Rebuild on shared BYOK template: user-supplied API key, v3 API, Python 3.11

Dockerfile

@@ -0,0 +1,16 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY . .
+
+EXPOSE 7860
+ENV GRADIO_SERVER_NAME="0.0.0.0" \
+    GRADIO_SERVER_PORT="7860" \
+    GRADIO_ANALYTICS_ENABLED="False" \
+    HF_HUB_DISABLE_TELEMETRY="1"
+
+CMD ["python", "app.py"]

README.md

@@ -1,15 +1,34 @@
 ---
-title: Hidream E1 Full
-emoji: 🖼
-colorFrom: purple
-colorTo: red
-sdk: gradio
-sdk_version: 5.25.2
-python_version: "3.11"
-app_file: app.py
+title: HiDream-E1 Full
+emoji: 🖼️
+colorFrom: blue
+colorTo: purple
+sdk: docker
 pinned: false
-license: apache-2.0
-short_description: 'HiDream-E1 is an image editing model built on HiDream-I1. '
+license: mit
+short_description: Image editing built on HiDream-I1.
 ---
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+# HiDream-E1 Full
+
+Image editing built on HiDream-I1.
+
+Runs [`wavespeed-ai/hidream-e1-full`](https://wavespeed.ai/models/wavespeed-ai/hidream-e1-full) through the
+[WaveSpeed](https://wavespeed.ai) v3 API.
+
+## Bring your own API key
+
+This Space does not ship an API key. Paste your own in the field at the top —
+create one in the [WaveSpeed dashboard](https://wavespeed.ai/dashboard).
+
+Your key is sent only to `api.wavespeed.ai` to run the model. It is not stored,
+not logged, and not written to disk; it is stripped out of error messages
+before they are displayed, and Gradio's flagging and API-page features (both of
+which would otherwise record or republish inputs) are disabled. Generations are
+billed to your own account.
+
+## Development
+
+Source of truth is `_shared/` in the working repo, not this copy:
+
+    python3 _shared/build_apps.py

app.py

@@ -1,320 +1,47 @@
-import os
-import requests
-import json
-import time
-import threading
-import uuid
-import base64
-from pathlib import Path
-from dotenv import load_dotenv
-import gradio as gr
-import random
-import torch
-from PIL import Image, ImageDraw, ImageFont
-from transformers import AutoTokenizer, AutoModelForSequenceClassification
-
-# 环境变量加载
-load_dotenv()
-API_KEY = os.getenv("WAVESPEED_API_KEY")
-# Missing credentials are reported when a request is made, not at import.
-# Raising here took the whole Space down with nothing but a traceback.
-
-# 安全分类配置
-MODEL_URL = "TostAI/nsfw-text-detection-large"
-CLASS_NAMES = {0: "✅ SAFE", 1: "⚠️ QUESTIONABLE", 2: "🚫 UNSAFE"}
-
-# 加载安全模型
-# The safety classifier is loaded on first use rather than at import. Loading
-# it at import meant a multi-hundred-MB download had to finish before the app
-# could bind its port, so the Space was killed as unhealthy before it ever
-# served a request. If the model cannot be loaded we raise, so a classifier
-# failure never silently leaves prompts unscreened.
-tokenizer = None
-model = None
-_classifier_lock = threading.Lock()
-
-
-def _ensure_classifier():
-    global tokenizer, model
-    if tokenizer is not None and model is not None:
-        return
-    with _classifier_lock:
-        if tokenizer is None or model is None:
-            tokenizer = AutoTokenizer.from_pretrained(MODEL_URL)
-            model = AutoModelForSequenceClassification.from_pretrained(MODEL_URL)
-
-
-# 会话管理
-class SessionManager:
-    _instances = {}
-    _lock = threading.Lock()
-
-    @classmethod
-    def get_session(cls, session_id):
-        with cls._lock:
-            if session_id not in cls._instances:
-                cls._instances[session_id] = {
-                    'count': 0,
-                    'history': [],
-                    'last_active': time.time()
-                }
-            return cls._instances[session_id]
-
-    @classmethod
-    def cleanup_sessions(cls):
-        with cls._lock:
-            now = time.time()
-            expired = [
-                k for k, v in cls._instances.items()
-                if now - v['last_active'] > 3600
-            ]
-            for k in expired:
-                del cls._instances[k]
-
-
-# 速率限制
-class RateLimiter:
-
-    def __init__(self):
-        self.clients = {}
-        self.lock = threading.Lock()
-
-    def check(self, client_id):
-        with self.lock:
-            now = time.time()
-            if client_id not in self.clients:
-                self.clients[client_id] = {'count': 1, 'reset': now + 3600}
-                return True
-            if now > self.clients[client_id]['reset']:
-                self.clients[client_id] = {'count': 1, 'reset': now + 3600}
-                return True
-            if self.clients[client_id]['count'] >= 20:
-                return False
-            self.clients[client_id]['count'] += 1
-            return True
-
-
-session_manager = SessionManager()
-rate_limiter = RateLimiter()
-
-
-# 工具函数
-def create_error_image(message):
-    """生成错误提示图片"""
-    img = Image.new("RGB", (512, 512), "#ffdddd")
-    try:
-        font = ImageFont.truetype("arial.ttf", 24)
-    except:
-        font = ImageFont.load_default()
-    draw = ImageDraw.Draw(img)
-    text = f"Error: {message[:60]}..." if len(message) > 60 else message
-    draw.text((50, 200), text, fill="#ff0000", font=font)
-    return img
-
-
-@torch.no_grad()
-def classify_prompt(prompt):
-    _ensure_classifier()
-    """安全分类"""
-    inputs = tokenizer(prompt,
-                       return_tensors="pt",
-                       truncation=True,
-                       max_length=512)
-    outputs = model(**inputs)
-    return torch.argmax(outputs.logits).item()
-
-
-def image_to_base64(file_path):
-    """将图片转换为Base64格式"""
-    with open(file_path, "rb") as f:
-        file_ext = Path(file_path).suffix.lower()[1:]
-        mime_type = f"image/{file_ext}" if file_ext in ["jpeg", "jpg", "png"
-                                                        ] else "image/jpeg"
-        return f"data:{mime_type};base64,{base64.b64encode(f.read()).decode()}"
+"""HiDream-E1 Full — powered by WaveSpeed AI.
 
+Generated from _shared/apps.py — edit the spec there, not this file.
+"""
 
-# 核心生成逻辑
-def generate_image(image_file, prompt, seed, session_id, enable_safety=True):
-    try:
-        # 安全检查
-        if enable_safety:
-            safety_level = classify_prompt(prompt)
-            if safety_level != 0:
-                error_img = create_error_image(CLASS_NAMES[safety_level])
-                yield f"❌ Blocked: {CLASS_NAMES[safety_level]}", error_img, ""
-                return
-
-        # 速率限制
-        if not rate_limiter.check(session_id):
-            error_img = create_error_image(
-                "Hourly limit exceeded (20 requests)")
-            yield "❌ 请求过于频繁，请稍后再试", error_img, ""
-            return
-
-        # 会��更新
-        session = session_manager.get_session(session_id)
-        session['last_active'] = time.time()
-        session['count'] += 1
-
-        # 输入验证
-        error_messages = []
-        if not image_file:
-            error_messages.append("请上传图片文件")
-        elif not Path(image_file).exists():
-            error_messages.append("文件不存在")
-        elif Path(image_file).suffix.lower()[1:] not in ["jpg", "jpeg", "png"]:
-            error_messages.append("仅支持JPG/PNG格式")
-        if not prompt.strip():
-            error_messages.append("提示语不能为空")
-        if error_messages:
-            error_img = create_error_image(" | ".join(error_messages))
-            yield "❌ 输入验证失败", error_img, ""
-            return
-
-        # 转换为Base64
-        try:
-            base64_image = image_to_base64(image_file)
-        except Exception as e:
-            error_img = create_error_image(f"文件处理失败: {str(e)}")
-            yield "❌ 文件处理失败", error_img, ""
-            return
+import os
 
-        # 构造请求
-        headers = {
-            "Content-Type": "application/json",
-            "Authorization": f"Bearer {API_KEY}",
-        }
-        payload = {
-            "enable_base64_output": True,
-            "enable_safety_checker": enable_safety,
-            "image": base64_image,
-            "prompt": prompt,
-            "seed": int(seed) if seed != -1 else random.randint(0, 999999)
+# Set before gradio is imported: its telemetry client reads these at import time.
+os.environ.setdefault("GRADIO_ANALYTICS_ENABLED", "False")
+os.environ.setdefault("HF_HUB_DISABLE_TELEMETRY", "1")
+
+from pathlib import Path  # noqa: E402
+
+import spaceui  # noqa: E402
+
+SPEC = {
+    "title": "HiDream-E1 Full",
+    "model": "wavespeed-ai/hidream-e1-full",
+    "output": "image",
+    "tagline": "Image editing built on HiDream-I1.",
+    "fields": [
+        {
+            "kind": "image",
+            "key": "image",
+            "label": "Input image"
+        },
+        {
+            "kind": "prompt",
+            "key": "prompt",
+            "label": "Prompt",
+            "placeholder": "Describe the edit to apply"
+        },
+        {
+            "kind": "seed",
+            "key": "seed"
         }
-
-        # 提交请求
-        response = requests.post(
-            "https://api.wavespeed.ai/api/v2/wavespeed-ai/hidream-e1-full",
-            headers=headers,
-            json=payload,
-            timeout=30)
-        response.raise_for_status()
-
-        # 处理响应
-        request_id = response.json()["data"]["id"]
-        result_url = f"https://api.wavespeed.ai/api/v2/predictions/{request_id}/result"
-        start_time = time.time()
-
-        # 轮询结果
-        for _ in range(60):
-            time.sleep(1)
-            resp = requests.get(result_url, headers=headers)
-            resp.raise_for_status()
-
-            data = resp.json()["data"]
-            status = data["status"]
-
-            if status == "completed":
-                elapsed = time.time() - start_time
-                image_url = data["outputs"][0]
-                session["history"].append(image_url)
-                yield f"🎉 生成成功! 耗时 {elapsed:.1f}s", image_url, image_url
-                return
-            elif status == "failed":
-                raise Exception(data.get("error", "Unknown error"))
-            else:
-                yield f"⏳ 当前状态: {status.capitalize()}...", None, None
-
-        raise Exception("生成超时")
-
-    except Exception as e:
-        error_img = create_error_image(str(e))
-        yield f"❌ 生成失败: {str(e)}", error_img, ""
-
-
-# 后台清理任务
-def cleanup_task():
-    while True:
-        session_manager.cleanup_sessions()
-        time.sleep(3600)
-
-
-# 界面构建
-with gr.Blocks(theme=gr.themes.Soft(),
-               css="""
-    .status-box { padding: 10px; border-radius: 5px; margin: 5px; }
-    .safe { background: #e8f5e9; border: 1px solid #a5d6a7; }
-    .warning { background: #fff3e0; border: 1px solid #ffcc80; }
-    .error { background: #ffebee; border: 1px solid #ef9a9a; }
-    """) as app:
-
-    session_id = gr.State(str(uuid.uuid4()))
-
-    gr.Markdown("# 🖼️Hidream-E1-Full Live On  Wavespeed Ai")
-    gr.Markdown("HiDream-E1 is an image editing model built on HiDream-I1.")
-
-    with gr.Row():
-        with gr.Column(scale=1):
-            image_file = gr.Image(label="Upload Image",
-                                  type="filepath",
-                                  sources=["upload"],
-                                  interactive=True,
-                                  image_mode="RGB")
-            prompt = gr.Textbox(
-                label="prompt",
-                placeholder="Please enter an English prompt...",
-                lines=3)
-            seed = gr.Number(label="seed",
-                             value=-1,
-                             minimum=-1,
-                             maximum=999999,
-                             step=1)
-            random_btn = gr.Button("random🎲seed", variant="secondary")
-            enable_safety = gr.Checkbox(label="🔒 Enable Safety Checker",
-                                        value=True,
-                                        interactive=False)
-        with gr.Column(scale=1):
-            output_image = gr.Image(label="Generated Result")
-            output_url = gr.Textbox(label="image url",
-                                    interactive=True,
-                                    visible=False)
-            status = gr.Textbox(label="Status", elem_classes=["status-box"])
-            submit_btn = gr.Button("开始生成", variant="primary")
-    gr.Examples(examples=[
-        [
-            "Convert the image into Claymation style.",
-            "examples/penguin-9bdee7.png"
-        ],
-        [
-            "Convert the image into a Ghibli style.",
-            "examples/flux_ip_adapter_input-8dbae5.jpg"
-        ],
-        [
-            "Add sunglasses to the face of the girl.",
-            "examples/ip_mask_girl2-b393af.png"
-        ],
-        [
-            'Convert the image into an ink sketch style.',
-            "examples/astronaut-2e89be.jpg"
-        ],
-        [
-            'Add a butterfly to the scene.',
-            "examples/controlnet_depth_result-594bc1.png"
-        ]
     ],
-                inputs=[prompt, image_file],
-                label="Examples")
-
-    random_btn.click(fn=lambda: random.randint(0, 999999), outputs=seed)
+    "extra": {
+        "enable_base64_output": False,
+        "enable_sync_mode": False
+    }
+}
 
-    submit_btn.click(
-        generate_image,
-        inputs=[image_file, prompt, seed, session_id, enable_safety],
-        outputs=[status, output_image, output_url])
+SPEC["css"] = Path(__file__).with_name("style.css").read_text(encoding="utf-8")
 
 if __name__ == "__main__":
-    threading.Thread(target=cleanup_task, daemon=True).start()
-    app.queue(max_size=4).launch(server_name="0.0.0.0",
-                                 server_port=7860,
-                                 show_error=True,
-                                 share=False)
+    spaceui.launch(spaceui.build(SPEC), SPEC["css"])

requirements.txt

@@ -1,6 +1,2 @@
-gradio
-aiohttp
-python-dotenv
-torch
-transformers>=4.40
-requests
+gradio>=6.22,<7
+requests>=2.31

spaceui.py

@@ -0,0 +1,240 @@
+"""Builds a Space UI from a declarative spec.
+
+Shared verbatim by every Space in the wavespeed org. Generated from
+_shared/spaceapp/ — edit there and re-run _shared/build_apps.py.
+
+Handling of the user's API key
+------------------------------
+The key is typed into the browser and travels to this server on each request.
+Keeping it from leaking takes more than masking the textbox, because Gradio has
+several features that will happily persist or republish an input:
+
+  * `type="password"`          - not echoed back into the DOM.
+  * `api_visibility="private"` - Gradio 6 otherwise documents this event on the
+                                 app's public API page, generating client
+                                 snippets that include every input, the key
+                                 among them.
+  * `analytics_enabled=False`  - on Blocks, plus the env vars set in app.py
+                                 before gradio is imported.
+  * no `gr.State`/`gr.Examples` ever holds the key, so it is not serialised
+    into the page or cached to disk.
+  * every error is passed through `wavespeed.redact` before display, because a
+    requests exception can stringify the Authorization header.
+
+Gradio's flagging feature (which writes raw inputs to a CSV) belongs to
+gr.Interface; this UI is built from gr.Blocks, which has no flagging, so there
+is nothing to switch off there.
+
+The key is a plain function argument: it lives for the duration of one request
+and is not retained between them.
+"""
+
+from __future__ import annotations
+
+import gradio as gr
+
+import wavespeed as ws
+
+DASH = "https://wavespeed.ai/dashboard"
+
+
+def _model_link(model: str) -> str:
+    return f"https://wavespeed.ai/models/{model}"
+
+
+def _collect(spec, key, values, progress):
+    """Turn UI values into an API payload, uploading any local files first."""
+    payload = dict(spec.get("extra", {}))
+    for field, value in zip(spec["fields"], values):
+        kind, api_key_name = field["kind"], field["key"]
+
+        if kind in ("image", "audio", "video"):
+            if not value:
+                if field.get("required", True):
+                    raise ws.WaveSpeedError(f"{field['label']} is required.")
+                continue
+            progress(0.1, desc=f"Uploading {field['label'].lower()}…")
+            payload[api_key_name] = ws.upload(key, value)
+
+        elif kind == "images":
+            if not value:
+                if field.get("required", True):
+                    raise ws.WaveSpeedError(f"{field['label']} is required.")
+                continue
+            progress(0.1, desc=f"Uploading {field['label'].lower()}…")
+            payload[api_key_name] = [ws.upload(key, value)]
+
+        elif kind == "prompt":
+            text = (value or "").strip()
+            if not text and field.get("required", True):
+                raise ws.WaveSpeedError("Enter a prompt.")
+            if text:
+                payload[api_key_name] = text
+
+        elif kind == "seed":
+            # -1 means "let the service choose"; sending it would pin the seed.
+            if value is not None and int(value) >= 0:
+                payload[api_key_name] = int(value)
+
+        elif value is not None and value != "":
+            payload[api_key_name] = value
+
+    return payload
+
+
+def build(spec):
+    """Return a configured gr.Blocks for this Space."""
+    css = spec["css"]
+    outputs_are_video = spec["output"] == "video"
+
+    with gr.Blocks(
+        title=f"{spec['title']} - WaveSpeed AI",
+        analytics_enabled=False,
+    ) as demo:
+        gr.HTML(
+            f"""
+            <div class="hero-container">
+              <div class="hero-badge">WAVESPEED AI</div>
+              <h1 class="hero-title">{spec['title']}</h1>
+              <p class="hero-desc">{spec['tagline']}</p>
+            </div>
+            """
+        )
+
+        with gr.Row(elem_classes="api-key-row"):
+            api_key = gr.Textbox(
+                label="WaveSpeed API key",
+                placeholder="Paste your API key — it is used for this request only",
+                type="password",          # never echoed back to the page
+                show_label=False,
+                container=False,
+                scale=4,
+            )
+            gr.HTML(
+                f'<a class="get-key-btn" href="{DASH}" target="_blank" '
+                'rel="noopener">Get a key</a>'
+            )
+        gr.Markdown(
+            "Your key is sent only to `api.wavespeed.ai` to run this model. "
+            "It is not stored, logged, or shared, and generations are billed to "
+            "your own account.",
+            elem_classes="key-note",
+        )
+
+        controls = []
+        with gr.Row():
+            with gr.Column(scale=1):
+                for f in spec["fields"]:
+                    controls.append(_make_control(f))
+                run_btn = gr.Button(
+                    spec.get("button", "Generate"),
+                    variant="primary",
+                    elem_classes="primary-btn",
+                )
+            with gr.Column(scale=1):
+                if spec["output"] == "compare":
+                    outs = [
+                        gr.Image(label=m["label"], type="filepath")
+                        for m in spec["compare"]
+                    ]
+                elif outputs_are_video:
+                    outs = [gr.Video(label="Result")]
+                else:
+                    outs = [gr.Image(label="Result", type="filepath")]
+
+        gr.HTML(
+            f"""
+            <div class="cta-container">
+              <p class="cta-desc">Model:
+                <a href="{_model_link(spec['model'])}" target="_blank" rel="noopener">
+                  <code>{spec['model']}</code></a>
+                &middot; <a href="https://wavespeed.ai/docs" target="_blank"
+                  rel="noopener">API docs</a>
+              </p>
+            </div>
+            """
+        )
+
+        def _run(key, *values, progress=gr.Progress()):
+            blank = [None] * len(outs)
+            if not key or not key.strip():
+                gr.Warning("Enter your WaveSpeed API key first.")
+                return blank[0] if len(blank) == 1 else tuple(blank)
+            try:
+                payload = _collect(spec, key, values, progress)
+                progress(0.3, desc="Submitting…")
+                if spec["output"] == "compare":
+                    models = spec["compare"]
+                    results = []
+                    for i, m in enumerate(models):
+                        progress(
+                            0.3 + 0.6 * i / len(models),
+                            desc=f"Running {m['label']}…",
+                        )
+                        merged = dict(payload, **m.get("extra", {}))
+                        results.append(ws.run(key, m["model"], merged)[0])
+                    return tuple(results)
+                outputs = ws.run(
+                    key, spec["model"], payload,
+                    on_tick=lambda s: progress(0.6, desc=f"Generating ({s})…"),
+                )
+                return outputs[0]
+            except ws.WaveSpeedError as e:
+                # Message is already redacted by the client.
+                gr.Warning(str(e))
+            except Exception as e:  # noqa: BLE001 - never surface a raw trace
+                gr.Warning(ws.redact(f"Unexpected error: {e}", key))
+            return blank[0] if len(blank) == 1 else tuple(blank)
+
+        run_btn.click(
+            _run,
+            inputs=[api_key, *controls],
+            outputs=outs,
+            # Keep this event off the public API page — its generated snippets
+            # would include the api_key input.
+            api_visibility="private",
+        )
+
+    return demo
+
+
+def _make_control(f):
+    # seed fields carry no explicit label; they get the default below.
+    kind, label = f["kind"], f.get("label", "")
+    if kind == "prompt":
+        return gr.Textbox(
+            label=label, placeholder=f.get("placeholder", ""),
+            lines=f.get("lines", 3),
+        )
+    if kind == "image":
+        return gr.Image(label=label, type="filepath")
+    if kind == "images":
+        return gr.Image(label=label, type="filepath")
+    if kind == "audio":
+        return gr.Audio(label=label, type="filepath")
+    if kind == "video":
+        return gr.Video(label=label)
+    if kind == "choice":
+        return gr.Dropdown(
+            label=label, choices=f["choices"], value=f.get("default", f["choices"][0])
+        )
+    if kind == "bool":
+        return gr.Checkbox(label=label, value=f.get("default", False))
+    if kind == "seed":
+        return gr.Number(label=f.get("label", "Seed (-1 = random)"), value=-1, precision=0)
+    if kind == "slider":
+        return gr.Slider(
+            label=label, minimum=f["min"], maximum=f["max"],
+            step=f.get("step", 1), value=f["default"],
+        )
+    raise ValueError(f"unknown field kind: {kind}")
+
+
+def launch(demo, css):
+    """Launch the app. Gradio 6 takes css here rather than on Blocks."""
+    demo.launch(
+        server_name="0.0.0.0",
+        server_port=7860,
+        css=css,
+        quiet=True,
+    )

style.css

@@ -0,0 +1,131 @@
+/* Shared Space styling. Generated from _shared/spaceapp/ — do not edit in place. */
+
+.gradio-container {
+	max-width: 1080px !important;
+	margin: 0 auto !important;
+	font-family: "Inter", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto,
+		"Noto Sans", "PingFang SC", "Microsoft YaHei", sans-serif !important;
+}
+
+/* --- hero ---------------------------------------------------------------- */
+
+.hero-container {
+	text-align: center;
+	padding: 40px 16px 24px;
+}
+
+.hero-badge {
+	display: inline-block;
+	background: linear-gradient(135deg, #4f46e5, #2563eb);
+	color: #fff;
+	font-size: 0.66rem;
+	font-weight: 700;
+	letter-spacing: 0.14em;
+	padding: 7px 18px;
+	border-radius: 999px;
+	margin-bottom: 16px;
+}
+
+.hero-title {
+	font-size: 2.4rem;
+	font-weight: 800;
+	letter-spacing: -0.025em;
+	margin: 0 0 10px;
+	background: linear-gradient(135deg, #4338ca 0%, #2563eb 55%, #7c3aed 100%);
+	-webkit-background-clip: text;
+	background-clip: text;
+	-webkit-text-fill-color: transparent;
+}
+
+.hero-desc {
+	font-size: 1rem;
+	line-height: 1.6;
+	color: var(--body-text-color-subdued, #64748b);
+	max-width: 62ch;
+	margin: 0 auto;
+}
+
+@media (max-width: 620px) {
+	.hero-title {
+		font-size: 1.8rem;
+	}
+}
+
+/* --- api key row --------------------------------------------------------- */
+
+.api-key-row {
+	align-items: center;
+	gap: 10px;
+	margin-bottom: 4px;
+}
+
+.get-key-btn {
+	display: inline-block;
+	white-space: nowrap;
+	padding: 9px 16px;
+	border-radius: 8px;
+	border: 1px solid var(--border-color-primary, #d2d6de);
+	font-size: 0.86rem;
+	font-weight: 600;
+	text-decoration: none;
+	color: var(--body-text-color, #14161a);
+}
+
+.get-key-btn:hover {
+	background: var(--background-fill-secondary, #f4f5f7);
+}
+
+.key-note {
+	font-size: 0.82rem !important;
+	line-height: 1.55;
+	color: var(--body-text-color-subdued, #6b7280) !important;
+	margin: 2px 2px 18px !important;
+}
+
+.key-note code {
+	font-size: 0.95em;
+}
+
+/* --- controls ------------------------------------------------------------ */
+
+.primary-btn {
+	background: linear-gradient(135deg, #4f46e5, #2563eb) !important;
+	border: 0 !important;
+	color: #fff !important;
+	font-weight: 650 !important;
+	border-radius: 9px !important;
+	margin-top: 8px;
+}
+
+.primary-btn:hover {
+	filter: brightness(1.08);
+}
+
+/* --- footer -------------------------------------------------------------- */
+
+.cta-container {
+	text-align: center;
+	padding: 22px 16px 8px;
+	margin-top: 18px;
+	border-top: 1px solid var(--border-color-primary, #e4e6eb);
+}
+
+.cta-desc {
+	font-size: 0.86rem;
+	color: var(--body-text-color-subdued, #6b7280);
+	margin: 0;
+}
+
+.cta-desc a {
+	color: #4f46e5;
+	text-decoration: none;
+	font-weight: 600;
+}
+
+.cta-desc a:hover {
+	text-decoration: underline;
+}
+
+.cta-desc code {
+	font-size: 0.95em;
+}

wavespeed.py

@@ -0,0 +1,151 @@
+"""Minimal WaveSpeed v3 API client.
+
+Shared verbatim by every Space in the wavespeed org. Generated from
+_shared/spaceapp/ — edit there and re-run _shared/build_apps.py, never edit the
+copy inside a Space.
+
+The user supplies their own API key through the UI. It is used to sign requests
+to api.wavespeed.ai and nothing else: it is never logged, never written to
+disk, never placed in a Gradio component value, and is stripped out of every
+error message before that message can reach a browser (see `redact`). An
+exception raised by `requests` can carry the full request headers in its text,
+which is exactly how a key ends up in a user-visible traceback, so every raise
+in this module goes through `redact` first.
+
+API reference: https://wavespeed.ai/docs/rest-api
+"""
+
+from __future__ import annotations
+
+import time
+from typing import Any
+
+import requests
+
+API_BASE = "https://api.wavespeed.ai/api/v3"
+UPLOAD_URL = f"{API_BASE}/media/upload/binary"
+
+# The docs ask for >= 2s between polls of the same task, easing toward 5-10s
+# for long jobs. Anything faster risks being throttled.
+POLL_START = 2.0
+POLL_MAX = 8.0
+POLL_GROWTH = 1.25
+POLL_TIMEOUT = 600
+
+TERMINAL_OK = "completed"
+TERMINAL_BAD = ("failed", "cancelled", "timeout")
+
+
+class WaveSpeedError(Exception):
+    """User-facing error. The message is always key-free."""
+
+
+def redact(text: Any, key: str | None) -> str:
+    """Remove the API key (and any bearer token) from text headed for a user."""
+    s = str(text)
+    if key:
+        k = key.strip()
+        if k:
+            s = s.replace(k, "***")
+            # Defend against a partially-quoted key in a repr.
+            if len(k) > 12:
+                s = s.replace(k[:12], "***")
+    # Catch any Authorization header echoed by a library.
+    import re
+
+    s = re.sub(r"(?i)(bearer\s+)[A-Za-z0-9._\-]+", r"\1***", s)
+    s = re.sub(r"(?i)('authorization':\s*')[^']*", r"\1***", s)
+    return s
+
+
+def _headers(key: str, json: bool = False) -> dict:
+    h = {"Authorization": f"Bearer {key.strip()}"}
+    if json:
+        h["Content-Type"] = "application/json"
+    return h
+
+
+def _check(resp: requests.Response, key: str) -> dict:
+    if resp.status_code == 401:
+        raise WaveSpeedError("Invalid API key. Check the key and try again.")
+    if resp.status_code == 402:
+        raise WaveSpeedError("This account is out of credit.")
+    if resp.status_code == 429:
+        raise WaveSpeedError("Rate limit or quota exceeded. Wait and retry.")
+    if resp.status_code >= 400:
+        raise WaveSpeedError(
+            redact(f"API error {resp.status_code}: {resp.text[:300]}", key)
+        )
+    try:
+        body = resp.json()
+    except ValueError:
+        raise WaveSpeedError("API returned a non-JSON response.") from None
+    if body.get("code") != 200:
+        raise WaveSpeedError(redact(body.get("message", "Unknown API error"), key))
+    return body.get("data", {}) or {}
+
+
+def upload(key: str, path: str) -> str:
+    """Upload a local file, returning the URL to reference it by."""
+    try:
+        with open(path, "rb") as fh:
+            resp = requests.post(
+                UPLOAD_URL, headers=_headers(key), files={"file": fh}, timeout=120
+            )
+    except requests.RequestException as e:
+        raise WaveSpeedError(redact(f"Upload failed: {e}", key)) from None
+    data = _check(resp, key)
+    url = data.get("download_url") or data.get("url")
+    if not url:
+        raise WaveSpeedError("Upload succeeded but returned no URL.")
+    return url
+
+
+def submit(key: str, model: str, payload: dict) -> str:
+    """Start a job and return its request id.
+
+    Deliberately not retried: the docs warn that repeating a POST can bill the
+    caller twice. Only the GET poll below is safe to retry.
+    """
+    try:
+        resp = requests.post(
+            f"{API_BASE}/{model}", headers=_headers(key, json=True), json=payload, timeout=60
+        )
+    except requests.RequestException as e:
+        raise WaveSpeedError(redact(f"Could not reach the API: {e}", key)) from None
+    data = _check(resp, key)
+    rid = data.get("id")
+    if not rid:
+        raise WaveSpeedError("API accepted the request but returned no task id.")
+    return rid
+
+
+def poll(key: str, request_id: str, on_tick=None) -> list[str]:
+    """Poll a task to completion and return its output URLs."""
+    url = f"{API_BASE}/predictions/{request_id}/result"
+    deadline = time.time() + POLL_TIMEOUT
+    delay = POLL_START
+    while time.time() < deadline:
+        time.sleep(delay)
+        delay = min(delay * POLL_GROWTH, POLL_MAX)
+        try:
+            resp = requests.get(url, headers=_headers(key), timeout=60)
+        except requests.RequestException:
+            continue  # transient; a GET is safe to repeat
+        data = _check(resp, key)
+        status = data.get("status", "")
+        if status == TERMINAL_OK:
+            outputs = data.get("outputs") or []
+            if not outputs:
+                raise WaveSpeedError("Generation finished but produced no output.")
+            return outputs
+        if status in TERMINAL_BAD:
+            detail = redact(data.get("error") or status, key)
+            raise WaveSpeedError(f"Generation {status}: {detail}")
+        if on_tick:
+            on_tick(status)
+    raise WaveSpeedError("Timed out waiting for the result. The job may still finish.")
+
+
+def run(key: str, model: str, payload: dict, on_tick=None) -> list[str]:
+    return poll(key, submit(key, model, payload), on_tick=on_tick)