@bonginkan/maria 4.3.46 → 4.4.1

package/dist/server/express-server.cjs

@@ -6854,6 +6854,65 @@ var init_image_post = __esm({
   "src/services/media-orchestrator/image-post.ts"() {
   }
 });
+
+// src/services/routing/model-routing.ts
+var model_routing_exports = {};
+__export(model_routing_exports, {
+  determineRouting: () => determineRouting,
+  providerFromModel: () => providerFromModel
+});
+function providerFromModel(model) {
+  const m2 = (model || "").toLowerCase();
+  if (!m2) return void 0;
+  if (m2.startsWith("gemini") || m2.startsWith("veo")) return "google";
+  if (m2.startsWith("gpt") || m2.startsWith("sora")) return "openai";
+  return void 0;
+}
+function determineRouting(input) {
+  const requestedProvider = normalizeProvider(input.requestedProvider);
+  const requestedModel = input.requestedModel?.trim();
+  const isPro = !!input.isProOrAbove;
+  if (requestedModel && requestedModel.length > 0) {
+    const p = providerFromModel(requestedModel);
+    if (!p) return { error: "unknown_model", message: `Unknown model family for '${requestedModel}'` };
+    if (p === "google" && !input.hasGeminiKey) return { error: "missing_key", message: `Requested model '${requestedModel}' requires Google API key` };
+    if (p === "openai" && !input.hasOpenAIKey) return { error: "missing_key", message: `Requested model '${requestedModel}' requires OpenAI API key` };
+    return { provider: p, model: requestedModel };
+  }
+  if (requestedProvider) {
+    if (requestedProvider === "google") {
+      if (!input.hasGeminiKey) return { error: "missing_key", message: "Google API key is not configured" };
+      return { provider: "google", model: "gemini-2.5-flash" };
+    }
+    if (requestedProvider === "openai") {
+      if (!input.hasOpenAIKey) return { error: "missing_key", message: "OpenAI API key is not configured" };
+      return { provider: "openai", model: isPro ? "gpt-5" : "gpt-5-mini" };
+    }
+  }
+  if ((input.taskType || "").toLowerCase() === "research") {
+    if (!input.hasGeminiKey) return { error: "missing_key", message: "Google API key is required for research task" };
+    return { provider: "google", model: "gemini-2.5-flash" };
+  }
+  if (isPro && input.hasOpenAIKey) {
+    return { provider: "openai", model: "gpt-5" };
+  }
+  if (input.hasGeminiKey) {
+    return { provider: "google", model: "gemini-2.5-flash" };
+  }
+  if (input.hasOpenAIKey) {
+    return { provider: "openai", model: "gpt-5-mini" };
+  }
+  return { error: "no_provider_available", message: "No valid provider API key configured" };
+}
+function normalizeProvider(p) {
+  const s2 = (p || "").toLowerCase().trim();
+  if (s2 === "google" || s2 === "openai") return s2;
+  return void 0;
+}
+var init_model_routing = __esm({
+  "src/services/routing/model-routing.ts"() {
+  }
+});
 var rateLimitStore = /* @__PURE__ */ new Map();
 var RATE_LIMITS = {
   "/image:FREE": { windowMs: 3e3, requests: 1 },
@@ -7219,7 +7278,7 @@ var GeminiMediaProvider = class {
     const fps = typeof req?.fps === "number" ? req.fps : "n/a";
     const duration = typeof req?.duration === "number" ? req.duration : "n/a";
     throw new Error(
-      `GeminiMediaProvider.generateVideoFrames is not supported locally. Use server /api/v1/video (veo-3.0-generate-001). requested_fps=${fps}; requested_duration=${duration}`
+      `GeminiMediaProvider.generateVideoFrames is not supported locally. Use server /api/v1/video (veo-3.1-generate-preview). requested_fps=${fps}; requested_duration=${duration}`
     );
   }
 };
@@ -9447,7 +9506,7 @@ app.get("/api/status", (req, res) => {
 app.get("/", (req, res) => {
   res.json({
     name: "MARIA CODE API",
-    version: "4.3.46",
+    version: "4.4.1",
     status: "running",
     environment: process.env.NODE_ENV || "development",
     endpoints: {
@@ -9931,7 +9990,8 @@ app.post("/api/v1/image", rateLimitMiddleware, async (req, res) => {
       mime: format === "jpg" ? "image/jpeg" : `image/${format}`,
       bytesBase64: b.toString("base64")
     }));
-    return res.json({ success: true, data: { url: saved.manifestPath, files: saved.files, filesInline, jobId: manifest.trace } });
+    const publicUrl = saved.manifestPath.startsWith("/") ? saved.manifestPath : `/${saved.manifestPath}`;
+    return res.json({ success: true, data: { url: publicUrl, files: saved.files, filesInline, jobId: manifest.trace } });
   } catch (error) {
     console.error("[Image API] Error:", error);
     const mapped = classifyMediaError(error);
@@ -9943,7 +10003,7 @@ app.post("/api/v1/video", rateLimitMiddleware, async (req, res) => {
     await loadProviderKeys();
     const auth = req.headers.authorization;
     if (!auth || !auth.startsWith("Bearer ")) return res.status(401).json({ error: "unauthorized", message: "Login required", hint: "Sign in and retry" });
-    const { prompt, duration = 8, fps = 24, res: resStr = "1280x720", aspect: aspectStr, format = "mp4", model, seed } = req.body || {};
+    const { prompt, duration = 8, fps = 24, res: resStr = "1280x720", aspect: aspectStr, format = "mp4", model, seed, provider: reqProvider } = req.body || {};
     if (!prompt) return res.status(400).json({ error: "bad_request", message: "prompt required" });
     let w, h2;
     const aspect = typeof aspectStr === "string" && (aspectStr === "16:9" || aspectStr === "9:16") ? aspectStr : void 0;
@@ -9971,15 +10031,108 @@ app.post("/api/v1/video", rateLimitMiddleware, async (req, res) => {
     } else {
       return res.status(400).json({ error: "bad_request", message: "res must be WxH or 720|1080" });
     }
+    const vidToken = auth.substring("Bearer ".length).trim();
+    const vidDecoded = await decodeFirebaseToken(vidToken).catch(() => null);
+    const vidUid = vidDecoded?.uid || vidDecoded?.sub || "current";
+    let isProOrAbove = false;
+    try {
+      const { planId: _pid } = await getUserPlanAndLimits(vidUid);
+      const p = String(_pid || "free").toLowerCase();
+      isProOrAbove = ["pro", "pro-annual", "ultra", "ultra-annual", "enterprise"].includes(p);
+    } catch {
+    }
+    const requestedProvider = typeof reqProvider === "string" ? reqProvider.toLowerCase() : void 0;
+    const requestedModel = typeof model === "string" ? String(model).trim().toLowerCase() : void 0;
+    const providerFromModel2 = (() => {
+      if (!requestedModel) return void 0;
+      if (requestedModel.startsWith("sora")) return "openai";
+      if (requestedModel.startsWith("veo") || requestedModel.startsWith("gemini")) return "google";
+      return void 0;
+    })();
+    const openaiKey = process.env.OPENAI_API_KEY;
+    const goOpenAI = providerFromModel2 === "openai" || requestedProvider === "openai" || !providerFromModel2 && !requestedProvider && (isProOrAbove && !!openaiKey);
+    if (goOpenAI && openaiKey) {
+      const OpenAI2 = (await import('openai')).default;
+      const client = new OpenAI2({ apiKey: openaiKey });
+      const soraModel = requestedModel && requestedModel.startsWith("sora") ? requestedModel : "sora-2";
+      const secondsStr = (() => {
+        const d = Number(duration) || 8;
+        if (d <= 4) return "4";
+        if (d <= 8) return "8";
+        return "12";
+      })();
+      const size = `${w}x${h2}`;
+      const startedMs2 = Date.now();
+      let job;
+      try {
+        job = await client.videos.create({ model: soraModel, prompt: String(prompt), seconds: secondsStr, size });
+      } catch (e2) {
+        try {
+          console.warn("[Video API][Sora] videos.create failed:", e2?.message || String(e2));
+        } catch {
+        }
+        throw e2;
+      }
+      let safetyDeadline = Date.now() + 72e4;
+      while (job && (job.status === "queued" || job.status === "in_progress")) {
+        if (Date.now() > safetyDeadline) return res.status(504).json({ error: "timeout", message: "video generation timed out" });
+        await new Promise((r2) => setTimeout(r2, 8e3));
+        job = await client.videos.retrieve(job.id);
+      }
+      if (!job || job.status !== "completed") {
+        return res.status(500).json({ error: "internal_error", message: `video generation failed: ${job?.status || "unknown"}` });
+      }
+      const downloadWithBackoff = async () => {
+        let delay = 2e3;
+        for (let i2 = 0; i2 < 6; i2++) {
+          try {
+            const content = await client.videos.downloadContent(job.id);
+            const ab = await content.arrayBuffer();
+            return Buffer.from(ab);
+          } catch (e2) {
+            if (i2 === 5) throw e2;
+            await new Promise((r2) => setTimeout(r2, delay));
+            delay = Math.min(15e3, Math.floor(delay * 1.8));
+          }
+        }
+        throw new Error("download failed after retries");
+      };
+      const videoBytes2 = await downloadWithBackoff();
+      const outExt2 = ".mp4";
+      const traceId2 = Math.random().toString(36).slice(2, 8).toUpperCase();
+      const promptHash2 = hashPrompt(prompt);
+      const manifest2 = {
+        kind: "video",
+        request: { promptHash: promptHash2, seed, params: { size: [w, h2], fps: Number(fps) || 24, duration: Number(secondsStr), format: "mp4" }, model: soraModel, provider: "openai" },
+        artifacts: [],
+        metrics: { durationMs: Date.now() - startedMs2, retries: 0, fallbacks: 0 },
+        trace: traceId2
+      };
+      const baseDir2 = path__namespace.default.join("artifacts", "media", "videos", traceId2);
+      const saved2 = await saveArtifacts({ root: process.cwd(), kind: "video", baseDir: baseDir2, flat: true, trace: traceId2 }, [{ bytes: videoBytes2, ext: outExt2, logicalName: "video" }], manifest2);
+      const idemKey2 = req.headers["idempotency-key"] || void 0;
+      await applyConsumption(vidUid, { requests: 1, video: 1 }, idemKey2);
+      jobIndex.set(String(manifest2.trace), { id: String(manifest2.trace), status: "completed", kind: "video", manifestPath: saved2.manifestPath, createdAt: (/* @__PURE__ */ new Date()).toISOString(), updatedAt: (/* @__PURE__ */ new Date()).toISOString(), uid: vidUid });
+      const publicUrl = saved2.manifestPath.startsWith("/") ? saved2.manifestPath : `/${saved2.manifestPath}`;
+      return res.json({ success: true, data: { url: publicUrl || (saved2.files[0] ? `/${saved2.files[0]}` : void 0), files: saved2.files, jobId: manifest2.trace, applied: { durationSeconds: Number(secondsStr), frameRate: Number(fps) || 24 } } });
+    }
     const { GoogleGenAI } = __require("@google/genai");
     const apiKey = process.env.GOOGLE_API_KEY || process.env.GEMINI_API_KEY;
     if (!apiKey) return res.status(503).json({ error: "provider_unavailable", message: "Provider API key is not configured", hint: "Set GOOGLE_API_KEY or GEMINI_API_KEY on the server" });
     const ai = new GoogleGenAI({ apiKey });
-    const veoModel = model && String(model).trim() || process.env.MARIA_VIDEO_MODEL || "veo-3.0-generate-001";
-    const aspectRatio = "16:9";
+    const veoModel = model && String(model).trim() || process.env.MARIA_VIDEO_MODEL || "veo-3.1-generate-preview";
+    const aspectRatio = w >= h2 ? "16:9" : "9:16";
     const startedMs = Date.now();
     const requestedDuration = Number(duration);
-    const effectiveDuration = Number.isFinite(requestedDuration) && requestedDuration === 8 ? 8 : 8;
+    const maxEdge = Math.max(w, h2);
+    const is1080 = maxEdge >= 1920;
+    const effectiveDuration = (() => {
+      if (is1080) return 8;
+      const d = Number.isFinite(requestedDuration) ? Math.floor(requestedDuration) : 8;
+      if (d <= 4) return 4;
+      if (d <= 6) return 6;
+      return 8;
+    })();
     const requestedFps = Number(fps);
     const effectiveFps = Number.isFinite(requestedFps) ? Math.min(60, Math.max(1, Math.floor(requestedFps))) : 24;
     const resolution = Math.max(w, h2) >= 1920 ? "1080p" : "720p";
@@ -9994,12 +10147,12 @@ app.post("/api/v1/video", rateLimitMiddleware, async (req, res) => {
         frameRate: effectiveFps
       }
     });
-    const deadline = Date.now() + 72e4;
+    const deadline = Date.now() + 9e5;
     while (!operation?.done) {
       if (Date.now() > deadline) {
         return res.status(504).json({ error: "timeout", message: "video generation timed out" });
       }
-      await new Promise((r2) => setTimeout(r2, 1e4));
+      await new Promise((r2) => setTimeout(r2, 12e3));
       operation = await ai.operations.getVideosOperation({ operation });
     }
     await new Promise((r2) => setTimeout(r2, 2500));
@@ -10145,7 +10298,7 @@ app.post("/api/v1/video", rateLimitMiddleware, async (req, res) => {
       return null;
     };
     let videoBytes = null;
-    const maxAttempts = 10;
+    const maxAttempts = 15;
     for (let attempt = 1; attempt <= maxAttempts; attempt++) {
       let bytes = await trySdkDownloadOnce();
       if (!bytes) bytes = await tryManualDownload();
@@ -10156,7 +10309,7 @@ app.post("/api/v1/video", rateLimitMiddleware, async (req, res) => {
           break;
         }
       }
-      await new Promise((r2) => setTimeout(r2, Math.min(8e3, 1500 * attempt)));
+      await new Promise((r2) => setTimeout(r2, Math.min(12e3, 1800 * attempt)));
     }
     if (!videoBytes) throw new Error("failed to obtain fully materialized video");
     const header = videoBytes.subarray(0, 256);
@@ -10258,6 +10411,13 @@ app.post("/api/v1/code", rateLimitMiddleware, async (req, res) => {
     const decoded = await decodeFirebaseToken(idToken).catch(() => null);
     if (!decoded) return res.status(401).json({ error: "unauthorized" });
     const uid = decoded?.uid || decoded?.sub;
+    let isProOrAbove = false;
+    try {
+      const { planId: _pid } = await getUserPlanAndLimits(uid);
+      const p = String(_pid || "free").toLowerCase();
+      isProOrAbove = ["pro", "pro-annual", "ultra", "ultra-annual", "enterprise"].includes(p);
+    } catch {
+    }
     const { prompt, language = "typescript", model = "gpt-4" } = req.body;
     if (!prompt) {
       return res.status(400).json({
@@ -10351,7 +10511,8 @@ app.post("/v1/ai-proxy", rateLimitMiddleware, async (req, res) => {
     const idemKey = req.headers["idempotency-key"] || void 0;
     if (process.env.MARIA_TELEMETRY === "1") {
       try {
-        console.log(JSON.stringify({ ev: "ai_proxy_request", taskType: taskType || "unknown", promptLen: String(effectivePrompt || research?.query || "").length }));
+        const attCount = Array.isArray((req.body?.metadata || {}).attachments) ? (req.body.metadata.attachments || []).filter(Boolean).length : 0;
+        console.log(JSON.stringify({ ev: "ai_proxy_request", taskType: taskType || "unknown", promptLen: String(effectivePrompt || research?.query || "").length, requestedProvider: reqProvider || null, requestedModel: reqModel || null, attachments: attCount }));
       } catch {
       }
     }
@@ -10383,18 +10544,40 @@ app.post("/v1/ai-proxy", rateLimitMiddleware, async (req, res) => {
     const gemKey = sanitizeKey2(keys?.googleApiKey || process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY);
     const requestedProvider = typeof reqProvider === "string" ? reqProvider.toLowerCase() : void 0;
     const requestedModel = typeof reqModel === "string" ? String(reqModel).trim() : void 0;
-    const wantsGoogle = requestedProvider === "google" || !!requestedModel && requestedModel.toLowerCase().startsWith("gemini") || !requestedProvider && !requestedModel;
-    if (gemKey && wantsGoogle) {
+    let isProOrAbove = false;
+    try {
+      const { planId: _pid } = await getUserPlanAndLimits(uid);
+      const p = String(_pid || "free").toLowerCase();
+      isProOrAbove = ["pro", "pro-annual", "ultra", "ultra-annual", "enterprise"].includes(p);
+    } catch {
+    }
+    const { determineRouting: determineRouting2 } = await Promise.resolve().then(() => (init_model_routing(), model_routing_exports));
+    const decision = determineRouting2({
+      requestedModel,
+      requestedProvider,
+      taskType,
+      isProOrAbove,
+      hasGeminiKey: !!gemKey,
+      hasOpenAIKey: !!(keys?.openaiApiKey || process.env.OPENAI_API_KEY)
+    });
+    if (decision.error) {
+      const map = { missing_key: 503, unknown_model: 400, no_provider_available: 503 };
+      const status = map[decision.error] || 400;
+      return res.status(status).json({ error: decision.error, message: decision.message });
+    }
+    const effectiveProvider = decision.provider;
+    const effectiveModel = decision.model;
+    if (effectiveProvider === "google") {
       try {
         const { GoogleGenerativeAI: GoogleGenerativeAI2 } = await import('@google/generative-ai');
         const ai = new GoogleGenerativeAI2(gemKey);
-        const modelName = requestedModel && requestedModel.length > 0 ? requestedModel : process.env.MARIA_CODE_MODEL || "gemini-2.5-flash";
-        const model2 = ai.getGenerativeModel({ model: modelName });
-        let content2 = "";
+        const modelName = effectiveModel || "gemini-2.5-flash";
+        const model = ai.getGenerativeModel({ model: modelName });
+        let content = "";
         if (taskType === "research" && research?.query) {
           const tool = { googleSearch: {} };
           const r2 = await ai.models.generateContent({ model: modelName, contents: String(research.query), config: { tools: [tool] } });
-          content2 = String(r2?.text?.() || r2?.text || r2?.response?.candidates?.[0]?.content?.parts?.[0]?.text || "");
+          content = String(r2?.text?.() || r2?.text || r2?.response?.candidates?.[0]?.content?.parts?.[0]?.text || "");
         } else {
           const attachments = Array.isArray((req.body?.metadata || {}).attachments) ? (req.body.metadata.attachments || []).filter(Boolean) : [];
           const parts = [{ text: String(effectivePrompt || "") }];
@@ -10403,93 +10586,140 @@ app.post("/v1/ai-proxy", rateLimitMiddleware, async (req, res) => {
               const b64 = String(a.data_base64 || "");
               const mime = String(a.mime || "application/octet-stream");
               if (!b64) continue;
+              if (Buffer.byteLength(b64, "base64") > 10 * 1024 * 1024) continue;
               parts.push({ inlineData: { data: b64, mimeType: mime } });
             } catch {
             }
           }
-          const resp = await model2.generateContent({ contents: [{ role: "user", parts }] });
-          content2 = resp?.response?.text?.() || resp?.response?.candidates?.[0]?.content?.parts?.[0]?.text || "";
+          const resp = await model.generateContent({ contents: [{ role: "user", parts }] });
+          content = resp?.response?.text?.() || resp?.response?.candidates?.[0]?.content?.parts?.[0]?.text || "";
         }
         if (process.env.MARIA_TELEMETRY === "1") {
           try {
-            console.log(JSON.stringify({ ev: "ai_proxy_route", vendor: "google", model: modelName, empty: !content2 }));
+            console.log(JSON.stringify({ ev: "ai_proxy_route", vendor: "google", model: modelName, empty: !content }));
           } catch {
           }
         }
-        const consumption2 = { requests: 1 };
-        if (taskType === "code" || taskType === "evaluation") consumption2.code = 1;
+        const consumption = { requests: 1 };
+        if (taskType === "code" || taskType === "evaluation") consumption.code = 1;
         try {
-          await applyConsumption(uid, consumption2, idemKey);
+          await applyConsumption(uid, consumption, idemKey);
         } catch {
         }
-        return res.json({ data: { content: content2, routedModel: { vendor: "google", family: "gemini", name: modelName, reason: taskType || "code" } } });
+        return res.json({ data: { content, routedModel: { vendor: "google", family: "gemini", name: modelName, reason: taskType || "code" } } });
       } catch (e2) {
-        console.warn("[AI Proxy] Gemini path failed, falling back to OpenAI:", e2?.message || e2);
+        const msg = e2?.message || "Google provider request failed";
         if (process.env.MARIA_TELEMETRY === "1") {
           try {
             console.log(JSON.stringify({ ev: "ai_proxy_google_error", message: e2?.message || String(e2) }));
           } catch {
           }
         }
+        return res.status(502).json({ error: "provider_error", message: String(msg) });
       }
     }
-    const openaiKey = sanitizeKey2(keys?.openaiApiKey || process.env.OPENAI_API_KEY);
-    if (!openaiKey) {
+    if (effectiveProvider === "openai") {
+      const openaiKey = sanitizeKey2(keys?.openaiApiKey || process.env.OPENAI_API_KEY);
+      if (!openaiKey) {
+        if (process.env.MARIA_TELEMETRY === "1") {
+          try {
+            console.log(JSON.stringify({ ev: "ai_proxy_no_keys" }));
+          } catch {
+          }
+        }
+        return res.status(503).json({ error: "provider_unavailable", message: "No valid OpenAI API key" });
+      }
+      const OpenAI2 = (await import('openai')).default;
+      const client = new OpenAI2({ apiKey: openaiKey });
+      let model = effectiveModel || (isProOrAbove ? "gpt-5" : "gpt-5-mini");
+      let content = "";
+      let totalTokens = 0;
+      const attachments = Array.isArray((req.body?.metadata || {}).attachments) ? (req.body.metadata.attachments || []).filter(Boolean) : [];
+      try {
+        if (attachments.length > 0) {
+          const vs = await client.vectorStores.create({ name: `ai-proxy-${uid}-${Date.now()}` });
+          for (const a of attachments) {
+            try {
+              const b64 = String(a.data_base64 || "");
+              if (!b64) continue;
+              const buffer = Buffer.from(b64, "base64");
+              const filename = a.name || "attachment.txt";
+              const toFile = OpenAI2.toFile;
+              const fileInput = toFile ? await toFile(buffer, filename) : buffer;
+              const file = await client.files.create({ file: fileInput, purpose: "assistants" });
+              await client.vectorStores.files.create(vs.id, { file_id: file.id });
+            } catch {
+            }
+          }
+          const r2 = await client.responses.create({
+            model,
+            input: String(effectivePrompt || ""),
+            tools: [{ type: "file_search", vector_store_ids: [vs.id] }]
+          });
+          content = r2?.output_text || r2?.content?.[0]?.text || "";
+          const u = r2?.usage;
+          if (u) {
+            const inTok = Number(u.input_tokens || u.inputTokens || 0);
+            const outTok = Number(u.output_tokens || u.outputTokens || 0);
+            totalTokens = Number(u.total_tokens || u.totalTokens || inTok + outTok || 0);
+          }
+        } else {
+          const r2 = await client.responses.create({
+            model,
+            input: [
+              { role: "system", content: "You output only code blocks when asked for code." },
+              { role: "user", content: effectivePrompt || "" }
+            ]
+          });
+          content = r2?.output_text || r2?.content?.[0]?.text || "";
+          const u = r2?.usage;
+          if (u) {
+            const inTok = Number(u.input_tokens || u.inputTokens || 0);
+            const outTok = Number(u.output_tokens || u.outputTokens || 0);
+            totalTokens = Number(u.total_tokens || u.totalTokens || inTok + outTok || 0);
+          }
+        }
+      } catch (_e) {
+        try {
+          console.warn("[AI Proxy][OpenAI] responses.create failed:", _e?.message || String(_e));
+        } catch {
+        }
+        model = "gpt-5-mini";
+        try {
+          const r2 = await client.chat.completions.create({
+            model,
+            messages: [
+              { role: "system", content: "You output only code blocks when asked for code." },
+              { role: "user", content: effectivePrompt || "" }
+            ]
+          });
+          content = r2.choices?.[0]?.message?.content || "";
+          const u2 = r2?.usage;
+          if (u2) totalTokens = Number(u2.total_tokens || 0);
+        } catch (e2) {
+          try {
+            console.error("[AI Proxy][OpenAI] chat.completions fallback failed:", e2?.message || String(e2));
+          } catch {
+          }
+          throw e2;
+        }
+      }
       if (process.env.MARIA_TELEMETRY === "1") {
         try {
-          console.log(JSON.stringify({ ev: "ai_proxy_no_keys" }));
+          console.log(JSON.stringify({ ev: "ai_proxy_route", vendor: "openai", model, empty: !content }));
         } catch {
         }
       }
-      return res.status(503).json({ error: "provider_unavailable", message: "No valid provider key (set GEMINI_API_KEY/GOOGLE_API_KEY or OPENAI_API_KEY)" });
-    }
-    const OpenAI2 = (await import('openai')).default;
-    const client = new OpenAI2({ apiKey: openaiKey });
-    let model = requestedProvider === "openai" && requestedModel ? requestedModel : process.env.MARIA_CODE_MODEL || "gpt-5-mini";
-    let content = "";
-    let totalTokens = 0;
-    try {
-      const r2 = await client.responses.create({
-        model,
-        input: [
-          { role: "system", content: "You output only code blocks when asked for code." },
-          { role: "user", content: effectivePrompt || "" }
-        ]
-      });
-      content = r2?.output_text || r2?.content?.[0]?.text || "";
-      const u = r2?.usage;
-      if (u) {
-        const inTok = Number(u.input_tokens || u.inputTokens || 0);
-        const outTok = Number(u.output_tokens || u.outputTokens || 0);
-        totalTokens = Number(u.total_tokens || u.totalTokens || inTok + outTok || 0);
-      }
-    } catch (_e) {
-      model = "gpt-4o-mini";
-      const r2 = await client.chat.completions.create({
-        model,
-        messages: [
-          { role: "system", content: "You output only code blocks when asked for code." },
-          { role: "user", content: effectivePrompt || "" }
-        ]
-      });
-      content = r2.choices?.[0]?.message?.content || "";
-      const u2 = r2?.usage;
-      if (u2) totalTokens = Number(u2.total_tokens || 0);
-    }
-    if (process.env.MARIA_TELEMETRY === "1") {
+      const consumption = { requests: 1 };
+      if (totalTokens > 0) consumption.tokens = totalTokens;
+      if (taskType === "code" || taskType === "evaluation") consumption.code = 1;
       try {
-        console.log(JSON.stringify({ ev: "ai_proxy_route", vendor: "openai", model, empty: !content }));
+        await applyConsumption(uid, consumption, idemKey);
       } catch {
       }
+      return res.json({ data: { content, routedModel: { vendor: "openai", family: "gpt", name: model, reason: taskType || "code" } } });
     }
-    const consumption = { requests: 1 };
-    if (totalTokens > 0) consumption.tokens = totalTokens;
-    if (taskType === "code" || taskType === "evaluation") consumption.code = 1;
-    try {
-      await applyConsumption(uid, consumption, idemKey);
-    } catch {
-    }
-    return res.json({ data: { content, routedModel: { vendor: "openai", family: "gpt", name: model, reason: taskType || "code" } } });
+    return res.status(500).json({ error: "routing_error", message: "No provider selected for AI proxy" });
   } catch (error) {
     console.error("[AI Proxy] Error:", error);
     if (process.env.MARIA_TELEMETRY === "1") {
@@ -10516,6 +10746,136 @@ async function getFirestoreSafe() {
     return null;
   }
 }
+app.post("/api/v1/snapshots", rateLimitMiddleware, async (req, res) => {
+  try {
+    const auth = req.headers.authorization;
+    if (!auth || !auth.startsWith("Bearer ")) return res.status(401).json({ error: "unauthorized" });
+    const idToken = auth.substring("Bearer ".length).trim();
+    const decoded = await decodeFirebaseToken(idToken).catch(() => null);
+    if (!decoded) return res.status(401).json({ error: "unauthorized" });
+    const uid = decoded?.uid || decoded?.sub;
+    const { projectId, taskId, summary, decisions, artifacts, refs, resumePrompt } = req.body || {};
+    const pid = typeof projectId === "string" && projectId.trim() ? String(projectId).trim() : "default";
+    const tid = typeof taskId === "string" && taskId.trim() ? String(taskId).trim() : "";
+    const sum = typeof summary === "string" && summary.trim() ? String(summary).trim() : "";
+    try {
+      console.log("[Snapshots][POST] incoming", { uid: String(uid).slice(0, 8) + "\u2026", projectId: pid, taskId: tid, hasSummary: !!sum });
+    } catch {
+    }
+    if (!tid || !sum) return res.status(400).json({ error: "bad_request", message: "taskId and summary are required" });
+    const db = await getFirestoreSafe();
+    if (!db) return res.status(503).json({ error: "unavailable", message: "database is not configured" });
+    const tsId = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").split(".")[0] + "Z";
+    const userRef = db.collection("users").doc(uid);
+    const projRef = userRef.collection("projects").doc(pid);
+    const taskRef = projRef.collection("tasks").doc(tid);
+    const ref = taskRef.collection("snapshots").doc(tsId);
+    const nowISO = (/* @__PURE__ */ new Date()).toISOString();
+    try {
+      await Promise.all([
+        userRef.set({ updatedAt: nowISO }, { merge: true }),
+        projRef.set({ projectId: pid, updatedAt: nowISO }, { merge: true }),
+        taskRef.set({ taskId: tid, updatedAt: nowISO }, { merge: true })
+      ]);
+    } catch (e2) {
+      try {
+        console.warn("[Snapshots][POST] parent set warn:", e2?.message || String(e2));
+      } catch {
+      }
+    }
+    await ref.set({
+      snapshotVersion: 1,
+      uid,
+      projectId: pid,
+      taskId: tid,
+      timestamp: nowISO,
+      summary: sum,
+      decisions: Array.isArray(decisions) ? decisions.slice(0, 50).map(String) : [],
+      artifacts: Array.isArray(artifacts) ? artifacts.slice(0, 200).map(String) : [],
+      links: Array.isArray(refs) ? refs.slice(0, 200).map((r2) => ({ type: "fs", ref: String(r2) })) : [],
+      resumePrompt: typeof resumePrompt === "string" ? String(resumePrompt) : ""
+    });
+    try {
+      console.log("[Snapshots][POST] saved", { path: `users/${uid}/projects/${pid}/tasks/${tid}/snapshots/${tsId}` });
+    } catch {
+    }
+    return res.json({ success: true });
+  } catch (e2) {
+    try {
+      console.error("[Snapshots][POST] error:", e2?.message || String(e2));
+    } catch {
+    }
+    return res.status(500).json({ error: "internal_error" });
+  }
+});
+app.get("/api/v1/get-snapshots", rateLimitMiddleware, async (req, res) => {
+  try {
+    const auth = req.headers.authorization;
+    if (!auth || !auth.startsWith("Bearer ")) return res.status(401).json({ error: "unauthorized" });
+    const idToken = auth.substring("Bearer ".length).trim();
+    const decoded = await decodeFirebaseToken(idToken).catch(() => null);
+    if (!decoded) return res.status(401).json({ error: "unauthorized" });
+    const uid = decoded?.uid || decoded?.sub;
+    const projectId = typeof req.query.projectId === "string" && req.query.projectId.trim() ? String(req.query.projectId).trim() : "default";
+    const taskId = typeof req.query.taskId === "string" && req.query.taskId.trim() ? String(req.query.taskId).trim() : void 0;
+    const dateISO = typeof req.query.date === "string" && req.query.date.trim() ? String(req.query.date).trim() : void 0;
+    const limit = Number.isFinite(Number(req.query.limit)) ? Math.max(1, Math.min(50, Number(req.query.limit))) : 5;
+    const db = await getFirestoreSafe();
+    if (!db) return res.status(503).json({ error: "unavailable", message: "database is not configured" });
+    let docs = [];
+    if (taskId) {
+      const q = db.collection("users").doc(uid).collection("projects").doc(projectId).collection("tasks").doc(taskId).collection("snapshots").orderBy("timestamp", "desc").limit(limit);
+      const ss = await q.get();
+      docs = ss.docs.map((d) => d.data());
+    } else if (dateISO) {
+      const start = new Date(dateISO).toISOString();
+      const end = new Date(new Date(dateISO).getTime() + 24 * 60 * 60 * 1e3).toISOString();
+      try {
+        const ss = await db.collectionGroup("snapshots").where("uid", "==", uid).where("projectId", "==", projectId).where("timestamp", ">=", start).where("timestamp", "<", end).orderBy("timestamp", "desc").limit(limit).get();
+        docs = ss.docs.map((d) => d.data());
+      } catch (e2) {
+        const projRef = db.collection("users").doc(uid).collection("projects").doc(projectId);
+        const tasksSnap = await projRef.collection("tasks").get();
+        const collected = [];
+        for (const t2 of tasksSnap.docs) {
+          try {
+            const snaps = await t2.ref.collection("snapshots").orderBy("timestamp", "desc").limit(50).get();
+            for (const s2 of snaps.docs) {
+              const data = s2.data();
+              const ts = String(data?.timestamp || "");
+              if (ts >= start && ts < end) collected.push(data);
+            }
+          } catch {
+          }
+        }
+        collected.sort((a, b) => String(b?.timestamp || "").localeCompare(String(a?.timestamp || "")));
+        docs = collected.slice(0, limit);
+      }
+    } else {
+      try {
+        const ss = await db.collectionGroup("snapshots").where("uid", "==", uid).where("projectId", "==", projectId).orderBy("timestamp", "desc").limit(limit).get();
+        docs = ss.docs.map((d) => d.data());
+      } catch (e2) {
+        const projRef = db.collection("users").doc(uid).collection("projects").doc(projectId);
+        const tasksSnap = await projRef.collection("tasks").get();
+        const perTaskTop = [];
+        for (const t2 of tasksSnap.docs) {
+          try {
+            const snaps = await t2.ref.collection("snapshots").orderBy("timestamp", "desc").limit(Math.max(1, Math.ceil(limit / Math.max(1, tasksSnap.size)))).get();
+            for (const s2 of snaps.docs) perTaskTop.push(s2.data());
+          } catch {
+          }
+        }
+        perTaskTop.sort((a, b) => String(b?.timestamp || "").localeCompare(String(a?.timestamp || "")));
+        docs = perTaskTop.slice(0, limit);
+      }
+    }
+    return res.json({ success: true, data: { snapshots: docs } });
+  } catch (e2) {
+    console.error("[Snapshots] GET error", e2);
+    return res.status(500).json({ error: "internal_error" });
+  }
+});
 app.get("/api/v1/usage", rateLimitMiddleware, async (req, res) => {
   try {
     const auth = req.headers.authorization;