,7 +26069,7 @@ import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 // src/alias-adapter.ts
 import { LlmAdapter, LlmError } from "@deepseek-ai/dsh-llm";
 
-// src/grok-errors.ts
+// src/runtime/grok-errors.ts
 var XAI_CAPACITY = /\b(?:at\s+capacity|high\s+demand|priority\s+processing|overloaded)\b/i;
 function isXaiCapacityError(detail) {
   return XAI_CAPACITY.test(detail);
@@ -26079,7 +26079,7 @@ function remapXaiCapacityFailure(failure) {
   return { ...failure, code: "RATE_LIMIT" };
 }
 
-// src/kimi-errors.ts
+// src/runtime/kimi-errors.ts
 import { CONTEXT_WINDOW_EXCEEDED_CODE, isContextWindowExceededError } from "@deepseek-ai/dsh-llm";
 var KIMI_CONTEXT_CAPACITY = /\bsupports only\s+\d+\s*k\s+context\b/i;
 function isMisclassifiedContextWindowError(detail) {
@@ -28248,7 +28248,7 @@ async function importGrokBuildSession(session, filename) {
   await session.refreshLiveCatalog();
 }
 
-// src/http-json.ts
+// src/runtime/http-json.ts
 var JSON_BODY_LIMIT_BYTES = 64 * 1024;
 var JsonRequestError = class extends Error {
   statusCode;
@@ -30589,11 +30589,11 @@ function createCodexImageController(options) {
   };
 }
 
-// src/grok-imagine.ts
+// src/grok-imagine/client.ts
 var import_undici2 = __toESM(require_undici());
 import { Buffer as Buffer3 } from "node:buffer";
 import { lookup as dnsLookup } from "node:dns/promises";
-import { BlockList, isIP } from "node:net";
+import { isIP as isIP2 } from "node:net";
 
 // src/media-store.ts
 import { createHash as createHash3, randomBytes as randomBytes3 } from "node:crypto";
@@ -31330,7 +31330,10 @@ var MediaStore = class {
   }
 };
 
-// src/grok-imagine.ts
+// src/grok-imagine/net.ts
+import { BlockList, isIP } from "node:net";
+
+// src/grok-imagine/types.ts
 var XAI_API_ORIGIN = "https://api.x.ai";
 var GROK_IMAGINE_IMAGE_PATH = "/v1/images/generations";
 var GROK_IMAGINE_VIDEO_START_PATH = "/v1/videos/generations";
@@ -31387,6 +31390,8 @@ var IMAGE_RESOLUTION_SET = new Set(IMAGINE_IMAGE_RESOLUTIONS);
 var VIDEO_RESOLUTION_SET = new Set(IMAGINE_VIDEO_RESOLUTIONS);
 var IMAGE_ASPECT_SET = new Set(IMAGINE_IMAGE_ASPECT_RATIOS);
 var VIDEO_ASPECT_SET = new Set(IMAGINE_VIDEO_ASPECT_RATIOS);
+
+// src/grok-imagine/net.ts
 var blockedNetworks = new BlockList();
 blockedNetworks.addSubnet("0.0.0.0", 8, "ipv4");
 blockedNetworks.addSubnet("10.0.0.0", 8, "ipv4");
@@ -31418,16 +31423,6 @@ blockedNetworks.addSubnet("5f00::", 16, "ipv6");
 blockedNetworks.addSubnet("fc00::", 7, "ipv6");
 blockedNetworks.addSubnet("fe80::", 10, "ipv6");
 blockedNetworks.addSubnet("ff00::", 8, "ipv6");
-function isRecord5(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function redactImagineMessage(error) {
-  const withoutRemoteUrls = (error instanceof Error ? error.message : String(error)).replace(
-    /https?:\/\/[^\s"'<>\\]+/giu,
-    "[redacted-url]"
-  );
-  return safeMessage(withoutRemoteUrls);
-}
 function dottedFromWords(high, low) {
   return `${high >> 8 & 255}.${high & 255}.${low >> 8 & 255}.${low & 255}`;
 }
@@ -31520,6 +31515,18 @@ function isBlockedHostname(hostname) {
 function isAllowlistedImagineHost(hostname) {
   return FROZEN_OUTPUT_HOSTS.has(normalizeHostname(hostname));
 }
+
+// src/grok-imagine/parse.ts
+function isRecord5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function redactImagineMessage(error) {
+  const withoutRemoteUrls = (error instanceof Error ? error.message : String(error)).replace(
+    /https?:\/\/[^\s"'<>\\]+/giu,
+    "[redacted-url]"
+  );
+  return safeMessage(withoutRemoteUrls);
+}
 function grokImagineVideoStatusPath(requestId) {
   if (!VIDEO_REQUEST_ID_PATTERN.test(requestId)) {
     throw new GrokImagineError("INVALID_INPUT", "video request id is not a safe identifier");
@@ -31614,6 +31621,20 @@ function detectVideoMediaType(data) {
   }
   return void 0;
 }
+function parseVideoRequestId(value) {
+  if (typeof value !== "string") {
+    throw new GrokImagineError("INVALID_INPUT", "video request id must be a string");
+  }
+  if (!VIDEO_REQUEST_ID_PATTERN.test(value)) {
+    throw new GrokImagineError(
+      "INVALID_INPUT",
+      "video request id must match ^[A-Za-z0-9_-]{1,256}$ and be a safe ASCII identifier"
+    );
+  }
+  return value;
+}
+
+// src/grok-imagine/client.ts
 function parseContentType(value) {
   if (value === null || value === void 0 || value.trim() === "") return void 0;
   return value.split(";", 1)[0]?.trim().toLowerCase();
@@ -31639,7 +31660,7 @@ async function assertSafeRemoteMediaUrl(raw, lookup) {
     throw new GrokImagineError("SSRF", "generated media URL must use port 443");
   }
   const host = normalizeHostname(url.hostname);
-  if (host === "" || isBlockedHostname(host) || isIP(host) !== 0) {
+  if (host === "" || isBlockedHostname(host) || isIP2(host) !== 0) {
     throw new GrokImagineError("SSRF", "generated media host is not allowed");
   }
   if (!isAllowlistedImagineHost(host)) {
@@ -31658,7 +31679,7 @@ async function assertSafeRemoteMediaUrl(raw, lookup) {
 }
 async function resolvePublicAddresses(hostname, lookup) {
   const host = normalizeHostname(hostname);
-  if (host === "" || isBlockedHostname(host) || isIP(host) !== 0) {
+  if (host === "" || isBlockedHostname(host) || isIP2(host) !== 0) {
     throw new GrokImagineError("SSRF", "host is not allowed");
   }
   const addresses = [...await lookup(host)];
@@ -31671,7 +31692,7 @@ async function resolvePublicAddresses(hostname, lookup) {
 function createPinnedAgent(hostname, addresses) {
   const expected = normalizeHostname(hostname);
   const records = addresses.map((address) => {
-    const family = isIP(address);
+    const family = isIP2(address);
     if (family !== 4 && family !== 6) {
       throw new GrokImagineError("SSRF", "pinned address is not a valid IP");
     }
@@ -31926,18 +31947,6 @@ function requirePrompt(prompt) {
   }
   return prompt;
 }
-function parseVideoRequestId(value) {
-  if (typeof value !== "string") {
-    throw new GrokImagineError("INVALID_INPUT", "video request id must be a string");
-  }
-  if (!VIDEO_REQUEST_ID_PATTERN.test(value)) {
-    throw new GrokImagineError(
-      "INVALID_INPUT",
-      "video request id must match ^[A-Za-z0-9_-]{1,256}$ and be a safe ASCII identifier"
-    );
-  }
-  return value;
-}
 var ImagineAbortError = class extends Error {
   name = "ImagineAbortError";
   constructor(reason) {
@@ -33628,7 +33637,7 @@ async function persistGatewayKeyDocument(path, document) {
 `, { mode: 384 });
 }
 
-// src/gateway-protocol.ts
+// src/runtime/gateway-protocol.ts
 function isThinkingLevel(value) {
   return value === "off" || value === "minimal" || value === "low" || value === "medium" || value === "high" || value === "xhigh" || value === "max";
 }
@@ -34645,6 +34654,17 @@ function createCodingOAuthGatewayController(options) {
 }
 
 // src/gateway-routes.ts
+function authorizeGatewayControl(req, ownerRequestPolicy) {
+  return ownerRequestPolicy.authorize(req);
+}
+function authorizeGatewaySecret(req, ownerRequestPolicy) {
+  const decision = ownerRequestPolicy.authorize(req);
+  if (!decision.authorized) return decision;
+  if (decision.accessMode !== "loopback") {
+    return { authorized: false, reason: "loopback-only" };
+  }
+  return decision;
+}
 function registerGatewayRoutes(ctx, controller, ownerRequestPolicy = LOOPBACK_OWNER_REQUEST_POLICY) {
   let dispose = () => void 0;
   ctx.effect(() => {
@@ -34670,7 +34690,7 @@ function registerGatewayRoutes(ctx, controller, ownerRequestPolicy = LOOPBACK_OW
   return () => dispose();
 }
 async function handleGatewaySettings(req, res, controller, ownerRequestPolicy) {
-  if (!ownerRequestPolicy.authorize(req).authorized) {
+  if (!authorizeGatewayControl(req, ownerRequestPolicy).authorized) {
     json3(res, 403, { error: "forbidden" });
     return;
   }
@@ -34715,7 +34735,7 @@ async function handleGatewaySettings(req, res, controller, ownerRequestPolicy) {
   }
 }
 async function handleGatewayReveal(req, res, controller, ownerRequestPolicy) {
-  if (!ownerRequestPolicy.authorize(req).authorized) {
+  if (!authorizeGatewaySecret(req, ownerRequestPolicy).authorized) {
     json3(res, 403, { error: "forbidden" });
     return;
   }
@@ -34730,7 +34750,7 @@ async function handleGatewayReveal(req, res, controller, ownerRequestPolicy) {
   }
 }
 async function handleGatewayRotate(req, res, controller, ownerRequestPolicy) {
-  if (!ownerRequestPolicy.authorize(req).authorized) {
+  if (!authorizeGatewaySecret(req, ownerRequestPolicy).authorized) {
     json3(res, 403, { error: "forbidden" });
     return;
   }