ysk-omni 1.0.0

package/dist/utils/request-meta.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Shared HTTP request helpers for controllers (idempotency, headers).
+ */
+import type { Request } from 'express';
+/** Read Idempotency-Key header (case-insensitive via Express). */
+export declare function readIdempotencyKey(req: Request): string | undefined;
+/**
+ * Scope an idempotency key to an API key id (prevents cross-tenant replay).
+ */
+export declare function scopedIdempotencyKey(apiKeyId: string, clientKey: string | undefined): string | undefined;
+export declare function readIdempotencyKeyScoped(req: Request, apiKeyId: string): string | undefined;
+//# sourceMappingURL=request-meta.d.ts.map

package/dist/utils/request-meta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-meta.d.ts","sourceRoot":"","sources":["../../src/utils/request-meta.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,kEAAkE;AAClE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAOnE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,MAAM,GAAG,SAAS,CAGpB;AAED,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,GACf,MAAM,GAAG,SAAS,CAEpB"}

package/dist/utils/request-meta.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readIdempotencyKey = readIdempotencyKey;
+exports.scopedIdempotencyKey = scopedIdempotencyKey;
+exports.readIdempotencyKeyScoped = readIdempotencyKeyScoped;
+/** Read Idempotency-Key header (case-insensitive via Express). */
+function readIdempotencyKey(req) {
+    const raw = req.header('idempotency-key') ||
+        req.header('Idempotency-Key') ||
+        undefined;
+    if (!raw?.trim())
+        return undefined;
+    return String(raw).trim().slice(0, 200);
+}
+/**
+ * Scope an idempotency key to an API key id (prevents cross-tenant replay).
+ */
+function scopedIdempotencyKey(apiKeyId, clientKey) {
+    if (!clientKey)
+        return undefined;
+    return `${apiKeyId}:${clientKey.slice(0, 200)}`;
+}
+function readIdempotencyKeyScoped(req, apiKeyId) {
+    return scopedIdempotencyKey(apiKeyId, readIdempotencyKey(req));
+}
+//# sourceMappingURL=request-meta.js.map

package/dist/utils/request-meta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-meta.js","sourceRoot":"","sources":["../../src/utils/request-meta.ts"],"names":[],"mappings":";;AAMA,gDAOC;AAKD,oDAMC;AAED,4DAKC;AA1BD,kEAAkE;AAClE,SAAgB,kBAAkB,CAAC,GAAY;IAC7C,MAAM,GAAG,GACP,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC7B,SAAS,CAAC;IACZ,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IACnC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAClC,QAAgB,EAChB,SAA6B;IAE7B,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,OAAO,GAAG,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,SAAgB,wBAAwB,CACtC,GAAY,EACZ,QAAgB;IAEhB,OAAO,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;AACjE,CAAC"}

package/dist/utils/responses-mapper.d.ts

@@ -0,0 +1,9 @@
+import type { CreateChatCompletionDto } from '../dto/chat.dto';
+import type { CreateResponseDto } from '../dto/responses.dto';
+import type { OpenAiChatCompletion } from '../interfaces/open-ai-chat-completion.interface';
+import type { OpenAiResponse } from '../interfaces/open-ai-response.interface';
+export declare function responsesDtoToChatDto(dto: CreateResponseDto): CreateChatCompletionDto;
+export declare function chatCompletionToResponse(completion: OpenAiChatCompletion, opts?: {
+    responseId?: string;
+}): OpenAiResponse;
+//# sourceMappingURL=responses-mapper.d.ts.map

package/dist/utils/responses-mapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses-mapper.d.ts","sourceRoot":"","sources":["../../src/utils/responses-mapper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAG/E,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,iBAAiB,GAAG,uBAAuB,CAcrF;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,oBAAoB,EAChC,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7B,cAAc,CAmChB"}

package/dist/utils/responses-mapper.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.responsesDtoToChatDto = responsesDtoToChatDto;
+exports.chatCompletionToResponse = chatCompletionToResponse;
+const id_1 = require("./id");
+function responsesDtoToChatDto(dto) {
+    return {
+        model: dto.model,
+        messages: dto.messages.map((m) => ({
+            role: m.role,
+            content: m.content,
+        })),
+        stream: Boolean(dto.stream),
+        temperature: dto.temperature,
+        max_tokens: dto.max_output_tokens,
+        include_reasoning: dto.include_reasoning !== false,
+        tools: dto.tools,
+        reasoning_effort: dto.reasoning_effort,
+    };
+}
+function chatCompletionToResponse(completion, opts) {
+    const text = completion.choices?.[0]?.message?.content ?? '';
+    const responseId = opts?.responseId || (0, id_1.createResponseId)();
+    const msgId = `msg_${(0, id_1.createId)().replace(/-/g, '').slice(0, 24)}`;
+    const created = completion.created || Math.floor(Date.now() / 1000);
+    return {
+        id: responseId,
+        object: 'response',
+        created_at: created,
+        status: 'completed',
+        error: null,
+        incomplete_details: null,
+        model: completion.model,
+        output: [
+            {
+                type: 'message',
+                id: msgId,
+                status: 'completed',
+                role: 'assistant',
+                content: [
+                    {
+                        type: 'output_text',
+                        text: text || '',
+                        annotations: [],
+                    },
+                ],
+            },
+        ],
+        usage: {
+            input_tokens: completion.usage?.prompt_tokens ?? 0,
+            output_tokens: completion.usage?.completion_tokens ?? 0,
+            total_tokens: completion.usage?.total_tokens ?? 0,
+        },
+    };
+}
+//# sourceMappingURL=responses-mapper.js.map

package/dist/utils/responses-mapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses-mapper.js","sourceRoot":"","sources":["../../src/utils/responses-mapper.ts"],"names":[],"mappings":";;AAMA,sDAcC;AAED,4DAsCC;AAxDD,6BAAkD;AAElD,SAAgB,qBAAqB,CAAC,GAAsB;IAC1D,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC,CAAC;QACH,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;QAC3B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,UAAU,EAAE,GAAG,CAAC,iBAAiB;QACjC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,KAAK,KAAK;QAClD,KAAK,EAAE,GAAG,CAAC,KAAyC;QACpD,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;KACvC,CAAC;AACJ,CAAC;AAED,SAAgB,wBAAwB,CACtC,UAAgC,EAChC,IAA8B;IAE9B,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;IAC7D,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,IAAA,qBAAgB,GAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,OAAO,IAAA,aAAQ,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAEpE,OAAO;QACL,EAAE,EAAE,UAAU;QACd,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,OAAO;QACnB,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,IAAI;QACX,kBAAkB,EAAE,IAAI;QACxB,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,WAAW;gBACnB,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,aAAa;wBACnB,IAAI,EAAE,IAAI,IAAI,EAAE;wBAChB,WAAW,EAAE,EAAE;qBAChB;iBACF;aACF;SACF;QACD,KAAK,EAAE;YACL,YAAY,EAAE,UAAU,CAAC,KAAK,EAAE,aAAa,IAAI,CAAC;YAClD,aAAa,EAAE,UAAU,CAAC,KAAK,EAAE,iBAAiB,IAAI,CAAC;YACvD,YAAY,EAAE,UAAU,CAAC,KAAK,EAAE,YAAY,IAAI,CAAC;SAClD;KACF,CAAC;AACJ,CAAC"}

package/dist/utils/role-normalize.d.ts

@@ -0,0 +1,9 @@
+import type { ApiKeyMode, ApiKeyRole } from '../interfaces';
+/**
+ * Normalize legacy / CLI role aliases to canonical ApiKeyRole.
+ * Historically CLI wrote `user` while API uses `client`.
+ */
+export declare function normalizeApiKeyRole(role: string | null | undefined): ApiKeyRole;
+/** Resolve key mode; admin keys are always agent. */
+export declare function normalizeApiKeyMode(role: ApiKeyRole | string, mode?: string | null): ApiKeyMode;
+//# sourceMappingURL=role-normalize.d.ts.map

package/dist/utils/role-normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-normalize.d.ts","sourceRoot":"","sources":["../../src/utils/role-normalize.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE5D;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,UAAU,CAOZ;AAED,qDAAqD;AACrD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,UAAU,GAAG,MAAM,EACzB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,UAAU,CAIZ"}

package/dist/utils/role-normalize.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeApiKeyRole = normalizeApiKeyRole;
+exports.normalizeApiKeyMode = normalizeApiKeyMode;
+/**
+ * Pure role / mode normalization (no DB). Used by API services + CLI.
+ */
+const constants_1 = require("../config/constants");
+/**
+ * Normalize legacy / CLI role aliases to canonical ApiKeyRole.
+ * Historically CLI wrote `user` while API uses `client`.
+ */
+function normalizeApiKeyRole(role) {
+    const r = String(role || '')
+        .trim()
+        .toLowerCase();
+    if (r === 'admin')
+        return constants_1.ROLES.ADMIN;
+    // user is legacy alias for client
+    return constants_1.ROLES.CLIENT;
+}
+/** Resolve key mode; admin keys are always agent. */
+function normalizeApiKeyMode(role, mode) {
+    const r = normalizeApiKeyRole(role);
+    if (r === constants_1.ROLES.ADMIN)
+        return constants_1.KEY_MODES.AGENT;
+    return mode === constants_1.KEY_MODES.AGENT ? constants_1.KEY_MODES.AGENT : constants_1.KEY_MODES.SAFE;
+}
+//# sourceMappingURL=role-normalize.js.map

package/dist/utils/role-normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-normalize.js","sourceRoot":"","sources":["../../src/utils/role-normalize.ts"],"names":[],"mappings":";;AAUA,kDASC;AAGD,kDAOC;AA7BD;;GAEG;AACH,mDAAuD;AAGvD;;;GAGG;AACH,SAAgB,mBAAmB,CACjC,IAA+B;IAE/B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;SACzB,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IACjB,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,iBAAK,CAAC,KAAK,CAAC;IACtC,kCAAkC;IAClC,OAAO,iBAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,qDAAqD;AACrD,SAAgB,mBAAmB,CACjC,IAAyB,EACzB,IAAoB;IAEpB,MAAM,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,iBAAK,CAAC,KAAK;QAAE,OAAO,qBAAS,CAAC,KAAK,CAAC;IAC9C,OAAO,IAAI,KAAK,qBAAS,CAAC,KAAK,CAAC,CAAC,CAAC,qBAAS,CAAC,KAAK,CAAC,CAAC,CAAC,qBAAS,CAAC,IAAI,CAAC;AACrE,CAAC"}

package/dist/utils/ssrf.d.ts

@@ -0,0 +1,11 @@
+import { promises as dns } from 'node:dns';
+/** True when the address must not be fetched as a vision source. */
+export declare function isBlockedIp(ip: string): boolean;
+export declare function isBlockedHostname(hostname: string): boolean;
+export type ParsedVisionUrl = {
+    href: string;
+    hostname: string;
+};
+export declare function parsePublicHttpUrl(raw: string): ParsedVisionUrl;
+export declare function assertResolvedPublicHost(hostname: string, lookup?: typeof dns.lookup): Promise<void>;
+//# sourceMappingURL=ssrf.d.ts.map

package/dist/utils/ssrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.d.ts","sourceRoot":"","sources":["../../src/utils/ssrf.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,UAAU,CAAC;AAmB3C,oEAAoE;AACpE,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CA+B/C;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQ3D;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAiB/D;AAED,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,OAAO,GAAG,CAAC,MAAmB,GACrC,OAAO,CAAC,IAAI,CAAC,CAYf"}

package/dist/utils/ssrf.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isBlockedIp = isBlockedIp;
+exports.isBlockedHostname = isBlockedHostname;
+exports.parsePublicHttpUrl = parsePublicHttpUrl;
+exports.assertResolvedPublicHost = assertResolvedPublicHost;
+const node_net_1 = require("node:net");
+const node_dns_1 = require("node:dns");
+const BLOCKED_HOSTS = new Set([
+    'localhost',
+    'localhost.localdomain',
+    'ip6-localhost',
+    'metadata.google.internal',
+    'metadata.goog',
+    'metadata',
+]);
+function ipv4Octets(ip) {
+    const parts = ip.split('.');
+    if (parts.length !== 4)
+        return null;
+    const nums = parts.map((p) => Number(p));
+    if (nums.some((n) => !Number.isInteger(n) || n < 0 || n > 255))
+        return null;
+    return nums;
+}
+/** True when the address must not be fetched as a vision source. */
+function isBlockedIp(ip) {
+    const raw = ip.trim().toLowerCase().replace(/^\[|\]$/g, '');
+    if (!raw)
+        return true;
+    if (raw.startsWith('::ffff:')) {
+        return isBlockedIp(raw.slice(7));
+    }
+    const kind = (0, node_net_1.isIP)(raw);
+    if (kind === 4) {
+        const o = ipv4Octets(raw);
+        if (!o)
+            return true;
+        const [a, b] = o;
+        if (a === 0 || a === 10 || a === 127)
+            return true;
+        if (a === 169 && b === 254)
+            return true;
+        if (a === 172 && b >= 16 && b <= 31)
+            return true;
+        if (a === 192 && b === 168)
+            return true;
+        if (a === 100 && b >= 64 && b <= 127)
+            return true;
+        if (a === 198 && (b === 18 || b === 19))
+            return true;
+        if (a >= 224)
+            return true;
+        return false;
+    }
+    if (kind === 6) {
+        if (raw === '::1' || raw === '::')
+            return true;
+        if (raw.startsWith('fc') || raw.startsWith('fd'))
+            return true;
+        if (raw.startsWith('fe8') || raw.startsWith('fe9') || raw.startsWith('fea') || raw.startsWith('feb')) {
+            return true;
+        }
+        return false;
+    }
+    return false;
+}
+function isBlockedHostname(hostname) {
+    const h = hostname.trim().toLowerCase().replace(/\.$/, '').replace(/^\[|\]$/g, '');
+    if (!h)
+        return true;
+    if (BLOCKED_HOSTS.has(h) || h.endsWith('.localhost') || h.endsWith('.local')) {
+        return true;
+    }
+    if ((0, node_net_1.isIP)(h) && isBlockedIp(h))
+        return true;
+    return false;
+}
+function parsePublicHttpUrl(raw) {
+    let u;
+    try {
+        u = new URL(raw.trim());
+    }
+    catch {
+        throw new Error('invalid url');
+    }
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+        throw new Error('non-http scheme');
+    }
+    if (u.username || u.password) {
+        throw new Error('url credentials');
+    }
+    if (isBlockedHostname(u.hostname)) {
+        throw new Error('blocked host');
+    }
+    return { href: u.href, hostname: u.hostname };
+}
+async function assertResolvedPublicHost(hostname, lookup = node_dns_1.promises.lookup) {
+    if ((0, node_net_1.isIP)(hostname)) {
+        if (isBlockedIp(hostname))
+            throw new Error('blocked ip');
+        return;
+    }
+    const addrs = await lookup(hostname, { all: true, verbatim: true });
+    const list = Array.isArray(addrs) ? addrs : [addrs];
+    if (!list.length)
+        throw new Error('dns empty');
+    for (const a of list) {
+        const addr = typeof a === 'string' ? a : a.address;
+        if (isBlockedIp(addr))
+            throw new Error(`blocked resolved ip ${addr}`);
+    }
+}
+//# sourceMappingURL=ssrf.js.map

package/dist/utils/ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.js","sourceRoot":"","sources":["../../src/utils/ssrf.ts"],"names":[],"mappings":";;AAqBA,kCA+BC;AAED,8CAQC;AAOD,gDAiBC;AAED,4DAeC;AAvGD,uCAAgC;AAChC,uCAA2C;AAE3C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,WAAW;IACX,uBAAuB;IACvB,eAAe;IACf,0BAA0B;IAC1B,eAAe;IACf,UAAU;CACX,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,EAAU;IAC5B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oEAAoE;AACpE,SAAgB,WAAW,CAAC,EAAU;IACpC,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,IAAI,GAAG,IAAA,eAAI,EAAC,GAAG,CAAC,CAAC;IACvB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAE,IAAI,EAAE,IAAI,CAAE,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAE,IAAI,EAAE,IAAI,CAAE,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QACpD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,IAAI,CAAE,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9D,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACrG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,iBAAiB,CAAC,QAAgB;IAChD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACnF,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAA,eAAI,EAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,KAAK,CAAC;AACf,CAAC;AAOD,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChD,CAAC;AAEM,KAAK,UAAU,wBAAwB,CAC5C,QAAgB,EAChB,SAA4B,mBAAG,CAAC,MAAM;IAEtC,IAAI,IAAA,eAAI,EAAC,QAAQ,CAAC,EAAE,CAAC;QACnB,IAAI,WAAW,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACnD,IAAI,WAAW,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC"}

package/dist/utils/stream.d.ts

@@ -0,0 +1,7 @@
+import type { Response } from 'express';
+export declare function initSse(res: Response): void;
+export declare function writeSseData(res: Response, data: unknown): void;
+/** Named SSE event (Anthropic / Responses style). */
+export declare function writeSseEvent(res: Response, event: string, data: unknown): void;
+export declare function writeSseDone(res: Response): void;
+//# sourceMappingURL=stream.d.ts.map

package/dist/utils/stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/utils/stream.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAcxC,wBAAgB,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CAmB3C;AAcD,wBAAgB,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAI/D;AAED,qDAAqD;AACrD,wBAAgB,aAAa,CAC3B,GAAG,EAAE,QAAQ,EACb,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,OAAO,GACZ,IAAI,CAKN;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CAIhD"}

package/dist/utils/stream.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initSse = initSse;
+exports.writeSseData = writeSseData;
+exports.writeSseEvent = writeSseEvent;
+exports.writeSseDone = writeSseDone;
+function tryFlush(res) {
+    // compression middleware / some proxies expose flush
+    const anyRes = res;
+    if (typeof anyRes.flush === 'function') {
+        try {
+            anyRes.flush();
+        }
+        catch {
+            /* ignore */
+        }
+    }
+}
+function initSse(res) {
+    // Disable request socket timeout so long streams are not cut
+    try {
+        reqSocketSetTimeout(res, 0);
+    }
+    catch {
+        /* ignore */
+    }
+    res.status(200);
+    res.setHeader('Content-Type', 'text/event-stream; charset=utf-8');
+    res.setHeader('Cache-Control', 'no-cache, no-transform');
+    res.setHeader('Connection', 'keep-alive');
+    res.setHeader('X-Accel-Buffering', 'no'); // nginx: disable response buffering
+    if (typeof res.flushHeaders === 'function') {
+        res.flushHeaders();
+    }
+    // Immediate padding comment helps some proxies flush the first bytes
+    res.write(': ok\n\n');
+    tryFlush(res);
+}
+function reqSocketSetTimeout(res, ms) {
+    const sock = res.socket;
+    if (sock && typeof sock.setTimeout === 'function') {
+        sock.setTimeout(ms);
+    }
+    // Also clear idle timeout on the request if present
+    const req = res.req;
+    if (req && typeof req.setTimeout === 'function') {
+        req.setTimeout(ms);
+    }
+}
+function writeSseData(res, data) {
+    if (res.writableEnded)
+        return;
+    res.write(`data: ${JSON.stringify(data)}\n\n`);
+    tryFlush(res);
+}
+/** Named SSE event (Anthropic / Responses style). */
+function writeSseEvent(res, event, data) {
+    if (res.writableEnded)
+        return;
+    res.write(`event: ${event}\n`);
+    res.write(`data: ${JSON.stringify(data)}\n\n`);
+    tryFlush(res);
+}
+function writeSseDone(res) {
+    if (res.writableEnded)
+        return;
+    res.write('data: [DONE]\n\n');
+    tryFlush(res);
+}
+//# sourceMappingURL=stream.js.map

package/dist/utils/stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.js","sourceRoot":"","sources":["../../src/utils/stream.ts"],"names":[],"mappings":";;AAcA,0BAmBC;AAcD,oCAIC;AAGD,sCASC;AAED,oCAIC;AAnED,SAAS,QAAQ,CAAC,GAAa;IAC7B,qDAAqD;IACrD,MAAM,MAAM,GAAG,GAAwC,CAAC;IACxD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAgB,OAAO,CAAC,GAAa;IACnC,6DAA6D;IAC7D,IAAI,CAAC;QACH,mBAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kCAAkC,CAAC,CAAC;IAClE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;IACzD,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAC1C,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC,oCAAoC;IAC9E,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QAC3C,GAAG,CAAC,YAAY,EAAE,CAAC;IACrB,CAAC;IACD,qEAAqE;IACrE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAa,EAAE,EAAU;IACpD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC;IACxB,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACtB,CAAC;IACD,oDAAoD;IACpD,MAAM,GAAG,GAAI,GAAiE,CAAC,GAAG,CAAC;IACnF,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAChD,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAgB,YAAY,CAAC,GAAa,EAAE,IAAa;IACvD,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO;IAC9B,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,GAAG,CAAC,CAAC;AAChB,CAAC;AAED,qDAAqD;AACrD,SAAgB,aAAa,CAC3B,GAAa,EACb,KAAa,EACb,IAAa;IAEb,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO;IAC9B,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;IAC/B,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,GAAG,CAAC,CAAC;AAChB,CAAC;AAED,SAAgB,YAAY,CAAC,GAAa;IACxC,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO;IAC9B,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC9B,QAAQ,CAAC,GAAG,CAAC,CAAC;AAChB,CAAC"}

package/dist/utils/vision-remote.d.ts

@@ -0,0 +1,28 @@
+import type { CreateChatCompletionDto } from '../dto/chat.dto';
+export declare const VISION_FETCH_TIMEOUT_MS = 10000;
+export declare const VISION_FETCH_MAX_BYTES: number;
+export declare const VISION_FETCH_MAX_URLS = 8;
+type ChatMessage = CreateChatCompletionDto['messages'][number];
+export type VisionFetchImpl = (url: string, init: {
+    signal: AbortSignal;
+    redirect?: 'follow' | 'error' | 'manual';
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    headers: {
+        get(name: string): string | null;
+    };
+    arrayBuffer(): Promise<ArrayBuffer>;
+    body?: ReadableStream<Uint8Array> | null;
+}>;
+/**
+ * Download http(s) image parts to data URLs so `--prompt-json` can send ACP images.
+ * Failures stay as `[image: url]` text (same as the previous fallback).
+ */
+export declare function inlineRemoteImageUrls(messages: ChatMessage[], opts?: {
+    timeoutMs?: number;
+    maxBytes?: number;
+    fetchImpl?: VisionFetchImpl;
+}): Promise<ChatMessage[]>;
+export {};
+//# sourceMappingURL=vision-remote.d.ts.map

package/dist/utils/vision-remote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vision-remote.d.ts","sourceRoot":"","sources":["../../src/utils/vision-remote.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAO/D,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAC9C,eAAO,MAAM,sBAAsB,QAAkB,CAAC;AACtD,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC,KAAK,WAAW,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,MAAM,MAAM,eAAe,GAAG,CAC5B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAA;CAAE,KACpE,OAAO,CAAC;IACX,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC9C,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;CAC1C,CAAC,CAAC;AA2KH;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,WAAW,EAAE,EACvB,IAAI,CAAC,EAAE;IACL,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B,GACA,OAAO,CAAC,WAAW,EAAE,CAAC,CA0CxB"}

package/dist/utils/vision-remote.js

@@ -0,0 +1,206 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VISION_FETCH_MAX_URLS = exports.VISION_FETCH_MAX_BYTES = exports.VISION_FETCH_TIMEOUT_MS = void 0;
+exports.inlineRemoteImageUrls = inlineRemoteImageUrls;
+const logger_1 = require("./logger");
+const ssrf_1 = require("./ssrf");
+exports.VISION_FETCH_TIMEOUT_MS = 10_000;
+exports.VISION_FETCH_MAX_BYTES = 8 * 1024 * 1024;
+exports.VISION_FETCH_MAX_URLS = 8;
+async function readCappedBody(res, maxBytes) {
+    const cl = Number(res.headers.get('content-length'));
+    if (Number.isFinite(cl) && cl > maxBytes)
+        return null;
+    const stream = res.body;
+    if (stream && typeof stream.getReader === 'function') {
+        const reader = stream.getReader();
+        const chunks = [];
+        let n = 0;
+        try {
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                if (!value)
+                    continue;
+                n += value.byteLength;
+                if (n > maxBytes) {
+                    await reader.cancel().catch(() => undefined);
+                    return null;
+                }
+                chunks.push(Buffer.from(value));
+            }
+        }
+        catch {
+            return null;
+        }
+        return Buffer.concat(chunks);
+    }
+    const buf = Buffer.from(await res.arrayBuffer());
+    if (buf.length > maxBytes)
+        return null;
+    return buf;
+}
+function isHttpUrl(url) {
+    try {
+        (0, ssrf_1.parsePublicHttpUrl)(url);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function sniffImageMime(bytes, headerMime) {
+    const declared = headerMime.split(';')[0].trim().toLowerCase();
+    if (declared.startsWith('image/'))
+        return declared;
+    if (bytes.length >= 3 && bytes[0] === 0xff && bytes[1] === 0xd8) {
+        return 'image/jpeg';
+    }
+    if (bytes.length >= 8 &&
+        bytes[0] === 0x89 &&
+        bytes[1] === 0x50 &&
+        bytes[2] === 0x4e &&
+        bytes[3] === 0x47) {
+        return 'image/png';
+    }
+    if (bytes.length >= 6 &&
+        bytes.subarray(0, 6).toString('ascii') === 'GIF87a') {
+        return 'image/gif';
+    }
+    if (bytes.length >= 6 &&
+        bytes.subarray(0, 6).toString('ascii') === 'GIF89a') {
+        return 'image/gif';
+    }
+    if (bytes.length >= 12 &&
+        bytes.subarray(0, 4).toString('ascii') === 'RIFF' &&
+        bytes.subarray(8, 12).toString('ascii') === 'WEBP') {
+        return 'image/webp';
+    }
+    return null;
+}
+async function fetchAsDataUrl(url, opts) {
+    let current;
+    try {
+        current = (0, ssrf_1.parsePublicHttpUrl)(url).href;
+    }
+    catch {
+        return null;
+    }
+    if (opts.resolveDns) {
+        try {
+            await (0, ssrf_1.assertResolvedPublicHost)(new URL(current).hostname);
+        }
+        catch {
+            return null;
+        }
+    }
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), opts.timeoutMs);
+    try {
+        const res = await opts.fetchImpl(current, {
+            signal: ac.signal,
+            redirect: 'manual',
+        });
+        if (res.status >= 300 && res.status < 400) {
+            const loc = res.headers.get('location');
+            const hops = opts.hops ?? 0;
+            if (!loc || hops >= 3)
+                return null;
+            const next = new URL(loc, current).href;
+            return fetchAsDataUrl(next, { ...opts, hops: hops + 1 });
+        }
+        if (!res.ok)
+            return null;
+        const buf = await readCappedBody(res, opts.maxBytes);
+        if (!buf || buf.length === 0)
+            return null;
+        const mime = sniffImageMime(buf, res.headers.get('content-type') || '');
+        if (!mime)
+            return null;
+        return `data:${mime};base64,${buf.toString('base64')}`;
+    }
+    catch (err) {
+        logger_1.logger.warn({ err, url: url.slice(0, 120) }, 'Vision remote image fetch failed');
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function rewritePart(part, dataUrl, originalUrl) {
+    if (!dataUrl) {
+        return { type: 'text', text: `[image: ${originalUrl}]` };
+    }
+    if (part.type === 'image' && part.source && typeof part.source === 'object') {
+        return {
+            type: 'image_url',
+            image_url: { url: dataUrl },
+        };
+    }
+    return {
+        ...part,
+        type: part.type === 'input_image' ? 'input_image' : 'image_url',
+        image_url: { url: dataUrl },
+    };
+}
+function extractHttpUrl(part) {
+    if (part.type === 'image' && part.source && typeof part.source === 'object') {
+        const src = part.source;
+        if (typeof src.url === 'string' && isHttpUrl(src.url))
+            return src.url;
+    }
+    const raw = part.image_url ?? (part.type === 'input_image' ? part.url : undefined);
+    const url = typeof raw === 'object' && raw
+        ? String(raw.url || '')
+        : String(raw || '');
+    return isHttpUrl(url) ? url : null;
+}
+/**
+ * Download http(s) image parts to data URLs so `--prompt-json` can send ACP images.
+ * Failures stay as `[image: url]` text (same as the previous fallback).
+ */
+async function inlineRemoteImageUrls(messages, opts) {
+    const timeoutMs = opts?.timeoutMs ?? exports.VISION_FETCH_TIMEOUT_MS;
+    const maxBytes = opts?.maxBytes ?? exports.VISION_FETCH_MAX_BYTES;
+    const usingDefaultFetch = !opts?.fetchImpl;
+    const fetchImpl = opts?.fetchImpl ?? globalThis.fetch;
+    if (typeof fetchImpl !== 'function')
+        return messages;
+    const out = [];
+    let fetched = 0;
+    for (const msg of messages) {
+        if (!Array.isArray(msg.content)) {
+            out.push(msg);
+            continue;
+        }
+        const nextParts = [];
+        for (const part of msg.content) {
+            if (!part || typeof part !== 'object') {
+                nextParts.push(part);
+                continue;
+            }
+            const rec = part;
+            const url = extractHttpUrl(rec);
+            if (!url) {
+                nextParts.push(part);
+                continue;
+            }
+            if (fetched >= exports.VISION_FETCH_MAX_URLS) {
+                nextParts.push(rewritePart(rec, null, url));
+                continue;
+            }
+            fetched += 1;
+            const dataUrl = await fetchAsDataUrl(url, {
+                timeoutMs,
+                maxBytes,
+                fetchImpl,
+                resolveDns: usingDefaultFetch,
+            });
+            nextParts.push(rewritePart(rec, dataUrl, url));
+        }
+        out.push({ ...msg, content: nextParts });
+    }
+    return out;
+}
+//# sourceMappingURL=vision-remote.js.map