@1agh/maude 1.0.9 → 1.2.0

package/apps/studio/generation/elevenlabs.test.ts

@@ -1,223 +0,0 @@
-// generation/elevenlabs.test.ts — the ElevenLabs adapter proven per-capability
-// against stubbed HTTP (no real key, no network). Audio verbs yield audio bytes;
-// Scribe yields an SRT built from word timings.
-
-import { afterEach, describe, expect, test } from 'bun:test';
-
-import { createElevenLabsAdapter, parseHistory } from './adapters/elevenlabs.ts';
-import { createAdapter, providersForModality } from './registry.ts';
-import type { AdapterContext, GenRequest } from './types.ts';
-
-const realFetch = globalThis.fetch;
-afterEach(() => {
-  globalThis.fetch = realFetch;
-});
-
-function ctxWith(overrides: Partial<AdapterContext> = {}): AdapterContext {
-  return {
-    apiKey: 'sk-eleven-test',
-    localize: async () => 'assets/stub.mp3',
-    ...overrides,
-  };
-}
-
-/** Capture the last request + return a canned response. */
-function stub(makeRes: () => Response): { calls: Array<{ url: string; init: RequestInit }> } {
-  const calls: Array<{ url: string; init: RequestInit }> = [];
-  globalThis.fetch = (async (url: string, init: RequestInit) => {
-    calls.push({ url: String(url), init });
-    return makeRes();
-  }) as typeof fetch;
-  return { calls };
-}
-
-const MP3 = new Uint8Array([0xff, 0xfb, 0x90, 0x00, 1, 2, 3, 4]); // MP3 frame-sync-ish
-function audioRes(): Response {
-  return new Response(MP3, { status: 200, headers: { 'content-type': 'audio/mpeg' } });
-}
-
-async function firstAsset(adapter: ReturnType<typeof createElevenLabsAdapter>, req: GenRequest) {
-  const job = await adapter.submit(req);
-  const res = await job.result();
-  return { job, res };
-}
-
-describe('elevenlabs audio', () => {
-  test('music POSTs /v1/music and yields audio bytes', async () => {
-    const { calls } = stub(audioRes);
-    const { job, res } = await firstAsset(createElevenLabsAdapter(ctxWith()), {
-      modality: 'audio',
-      provider: 'elevenlabs',
-      prompt: 'a warm lo-fi loop',
-    });
-    expect(job.status()).toBe('done');
-    expect(calls[0].url).toContain('/v1/music');
-    expect(res.assets[0].kind).toBe('audio');
-    expect(res.assets[0].bytes?.byteLength).toBe(MP3.byteLength);
-    // The key rides the header only, never the URL.
-    expect(String(calls[0].init.headers['xi-api-key'])).toBe('sk-eleven-test');
-    expect(calls[0].url).not.toContain('sk-eleven-test');
-  });
-
-  test('sfx POSTs /v1/sound-generation with a duration', async () => {
-    const { calls } = stub(audioRes);
-    await firstAsset(createElevenLabsAdapter(ctxWith()), {
-      modality: 'audio',
-      provider: 'elevenlabs',
-      prompt: 'glass shatter',
-      params: { audioKind: 'sfx', durationSeconds: 2 },
-    });
-    expect(calls[0].url).toContain('/v1/sound-generation');
-    expect(JSON.parse(String(calls[0].init.body)).duration_seconds).toBe(2);
-  });
-
-  test('tts POSTs /v1/text-to-speech/{voice} and requires a voice_id', async () => {
-    const { calls } = stub(audioRes);
-    await firstAsset(createElevenLabsAdapter(ctxWith()), {
-      modality: 'audio',
-      provider: 'elevenlabs',
-      prompt: 'Welcome to Maude',
-      params: { audioKind: 'tts', voice_id: 'Rachel' },
-    });
-    expect(calls[0].url).toContain('/v1/text-to-speech/Rachel');
-
-    const noVoice = createElevenLabsAdapter(ctxWith());
-    const job = await noVoice.submit({
-      modality: 'audio',
-      provider: 'elevenlabs',
-      prompt: 'x',
-      params: { audioKind: 'tts' },
-    });
-    await expect(job.result()).rejects.toThrow(/voice_id/);
-  });
-
-  test('a missing key fails fast without a network call', async () => {
-    let called = false;
-    globalThis.fetch = (async () => {
-      called = true;
-      return audioRes();
-    }) as typeof fetch;
-    const job = await createElevenLabsAdapter(ctxWith({ apiKey: null })).submit({
-      modality: 'audio',
-      provider: 'elevenlabs',
-      prompt: 'x',
-    });
-    await expect(job.result()).rejects.toThrow(/no ElevenLabs key/);
-    expect(called).toBe(false);
-  });
-
-  test('an HTTP error surfaces the provider detail, never the key', async () => {
-    stub(
-      () =>
-        new Response(JSON.stringify({ detail: { message: 'quota exceeded' } }), {
-          status: 429,
-          headers: { 'content-type': 'application/json' },
-        })
-    );
-    const job = await createElevenLabsAdapter(ctxWith()).submit({
-      modality: 'audio',
-      provider: 'elevenlabs',
-      prompt: 'x',
-    });
-    await expect(job.result()).rejects.toThrow(/quota exceeded/);
-  });
-});
-
-describe('elevenlabs scribe (transcription)', () => {
-  test('word timings become an SRT text asset', async () => {
-    stub(
-      () =>
-        new Response(
-          JSON.stringify({
-            text: 'Hello there.',
-            words: [
-              { text: 'Hello', start: 0, end: 0.4, type: 'word' },
-              { text: ' ', start: 0.4, end: 0.4, type: 'spacing' },
-              { text: 'there.', start: 0.4, end: 0.8, type: 'word' },
-            ],
-          }),
-          { status: 200, headers: { 'content-type': 'application/json' } }
-        )
-    );
-    const adapter = createElevenLabsAdapter(
-      ctxWith({
-        readSourceAsset: async () => ({ bytes: new Uint8Array([1, 2, 3]), mime: 'audio/mpeg' }),
-      })
-    );
-    const { res } = await firstAsset(adapter, {
-      modality: 'transcription',
-      provider: 'elevenlabs',
-      sourceAsset: 'assets/deadbeef.mp3',
-    });
-    const asset = res.assets[0];
-    expect(asset.kind).toBe('transcription');
-    expect(asset.text).toContain('00:00:00,000 --> 00:00:00,800');
-    expect(asset.text).toContain('Hello there.');
-    // The spacing token is dropped, not emitted as a word.
-    expect(asset.text).not.toContain('Hello  there');
-  });
-
-  test('transcription without a source asset fails', async () => {
-    const job = await createElevenLabsAdapter(ctxWith()).submit({
-      modality: 'transcription',
-      provider: 'elevenlabs',
-      sourceAsset: 'assets/deadbeef.mp3',
-    });
-    // no readSourceAsset wired → hard error
-    await expect(job.result()).rejects.toThrow(/source-asset access/);
-  });
-});
-
-describe('registry', () => {
-  test('elevenlabs is registered for audio + transcription', () => {
-    expect(providersForModality('audio').some((p) => p.id === 'elevenlabs')).toBe(true);
-    expect(providersForModality('transcription').some((p) => p.id === 'elevenlabs')).toBe(true);
-    const adapter = createAdapter('elevenlabs', ctxWith());
-    expect(adapter.descriptor.id).toBe('elevenlabs');
-  });
-});
-
-describe('elevenlabs history (Task 2.5 — reuse-before-you-pay)', () => {
-  test('parseHistory maps items, drops id-less, converts date_unix → ISO', () => {
-    const items = parseHistory({
-      history: [
-        { history_item_id: 'h1', text: 'warm lofi loop', voice_id: 'v1', date_unix: 1_700_000_000 },
-        { text: 'no id — dropped' },
-        { history_item_id: 'h2', text: 'sfx whoosh' },
-      ],
-    });
-    expect(items.map((i) => i.id)).toEqual(['h1', 'h2']);
-    expect(items[0].text).toBe('warm lofi loop');
-    expect(items[0].voiceId).toBe('v1');
-    expect(items[0].at).toBe(new Date(1_700_000_000 * 1000).toISOString());
-    expect(items[1].at).toBeUndefined();
-  });
-
-  test('parseHistory tolerates an empty / missing history', () => {
-    expect(parseHistory({})).toEqual([]);
-    expect(parseHistory({ history: [] })).toEqual([]);
-  });
-
-  test('listHistory GETs /v1/history with the key in the header only', async () => {
-    const { calls } = stub(
-      () =>
-        new Response(JSON.stringify({ history: [{ history_item_id: 'h1', text: 'x' }] }), {
-          status: 200,
-          headers: { 'content-type': 'application/json' },
-        })
-    );
-    const items = await createElevenLabsAdapter(ctxWith()).listHistory?.();
-    expect(items?.[0].id).toBe('h1');
-    expect(calls[0].url).toContain('/v1/history');
-    expect(String(calls[0].init.headers['xi-api-key'])).toBe('sk-eleven-test');
-    expect(calls[0].url).not.toContain('sk-eleven-test');
-  });
-
-  test('fetchHistoryAudio GETs the item audio and yields audio bytes', async () => {
-    const { calls } = stub(audioRes);
-    const asset = await createElevenLabsAdapter(ctxWith()).fetchHistoryAudio?.('h1');
-    expect(asset?.kind).toBe('audio');
-    expect(asset?.bytes?.byteLength).toBe(MP3.byteLength);
-    expect(calls[0].url).toContain('/v1/history/h1/audio');
-  });
-});

package/apps/studio/generation/gemini.test.ts

@@ -1,350 +0,0 @@
-// generation/gemini.test.ts — the Gemini adapter + download localizer proven
-// against a stubbed HTTP response (no real key, no network). A 1x1 PNG's base64
-// round-trips: adapter → GenResult.bytes → localizeGenAsset → a saveAsset call
-// that lands `assets/<sha8>.png`.
-
-import { afterEach, describe, expect, test } from 'bun:test';
-
-import { createGeminiAdapter, extractOperationName, extractVideoUri } from './adapters/gemini.ts';
-import { localizeGenAsset } from './download.ts';
-import { createAdapter, providersForModality } from './registry.ts';
-import type { AdapterContext } from './types.ts';
-
-// A real 1x1 transparent PNG (so a magic-byte sniff downstream would accept it).
-const PNG_1x1_B64 =
-  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==';
-
-const realFetch = globalThis.fetch;
-afterEach(() => {
-  globalThis.fetch = realFetch;
-});
-
-function stubFetch(body: unknown, status = 200): void {
-  globalThis.fetch = (async () =>
-    new Response(JSON.stringify(body), {
-      status,
-      headers: { 'content-type': 'application/json' },
-    })) as typeof fetch;
-}
-
-function ctxWith(overrides: Partial<AdapterContext> = {}): AdapterContext {
-  return {
-    apiKey: 'AIza-test-key',
-    localize: async () => 'assets/stub.png',
-    ...overrides,
-  };
-}
-
-describe('gemini adapter', () => {
-  test('a successful generateContent yields an already-done Job with PNG bytes', async () => {
-    stubFetch({
-      candidates: [
-        { content: { parts: [{ inlineData: { mimeType: 'image/png', data: PNG_1x1_B64 } }] } },
-      ],
-    });
-    const adapter = createGeminiAdapter(ctxWith());
-    const job = await adapter.submit({
-      modality: 'image',
-      provider: 'gemini',
-      prompt: 'a red circle',
-    });
-    const res = await job.result();
-    expect(job.status()).toBe('done');
-    expect(res.assets).toHaveLength(1);
-    expect(res.assets[0].kind).toBe('image');
-    expect(res.assets[0].bytes?.byteLength).toBeGreaterThan(0);
-  });
-
-  test('a missing key fails fast without a network call', async () => {
-    let called = false;
-    globalThis.fetch = (async () => {
-      called = true;
-      return new Response('{}');
-    }) as typeof fetch;
-    const adapter = createGeminiAdapter(ctxWith({ apiKey: null }));
-    const job = await adapter.submit({ modality: 'image', provider: 'gemini', prompt: 'x' });
-    await expect(job.result()).rejects.toThrow(/no Google Gemini key/);
-    expect(called).toBe(false);
-  });
-
-  test('an HTTP error surfaces the provider message, never the key', async () => {
-    stubFetch({ error: { message: 'quota exceeded' } }, 429);
-    const adapter = createGeminiAdapter(ctxWith());
-    const job = await adapter.submit({ modality: 'image', provider: 'gemini', prompt: 'x' });
-    await expect(job.result()).rejects.toThrow(/quota exceeded/);
-  });
-
-  test('a response with no image part is an error', async () => {
-    stubFetch({ candidates: [{ content: { parts: [{ text: 'I cannot do that' }] } }] });
-    const adapter = createGeminiAdapter(ctxWith());
-    const job = await adapter.submit({ modality: 'image', provider: 'gemini', prompt: 'x' });
-    await expect(job.result()).rejects.toThrow(/no image/);
-  });
-
-  // Task 1.2 — the maskless-edit flow reads the source asset into an inlineData
-  // part alongside the prompt (via the host-provided readSourceAsset).
-  test('an edit request sends the source image as an inlineData part', async () => {
-    let sentBody: {
-      contents?: Array<{
-        parts?: Array<{ text?: string; inlineData?: { mimeType?: string; data?: string } }>;
-      }>;
-    } | null = null;
-    globalThis.fetch = (async (_url: string, init: RequestInit) => {
-      sentBody = JSON.parse(String(init.body));
-      return new Response(
-        JSON.stringify({
-          candidates: [
-            { content: { parts: [{ inlineData: { mimeType: 'image/png', data: PNG_1x1_B64 } }] } },
-          ],
-        }),
-        { status: 200, headers: { 'content-type': 'application/json' } }
-      );
-    }) as typeof fetch;
-    const adapter = createGeminiAdapter(
-      ctxWith({
-        readSourceAsset: async () => ({
-          bytes: new Uint8Array([137, 80, 78, 71]),
-          mime: 'image/png',
-        }),
-      })
-    );
-    const job = await adapter.submit({
-      modality: 'image',
-      provider: 'gemini',
-      prompt: 'make the sky purple',
-      sourceAsset: 'assets/deadbeef.png',
-    });
-    await job.result();
-    const parts = sentBody?.contents?.[0]?.parts ?? [];
-    // Source image FIRST, then the instruction text (Gemini's edit order).
-    expect(parts[0]?.inlineData?.mimeType).toBe('image/png');
-    expect(typeof parts[0]?.inlineData?.data).toBe('string');
-    expect(parts[1]?.text).toBe('make the sky purple');
-  });
-
-  test('an edit request with no source-asset reader fails fast', async () => {
-    let called = false;
-    globalThis.fetch = (async () => {
-      called = true;
-      return new Response('{}');
-    }) as typeof fetch;
-    const adapter = createGeminiAdapter(ctxWith()); // no readSourceAsset
-    const job = await adapter.submit({
-      modality: 'image',
-      provider: 'gemini',
-      prompt: 'edit',
-      sourceAsset: 'assets/deadbeef.png',
-    });
-    await expect(job.result()).rejects.toThrow(/source-asset access/);
-    expect(called).toBe(false);
-  });
-
-  test('an edit whose source is not an image is rejected', async () => {
-    const adapter = createGeminiAdapter(
-      ctxWith({
-        readSourceAsset: async () => ({ bytes: new Uint8Array([0, 0, 0]), mime: 'video/mp4' }),
-      })
-    );
-    const job = await adapter.submit({
-      modality: 'image',
-      provider: 'gemini',
-      prompt: 'edit',
-      sourceAsset: 'assets/deadbeef.mp4',
-    });
-    await expect(job.result()).rejects.toThrow(/not an image/);
-  });
-
-  // security fan-out F2 — an env-poisoned non-default base is refused before the
-  // key-bearing request (unless MAUDE_GEN_ALLOW_CUSTOM_BASE is opted in).
-  test('a non-allowlisted MAUDE_GEMINI_API_BASE is refused without touching the network', async () => {
-    const prevBase = process.env.MAUDE_GEMINI_API_BASE;
-    const prevAllow = process.env.MAUDE_GEN_ALLOW_CUSTOM_BASE;
-    process.env.MAUDE_GEMINI_API_BASE = 'https://evil.example.com/v1beta';
-    delete process.env.MAUDE_GEN_ALLOW_CUSTOM_BASE;
-    // Re-import the module so the module-level base constant re-reads the env.
-    const mod = await import(`./adapters/gemini.ts?evilbase=${Date.now()}`);
-    let called = false;
-    globalThis.fetch = (async () => {
-      called = true;
-      return new Response('{}');
-    }) as typeof fetch;
-    try {
-      const adapter = mod.createGeminiAdapter(ctxWith());
-      const job = await adapter.submit({ modality: 'image', provider: 'gemini', prompt: 'x' });
-      await expect(job.result()).rejects.toThrow(/not allowlisted/);
-      expect(called).toBe(false);
-    } finally {
-      if (prevBase === undefined) delete process.env.MAUDE_GEMINI_API_BASE;
-      else process.env.MAUDE_GEMINI_API_BASE = prevBase;
-      if (prevAllow === undefined) delete process.env.MAUDE_GEN_ALLOW_CUSTOM_BASE;
-      else process.env.MAUDE_GEN_ALLOW_CUSTOM_BASE = prevAllow;
-    }
-  });
-
-  // security fan-out F1 — an oversized provider response is rejected before it
-  // is fully materialized + base64-decoded in RAM (OOM guard).
-  test('an over-cap response body is rejected (RAM DoS guard)', async () => {
-    const prev = process.env.MAUDE_GEMINI_MAX_RESPONSE_BYTES;
-    // The cap has a 1 MB floor, so drive the test with a >1 MB body at the floor.
-    process.env.MAUDE_GEMINI_MAX_RESPONSE_BYTES = String(1024 * 1024);
-    const mod = await import(`./adapters/gemini.ts?cap=${Date.now()}`);
-    globalThis.fetch = (async () =>
-      new Response('x'.repeat(2 * 1024 * 1024), {
-        status: 200,
-        headers: { 'content-type': 'application/json' },
-      })) as typeof fetch;
-    try {
-      const adapter = mod.createGeminiAdapter(ctxWith());
-      const job = await adapter.submit({ modality: 'image', provider: 'gemini', prompt: 'x' });
-      await expect(job.result()).rejects.toThrow(/too large|exceeded/);
-    } finally {
-      if (prev === undefined) delete process.env.MAUDE_GEMINI_MAX_RESPONSE_BYTES;
-      else process.env.MAUDE_GEMINI_MAX_RESPONSE_BYTES = prev;
-    }
-  });
-});
-
-describe('download localizer', () => {
-  test('inline bytes land via saveAsset and return the rel path', async () => {
-    const saved: Uint8Array[] = [];
-    const rel = await localizeGenAsset(
-      { kind: 'image', mime: 'image/png', bytes: new Uint8Array([137, 80, 78, 71]) },
-      {
-        saveAsset: async (bytes) => {
-          saved.push(bytes);
-          return { ok: true, path: 'assets/deadbeef.png' };
-        },
-      }
-    );
-    expect(rel).toBe('assets/deadbeef.png');
-    expect(saved).toHaveLength(1);
-  });
-
-  test('a rejected save throws', async () => {
-    await expect(
-      localizeGenAsset(
-        { kind: 'image', mime: 'image/png', bytes: new Uint8Array([1]) },
-        { saveAsset: async () => ({ ok: false, error: 'not an image' }) }
-      )
-    ).rejects.toThrow(/rejected on save/);
-  });
-
-  test('a URL result fails loud in Phase 0 (no unhardened egress)', async () => {
-    await expect(
-      localizeGenAsset(
-        { kind: 'image', mime: 'image/png', url: 'https://cdn.example/x.png' },
-        { saveAsset: async () => ({ ok: true, path: 'assets/x.png' }) }
-      )
-    ).rejects.toThrow(/Phase 1/);
-  });
-});
-
-describe('registry', () => {
-  test('gemini is registered for image and instantiable', () => {
-    expect(providersForModality('image').some((p) => p.id === 'gemini')).toBe(true);
-    const adapter = createAdapter('gemini', ctxWith());
-    expect(adapter.descriptor.id).toBe('gemini');
-  });
-
-  test('an unknown provider throws', () => {
-    expect(() => createAdapter('nope', ctxWith())).toThrow(/unknown provider/);
-  });
-});
-
-describe('veo video (Task 3.1 — async operation lifecycle)', () => {
-  // A minimal MP4 (ftyp box) so a magic-byte sniff downstream would accept it.
-  const MP4 = new Uint8Array([
-    0x00, 0x00, 0x00, 0x18, 0x66, 0x74, 0x79, 0x70, 0x6d, 0x70, 0x34, 0x32, 0, 0, 0, 0, 0x6d, 0x70,
-    0x34, 0x32, 0x69, 0x73, 0x6f, 0x6d,
-  ]);
-
-  test('extractOperationName reads the start-response name', () => {
-    expect(extractOperationName({ name: 'operations/abc' })).toBe('operations/abc');
-    expect(extractOperationName({})).toBeNull();
-  });
-
-  test('extractVideoUri walks nested shapes for the first https uri', () => {
-    expect(
-      extractVideoUri({
-        response: {
-          generateVideoResponse: {
-            generatedSamples: [{ video: { uri: 'https://generativelanguage.googleapis.com/v/1' } }],
-          },
-        },
-      })
-    ).toBe('https://generativelanguage.googleapis.com/v/1');
-    expect(
-      extractVideoUri({
-        response: {
-          generatedVideos: [
-            { video: { fileUri: 'https://generativelanguage.googleapis.com/v/2' } },
-          ],
-        },
-      })
-    ).toBe('https://generativelanguage.googleapis.com/v/2');
-    expect(extractVideoUri({ response: {} })).toBeNull();
-  });
-
-  test('submit(video) drives start → poll(done) → download and yields MP4 bytes', async () => {
-    process.env.MAUDE_VEO_POLL_INTERVAL_MS = '1';
-    const calls: string[] = [];
-    globalThis.fetch = (async (url: string) => {
-      calls.push(String(url));
-      if (String(url).includes(':predictLongRunning'))
-        return new Response(JSON.stringify({ name: 'operations/xyz' }), {
-          status: 200,
-          headers: { 'content-type': 'application/json' },
-        });
-      if (String(url).includes('operations/xyz'))
-        return new Response(
-          JSON.stringify({
-            done: true,
-            response: {
-              generatedSamples: [
-                {
-                  video: {
-                    uri: 'https://generativelanguage.googleapis.com/v1beta/files/x:download',
-                  },
-                },
-              ],
-            },
-          }),
-          { status: 200, headers: { 'content-type': 'application/json' } }
-        );
-      // the video download
-      return new Response(MP4, { status: 200, headers: { 'content-type': 'video/mp4' } });
-    }) as typeof fetch;
-
-    const adapter = createGeminiAdapter(ctxWith());
-    const job = await adapter.submit({ modality: 'video', provider: 'gemini', prompt: 'a wave' });
-    const res = await job.result();
-    delete process.env.MAUDE_VEO_POLL_INTERVAL_MS;
-    expect(res.assets[0].kind).toBe('video');
-    expect(res.assets[0].bytes?.byteLength).toBe(MP4.byteLength);
-    expect(calls.some((u) => u.includes(':predictLongRunning'))).toBe(true);
-    expect(calls.some((u) => u.includes('operations/xyz'))).toBe(true);
-  });
-
-  test('a video URI off the Google host is rejected (no key exfil)', async () => {
-    process.env.MAUDE_VEO_POLL_INTERVAL_MS = '1';
-    globalThis.fetch = (async (url: string) => {
-      if (String(url).includes(':predictLongRunning'))
-        return new Response(JSON.stringify({ name: 'operations/xyz' }), { status: 200 });
-      return new Response(
-        JSON.stringify({ done: true, response: { video: { uri: 'https://evil.example/v.mp4' } } }),
-        { status: 200 }
-      );
-    }) as typeof fetch;
-    const job = await createGeminiAdapter(ctxWith()).submit({
-      modality: 'video',
-      provider: 'gemini',
-      prompt: 'x',
-    });
-    await expect(job.result()).rejects.toThrow(/host not allowlisted/);
-    delete process.env.MAUDE_VEO_POLL_INTERVAL_MS;
-  });
-
-  test('gemini is now registered for the video modality', () => {
-    expect(providersForModality('video').some((p) => p.id === 'gemini')).toBe(true);
-  });
-});