InvokeAI 6.14.0rc2__tar.gz → 6.14.2__tar.gz

{invokeai-6.14.0rc2 → invokeai-6.14.2}/InvokeAI.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: InvokeAI
-Version: 6.14.0rc2
+Version: 6.14.2
 Summary: A full-featured AI-assisted image generation environment designed for creatives and enthusiasts.
 Author-email: Invoke <support@invoke.ai>
 License:                                  Apache License
@@ -214,7 +214,7 @@ License-File: LICENSE-SDXL.txt
 Requires-Dist: accelerate
 Requires-Dist: bitsandbytes; sys_platform != "darwin"
 Requires-Dist: compel<3,>=2.4.0
-Requires-Dist: diffusers[torch]==0.39.0
+Requires-Dist: diffusers[torch]==0.40.0
 Requires-Dist: gguf
 Requires-Dist: mediapipe==0.10.14
 Requires-Dist: mistral-common<2,>=1.5.4
@@ -233,7 +233,7 @@ Requires-Dist: torchsde
 Requires-Dist: torchvision
 Requires-Dist: transformers<5.6,>=5.5
 Requires-Dist: fastapi-events
-Requires-Dist: fastapi==0.118.3
+Requires-Dist: fastapi<0.142,>=0.141.1
 Requires-Dist: huggingface-hub
 Requires-Dist: networkx
 Requires-Dist: pydantic-settings
@@ -247,6 +247,7 @@ Requires-Dist: dnspython
 Requires-Dist: dynamicprompts
 Requires-Dist: einops
 Requires-Dist: email-validator>=2.0.0
+Requires-Dist: fonttools[woff]
 Requires-Dist: passlib[bcrypt]>=1.7.4
 Requires-Dist: picklescan
 Requires-Dist: pillow

{invokeai-6.14.0rc2 → invokeai-6.14.2}/InvokeAI.egg-info/SOURCES.txt

@@ -124,6 +124,7 @@ invokeai/app/invocations/krea2_denoise.py
 invokeai/app/invocations/krea2_lora_loader.py
 invokeai/app/invocations/krea2_model_loader.py
 invokeai/app/invocations/krea2_seed_variance.py
+invokeai/app/invocations/krea2_style_reference.py
 invokeai/app/invocations/krea2_text_encoder.py
 invokeai/app/invocations/latent_noise.py
 invokeai/app/invocations/latents_to_image.py
@@ -359,6 +360,8 @@ invokeai/app/services/shared/sqlite_migrator/migrations/migration_2026_07_01_add
 invokeai/app/services/shared/sqlite_migrator/migrations/migration_2026_07_01_add_workflow_call_queue_metadata.py
 invokeai/app/services/shared/sqlite_migrator/migrations/migration_2026_07_03_round_robin_indexes.py
 invokeai/app/services/shared/sqlite_migrator/migrations/migration_2026_07_10_create_system_prompts.py
+invokeai/app/services/shared/sqlite_migrator/migrations/migration_2026_07_31_add_user_token_epoch.py
+invokeai/app/services/shared/sqlite_migrator/migrations/migration_2026_08_08_demote_system_user.py
 invokeai/app/services/shared/sqlite_migrator/migrations/migration_21.py
 invokeai/app/services/shared/sqlite_migrator/migrations/migration_22.py
 invokeai/app/services/shared/sqlite_migrator/migrations/migration_23.py
@@ -473,6 +476,7 @@ invokeai/app/util/dynamicprompts.py
 invokeai/app/util/metaenum.py
 invokeai/app/util/misc.py
 invokeai/app/util/model_exclude_null.py
+invokeai/app/util/path_safety.py
 invokeai/app/util/profiler.py
 invokeai/app/util/ssrf.py
 invokeai/app/util/startup_utils.py
@@ -657,6 +661,10 @@ invokeai/backend/krea2/__init__.py
 invokeai/backend/krea2/attention.py
 invokeai/backend/krea2/regional_prompting.py
 invokeai/backend/krea2/sampling_utils.py
+invokeai/backend/krea2/style_reference.py
+invokeai/backend/krea2/style_reference_extension.py
+invokeai/backend/krea2/style_reference_rf.py
+invokeai/backend/krea2/text_encoding.py
 invokeai/backend/krea2/vae_compat.py
 invokeai/backend/model_hash/hash_validator.py
 invokeai/backend/model_hash/model_hash.py
@@ -931,12 +939,15 @@ invokeai/backend/util/mask.py
 invokeai/backend/util/original_weights_storage.py
 invokeai/backend/util/prefix_logger_adapter.py
 invokeai/backend/util/silence_warnings.py
+invokeai/backend/util/state_dict_loading.py
 invokeai/backend/util/test_utils.py
 invokeai/backend/util/util.py
 invokeai/backend/util/vae_working_memory.py
 invokeai/backend/wan/__init__.py
+invokeai/backend/wan/memory_optimization.py
 invokeai/backend/wan/rocm_causal_conv3d.py
 invokeai/backend/wan/sampling_utils.py
+invokeai/backend/wan/vae_decode.py
 invokeai/backend/wan/extensions/__init__.py
 invokeai/backend/wan/extensions/wan_ref_image_extension.py
 invokeai/backend/z_image/__init__.py
@@ -971,12 +982,12 @@ invokeai/frontend/install/__init__.py
 invokeai/frontend/install/import_images.py
 invokeai/frontend/web/__init__.py
 invokeai/frontend/web/dist/index.html
-invokeai/frontend/web/dist/assets/App-C6Vlujfv.js
+invokeai/frontend/web/dist/assets/App-DvlZKGz7.js
 invokeai/frontend/web/dist/assets/App-tn1JZtBo.css
 invokeai/frontend/web/dist/assets/browser-ponyfill-BpMPqZAt.js
 invokeai/frontend/web/dist/assets/chunk-jRWAZmH_.js
 invokeai/frontend/web/dist/assets/denoising-strength-4mznP2tj.png
-invokeai/frontend/web/dist/assets/index-Bd6Mw58F.js
+invokeai/frontend/web/dist/assets/index-BuK6cFYB.js
 invokeai/frontend/web/dist/assets/inter-cyrillic-ext-wght-normal-BOeWTOD4.woff2
 invokeai/frontend/web/dist/assets/inter-cyrillic-wght-normal-DqGufNeO.woff2
 invokeai/frontend/web/dist/assets/inter-greek-ext-wght-normal-DlzME5K_.woff2
@@ -1041,6 +1052,7 @@ invokeai/invocation_api/__init__.py
 invokeai/version/__init__.py
 invokeai/version/invokeai_version.py
 tests/test_asyncio_shutdown.py
+tests/test_calibrate_wan_vae_working_memory.py
 tests/test_check_pins.py
 tests/test_config.py
 tests/test_dangerously_run_function_in_subprocess.py

{invokeai-6.14.0rc2 → invokeai-6.14.2}/InvokeAI.egg-info/requires.txt

@@ -1,6 +1,6 @@
 accelerate
 compel<3,>=2.4.0
-diffusers[torch]==0.39.0
+diffusers[torch]==0.40.0
 gguf
 mediapipe==0.10.14
 mistral-common<2,>=1.5.4
@@ -17,7 +17,7 @@ torchsde
 torchvision
 transformers<5.6,>=5.5
 fastapi-events
-fastapi==0.118.3
+fastapi<0.142,>=0.141.1
 huggingface-hub
 networkx
 pydantic-settings
@@ -31,6 +31,7 @@ dnspython
 dynamicprompts
 einops
 email-validator>=2.0.0
+fonttools[woff]
 passlib[bcrypt]>=1.7.4
 picklescan
 pillow

{invokeai-6.14.0rc2 → invokeai-6.14.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: InvokeAI
-Version: 6.14.0rc2
+Version: 6.14.2
 Summary: A full-featured AI-assisted image generation environment designed for creatives and enthusiasts.
 Author-email: Invoke <support@invoke.ai>
 License:                                  Apache License
@@ -214,7 +214,7 @@ License-File: LICENSE-SDXL.txt
 Requires-Dist: accelerate
 Requires-Dist: bitsandbytes; sys_platform != "darwin"
 Requires-Dist: compel<3,>=2.4.0
-Requires-Dist: diffusers[torch]==0.39.0
+Requires-Dist: diffusers[torch]==0.40.0
 Requires-Dist: gguf
 Requires-Dist: mediapipe==0.10.14
 Requires-Dist: mistral-common<2,>=1.5.4
@@ -233,7 +233,7 @@ Requires-Dist: torchsde
 Requires-Dist: torchvision
 Requires-Dist: transformers<5.6,>=5.5
 Requires-Dist: fastapi-events
-Requires-Dist: fastapi==0.118.3
+Requires-Dist: fastapi<0.142,>=0.141.1
 Requires-Dist: huggingface-hub
 Requires-Dist: networkx
 Requires-Dist: pydantic-settings
@@ -247,6 +247,7 @@ Requires-Dist: dnspython
 Requires-Dist: dynamicprompts
 Requires-Dist: einops
 Requires-Dist: email-validator>=2.0.0
+Requires-Dist: fonttools[woff]
 Requires-Dist: passlib[bcrypt]>=1.7.4
 Requires-Dist: picklescan
 Requires-Dist: pillow

{invokeai-6.14.0rc2 → invokeai-6.14.2}/invokeai/app/api/auth_dependencies.py

@@ -1,19 +1,73 @@
 """FastAPI dependencies for authentication."""
 
-from typing import Annotated
+from typing import TYPE_CHECKING, Annotated
 
 from fastapi import Cookie, Depends, HTTPException, status
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 
 from invokeai.app.api.dependencies import ApiDependencies
 from invokeai.app.services.auth.token_service import TokenData, verify_token
+from invokeai.app.services.users.users_common import SYSTEM_USER_ID
 from invokeai.backend.util.logging import logging
 
+if TYPE_CHECKING:
+    from invokeai.app.services.users.users_common import UserDTO
+
 logger = logging.getLogger(__name__)
 
 # HTTP Bearer token security scheme
 security = HTTPBearer(auto_error=False)
 MEDIA_TOKEN_COOKIE = "invokeai_media_token"
+# Deliberately indistinguishable from an ordinary expiry to a client: a token that fails
+# the epoch check is simply no longer valid, and saying *why* would tell a holder of a
+# stolen token that the account's password was just rotated.
+TOKEN_REVOKED_DETAIL = "Invalid or expired authentication token"
+
+
+def resolve_authorized_user(token_data: TokenData) -> "UserDTO | None":
+    """Return the account a verified token still grants access to, or None.
+
+    This is the single place that decides whether a syntactically valid token is still
+    honored, and every authenticated entry point must go through it: the REST
+    dependencies below, the Socket.IO handshake, and the video-upload ASGI gate. Keeping
+    the rules in one function is deliberate — they were previously repeated at each call
+    site, and a check added to some copies but not others is indistinguishable from no
+    check at all on the paths that were missed.
+
+    A token is honored when all four hold:
+
+    - it does not claim the internal ``system`` account,
+    - the account still exists,
+    - it is active,
+    - and the token carries the account's current revocation epoch. Any mismatch counts
+      as revoked: the token was not issued from the record as it now stands. Tokens
+      predating the claim decode to 0 and so remain valid against a record that has never
+      been bumped, which is why upgrading logs nobody out.
+
+    Raises whatever the user service raises; callers that must fail closed should catch.
+    """
+    # `system` owns everything carried over from before multiuser support, and is not a
+    # login account: `UserService.authenticate` refuses it and the migration clears any
+    # password left on the row. Neither of those reaches a token that was *already issued*
+    # — on an instance that set a password through the old `PATCH /auth/users/system` hole
+    # and logged in before it was closed, the JWT survives the upgrade, and nothing else
+    # here would reject it: the row is deliberately kept active and its epoch still
+    # matches, so the sliding-window middleware would renew it indefinitely. Refusing the
+    # id is what actually ends those sessions, and it holds for databases that applied an
+    # earlier revision of the migration too.
+    #
+    # Single-user mode, where everything legitimately runs as `system`, never reaches here:
+    # its dependencies synthesize the TokenData and return before resolving anything (see
+    # `get_current_user_or_default`, `get_current_media_user_or_default`, and
+    # `_identify_video_upload_user`). So this refuses only real, minted tokens.
+    if token_data.user_id == SYSTEM_USER_ID:
+        return None
+    user = ApiDependencies.invoker.services.users.get(token_data.user_id)
+    if user is None or not user.is_active:
+        return None
+    if token_data.token_epoch != user.token_epoch:
+        return None
+    return user
 
 
 def _validate_token(token: str, invalid_detail: str) -> TokenData:
@@ -21,13 +75,34 @@ def _validate_token(token: str, invalid_detail: str) -> TokenData:
     if token_data is None:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail=invalid_detail)
 
-    user = ApiDependencies.invoker.services.users.get(token_data.user_id)
-    if user is None or not user.is_active:
+    user = resolve_authorized_user(token_data)
+    if user is None:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="User not found or inactive")
-    return token_data
+    return _db_derived_token_data(token_data, user)
+
+
+def _db_derived_token_data(token_data: TokenData, user: "UserDTO") -> TokenData:
+    """Build TokenData whose authorization fields come from the database record.
+
+    The JWT proves *identity* only. Authorization (``is_admin``) must reflect the
+    current database state on every request; otherwise a demoted administrator
+    keeps admin rights until their token expires — and sliding-window refresh
+    would renew that stale claim indefinitely. A promoted user symmetrically
+    gains admin rights on their next request without re-login.
+
+    The epoch is carried through from the record so a refreshed token stays valid
+    (callers only reach here once ``_token_epoch_is_current`` has passed).
+    """
+    return TokenData(
+        user_id=user.user_id,
+        email=user.email,
+        is_admin=user.is_admin,
+        remember_me=token_data.remember_me,
+        token_epoch=user.token_epoch,
+    )
 
 
-async def get_current_user(
+def get_current_user(
     credentials: Annotated[HTTPAuthorizationCredentials | None, Depends(security)],
 ) -> TokenData:
     """Get current authenticated user from Bearer token.
@@ -62,21 +137,20 @@ async def get_current_user(
             headers={"WWW-Authenticate": "Bearer"},
         )
 
-    # Verify user still exists and is active
-    user_service = ApiDependencies.invoker.services.users
-    user = user_service.get(token_data.user_id)
+    # Verify the token still grants access: user exists, is active, epoch is current.
+    user = resolve_authorized_user(token_data)
 
-    if user is None or not user.is_active:
+    if user is None:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="User account is inactive or does not exist",
             headers={"WWW-Authenticate": "Bearer"},
         )
 
-    return token_data
+    return _db_derived_token_data(token_data, user)
 
 
-async def get_current_user_or_default(
+def get_current_user_or_default(
     credentials: Annotated[HTTPAuthorizationCredentials | None, Depends(security)],
 ) -> TokenData:
     """Get current authenticated user from Bearer token, or return a default system user if not authenticated.
@@ -117,18 +191,17 @@ async def get_current_user_or_default(
         # Invalid token in multiuser mode - reject
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid or expired token")
 
-    # Verify user still exists and is active
-    user_service = ApiDependencies.invoker.services.users
-    user = user_service.get(token_data.user_id)
+    # Verify the token still grants access: user exists, is active, epoch is current.
+    user = resolve_authorized_user(token_data)
 
-    if user is None or not user.is_active:
-        # User doesn't exist or is inactive in multiuser mode - reject
+    if user is None:
+        # Missing, inactive, or revoked in multiuser mode - reject
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="User not found or inactive")
 
-    return token_data
+    return _db_derived_token_data(token_data, user)
 
 
-async def get_current_media_user_or_default(
+def get_current_media_user_or_default(
     credentials: Annotated[HTTPAuthorizationCredentials | None, Depends(security)],
     media_token: Annotated[str | None, Cookie(alias=MEDIA_TOKEN_COOKIE)] = None,
 ) -> TokenData:
@@ -141,11 +214,16 @@ async def get_current_media_user_or_default(
     return _validate_token(token, "Invalid or expired token")
 
 
-async def require_admin(
+def require_admin(
     current_user: Annotated[TokenData, Depends(get_current_user)],
 ) -> TokenData:
     """Require admin role for the current user.
 
+    Stays `async def`, unlike the dependencies it builds on: this only reads a field off the
+    already-resolved token data. Declaring it `def` would buy a threadpool round-trip per admin
+    request and nothing else. The `users.get` that can block lives in `get_current_user`, which
+    is synchronous for that reason.
+
     Args:
         current_user: The current authenticated user's token data
 
@@ -160,11 +238,13 @@ async def require_admin(
     return current_user
 
 
-async def require_admin_or_default(
+def require_admin_or_default(
     current_user: Annotated[TokenData, Depends(get_current_user_or_default)],
 ) -> TokenData:
     """Require admin role for the current user, or return default system admin in single-user mode.
 
+    `async def` for the same reason as `require_admin`: it does no blocking work of its own.
+
     This dependency is useful for admin-only endpoints that should work in both single-user and multiuser modes.
 
     When multiuser mode is disabled (default), this always returns a system user with admin privileges.

{invokeai-6.14.0rc2 → invokeai-6.14.2}/invokeai/app/api/routers/_access.py

@@ -8,7 +8,10 @@ from fastapi import HTTPException
 
 from invokeai.app.api.auth_dependencies import CurrentUserOrDefault
 from invokeai.app.api.dependencies import ApiDependencies
-from invokeai.app.services.board_records.board_records_common import BoardVisibility
+from invokeai.app.services.board_records.board_records_common import (
+    BoardRecordNotFoundException,
+    BoardVisibility,
+)
 
 
 def assert_image_owner(image_name: str, current_user: CurrentUserOrDefault) -> None:
@@ -28,18 +31,56 @@ def assert_image_owner(image_name: str, current_user: CurrentUserOrDefault) -> N
 
     board_id = ApiDependencies.invoker.services.board_image_records.get_board_for_image(image_name)
     if board_id is not None:
+        # The board *record*, not its DTO: the decision needs only the owner and the
+        # visibility, and the DTO would drag in cover-image resolution plus three COUNT
+        # aggregates — five extra queries and five extra ways to fail per name.
+        #
+        # Only a board positively known to be gone falls through to the 403. A storage error
+        # propagates instead of being caught here: `board_records.get` deliberately does not
+        # translate sqlite errors into not-found, and a caller that cannot decide ownership
+        # must not report the name as an ordinary permission denial — the batch loops treat a
+        # 403 as a silent auth skip, which turned a locked database into images dropped from
+        # the response with no failure reported at all.
         try:
-            board = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)
+            board = ApiDependencies.invoker.services.board_records.get(board_id)
+        except BoardRecordNotFoundException:
+            pass
+        else:
             if board.user_id == current_user.user_id:
                 return
             if board.board_visibility == BoardVisibility.Public:
                 return
-        except Exception:
-            pass
 
     raise HTTPException(status_code=403, detail="Not authorized to modify this image")
 
 
+def _assert_image_record_exists(image_name: str) -> None:
+    """Turn a refusal into a 404 when the image is positively gone.
+
+    The two refusals mean opposite things to a client holding a reference to the image — a
+    workflow's image field, a reference image on a canvas layer. Gone is permanent, and the
+    reference should be dropped. Denied is a permission decision that can be reversed (a board
+    flipped back to Shared, an owner re-granting access), and dropping the reference over one
+    destroys work the user cannot get back by restoring the permission.
+
+    Nothing above can tell them apart: the ownership test rests on `images.user_id`, which is
+    gone with the row, so a deleted image reaches that same 403 as a foreign one. So the
+    distinction is made here, on the refusal path only — the happy path pays nothing for it.
+
+    A storage error propagates rather than answering either, so an unreadable database cannot
+    present as a deleted image and take the user's references down with it. `exists` is a bare
+    row probe rather than `get` for the same reason from the other side: `get` deserializes, so
+    a row written by a newer version — an enum value this one does not know — would fail exactly
+    as absence does, and a live image would be reported gone.
+
+    The cost is that an authenticated caller can now tell an absent image from one they may not
+    read. Image names are generated UUIDs, so this buys an attacker nothing they could enumerate,
+    and it is the answer admins have always received.
+    """
+    if not ApiDependencies.invoker.services.image_records.exists(image_name):
+        raise HTTPException(status_code=404, detail="Image not found")
+
+
 def assert_image_read_access(image_name: str, current_user: CurrentUserOrDefault) -> None:
     """Raise 403 if the current user may not view the image.
 
@@ -57,13 +98,17 @@ def assert_image_read_access(image_name: str, current_user: CurrentUserOrDefault
 
     board_id = ApiDependencies.invoker.services.board_image_records.get_board_for_image(image_name)
     if board_id is not None:
+        # See `assert_image_owner` for why this reads the board record and catches only
+        # not-found: a lookup that cannot be decided must not present as a permission decision.
         try:
-            board = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)
+            board = ApiDependencies.invoker.services.board_records.get(board_id)
+        except BoardRecordNotFoundException:
+            pass
+        else:
             if board.board_visibility in (BoardVisibility.Shared, BoardVisibility.Public):
                 return
-        except Exception:
-            pass
 
+    _assert_image_record_exists(image_name)
     raise HTTPException(status_code=403, detail="Not authorized to access this image")
 
 

{invokeai-6.14.0rc2 → invokeai-6.14.2}/invokeai/app/api/routers/app_info.py

@@ -52,12 +52,12 @@ class AppVersion(BaseModel):
 
 
 @app_router.get("/version", operation_id="app_version", status_code=200, response_model=AppVersion)
-async def get_version() -> AppVersion:
+def get_version() -> AppVersion:
     return AppVersion(version=__version__)
 
 
 @app_router.get("/app_deps", operation_id="get_app_deps", status_code=200, response_model=dict[str, str])
-async def get_app_deps(current_user: CurrentUserOrDefault) -> dict[str, str]:
+def get_app_deps(current_user: CurrentUserOrDefault) -> dict[str, str]:
     deps: dict[str, str] = {dist.metadata["Name"]: dist.version for dist in distributions()}
     try:
         cuda = getattr(getattr(torch, "version", None), "cuda", None) or "N/A"  # pyright: ignore[reportAttributeAccessIssue]
@@ -72,7 +72,7 @@ async def get_app_deps(current_user: CurrentUserOrDefault) -> dict[str, str]:
 
 
 @app_router.get("/patchmatch_status", operation_id="get_patchmatch_status", status_code=200, response_model=bool)
-async def get_patchmatch_status(current_user: CurrentUserOrDefault) -> bool:
+def get_patchmatch_status(current_user: CurrentUserOrDefault) -> bool:
     return PatchMatch.patchmatch_available()
 
 
@@ -217,7 +217,7 @@ def _redact_config_secrets(config: InvokeAIAppConfig) -> InvokeAIAppConfig:
     status_code=200,
     response_model=list[GenerationDeviceOption],
 )
-async def get_generation_device_options(current_user: CurrentUserOrDefault) -> list[GenerationDeviceOption]:
+def get_generation_device_options(current_user: CurrentUserOrDefault) -> list[GenerationDeviceOption]:
     """List the devices available for generation, for use with the `generation_devices` setting."""
     options: list[GenerationDeviceOption] = []
     if torch.cuda.is_available():
@@ -246,7 +246,7 @@ async def get_generation_device_options(current_user: CurrentUserOrDefault) -> l
 @app_router.get(
     "/runtime_config", operation_id="get_runtime_config", status_code=200, response_model=InvokeAIAppConfigWithSetFields
 )
-async def get_runtime_config(current_admin: AdminUserOrDefault) -> InvokeAIAppConfigWithSetFields:
+def get_runtime_config(current_admin: AdminUserOrDefault) -> InvokeAIAppConfigWithSetFields:
     config = get_config()
     return InvokeAIAppConfigWithSetFields(set_fields=config.model_fields_set, config=_redact_config_secrets(config))
 
@@ -257,7 +257,7 @@ async def get_runtime_config(current_admin: AdminUserOrDefault) -> InvokeAIAppCo
     status_code=200,
     response_model=InvokeAIAppConfigWithSetFields,
 )
-async def update_runtime_config(
+def update_runtime_config(
     _: AdminUserOrDefault,
     changes: UpdateAppGenerationSettingsRequest = Body(description="Writable runtime configuration changes"),
 ) -> InvokeAIAppConfigWithSetFields:
@@ -290,7 +290,7 @@ async def update_runtime_config(
     status_code=200,
     response_model=list[ExternalProviderStatusModel],
 )
-async def get_external_provider_statuses(current_user: CurrentUserOrDefault) -> list[ExternalProviderStatusModel]:
+def get_external_provider_statuses(current_user: CurrentUserOrDefault) -> list[ExternalProviderStatusModel]:
     statuses = ApiDependencies.invoker.services.external_generation.get_provider_statuses()
     return [status_to_model(status) for status in statuses.values()]
 
@@ -301,7 +301,7 @@ async def get_external_provider_statuses(current_user: CurrentUserOrDefault) ->
     status_code=200,
     response_model=list[ExternalProviderConfigModel],
 )
-async def get_external_provider_configs(current_admin: AdminUserOrDefault) -> list[ExternalProviderConfigModel]:
+def get_external_provider_configs(current_admin: AdminUserOrDefault) -> list[ExternalProviderConfigModel]:
     config = get_config()
     return [_build_external_provider_config(provider_id, config) for provider_id in EXTERNAL_PROVIDER_FIELDS]
 
@@ -312,7 +312,7 @@ async def get_external_provider_configs(current_admin: AdminUserOrDefault) -> li
     status_code=200,
     response_model=ExternalProviderConfigModel,
 )
-async def set_external_provider_config(
+def set_external_provider_config(
     _: AdminUserOrDefault,
     provider_id: str = Path(description="The external provider identifier"),
     update: ExternalProviderConfigUpdate = Body(description="External provider configuration settings"),
@@ -343,7 +343,7 @@ async def set_external_provider_config(
     status_code=200,
     response_model=ExternalProviderConfigModel,
 )
-async def reset_external_provider_config(
+def reset_external_provider_config(
     _: AdminUserOrDefault,
     provider_id: str = Path(description="The external provider identifier"),
 ) -> ExternalProviderConfigModel:
@@ -452,7 +452,7 @@ def _remove_external_models_for_provider(provider_id: str) -> None:
     responses={200: {"description": "The operation was successful"}},
     response_model=LogLevel,
 )
-async def get_log_level(current_admin: AdminUserOrDefault) -> LogLevel:
+def get_log_level(current_admin: AdminUserOrDefault) -> LogLevel:
     """Returns the log level"""
     return LogLevel(ApiDependencies.invoker.services.logger.level)
 
@@ -463,7 +463,7 @@ async def get_log_level(current_admin: AdminUserOrDefault) -> LogLevel:
     responses={200: {"description": "The operation was successful"}},
     response_model=LogLevel,
 )
-async def set_log_level(
+def set_log_level(
     current_admin: AdminUserOrDefault,
     level: LogLevel = Body(description="New log verbosity level"),
 ) -> LogLevel:
@@ -477,7 +477,7 @@ async def set_log_level(
     operation_id="clear_invocation_cache",
     responses={200: {"description": "The operation was successful"}},
 )
-async def clear_invocation_cache(current_admin: AdminUserOrDefault) -> None:
+def clear_invocation_cache(current_admin: AdminUserOrDefault) -> None:
     """Clears the invocation cache"""
     ApiDependencies.invoker.services.invocation_cache.clear()
 
@@ -487,7 +487,7 @@ async def clear_invocation_cache(current_admin: AdminUserOrDefault) -> None:
     operation_id="enable_invocation_cache",
     responses={200: {"description": "The operation was successful"}},
 )
-async def enable_invocation_cache(current_admin: AdminUserOrDefault) -> None:
+def enable_invocation_cache(current_admin: AdminUserOrDefault) -> None:
     """Clears the invocation cache"""
     ApiDependencies.invoker.services.invocation_cache.enable()
 
@@ -497,7 +497,7 @@ async def enable_invocation_cache(current_admin: AdminUserOrDefault) -> None:
     operation_id="disable_invocation_cache",
     responses={200: {"description": "The operation was successful"}},
 )
-async def disable_invocation_cache(current_admin: AdminUserOrDefault) -> None:
+def disable_invocation_cache(current_admin: AdminUserOrDefault) -> None:
     """Clears the invocation cache"""
     ApiDependencies.invoker.services.invocation_cache.disable()
 
@@ -507,6 +507,6 @@ async def disable_invocation_cache(current_admin: AdminUserOrDefault) -> None:
     operation_id="get_invocation_cache_status",
     responses={200: {"model": InvocationCacheStatus}},
 )
-async def get_invocation_cache_status(current_admin: AdminUserOrDefault) -> InvocationCacheStatus:
+def get_invocation_cache_status(current_admin: AdminUserOrDefault) -> InvocationCacheStatus:
     """Clears the invocation cache"""
     return ApiDependencies.invoker.services.invocation_cache.get_status()