ima2-gen 3.13.1 → 3.14.0

package/lib/geminiApiImageAdapter.js

@@ -1,214 +1 @@
-import { logEvent } from "./logger.js";
-import { detectImageMimeFromB64 } from "./refs.js";
-import { getVertexAccessToken, getVertexProjectId, isVertexInitialized } from "./vertexAuth.js";
-import { deriveReferenceLimit } from "./providers/derive.js";
-const MODEL_ID_MAP = {
-    "nano-banana-2": "gemini-3.1-flash-image",
-    "nano-banana-pro": "gemini-3-pro-image",
-};
-const GEMINI_TIMEOUT_MS = 120_000;
-// Public v1beta ImageResponseFormat uses enums (ASPECT_RATIO_*/IMAGE_SIZE_*),
-// while Vertex imageConfig takes plain strings ("1:1"/"1K") — mixing them got
-// every public-API request rejected with invalid aspect_ratio (070 QA).
-const V1BETA_ASPECT_ENUM = {
-    "1:1": "ASPECT_RATIO_ONE_BY_ONE", "2:3": "ASPECT_RATIO_TWO_BY_THREE",
-    "3:2": "ASPECT_RATIO_THREE_BY_TWO", "3:4": "ASPECT_RATIO_THREE_BY_FOUR",
-    "4:3": "ASPECT_RATIO_FOUR_BY_THREE", "4:5": "ASPECT_RATIO_FOUR_BY_FIVE",
-    "5:4": "ASPECT_RATIO_FIVE_BY_FOUR", "9:16": "ASPECT_RATIO_NINE_BY_SIXTEEN",
-    "16:9": "ASPECT_RATIO_SIXTEEN_BY_NINE", "21:9": "ASPECT_RATIO_TWENTY_ONE_BY_NINE",
-    "1:8": "ASPECT_RATIO_ONE_BY_EIGHT", "8:1": "ASPECT_RATIO_EIGHT_BY_ONE",
-    "1:4": "ASPECT_RATIO_ONE_BY_FOUR", "4:1": "ASPECT_RATIO_FOUR_BY_ONE",
-};
-const V1BETA_SIZE_ENUM = {
-    "512": "IMAGE_SIZE_FIVE_TWELVE",
-    "1K": "IMAGE_SIZE_ONE_K",
-    "2K": "IMAGE_SIZE_TWO_K",
-    "4K": "IMAGE_SIZE_FOUR_K",
-};
-function toV1BetaImageFormat(params) {
-    const aspect = V1BETA_ASPECT_ENUM[params.aspectRatio];
-    const size = V1BETA_SIZE_ENUM[params.imageSize];
-    if (!aspect)
-        throw new Error(`gemini-api: no v1beta aspect enum for ${params.aspectRatio}`);
-    if (!size)
-        throw new Error(`gemini-api: no v1beta image-size enum for ${params.imageSize}`);
-    return { aspect_ratio: aspect, image_size: size };
-}
-function parseGeminiImageParams(size) {
-    if (!size || size === "auto" || size === "1024x1024")
-        return { aspectRatio: "1:1", imageSize: "1K" };
-    const match = size.match(/^(\d+)x(\d+)$/);
-    if (!match)
-        return { aspectRatio: "1:1", imageSize: "1K" };
-    const w = Number(match[1]);
-    const h = Number(match[2]);
-    const ratio = w / h;
-    const ratioMap = [
-        ["1:1", 1], ["2:3", 2 / 3], ["3:2", 3 / 2], ["3:4", 3 / 4], ["4:3", 4 / 3],
-        ["4:5", 4 / 5], ["5:4", 5 / 4], ["9:16", 9 / 16], ["16:9", 16 / 9], ["21:9", 21 / 9],
-        ["1:8", 1 / 8], ["8:1", 8], ["1:4", 1 / 4], ["4:1", 4],
-    ];
-    let bestLabel = "1:1";
-    let bestDist = Infinity;
-    for (const [label, val] of ratioMap) {
-        const dist = Math.abs(ratio - val);
-        if (dist < bestDist) {
-            bestDist = dist;
-            bestLabel = label;
-        }
-    }
-    const maxDim = Math.max(w, h);
-    const imageSize = maxDim <= 512 ? "512" : maxDim <= 1024 ? "1K" : maxDim <= 2048 ? "2K" : "4K";
-    return { aspectRatio: bestLabel, imageSize };
-}
-function geminiApiError(message, status, code) {
-    const err = new Error(message);
-    err.status = status;
-    err.code = code;
-    return err;
-}
-function resolveGeminiModelId(model) {
-    return MODEL_ID_MAP[model] || model;
-}
-function buildContents(prompt, references) {
-    const parts = [];
-    // Add reference images first (if any)
-    for (const ref of references.slice(0, deriveReferenceLimit("gemini-api", "edit"))) {
-        const mime = ref.declaredMime || ref.detectedMime || detectImageMimeFromB64(ref.b64) || "image/png";
-        parts.push({
-            inlineData: {
-                mimeType: mime,
-                data: ref.b64,
-            },
-        });
-    }
-    // Add text prompt
-    parts.push({ text: prompt });
-    return [{ role: "user", parts }];
-}
-export async function generateViaGeminiApi(prompt, ctx, options = {}) {
-    const apiKey = ctx.geminiApiKey;
-    const vertexReady = ctx.hasVertexKey && isVertexInitialized();
-    const authMode = ctx.geminiAuthMode;
-    const useVertex = authMode === "vertex" ? vertexReady : (!apiKey && vertexReady);
-    if (!apiKey && !useVertex) {
-        throw geminiApiError("Gemini API key or Vertex AI credentials not configured", 401, "GEMINI_API_KEY_MISSING");
-    }
-    const model = options.model || "nano-banana-2";
-    const apiModelId = resolveGeminiModelId(model);
-    const references = (options.references || []).slice(0, deriveReferenceLimit("gemini-api", "edit"));
-    let url;
-    let authHeaders;
-    if (useVertex) {
-        const token = await getVertexAccessToken();
-        const projectId = getVertexProjectId();
-        url = `https://aiplatform.googleapis.com/v1/projects/${projectId}/locations/global/publishers/google/models/${apiModelId}:generateContent`;
-        authHeaders = { "Content-Type": "application/json", "Authorization": `Bearer ${token}` };
-    }
-    else {
-        url = `https://generativelanguage.googleapis.com/v1beta/models/${apiModelId}:generateContent`;
-        authHeaders = { "Content-Type": "application/json", "x-goog-api-key": apiKey };
-    }
-    // size "auto" → omit image config entirely so the model decides ratio/size
-    const isAutoSize = !options.size || options.size === "auto";
-    const imageParams = isAutoSize ? null : parseGeminiImageParams(options.size);
-    // Vertex AI rejects responseFormat; it expects imageConfig directly under
-    // generationConfig (camelCase). Public API uses response_format.image (snake_case).
-    const generationConfig = useVertex
-        ? {
-            responseModalities: ["TEXT", "IMAGE"],
-            ...(imageParams
-                ? { imageConfig: { aspectRatio: imageParams.aspectRatio, imageSize: imageParams.imageSize } }
-                : {}),
-        }
-        : {
-            response_modalities: ["TEXT", "IMAGE"],
-            ...(imageParams
-                ? { response_format: { image: toV1BetaImageFormat(imageParams) } }
-                : {}),
-        };
-    const configKey = useVertex ? "generationConfig" : "generation_config";
-    const body = { contents: buildContents(prompt, references), [configKey]: generationConfig };
-    logEvent("gemini-api", "generate:start", {
-        requestId: options.requestId,
-        model,
-        apiModelId,
-        promptChars: prompt.length,
-        refs: references.length,
-    });
-    const timeoutSignal = AbortSignal.timeout(GEMINI_TIMEOUT_MS);
-    const combinedSignal = options.signal
-        ? AbortSignal.any([options.signal, timeoutSignal])
-        : timeoutSignal;
-    try {
-        const res = await fetch(url, {
-            method: "POST",
-            headers: authHeaders,
-            body: JSON.stringify(body),
-            signal: combinedSignal,
-        });
-        if (!res.ok) {
-            const text = await res.text().catch(() => "");
-            if (res.status === 429) {
-                throw geminiApiError(`Gemini API rate limited: ${text.slice(0, 200)}`, 429, "GEMINI_API_RATE_LIMITED");
-            }
-            if (res.status === 400 || res.status === 403) {
-                throw geminiApiError(`Gemini API error: ${text.slice(0, 200)}`, res.status, "GEMINI_API_BAD_REQUEST");
-            }
-            throw geminiApiError(`Gemini API error (${res.status}): ${text.slice(0, 200)}`, 502, "GEMINI_API_UPSTREAM_ERROR");
-        }
-        const json = await res.json();
-        // Extract image from candidates[0].content.parts[]
-        const parts = json?.candidates?.[0]?.content?.parts || [];
-        let b64 = null;
-        let textResponse = "";
-        let mime = "image/png";
-        for (const part of parts) {
-            if (part.inlineData?.data) {
-                b64 = part.inlineData.data;
-                mime = part.inlineData.mimeType || "image/png";
-            }
-            if (part.text) {
-                textResponse += part.text;
-            }
-        }
-        if (!b64) {
-            // Check for safety block
-            const finishReason = json?.candidates?.[0]?.finishReason;
-            if (finishReason === "SAFETY") {
-                throw geminiApiError("Gemini API: generation blocked by safety filter", 400, "GEMINI_API_SAFETY_BLOCKED");
-            }
-            throw geminiApiError(`Gemini API: no image in response (finishReason: ${finishReason || "unknown"})`, 502, "GEMINI_API_NO_IMAGE");
-        }
-        const usageMetadata = json?.usageMetadata || {};
-        logEvent("gemini-api", "generate:done", {
-            requestId: options.requestId,
-            model,
-            b64Len: b64.length,
-            mime,
-            textResponseLen: textResponse.length,
-        });
-        return {
-            b64,
-            revisedPrompt: textResponse || prompt,
-            usage: {
-                promptTokens: usageMetadata.promptTokenCount || 0,
-                candidatesTokens: usageMetadata.candidatesTokenCount || 0,
-                totalTokens: usageMetadata.totalTokenCount || 0,
-            },
-            webSearchCalls: 0,
-            mime,
-        };
-    }
-    catch (e) {
-        if (e.name === "AbortError") {
-            if (options.signal?.aborted) {
-                throw geminiApiError("Generation canceled", 499, "GENERATION_CANCELED");
-            }
-            throw geminiApiError("Gemini API generation timed out", 504, "GENERATION_TIMEOUT");
-        }
-        if (e.code && e.status)
-            throw e;
-        throw geminiApiError(`Gemini API request failed: ${e.message}`, 502, "GEMINI_API_NETWORK_FAILED");
-    }
-}
+export { generateViaGeminiApi } from "./providers/adapters/geminiOperations.js";

package/lib/generatePipeline.js

@@ -9,17 +9,10 @@ import { classifyUpstreamError } from "./errorClassify.js";
 import { appendGenerationRequestLog } from "./generationRequestLog.js";
 import { normalizeOAuthParams } from "./oauthNormalize.js";
 import { resolveProviderOptions } from "./providerOptions.js";
-import { generateViaResponses } from "./responsesImageAdapter.js";
-import { generateViaGrok, planGrokImage } from "./grokImageAdapter.js";
+import { prepareImageExecution } from "./providers/execution/index.js";
+import { checkImageExecutionAdmission } from "./providers/execution/admission.js";
 import { resolveGrokQualityModel } from "./imageModels.js";
-import { generateViaAgy } from "./agyImageAdapter.js";
-import { generateViaGeminiApi } from "./geminiApiImageAdapter.js";
-import { generateViaAtlasCloud } from "./atlasCloudImageAdapter.js";
-import { generateViaMinimax } from "./minimaxImageAdapter.js";
-import { generateViaNai } from "./naiImageAdapter.js";
 import { composerNegativePromptMeta, readNaiOptions } from "./naiOptions.js";
-import { generateViaComfy } from "./comfyImageAdapter.js";
-import { isNonRetryableGenerationError, normalizeGenerationFailure } from "./generationErrors.js";
 import { startJob, finishJob, registerJobAbortController, isJobCanceled, isStartJobFailure, setJobPhase, INFLIGHT_RETRY_AFTER_SECONDS, } from "./inflight.js";
 import { isGenerationCanceledError, makeGenerationCanceledError, throwIfJobCanceled, } from "./generationCancel.js";
 import { logEvent, logError } from "./logger.js";
@@ -27,7 +20,6 @@ import { embedImageMetadataBestEffort } from "./imageMetadataStore.js";
 import { invalidateHistoryIndex } from "./historyIndex.js";
 import { normalizeComposerInsertedPrompts, normalizeComposerPrompt, } from "./composerSnapshot.js";
 import { errInfo } from "./errInfo.js";
-import { requireRuntimeContext } from "./runtimeContext.js";
 import { STORYBOARD_PREFIX } from "./storyboardPrefix.js";
 import { parseBackgroundPreset, backgroundPromptSuffix, backgroundPlannerConstraint } from "./backgroundPresets.js";
 import { sizeNudgeSuffix } from "./sizeNudge.js";
@@ -39,7 +31,7 @@ import { publishJobEvent } from "./ssePublish.js";
 import { normalizeBodyRequestId, validateBoundedCount, validateGenerationPrompt } from "./generationInputValidation.js";
 import { getElementById } from "./assetsStore.js";
 import { compileElements, ELEMENT_CAPACITY_DEFAULTS } from "./elementCompiler.js";
-import { deriveReferenceLimit } from "./providers/derive.js";
+import { deriveReferenceLimit, getProviderSurfaceSupport } from "./providers/derive.js";
 import { claimIdempotencyKey, completeIdempotencyKey, fingerprintRequest, IdempotencyFingerprintConflict, IdempotencyKeyInvalid, readIdempotencyKey, } from "./jobs/idempotency.js";
 export async function runGeneratePipeline(req, res, ctx) {
     const requestId = normalizeBodyRequestId(req.body?.requestId, req.id);
@@ -160,7 +152,7 @@ export async function runGeneratePipeline(req, res, ctx) {
             rawSize: size,
             rawWebSearchEnabled,
         });
-        if (providerOptions.error) {
+        if (providerOptions.error !== undefined) {
             return fail(providerOptions.status, { error: providerOptions.error, code: providerOptions.code });
         }
         const imageModel = providerOptions.model;
@@ -273,11 +265,8 @@ export async function runGeneratePipeline(req, res, ctx) {
         const incomingProviderUrl = typeof req.body?.providerUrl === "string" && req.body.providerUrl.startsWith("http")
             ? req.body.providerUrl
             : null;
-        const grokRefs = incomingProviderUrl
-            ? [{ b64: "", url: incomingProviderUrl, declaredMime: "image/png", detectedMime: "image/png" }, ...refCheck.refDetails]
-            : refCheck.refDetails;
         const providerRefCount = activeProvider === "grok" || activeProvider === "grok-api"
-            ? grokRefs.length
+            ? refCheck.refs.length + (incomingProviderUrl ? 1 : 0)
             : refCheck.refs.length;
         const providerReferenceLimit = deriveReferenceLimit(activeProvider, "edit");
         if ((activeProvider === "grok" || activeProvider === "agy" || activeProvider === "grok-api" || activeProvider === "gemini-api") && providerRefCount > providerReferenceLimit) {
@@ -304,13 +293,19 @@ export async function runGeneratePipeline(req, res, ctx) {
         // Refuse loudly rather than dropping the input: lib/naiImageAdapter.ts is
         // text-to-image only, so a reference passed here would be ignored and the
         // user would get an unrelated image back believing they had edited one.
-        if (activeProvider === "nai" && providerRefCount > 0) {
+        if (getProviderSurfaceSupport(activeProvider ?? "", "generate")?.references === false && providerRefCount > 0) {
             return fail(400, {
                 error: "NovelAI image generation does not accept reference images yet",
                 code: "NAI_REF_UNSUPPORTED",
                 requestId,
             });
         }
+        const admission = checkImageExecutionAdmission(ctx, {
+            provider: activeProvider, surface: "classic", referenceCount: providerRefCount,
+        });
+        if (admission) {
+            return fail(admission.status, { error: admission.message, code: admission.code, requestId });
+        }
         const started = startJob({
             requestId,
             kind: "classic",
@@ -386,155 +381,34 @@ export async function runGeneratePipeline(req, res, ctx) {
             : (providerForcesJpeg ? "jpeg" : String(format));
         const mime = mimeMap[effectiveFormat] || "image/png";
         await mkdir(ctx.config.storage.generatedDir, { recursive: true });
-        const grokDirectApiKey = activeProvider === "grok-api" ? ctx.xaiApiKey : undefined;
-        const sharedGrokPlan = activeProvider === "grok" || activeProvider === "grok-api"
-            ? await planGrokImage(generationPrompt, ctx, {
-                model: resolveGrokQualityModel(imageModel, quality),
-                size: effectiveSize,
-                signal: cancelController.signal,
-                requestId,
-                referenceCount: grokRefs.length,
-                references: grokRefs,
-                directApiKey: grokDirectApiKey,
-                backgroundConstraint: backgroundPreset ? backgroundPlannerConstraint(backgroundPreset) : undefined,
-                webSearchEnabled,
-            })
-            : null;
-        const generateOne = async () => {
-            if (activeProvider === "gemini-api") {
-                const r = await generateViaGeminiApi(generationPrompt, requireRuntimeContext(ctx), {
-                    model: imageModel,
-                    size: effectiveSize,
-                    signal: cancelController.signal,
-                    requestId,
-                    references: refCheck.refDetails,
-                });
-                throwIfJobCanceled(requestId);
-                return r;
-            }
-            if (activeProvider === "agy") {
-                const r = await generateViaAgy(generationPrompt, {
-                    references: refCheck.refDetails,
-                    signal: cancelController.signal,
-                    requestId,
-                });
-                throwIfJobCanceled(requestId);
-                return r;
-            }
-            if (activeProvider === "atlascloud") {
-                const r = await generateViaAtlasCloud(generationPrompt, requireRuntimeContext(ctx), {
-                    model: imageModel,
-                    size: effectiveSize,
-                    quality,
-                    signal: cancelController.signal,
-                    requestId,
-                    references: refCheck.refDetails,
-                    ...(backgroundParams ? { background: backgroundParams.background } : {}),
-                    ...(backgroundParams?.outputFormat ? { outputFormat: backgroundParams.outputFormat } : {}),
-                });
-                throwIfJobCanceled(requestId);
-                return r;
-            }
-            if (activeProvider === "minimax") {
-                const r = await generateViaMinimax(generationPrompt, requireRuntimeContext(ctx), {
-                    model: imageModel,
-                    size: effectiveSize,
-                    signal: cancelController.signal,
-                    requestId,
-                    references: refCheck.refDetails,
-                });
-                throwIfJobCanceled(requestId);
-                return r;
-            }
-            if (activeProvider === "nai") {
-                // No references argument: the adapter is text-to-image only, and the
-                // guard above already refused any reference input rather than letting
-                // it be silently discarded here.
-                const r = await generateViaNai(generationPrompt, requireRuntimeContext(ctx), {
-                    model: imageModel,
-                    size: effectiveSize,
-                    signal: cancelController.signal,
-                    requestId,
-                    // One normalizer for every request-driven lane: the multimode and
-                    // node branches spread the same call, so the three cannot drift.
-                    ...readNaiOptions(req.body),
-                });
-                throwIfJobCanceled(requestId);
-                return r;
-            }
-            if (activeProvider === "comfy") {
-                const r = await generateViaComfy(generationPrompt, requireRuntimeContext(ctx), {
-                    model: imageModel,
-                    size: effectiveSize,
-                    signal: cancelController.signal,
-                    requestId,
-                    references: refCheck.refDetails,
-                    ...(typeof req.body?.seed === "number" ? { seed: req.body.seed } : {}),
-                    ...(req.body?.comfyParams && typeof req.body.comfyParams === "object"
-                        ? { params: req.body.comfyParams }
-                        : {}),
-                    // A local GPU queue is real user-visible waiting. Without this the
-                    // UI would show "streaming" while the job sits behind three other
-                    // prompts on someone's workstation.
-                    onQueue: (info) => {
-                        const phase = info.running ? "streaming" : "queued";
-                        setJobPhase(requestId, phase);
-                        if (asyncMode) {
-                            publish(requestId, "phase", { requestId, phase, queuePosition: info.position });
-                        }
-                    },
-                });
-                throwIfJobCanceled(requestId);
-                return r;
-            }
-            if (activeProvider === "grok" || activeProvider === "grok-api") {
-                const grokModel = resolveGrokQualityModel(imageModel, quality);
-                const r = await generateViaGrok(generationPrompt, ctx, {
-                    model: grokModel,
-                    size: effectiveSize,
-                    signal: cancelController.signal,
-                    requestId,
-                    plannedPrompt: sharedGrokPlan?.prompt,
-                    webSearchCalls: sharedGrokPlan?.webSearchCalls,
-                    references: grokRefs,
-                    directApiKey: grokDirectApiKey,
-                });
-                throwIfJobCanceled(requestId);
-                return r;
-            }
-            const MAX_RETRIES = 1;
-            let lastErr;
-            for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
-                try {
-                    const r = await generateViaResponses(activeProvider, generationPrompt, quality, effectiveSize, moderation, refCheck.refDetails || refCheck.refs, requestId, normalizedPromptMode, ctx, {
-                        model: imageModel,
-                        reasoningEffort,
-                        webSearchEnabled,
-                        signal: cancelController.signal,
-                        allowPromptOnlyOAuthFallback: activeProvider !== "api",
-                        ...(backgroundParams ? { background: backgroundParams.background } : {}),
-                        ...(backgroundParams?.outputFormat ? { outputFormat: backgroundParams.outputFormat } : {}),
-                    });
-                    throwIfJobCanceled(requestId);
-                    if (r.b64)
-                        return r;
-                    lastErr = new Error("Empty response (safety refusal)");
-                }
-                catch (e) {
-                    lastErr = e;
-                    if (isNonRetryableGenerationError(e))
-                        break;
-                }
-                if (attempt < MAX_RETRIES) {
-                    const errCode = (lastErr && typeof lastErr === "object" && "code" in lastErr)
-                        ? lastErr.code
-                        : undefined;
-                    logEvent("generate", "retry", { requestId, attempt: attempt + 1, errorCode: errCode });
+        const execution = await prepareImageExecution(ctx, {
+            surface: "classic", provider: activeProvider, requestId,
+            signal: cancelController.signal, prompt: generationPrompt, rawPrompt: prompt,
+            references: refCheck.refDetails, providerUrl: incomingProviderUrl,
+            options: { model: imageModel, quality, size: effectiveSize, moderation,
+                mode: normalizedPromptMode, reasoningEffort, webSearchEnabled },
+            background: backgroundParams,
+            backgroundConstraint: backgroundPreset ? backgroundPlannerConstraint(backgroundPreset) : undefined,
+            nai: activeProvider === "nai" ? readNaiOptions(req.body) : {},
+            comfy: {
+                ...(typeof req.body?.seed === "number" ? { seed: req.body.seed } : {}),
+                ...(req.body?.comfyParams && typeof req.body.comfyParams === "object"
+                    ? { params: req.body.comfyParams }
+                    : {}),
+            },
+        }, {
+            onQueue: (info) => {
+                const phase = info.running ? "streaming" : "queued";
+                setJobPhase(requestId, phase);
+                if (asyncMode) {
+                    publish(requestId, "phase", { requestId, phase, queuePosition: info.position });
                 }
-            }
-            throw normalizeGenerationFailure(lastErr, {
-                safetyMessage: "Content generation refused after retries",
-            });
+            },
+        });
+        const generateOne = async () => {
+            const { value } = await execution.execute();
+            throwIfJobCanceled(requestId);
+            return value;
         };
         const results = await Promise.allSettled(Array.from({ length: count }, generateOne));
         throwIfJobCanceled(requestId);

package/lib/generatedMediaAccess.js

@@ -0,0 +1,74 @@
+import express from "express";
+import { realpath } from "node:fs/promises";
+import { resolve, sep } from "node:path";
+import { isLocalBind } from "./localAccessPolicy.js";
+function missing(res, sidecar = false) {
+    res.status(404).type("text/plain").end(sidecar ? "Generated metadata is not public" : "Generated media not found");
+}
+function contained(root, path) {
+    return path !== root && path.startsWith(`${root}${sep}`);
+}
+/** Mount at /generated; access.mediaHeaders must ALSO precede the global guard. */
+export function createGeneratedMediaAccess(ctx, access) {
+    const lan = !isLocalBind(ctx.config.server.host);
+    const root = resolve(ctx.config.storage.generatedDir);
+    const inspect = async (req, res, next) => {
+        try {
+            const raw = req.url.split("?")[0] || "/";
+            if (/%(?:2f|5c)/i.test(raw))
+                return missing(res);
+            const decoded = decodeURIComponent(raw);
+            if (/[\0\\]/.test(decoded))
+                return missing(res);
+            const lower = decoded.toLowerCase();
+            if (lower.endsWith(".json"))
+                return missing(res, true);
+            const target = resolve(root, `.${decoded}`);
+            if (!contained(root, target))
+                return missing(res);
+            const [realRoot, realTarget] = await Promise.all([realpath(root), realpath(target)]);
+            if (!contained(realRoot, realTarget))
+                return missing(res);
+            if (realTarget.toLowerCase().endsWith(".json"))
+                return missing(res, true);
+            if (lower.endsWith(".svg") || realTarget.toLowerCase().endsWith(".svg")) {
+                res.setHeader("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'");
+                res.setHeader("X-Content-Type-Options", "nosniff");
+            }
+            if (!res.writableEnded && !res.destroyed)
+                next();
+        }
+        catch {
+            if (!res.writableEnded && !res.destroyed)
+                missing(res);
+        }
+    };
+    const serve = express.static(root, lan ? {
+        etag: false, lastModified: false, immutable: false, cacheControl: false, redirect: false, index: false,
+    } : { maxAge: ctx.config.storage.staticMaxAge, immutable: true, redirect: false, index: false });
+    // Containment is a realpath check, not protection against a malicious local FS writer's race.
+    return [access.mediaHeaders, access.guard, inspect, (req, res) => {
+            if (lan) {
+                delete req.headers["if-none-match"];
+                delete req.headers["if-modified-since"];
+            }
+            serve(req, res, error => {
+                if (res.writableEnded || res.destroyed)
+                    return;
+                if (error) {
+                    if (res.headersSent) {
+                        res.end();
+                        return;
+                    }
+                    const status = error.statusCode;
+                    if (status === 416 || status === 412) {
+                        res.status(status).type("text/plain").end("Generated media request cannot be satisfied");
+                        return;
+                    }
+                    missing(res);
+                    return;
+                }
+                missing(res);
+            });
+        }];
+}

package/lib/generationErrors.js

@@ -1,8 +1,10 @@
 import { classifyUpstreamError, classifyUpstreamErrorCode, classifyModerationStage } from "./errorClassify.js";
-import { providerErrorClass } from "./errors/providerMap.js";
+import { providerErrorClass, statusForErrorCode } from "./errors/providerMap.js";
+export { statusForErrorCode } from "./errors/providerMap.js";
 import { safeDiagnosticLabel } from "./responsesParse.js";
 import { RESPONSE_DIAGNOSTIC_CODES } from "./responsesErrors.js";
 const PASSTHROUGH_CODES = new Set([
+    "GROK_API_KEY_MISSING",
     "OAUTH_UNAVAILABLE",
     "NETWORK_FAILED",
     "AUTH_CHATGPT_EXPIRED",
@@ -104,27 +106,6 @@ export function isNonRetryableGenerationError(err) {
     const status = Number(err?.status);
     return code === "INVALID_REQUEST" || code === "OAUTH_IMAGE_TIMEOUT" || (Number.isFinite(status) && status >= 400 && status < 500);
 }
-export function statusForErrorCode(code, fallback = 500) {
-    if (code === "OAUTH_UNAVAILABLE" || code === "NETWORK_FAILED")
-        return 503;
-    if (code === "AUTH_CHATGPT_EXPIRED" || code === "AUTH_API_KEY_INVALID")
-        return 401;
-    if (code === "API_KEY_REQUIRED")
-        return 401;
-    if (code === "UPSTREAM_5XX")
-        return 502;
-    if (code === "RESPONSES_STREAM_ERROR")
-        return 502;
-    if (code === "OAUTH_IMAGE_TIMEOUT")
-        return 504;
-    if (code === "INVALID_REQUEST")
-        return 400;
-    if (RESPONSE_DIAGNOSTIC_CODES.has(code))
-        return 422;
-    if (code === "SAFETY_REFUSAL" || code === "MODERATION_REFUSED" || code === "moderation_blocked")
-        return 422;
-    return fallback;
-}
 function copyEmptyResponseMetadata(target, source) {
     if (!source)
         return;