Navigation: packages/AGENTS.md → atlascloud-nodes
Read packages/AGENTS.md § External-API Wrapper Nodes first — those billing/SSRF/poll/retry rules are the bulk of what matters here. This overlay notes the AtlasCloud specifics.
atlascloud-base.ts holds the hardened SSRF reference for the monorepo:
isPrivateOrLocalHost normalizes a host to numeric octets via full inet_aton
semantics (decimal/hex/octal + short forms), unwraps IPv4-mapped IPv6, blocks
localhost/*.localhost, and is tested against the decimal metadata IP
2852039166 (169.254.169.254). Other wrapper packages should adopt it.
Package specifics from shipped fixes:
- Download billed results through
atlasDownload(fetchWithRetry), not a plainfetch— a transient 429/5xx on the CDN otherwise discards an already-billed result. - Latent gap to respect:
fetchWithRetryhere does not yet distinguish idempotent methods, so do not route job-creatingPOSTs through a retrying path — a 5xx after the server billed would double-submit. (See thetopaz-nodesIDEMPOTENT_METHODSpattern.) - Recognize all terminal poll states via the
SUCCESS_STATUS/FAILURE_STATUSsynonym sets (complete/done/succeeded,canceled) — an unrecognized terminal status must not poll to timeout. guessMimereads bothmime_typeandmimeType— prompt @-mention injection (InjectedAssetRef) uses camelCase; don't rely on extension sniffing for extension-less /asset://URIs.- Model multi-image inputs as
list[image], not a singleimagewitharray: true. - A mixed reference array is
wrapInto, not one untyped list. Wan 3.0 and MiniMax H3 reference-to-video take a singlerefers: [{url, type}]covering images, videos and audio. The manifest splits that into typedreference_images/reference_videos/reference_audiosinputs, each carrying"wrapInto": "refers"; the factory appends their resolved URLs into one array in field order and tags each entry with the kind its input declared. The wire name is never a node property — the runtime provider reads the same flag so its genericimageToVideopostsrefers, notreference_images. Seedance 2.5 keeps the per-kind names because its API really does take three arrays. - Don't expose an API option that yields an extra output the single-output
node can't surface (the
return_last_frameSeedance option was dropped). The same rule keeps whole models out:pickOutputUrlreturns the first output, sobytedance/seedream-v5.0-pro/layer-decomposition— whose point is the set of layers it returns — is deliberately not shipped. A model that returns N interchangeable variants (n,num_images) is fine; one whose outputs are not interchangeable is not. - Suppress an option by name, not by upstream's
disabledflag. AtlasCloud marksenable_base64_output/enable_sync_modedisabled on most models but not on the FLUX.1 open-weight ones, and either switch breaks the poll-then-download flow.SUPPRESSED_FIELDSin the sync script is the list;output_dir(a server-side path on Tencent's upscaler) is there too. - The manifest is generated, not hand-edited.
node scripts/sync-atlascloud-manifest.mjsreconciles every entry's fields against theInputschema AtlasCloud publishes for that model (reachable from the unauthenticated catalog atGET /api/v1/models);--checkreports drift without writing. Hand-tuned enums, wrong separators (1024x1024vs1024*1024) and stale option lists are what the script exists to prevent. Add a model by hand — the script only maintains the fields of models we ship. Two shapes the script cannot fill in for a new entry, so write them yourself: asset fields (it never touchesimage/video/audio/list[…]props), and a schema property typedanyOfrather than a scalar — Cosmos 3 Super'simage_sizeis one, and hand-declaring it as anenumis what keeps the control, since the script preserves an option list the schema no longer carries. After adding entries,--checkmust report the manifest up to date; a drift line against a model you just added means the entry disagrees with the schema it was written from. - Chat is not a node concern. AtlasCloud's LLMs are OpenAI-compatible at
https://api.atlascloud.ai/v1and are served byAtlasCloudProviderinpackages/runtime, which extendsOpenAICompatProvider. Only the async prediction API (image/video) lives in this package.