@bonginkan/maria 4.3.8 → 4.3.10

package/dist/server-express.cjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 
+var secretManager = require('@google-cloud/secret-manager');
 var fs = require('fs');
 var path = require('path');
 var Stream = require('stream');
@@ -19,7 +20,6 @@ var auth = require('firebase-admin/auth');
 var fsp = require('fs/promises');
 var crypto = require('crypto');
 var child_process = require('child_process');
-var secretManager = require('@google-cloud/secret-manager');
 var events = require('events');
 var generativeAi = require('@google/generative-ai');
 var OpenAI = require('openai');
@@ -99,6 +99,267 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// src/services/intelligent-model-selector/SecretManagerIntegration.ts
+var SecretManagerIntegration_exports = {};
+__export(SecretManagerIntegration_exports, {
+  SecretManagerIntegration: () => SecretManagerIntegration
+});
+var SecretManagerIntegration;
+var init_SecretManagerIntegration = __esm({
+  "src/services/intelligent-model-selector/SecretManagerIntegration.ts"() {
+    SecretManagerIntegration = class {
+      constructor(config) {
+        this.config = config;
+        this.useGsm = this.shouldUseGsm();
+      }
+      client = null;
+      cache = /* @__PURE__ */ new Map();
+      cacheExpiry = /* @__PURE__ */ new Map();
+      CACHE_TTL = 36e5;
+      // 1 hour
+      useGsm;
+      MAX_RETRIES = 3;
+      BASE_DELAY_MS = 200;
+      /** Determine whether GSM should be used in this environment */
+      shouldUseGsm() {
+        if (process.env.MARIA_DISABLE_GSM === "true") return false;
+        if (process.env.GOOGLE_APPLICATION_CREDENTIALS) return true;
+        if (process.env.GOOGLE_CLOUD_PROJECT || process.env.GCLOUD_PROJECT) return true;
+        if (process.env.CLOUD_RUN_SERVICE || process.env.K_SERVICE) return true;
+        if (process.env.GCE_METADATA_HOST) return true;
+        return false;
+      }
+      /** Lazily create Secret Manager client only when permitted */
+      ensureClient() {
+        if (!this.useGsm) return null;
+        if (this.client) return this.client;
+        try {
+          this.client = new secretManager.SecretManagerServiceClient();
+        } catch {
+          this.client = null;
+        }
+        return this.client;
+      }
+      /**
+       * Get API key from Secret Manager with caching
+       */
+      async getApiKey(provider) {
+        const secretName = this.getSecretName(provider);
+        if (!secretName) {
+          return void 0;
+        }
+        const client = this.ensureClient();
+        if (!client) {
+          return this.getFallbackFromEnv(provider);
+        }
+        const valid = this.getCachedSecret(secretName);
+        if (valid) return valid;
+        const res = await this.accessWithBackoff(secretName).catch(() => void 0);
+        if (res) {
+          this.cacheSecret(secretName, res);
+          return res;
+        }
+        const stale = this.cache.get(secretName);
+        if (stale) return stale;
+        return this.getFallbackFromEnv(provider);
+      }
+      /**
+       * Get all API keys
+       */
+      async getAllApiKeys() {
+        const [googleApiKey, openaiApiKey, anthropicApiKey, groqApiKey] = await Promise.all([
+          this.getApiKey("google"),
+          this.getApiKey("openai"),
+          this.getApiKey("anthropic"),
+          this.getApiKey("groq")
+        ]);
+        return {
+          googleApiKey,
+          openaiApiKey,
+          anthropicApiKey,
+          groqApiKey
+        };
+      }
+      /** Fetch optional configuration values (not API keys) */
+      async getOptionalConfig() {
+        const client = this.ensureClient();
+        const read = async (name) => {
+          if (!name) return void 0;
+          if (!client) return void 0;
+          try {
+            const resName = `projects/${this.config.projectId}/secrets/${name}/versions/latest`;
+            const [version] = await client.accessSecretVersion({ name: resName });
+            const payload = version.payload?.data;
+            return payload?.toString();
+          } catch {
+            return void 0;
+          }
+        };
+        const [defaultModel, defaultProvider, lmstudioApiBase, ollamaApiUrl, vllmApiUrl] = await Promise.all([
+          read(this.config.secrets.defaultModel || "default-model"),
+          read(this.config.secrets.defaultProvider || "default-provider"),
+          read(this.config.secrets.lmstudioApiBase || "lmstudio-api-base"),
+          read(this.config.secrets.ollamaApiUrl || "ollama-api-url"),
+          read(this.config.secrets.vllmApiUrl || "vllm-api-url")
+        ]);
+        return { defaultModel, defaultProvider, lmstudioApiBase, ollamaApiUrl, vllmApiUrl };
+      }
+      /**
+       * Verify that required secrets exist
+       */
+      async verifySecrets() {
+        const client = this.ensureClient();
+        if (!client) {
+          return { available: [], missing: [] };
+        }
+        const available = [];
+        const missing = [];
+        const providers = ["google", "openai", "anthropic", "groq"];
+        for (const provider of providers) {
+          const secretName = this.getSecretName(provider);
+          if (!secretName) continue;
+          try {
+            const name = `projects/${this.config.projectId}/secrets/${secretName}`;
+            await client.getSecret({ name });
+            available.push(provider);
+          } catch (error) {
+            missing.push(provider);
+          }
+        }
+        return { available, missing };
+      }
+      /**
+       * Create or update a secret
+       */
+      async createOrUpdateSecret(provider, apiKey) {
+        const secretName = this.getSecretName(provider);
+        if (!secretName) {
+          return false;
+        }
+        const client = this.ensureClient();
+        if (!client) {
+          return false;
+        }
+        const secretId = `projects/${this.config.projectId}/secrets/${secretName}`;
+        try {
+          let secretExists = false;
+          try {
+            await client.getSecret({ name: secretId });
+            secretExists = true;
+          } catch {
+            secretExists = false;
+          }
+          if (!secretExists) {
+            await client.createSecret({
+              parent: `projects/${this.config.projectId}`,
+              secretId: secretName,
+              secret: {
+                replication: {
+                  automatic: {}
+                },
+                labels: {
+                  service: "ims",
+                  provider
+                }
+              }
+            });
+          }
+          await client.addSecretVersion({
+            parent: secretId,
+            payload: {
+              data: Buffer.from(apiKey, "utf8")
+            }
+          });
+          this.cache.delete(secretName);
+          this.cacheExpiry.delete(secretName);
+          return true;
+        } catch (error) {
+          return false;
+        }
+      }
+      /**
+       * Get secret name for provider
+       */
+      getSecretName(provider) {
+        switch (provider) {
+          case "google":
+            return this.config.secrets.googleAI || "google-ai-api-key";
+          case "openai":
+            return this.config.secrets.openAI || "openai-api-key";
+          case "anthropic":
+            return this.config.secrets.anthropic || "anthropic-api-key";
+          case "groq":
+            return this.config.secrets.groq || "groq-api-key";
+          default:
+            return void 0;
+        }
+      }
+      /**
+       * Get cached secret if valid
+       */
+      getCachedSecret(secretName) {
+        const expiry = this.cacheExpiry.get(secretName);
+        if (!expiry || Date.now() > expiry) {
+          this.cache.delete(secretName);
+          this.cacheExpiry.delete(secretName);
+          return void 0;
+        }
+        return this.cache.get(secretName);
+      }
+      /** Access a secret with retry + exponential backoff */
+      async accessWithBackoff(secretName) {
+        const client = this.ensureClient();
+        if (!client) return void 0;
+        const name = `projects/${this.config.projectId}/secrets/${secretName}/versions/latest`;
+        for (let attempt = 0; attempt < this.MAX_RETRIES; attempt++) {
+          try {
+            const [version] = await client.accessSecretVersion({ name });
+            const payload = version.payload?.data;
+            if (!payload) return void 0;
+            return payload.toString();
+          } catch (e2) {
+            if (attempt === this.MAX_RETRIES - 1) break;
+            const delay = this.BASE_DELAY_MS * Math.pow(2, attempt);
+            await new Promise((r2) => setTimeout(r2, delay));
+          }
+        }
+        return void 0;
+      }
+      /**
+       * Cache a secret
+       */
+      cacheSecret(secretName, value) {
+        this.cache.set(secretName, value);
+        this.cacheExpiry.set(secretName, Date.now() + this.CACHE_TTL);
+      }
+      /**
+       * Get fallback from environment variable
+       */
+      getFallbackFromEnv(provider) {
+        switch (provider) {
+          case "google":
+            return process.env.GOOGLE_AI_API_KEY;
+          case "openai":
+            return process.env.OPENAI_API_KEY;
+          case "anthropic":
+            return process.env.ANTHROPIC_API_KEY;
+          case "groq":
+            return process.env.GROQ_API_KEY;
+          default:
+            return void 0;
+        }
+      }
+      /**
+       * Clear cache
+       */
+      clearCache() {
+        this.cache.clear();
+        this.cacheExpiry.clear();
+      }
+    };
+  }
+});
+
 // node_modules/.pnpm/data-uri-to-buffer@4.0.1/node_modules/data-uri-to-buffer/dist/index.js
 function dataUriToBuffer(uri) {
   if (!/^data:/i.test(uri)) {
@@ -7035,256 +7296,9 @@ var free_plan_default = {
     ]
   }
 };
-var SecretManagerIntegration = class {
-  constructor(config) {
-    this.config = config;
-    this.useGsm = this.shouldUseGsm();
-  }
-  client = null;
-  cache = /* @__PURE__ */ new Map();
-  cacheExpiry = /* @__PURE__ */ new Map();
-  CACHE_TTL = 36e5;
-  // 1 hour
-  useGsm;
-  MAX_RETRIES = 3;
-  BASE_DELAY_MS = 200;
-  /** Determine whether GSM should be used in this environment */
-  shouldUseGsm() {
-    if (process.env.MARIA_DISABLE_GSM === "true") return false;
-    if (process.env.GOOGLE_APPLICATION_CREDENTIALS) return true;
-    if (process.env.GOOGLE_CLOUD_PROJECT || process.env.GCLOUD_PROJECT) return true;
-    if (process.env.CLOUD_RUN_SERVICE || process.env.K_SERVICE) return true;
-    if (process.env.GCE_METADATA_HOST) return true;
-    return false;
-  }
-  /** Lazily create Secret Manager client only when permitted */
-  ensureClient() {
-    if (!this.useGsm) return null;
-    if (this.client) return this.client;
-    try {
-      this.client = new secretManager.SecretManagerServiceClient();
-    } catch {
-      this.client = null;
-    }
-    return this.client;
-  }
-  /**
-   * Get API key from Secret Manager with caching
-   */
-  async getApiKey(provider) {
-    const secretName = this.getSecretName(provider);
-    if (!secretName) {
-      return void 0;
-    }
-    const client = this.ensureClient();
-    if (!client) {
-      return this.getFallbackFromEnv(provider);
-    }
-    const valid = this.getCachedSecret(secretName);
-    if (valid) return valid;
-    const res = await this.accessWithBackoff(secretName).catch(() => void 0);
-    if (res) {
-      this.cacheSecret(secretName, res);
-      return res;
-    }
-    const stale = this.cache.get(secretName);
-    if (stale) return stale;
-    return this.getFallbackFromEnv(provider);
-  }
-  /**
-   * Get all API keys
-   */
-  async getAllApiKeys() {
-    const [googleApiKey, openaiApiKey, anthropicApiKey, groqApiKey] = await Promise.all([
-      this.getApiKey("google"),
-      this.getApiKey("openai"),
-      this.getApiKey("anthropic"),
-      this.getApiKey("groq")
-    ]);
-    return {
-      googleApiKey,
-      openaiApiKey,
-      anthropicApiKey,
-      groqApiKey
-    };
-  }
-  /** Fetch optional configuration values (not API keys) */
-  async getOptionalConfig() {
-    const client = this.ensureClient();
-    const read = async (name) => {
-      if (!name) return void 0;
-      if (!client) return void 0;
-      try {
-        const resName = `projects/${this.config.projectId}/secrets/${name}/versions/latest`;
-        const [version] = await client.accessSecretVersion({ name: resName });
-        const payload = version.payload?.data;
-        return payload?.toString();
-      } catch {
-        return void 0;
-      }
-    };
-    const [defaultModel, defaultProvider, lmstudioApiBase, ollamaApiUrl, vllmApiUrl] = await Promise.all([
-      read(this.config.secrets.defaultModel || "default-model"),
-      read(this.config.secrets.defaultProvider || "default-provider"),
-      read(this.config.secrets.lmstudioApiBase || "lmstudio-api-base"),
-      read(this.config.secrets.ollamaApiUrl || "ollama-api-url"),
-      read(this.config.secrets.vllmApiUrl || "vllm-api-url")
-    ]);
-    return { defaultModel, defaultProvider, lmstudioApiBase, ollamaApiUrl, vllmApiUrl };
-  }
-  /**
-   * Verify that required secrets exist
-   */
-  async verifySecrets() {
-    const client = this.ensureClient();
-    if (!client) {
-      return { available: [], missing: [] };
-    }
-    const available = [];
-    const missing = [];
-    const providers = ["google", "openai", "anthropic", "groq"];
-    for (const provider of providers) {
-      const secretName = this.getSecretName(provider);
-      if (!secretName) continue;
-      try {
-        const name = `projects/${this.config.projectId}/secrets/${secretName}`;
-        await client.getSecret({ name });
-        available.push(provider);
-      } catch (error) {
-        missing.push(provider);
-      }
-    }
-    return { available, missing };
-  }
-  /**
-   * Create or update a secret
-   */
-  async createOrUpdateSecret(provider, apiKey) {
-    const secretName = this.getSecretName(provider);
-    if (!secretName) {
-      return false;
-    }
-    const client = this.ensureClient();
-    if (!client) {
-      return false;
-    }
-    const secretId = `projects/${this.config.projectId}/secrets/${secretName}`;
-    try {
-      let secretExists = false;
-      try {
-        await client.getSecret({ name: secretId });
-        secretExists = true;
-      } catch {
-        secretExists = false;
-      }
-      if (!secretExists) {
-        await client.createSecret({
-          parent: `projects/${this.config.projectId}`,
-          secretId: secretName,
-          secret: {
-            replication: {
-              automatic: {}
-            },
-            labels: {
-              service: "ims",
-              provider
-            }
-          }
-        });
-      }
-      await client.addSecretVersion({
-        parent: secretId,
-        payload: {
-          data: Buffer.from(apiKey, "utf8")
-        }
-      });
-      this.cache.delete(secretName);
-      this.cacheExpiry.delete(secretName);
-      return true;
-    } catch (error) {
-      return false;
-    }
-  }
-  /**
-   * Get secret name for provider
-   */
-  getSecretName(provider) {
-    switch (provider) {
-      case "google":
-        return this.config.secrets.googleAI || "google-ai-api-key";
-      case "openai":
-        return this.config.secrets.openAI || "openai-api-key";
-      case "anthropic":
-        return this.config.secrets.anthropic || "anthropic-api-key";
-      case "groq":
-        return this.config.secrets.groq || "groq-api-key";
-      default:
-        return void 0;
-    }
-  }
-  /**
-   * Get cached secret if valid
-   */
-  getCachedSecret(secretName) {
-    const expiry = this.cacheExpiry.get(secretName);
-    if (!expiry || Date.now() > expiry) {
-      this.cache.delete(secretName);
-      this.cacheExpiry.delete(secretName);
-      return void 0;
-    }
-    return this.cache.get(secretName);
-  }
-  /** Access a secret with retry + exponential backoff */
-  async accessWithBackoff(secretName) {
-    const client = this.ensureClient();
-    if (!client) return void 0;
-    const name = `projects/${this.config.projectId}/secrets/${secretName}/versions/latest`;
-    for (let attempt = 0; attempt < this.MAX_RETRIES; attempt++) {
-      try {
-        const [version] = await client.accessSecretVersion({ name });
-        const payload = version.payload?.data;
-        if (!payload) return void 0;
-        return payload.toString();
-      } catch (e2) {
-        if (attempt === this.MAX_RETRIES - 1) break;
-        const delay = this.BASE_DELAY_MS * Math.pow(2, attempt);
-        await new Promise((r2) => setTimeout(r2, delay));
-      }
-    }
-    return void 0;
-  }
-  /**
-   * Cache a secret
-   */
-  cacheSecret(secretName, value) {
-    this.cache.set(secretName, value);
-    this.cacheExpiry.set(secretName, Date.now() + this.CACHE_TTL);
-  }
-  /**
-   * Get fallback from environment variable
-   */
-  getFallbackFromEnv(provider) {
-    switch (provider) {
-      case "google":
-        return process.env.GOOGLE_AI_API_KEY;
-      case "openai":
-        return process.env.OPENAI_API_KEY;
-      case "anthropic":
-        return process.env.ANTHROPIC_API_KEY;
-      case "groq":
-        return process.env.GROQ_API_KEY;
-      default:
-        return void 0;
-    }
-  }
-  /**
-   * Clear cache
-   */
-  clearCache() {
-    this.cache.clear();
-    this.cacheExpiry.clear();
-  }
-};
+
+// src/services/intelligent-model-selector/IMSFacade.ts
+init_SecretManagerIntegration();
 
 // src/providers/ai-provider.ts
 var BaseAIProvider = class {
@@ -8532,7 +8546,7 @@ app.get("/health", (req, res) => {
 app.get("/api/status", (req, res) => {
   res.json({
     status: "healthy",
-    version: "4.3.8",
+    version: "4.3.10",
     uptime: process.uptime(),
     memory: process.memoryUsage(),
     platform: process.platform,
@@ -8543,7 +8557,7 @@ app.get("/api/status", (req, res) => {
 app.get("/", (req, res) => {
   res.json({
     name: "MARIA CODE API",
-    version: "4.3.8",
+    version: "4.3.10",
     status: "running",
     environment: process.env.NODE_ENV || "development",
     endpoints: {
@@ -8652,8 +8666,40 @@ app.post("/api/auth/revoke", async (req, res) => {
     return res.status(500).json({ error: "REVOCATION_FAILED" });
   }
 });
+var _keysCache = null;
+async function loadProviderKeys() {
+  if (_keysCache) return _keysCache;
+  try {
+    const { SecretManagerIntegration: SecretManagerIntegration2 } = await Promise.resolve().then(() => (init_SecretManagerIntegration(), SecretManagerIntegration_exports));
+    const sm = new SecretManagerIntegration2({
+      projectId: process.env.GOOGLE_CLOUD_PROJECT || process.env.GCLOUD_PROJECT || "maria-code-470602",
+      secrets: {
+        openAI: "openai-api-key",
+        googleAI: "google-ai-api-key"
+      }
+    });
+    const keys = await sm.getAllApiKeys().catch(() => ({}));
+    _keysCache = {
+      openaiApiKey: keys.openaiApiKey,
+      googleApiKey: keys.googleApiKey
+    };
+    if (_keysCache.googleApiKey && !process.env.GEMINI_API_KEY && !process.env.GOOGLE_API_KEY) {
+      process.env.GEMINI_API_KEY = _keysCache.googleApiKey;
+    }
+    if (_keysCache.openaiApiKey && !process.env.OPENAI_API_KEY) {
+      process.env.OPENAI_API_KEY = _keysCache.openaiApiKey;
+    }
+  } catch {
+    _keysCache = {
+      openaiApiKey: process.env.OPENAI_API_KEY,
+      googleApiKey: process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY
+    };
+  }
+  return _keysCache;
+}
 app.post("/api/v1/image", rateLimitMiddleware, async (req, res) => {
   try {
+    await loadProviderKeys();
     const auth = req.headers.authorization;
     if (!auth || !auth.startsWith("Bearer ")) return res.status(401).json({ error: "unauthorized" });
     const { prompt, model, size = "1024x1024", format = "png", count = 1, seed } = req.body || {};
@@ -8690,6 +8736,7 @@ app.post("/api/v1/image", rateLimitMiddleware, async (req, res) => {
 });
 app.post("/api/v1/video", rateLimitMiddleware, async (req, res) => {
   try {
+    await loadProviderKeys();
     const auth = req.headers.authorization;
     if (!auth || !auth.startsWith("Bearer ")) return res.status(401).json({ error: "unauthorized" });
     const { prompt, duration = 5, fps = 24, res: resStr = "1280x720", format = "mp4", model, seed } = req.body || {};
@@ -8794,11 +8841,36 @@ app.post("/v1/ai-proxy", rateLimitMiddleware, async (req, res) => {
     if (!auth || !auth.startsWith("Bearer ")) return res.status(401).json({ error: "unauthorized" });
     const { prompt, taskType } = req.body || {};
     if (!prompt) return res.status(400).json({ error: "bad_request", message: "prompt required" });
-    const gemKey = process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY;
+    const sanitizeKey = (v) => {
+      if (!v) return void 0;
+      let k = String(v).trim();
+      if (!k) return void 0;
+      if (k.startsWith('"') && k.endsWith('"') || k.startsWith("'") && k.endsWith("'")) {
+        k = k.slice(1, -1);
+      }
+      if (/^Bearer\s+/i.test(k)) k = k.replace(/^Bearer\s+/i, "");
+      if (/your_.*key|example|placeholder/i.test(k)) return void 0;
+      if (/\s/.test(k)) k = k.replace(/\s+/g, "");
+      return k || void 0;
+    };
+    const keys = await (async () => {
+      try {
+        return await global.___maria_keys ?? await (async () => {
+          const k = await (await Promise.resolve().then(() => (init_SecretManagerIntegration(), SecretManagerIntegration_exports))).SecretManagerIntegration;
+          const sm = new k({ projectId: process.env.GOOGLE_CLOUD_PROJECT || process.env.GCLOUD_PROJECT || "maria-code-470602", secrets: { openAI: "openai-api-key", googleAI: "google-ai-api-key" } });
+          const all = await sm.getAllApiKeys().catch(() => ({}));
+          global.___maria_keys = all;
+          return all;
+        })();
+      } catch {
+        return {};
+      }
+    })();
+    const gemKey = sanitizeKey(keys?.googleApiKey || process.env.GEMINI_API_KEY || process.env.GOOGLE_API_KEY);
     if (gemKey) {
       try {
         const { GoogleGenerativeAI: GoogleGenerativeAI2 } = await import('@google/generative-ai');
-        const ai = new GoogleGenerativeAI2({ apiKey: gemKey });
+        const ai = new GoogleGenerativeAI2(gemKey);
         const modelName = process.env.MARIA_CODE_MODEL || "gemini-2.5-flash";
         const model2 = ai.getGenerativeModel({ model: modelName });
         const resp = await model2.generateContent({ contents: [{ role: "user", parts: [{ text: prompt }] }] });
@@ -8808,8 +8880,10 @@ app.post("/v1/ai-proxy", rateLimitMiddleware, async (req, res) => {
         console.warn("[AI Proxy] Gemini path failed, falling back to OpenAI:", e2?.message || e2);
       }
     }
-    const openaiKey = process.env.OPENAI_API_KEY;
-    if (!openaiKey) return res.status(503).json({ error: "provider_unavailable", message: "No provider key (GEMINI_API_KEY/GOOGLE_API_KEY or OPENAI_API_KEY)" });
+    const openaiKey = sanitizeKey(keys?.openaiApiKey || process.env.OPENAI_API_KEY);
+    if (!openaiKey) {
+      return res.status(503).json({ error: "provider_unavailable", message: "No valid provider key (set GEMINI_API_KEY/GOOGLE_API_KEY or OPENAI_API_KEY)" });
+    }
     const OpenAI2 = (await import('openai')).default;
     const client = new OpenAI2({ apiKey: openaiKey });
     let model = process.env.MARIA_CODE_MODEL || "gpt-5-mini";