app.py

import gradio as gr

# Pure-frontend workflow. The canvas's `space` operator calls
# akhaliq/Z-Image-Turbo's /generate_image via gradio_client's call_space
# server function, forwarding the visitor's HF OAuth token. That proxy
# identity flows into the backend @spaces.GPU, where ZeroGPU budgets the
# call against the visitor's / PRO account.
#
# This Space is a test mirror of mrfakename PR #92. The akhaliq/Z-Image-Turbo
# backend is restored to the pre-workflow gr.Blocks shape at commit b7132b8.


demo = gr.Workflow(graph="workflow.json")

# gr.Workflow exposes each subject (output) node as a public REST endpoint
# (e.g. /output_image, /seed_used), registered internally via .click(api_name=…)
# with no api_visibility, so they default to "public" — callable by any
# gradio_client and listed on the API docs page. The Workflow constructor
# itself takes no api_visibility flag, so we flip the registered BlockFunctions
# to "private" here: hidden from API docs AND not callable by clients. This
# only affects the external REST surface; the canvas UI is unaffected because
# its Run button drives the backend Space directly via Client(...) and the
# canvas plumbing functions aren't .click()-registered fns.
#
# api_names are slugified from each subject group's first label (see
# gradio.workflow_api._slugify): "Output Image" -> "output_image",
# "Seed Used" -> "seed_used" (no leading slash on the stored attribute).
for _fn in demo.fns.values():
    if getattr(_fn, "api_name", None) in {"output_image", "seed_used"}:
        _fn.api_visibility = "private"

if __name__ == "__main__":
    demo.launch()