/api/image/generate - arweave upload

[sweetmantech]

Summary by CodeRabbit

• New Features
  • Generated images are now automatically uploaded and exposed via a public fetchable URL; API responses include imageUrl and Arweave transaction details.
  • Added utilities to detect, normalize, and convert Arweave/IPFS URLs into fetchable gateway URLs.
• Refactor
  • Image output schema flattened and now surfaces usage, imageUrl, and arweaveResult at the top level.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Updated (UTC)
recoup-api	Ready	Preview	Nov 28, 2025 4:11pm

[coderabbitai]

Warning

Rate limit exceeded

@sweetmantech has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 2 minutes and 12 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between 09e817f and 849d889.

📒 Files selected for processing (3)

• lib/arweave/isGatewayIPFSUrl.ts (1 hunks)
• lib/arweave/isNormalizeableIPFSUrl.ts (1 hunks)
• lib/arweave/normalizeIPFSUrl.ts (1 hunks)

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

Walkthrough

Adds Arweave upload of the first generated image in the image-generation GET flow, new Arweave/IPFS URL utilities, Arweave client upload implementation, and package dependencies; response schema extended with imageUrl, arweaveResult, and flattened image fields.

Changes

Cohort / File(s)	Summary
Image API + Schema app/api/image/generate/route.ts, middleware.ts	After generating images, uploads the first image to Arweave and awaits the transaction. Response now includes top-level imageUrl, arweaveResult, and flattened image entries plus existing usage.
Arweave upload implementation lib/arweave/uploadToArweave.ts	New default-exported uploadToArweave(imageData, getProgress?) that reads ARWEAVE_KEY, initializes Arweave client, creates/signs a transaction with Content-Type tag, uploads chunks with progress, and returns the completed Transaction.
Arweave core & gateway helpers lib/arweave/arweave.ts, lib/arweave/arweaveGatewayUrl.ts, lib/arweave/getFetchableUrl.ts	Added ArweaveURL type and isArweaveURL; arweaveGatewayUrl converts ar:// to https://arweave.net/<id>; getFetchableUrl normalizes/validates Arweave, IPFS, https/data/blob URLs and rejects insecure http.
IPFS utilities lib/arweave/isCID.ts, lib/arweave/isGatewayIPFSUrl.ts, lib/arweave/isIPFSUrl.ts, lib/arweave/isNormalizeableIPFSUrl.ts, lib/arweave/isNormalizedIPFSURL.ts, lib/arweave/normalizeIPFSUrl.ts, lib/arweave/ipfsGatewayUrl.ts	New helpers for detecting, normalizing, and converting IPFS/CID/gateway URLs (isCID, isGatewayIPFSUrl, isIPFSUrl, isNormalizeableIPFSUrl, isNormalizedIPFSURL, normalizeIPFSUrl, ipfsGatewayUrl).
Dependencies package.json	Added arweave (^1.15.7) and multiformats (^13.4.1).

Sequence Diagram(s)

sequenceDiagram
    actor Client
    participant API as Image Generation API
    participant ImageGen as Image Generator
    participant Uploader as uploadToArweave
    participant ArweaveNet as arweave.net

    Client->>API: GET /api/image/generate
    API->>ImageGen: generate images
    ImageGen-->>API: base64 image + mimeType (images[])
    API->>Uploader: uploadToArweave({base64Data, mimeType})
    Uploader->>Uploader: read ARWEAVE_KEY, init client
    Uploader->>ArweaveNet: upload chunks (signed transaction)
    ArweaveNet-->>Uploader: upload confirmation (tx id)
    Uploader-->>API: Transaction (arweaveResult)
    API->>API: ar://id -> fetchable URL (getFetchableUrl/arweaveGatewayUrl)
    API-->>Client: 200 { images, imageUrl, arweaveResult, usage }

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

• Pay attention to: environment key decoding and error paths in uploadToArweave.ts.
• Verify transaction tagging (Content-Type) and chunked uploader loop correctness.
• Validate URL normalization rules and security checks in getFetchableUrl.ts.
• Confirm response construction and error handling in app/api/image/generate/route.ts.

Possibly related PRs

• api/image/generate - generate an image #1 — Base image generation handler that this change extends by adding Arweave upload and response-schema updates.

Poem

🐰 I hopped a trail of base64 light,

Carried one image into Arweave night.
Chunk by chunk, the ledger sings,
Now fetchable dreams on immutable wings.
🥕✨

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly describes the main change: adding Arweave upload functionality to the /api/image/generate endpoint.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[coderabbitai]

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

app/api/image/generate/route.ts (1)

40-54: Critical: Null check on result comes after accessing result.images[0].

The code accesses result.images[0] on lines 42-43 before checking if result is null/falsy on line 46. If generateImage returns null, this will throw a runtime error. Additionally, there's no check that result.images exists and has at least one element.

     const result = await generateImage(prompt);
+
+    if (!result || !result.images?.length) {
+      return NextResponse.json(
+        { error: "Failed to generate image" },
+        {
+          status: 500,
+          headers: getCorsHeaders(),
+        },
+      );
+    }
+
     const arweaveResult = await uploadToArweave({
       base64Data: result.images[0].base64,
       mimeType: result.images[0].mediaType,
     });

-    if (!result) {
-      return NextResponse.json(
-        { error: "Failed to generate image" },
-        {
-          status: 500,
-          headers: getCorsHeaders(),
-        },
-      );
-    }
-
     return NextResponse.json(

🧹 Nitpick comments (6)

lib/arweave/uploadFile.tsx (2)

1-32: File extension should be .ts instead of .tsx.

This file contains no JSX—rename to uploadFile.ts for consistency.

---

13-22: Check HTTP status before parsing JSON to handle server errors gracefully.

If the server returns a non-2xx status with a non-JSON body, res.json() will throw before reaching your json.success check, producing an unclear error message.

     const res = await fetch("/api/upload", {
       method: "POST",
       body: data,
     });

+    if (!res.ok) {
+      throw new Error(`Upload request failed with status ${res.status}`);
+    }
+
     const json = await res.json();

     if (!json.success) {
       throw new Error(json.error || "Upload failed");
     }

lib/arweave/arweave.ts (1)

9-11: Consider using a type predicate for better type narrowing.

Returning url is ArweaveURL instead of boolean would allow TypeScript to narrow the type when used in conditionals.

-export function isArweaveURL(url: string | null | undefined): boolean {
-  return url && typeof url === "string" ? url.startsWith("ar://") : false;
+export function isArweaveURL(url: string | null | undefined): url is ArweaveURL {
+  return typeof url === "string" && url.startsWith("ar://");
 }

lib/arweave/uploadToArweave.ts (2)

34-46: Consider validating input parameters.

The function doesn't validate that base64Data is non-empty or that mimeType is a valid MIME type. Invalid inputs would result in an Arweave transaction with empty or malformed data.

 const uploadToArweave = async (
   imageData: { base64Data: string; mimeType: string },
   getProgress: (progress: number) => void = () => {},
 ): Promise<Transaction> => {
+  if (!imageData.base64Data) {
+    throw new Error("base64Data is required");
+  }
+  if (!imageData.mimeType) {
+    throw new Error("mimeType is required");
+  }
+
   const buffer = Buffer.from(imageData.base64Data, "base64");

---

50-56: No retry logic for chunk uploads.

Network interruptions during chunked uploads could cause the entire upload to fail. Consider adding retry logic with exponential backoff for transient failures.

lib/arweave/gateway.ts (1)

14-17: Add validation before URL replacement.

The function performs string replacement without verifying the input is actually an Arweave URL. If a non-Arweave URL is passed, it returns the input unchanged (or with an unintended mid-string replacement).

Consider adding validation:

 export function arweaveGatewayUrl(normalizedArweaveUrl: string | null) {
   if (!normalizedArweaveUrl || typeof normalizedArweaveUrl !== "string") return null;
+  if (!isArweaveURL(normalizedArweaveUrl)) return null;
   return normalizedArweaveUrl.replace("ar://", `${ARWEAVE_GATEWAY}/`);
 }

This ensures the function only processes valid Arweave URLs and returns null for invalid inputs, making the behavior more predictable.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 23eeef7 and 236592c.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (7)

• app/api/image/generate/route.ts (3 hunks)
• lib/arweave/arweave.ts (1 hunks)
• lib/arweave/gateway.ts (1 hunks)
• lib/arweave/ipfs.ts (1 hunks)
• lib/arweave/uploadFile.tsx (1 hunks)
• lib/arweave/uploadToArweave.ts (1 hunks)
• package.json (1 hunks)

🧰 Additional context used

🧬 Code graph analysis (2)

lib/arweave/gateway.ts (2)

lib/arweave/ipfs.ts (2)

• normalizeIPFSUrl (30-60)
• isNormalizeableIPFSUrl (107-109)

lib/arweave/arweave.ts (1)

• isArweaveURL (9-11)

app/api/image/generate/route.ts (1)

lib/arweave/gateway.ts (1)

• getFetchableUrl (40-65)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Vercel Agent Review

🔇 Additional comments (6)

app/api/image/generate/route.ts (1)

41-44: Arweave upload failure will propagate as a generic error.

If uploadToArweave fails, the error is caught by the outer try-catch and returns a 500 with the error message. Consider whether a partial success response (image generated but upload failed) would be more appropriate, or add explicit handling to distinguish Arweave failures.

lib/arweave/uploadToArweave.ts (1)

5-11: Module-level throw will crash the app at startup if ARWEAVE_KEY is missing.

This validation runs when the module is first imported, which means the entire application will fail to start if ARWEAVE_KEY is not set—even for endpoints that don't use Arweave. Consider lazy initialization or handling this more gracefully if Arweave is optional.

If Arweave integration is mandatory for this service, this approach is acceptable. Otherwise, consider deferring the check:

-const rawArweaveKey = process.env.ARWEAVE_KEY;
-
-if (!rawArweaveKey) {
-  throw new Error(
-    "ARWEAVE_KEY environment variable is missing. Please set it to a base64-encoded JSON key.",
-  );
-}
+const getArweaveKey = (): JWKInterface => {
+  const rawArweaveKey = process.env.ARWEAVE_KEY;
+  if (!rawArweaveKey) {
+    throw new Error(
+      "ARWEAVE_KEY environment variable is missing. Please set it to a base64-encoded JSON key.",
+    );
+  }
+  try {
+    const decodedKey = Buffer.from(rawArweaveKey, "base64").toString();
+    return JSON.parse(decodedKey) as JWKInterface;
+  } catch (error) {
+    throw new Error(
+      `Failed to decode ARWEAVE_KEY. Ensure it is base64-encoded JSON. ${
+        error instanceof Error ? error.message : error
+      }`,
+    );
+  }
+};

package.json (1)

21-22: Dependency versions are current and secure.

The arweave@1.15.7 and multiformats@13.4.1 packages specified in the PR are both confirmed as the latest stable versions with no known security vulnerabilities. The caret version constraints (^1.15.7 and ^13.4.1) follow standard npm practices and appropriately allow minor and patch updates while protecting against breaking changes.

lib/arweave/gateway.ts (2)

25-32: LGTM!

The function correctly leverages normalizeIPFSUrl for input validation and normalization before converting to a gateway URL. The null-handling is appropriate.

---

40-65: LGTM!

The function provides a well-structured security-conscious URL resolver:

• Blocks insecure http:// URLs (Line 44)
• Properly routes IPFS and Arweave URLs to their respective gateway converters
• Handles already-fetchable URLs (https/data/blob) appropriately
• Returns null for unrecognized formats

The ordering of checks is correct, ensuring protocol-specific handling occurs before the generic https fallthrough.

lib/arweave/ipfs.ts (1)

30-60: I'll help you verify the review comment about the CID extraction robustness in the normalizeIPFSUrl function. Let me start by examining the actual implementation and looking for test cases.
<function_calls>

#!/bin/bash

First, let's locate and read the IPFS file to see the actual implementation

fd ipfs.ts --type f


</function_calls>

Now let me read the file to see the complete function:
<function_calls>

#!/bin/bash

Read the IPFS file to see the full context

cat -n lib/arweave/ipfs.ts | head -100


</function_calls>

Let me search for test files related to this function:
<function_calls>

#!/bin/bash

Search for test files that might contain tests for normalizeIPFSUrl

fd -e test.ts -e spec.ts -e test.js -e spec.js | head -20


</function_calls>

Let me search more broadly for any test coverage:
<function_calls>

#!/bin/bash

Search for normalizeIPFSUrl mentions in the codebase

rg -n "normalizeIPFSUrl" --type ts


</function_calls>

<function_calls>

#!/bin/bash

Look for test directories

find . -type d -name "test" -o -type d -name "spec" | grep -v node_modules | head -20


</function_calls>

<function_calls>

#!/bin/bash

Check the full ipfs.ts file to understand the functions better

wc -l lib/arweave/ipfs.ts


</function_calls>

<function_calls>

#!/bin/bash

Read the complete ipfs.ts file

cat lib/arweave/ipfs.ts


</function_calls>

[coderabbitai]

Actionable comments posted: 4

🧹 Nitpick comments (1)

lib/arweave/isNormalizedIPFSURL.ts (1)

7-9: Normalized IPFS URL check looks good; can be simplified

Behavior (non‑empty string starting with ipfs://) is correct and matches the intended “normalized IPFS URL” concept. For readability you could collapse the ternary to a simple boolean expression:

export function isNormalizedIPFSURL(url: string | null | undefined): boolean {
  return typeof url === "string" && url.startsWith("ipfs://");
}

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between db730d1 and 3ee5e58.

📒 Files selected for processing (8)

• lib/arweave/getFetchableUrl.ts (1 hunks)
• lib/arweave/ipfsGatewayUrl.ts (1 hunks)
• lib/arweave/isCID.ts (1 hunks)
• lib/arweave/isGatewayIPFSUrl.ts (1 hunks)
• lib/arweave/isIPFSUrl.ts (1 hunks)
• lib/arweave/isNormalizeableIPFSUrl.ts (1 hunks)
• lib/arweave/isNormalizedIPFSURL.ts (1 hunks)
• lib/arweave/normalizeIPFSUrl.ts (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (2)

• lib/arweave/getFetchableUrl.ts
• lib/arweave/ipfsGatewayUrl.ts

🧰 Additional context used

🧬 Code graph analysis (4)

lib/arweave/isNormalizeableIPFSUrl.ts (2)

lib/arweave/isIPFSUrl.ts (1)

• isIPFSUrl (10-12)

lib/arweave/isCID.ts (1)

• isCID (9-20)

lib/arweave/isIPFSUrl.ts (2)

lib/arweave/isNormalizedIPFSURL.ts (1)

• isNormalizedIPFSURL (7-9)

lib/arweave/isGatewayIPFSUrl.ts (1)

• isGatewayIPFSUrl (9-20)

lib/arweave/normalizeIPFSUrl.ts (4)

lib/arweave/isNormalizedIPFSURL.ts (1)

• isNormalizedIPFSURL (7-9)

lib/arweave/isCID.ts (1)

• isCID (9-20)

lib/arweave/isIPFSUrl.ts (1)

• isIPFSUrl (10-12)

lib/arweave/isGatewayIPFSUrl.ts (1)

• isGatewayIPFSUrl (9-20)

lib/arweave/isGatewayIPFSUrl.ts (1)

lib/arweave/isNormalizedIPFSURL.ts (1)

• isNormalizedIPFSURL (7-9)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Vercel Agent Review

🔇 Additional comments (1)

lib/arweave/isIPFSUrl.ts (1)

10-12: IPFS URL composition via helpers looks correct

isIPFSUrl cleanly delegates to isNormalizedIPFSURL and isGatewayIPFSUrl and correctly treats falsy/empty values as non‑IPFS. No issues from my side here.