@contentgrowth/llm-service 1.3.7 → 1.4.0

package/README.md

@@ -124,7 +124,7 @@ VERTEX_LOCATION=us-central1
 VERTEX_MODEL=gemini-3.5-flash
 VERTEX_MODEL_EDGE=gemini-3.5-pro
 VERTEX_MODEL_FAST=gemini-3.5-flash
-VERTEX_IMAGE_MODEL=gemini-3.5-pro-image-preview
+VERTEX_IMAGE_MODEL=gemini-nano-banana-2.1
 VERTEX_VIDEO_MODEL=veo
 ```
 
@@ -409,6 +409,71 @@ await chatCompletion(messages, tenant, prompt, tools, { responseFormat: 'json' }
 
 ## Testing
 
+### Google Cloud Authentication Utilities
+
+The package exports utilities for working with Google Cloud service accounts in edge runtime environments (Cloudflare Workers, Vercel Edge, etc.) where traditional ADC (Application Default Credentials) is not available.
+
+```javascript
+import { 
+  parseGoogleCredentials, 
+  GoogleTokenManager,
+  getGoogleOAuth2Token 
+} from '@contentgrowth/llm-service/utils/google';
+
+// Parse service account from various formats
+const sa = parseGoogleCredentials(jsonString); // or base64 or object
+
+// Create token manager for automatic refresh
+const tokenManager = new GoogleTokenManager(sa);
+
+// Get token (cached or fresh)
+const token = await tokenManager.getToken();
+
+// Check if token is still valid
+if (tokenManager.isValid()) {
+  console.log(`Token valid for ${tokenManager.getTimeToExpiry()} seconds`);
+}
+
+// Force refresh
+tokenManager.invalidate();
+
+// Or get token directly (no caching)
+const freshToken = await getGoogleOAuth2Token(sa);
+```
+
+#### Using with llm-service
+
+```javascript
+import { LLMService } from '@contentgrowth/llm-service';
+import { parseGoogleCredentials, GoogleTokenManager } from '@contentgrowth/llm-service/utils/google';
+
+// Backend manages token lifecycle
+const sa = parseGoogleCredentials(serviceAccountJson);
+const tokenManager = new GoogleTokenManager(sa);
+const token = await tokenManager.getToken();
+
+// Pass pre-generated token to llm-service
+const llmService = new LLMService(env, {
+  provider: 'vertex',
+  accessToken: token,  // Pre-generated token
+  project: sa.project_id,
+  location: 'us-central1',
+  models: {
+    default: 'gemini-3.8-flash',
+    image: 'gemini-nano-banana-2.1'
+  }
+});
+
+// Use normally - llm-service will use the token
+const response = await llmService.chat('Hello!', 'tenant-id');
+```
+
+**Benefits of this approach:**
+- Backend controls token lifecycle and caching
+- Service account credentials stay in backend
+- llm-service receives only the token
+- Works in edge runtime environments
+
 ### Running JSON Mode Tests
 
 1. **Create `.env` file** (copy from `.env.example`):

package/dist/index.cjs

@@ -250,7 +250,7 @@ var MODEL_CONFIGS = {
     live: "gemini-3.8-live",
     liveThinking: "gemini-3.8-live-extended-thinking",
     video: "veo",
-    image: "gemini-3-pro-image"
+    image: "gemini-nano-banana-2.1"
   },
   // Vertex AI / Gemini Enterprise Agent Platform
   vertex: {
@@ -262,7 +262,7 @@ var MODEL_CONFIGS = {
     live: "gemini-3.8-live",
     liveThinking: "gemini-3.8-live-extended-thinking",
     video: "veo",
-    image: "gemini-3.1-flash-image"
+    image: "gemini-nano-banana-2.1"
   },
   // Anthropic IDs are "claude-<family>-<major>-<minor>", e.g. claude-sonnet-5-5 (not claude-5.5-sonnet).
   anthropic: {
@@ -277,11 +277,16 @@ var LEGACY_MODEL_ALIASES = {
   // OpenAI: ChatGPT product names, not API model IDs
   "gpt-5.5-instant": "gpt-5.6-luna",
   "gpt-5.5-thinking": "gpt-5.6-sol",
-  // Gemini: never existed
+  // Gemini: never existed or were preview names
   "gemini-3.5-pro": "gemini-3.1-pro-preview",
   "gemini-3.7-pro": "gemini-3.1-pro-preview",
   "gemini-3.5-pro-image-preview": "gemini-3-pro-image",
   "gemini-3.7-pro-image-preview": "gemini-3-pro-image",
+  // Old Gemini image models (pre-Nano Banana branding)
+  "gemini-3-pro-image": "gemini-nano-banana-2.1",
+  "gemini-3.1-flash-image": "gemini-nano-banana-2.1",
+  "gemini-3.1-flash-lite-image": "gemini-nano-banana-2.1",
+  "gemini-2.5-flash-image": "gemini-nano-banana-2.1",
   // Anthropic: wrong segment order
   "claude-4.5-haiku": "claude-haiku-4-5",
   "claude-4.6-sonnet": "claude-sonnet-4-6",
@@ -742,17 +747,24 @@ var GoogleProvider = class extends BaseLLMProvider {
     this.models = normalizeModelMap(config.models);
     this.defaultModel = this.models.default;
     this._pendingOperations = /* @__PURE__ */ new Map();
+    if (config.accessToken) {
+      this.accessToken = config.accessToken;
+      this.project = config.project;
+      this.location = config.location || "global";
+      this.useDirectAPI = true;
+      console.log(`[GoogleProvider] Using pre-generated access token for project: ${this.project}`);
+      return;
+    }
     const httpOptions = config.baseURL ? { baseUrl: config.baseURL } : void 0;
     if (config.provider === "vertex") {
-      const vertexLocation = config.location || "global";
       if (config.apiKey) {
         this.client = new import_genai.GoogleGenAI({
           vertexai: true,
           apiKey: config.apiKey,
-          location: vertexLocation,
           ...httpOptions ? { httpOptions } : {}
         });
       } else {
+        const vertexLocation = config.location || "global";
         if (!config.project) {
           console.warn("[GoogleProvider] Vertex AI: no project ID and no API key. Calls will likely fail.");
         }
@@ -776,8 +788,65 @@ var GoogleProvider = class extends BaseLLMProvider {
    * the client was constructed.
    */
   async _generateContent(requestOptions) {
+    if (this.useDirectAPI && this.accessToken) {
+      return this._directVertexAPICall(requestOptions);
+    }
     return this.client.models.generateContent(requestOptions);
   }
+  /**
+   * Direct Vertex AI API call using pre-generated access token
+   * @private
+   */
+  async _directVertexAPICall(requestOptions) {
+    var _a, _b, _c;
+    const modelPath = `projects/${this.project}/locations/${this.location}/publishers/google/models/${requestOptions.model}`;
+    const endpoint = `https://${this.location}-aiplatform.googleapis.com/v1/${modelPath}:generateContent`;
+    const body = {
+      contents: requestOptions.contents,
+      generationConfig: requestOptions.config
+    };
+    if ((_a = requestOptions.config) == null ? void 0 : _a.systemInstruction) {
+      body.systemInstruction = requestOptions.config.systemInstruction;
+    }
+    if ((_b = requestOptions.config) == null ? void 0 : _b.tools) {
+      body.tools = requestOptions.config.tools;
+    }
+    const response = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        "Authorization": `Bearer ${this.accessToken}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      let errorData;
+      try {
+        errorData = JSON.parse(errorText);
+      } catch (e) {
+        errorData = { message: errorText };
+      }
+      const errorMessage = ((_c = errorData.error) == null ? void 0 : _c.message) || errorData.message || `Vertex API error: ${response.status}`;
+      throw new LLMServiceException(errorMessage, response.status);
+    }
+    return response.json();
+  }
+  /**
+   * Determine authentication mode from config for logging/debugging
+   * @private
+   * @returns {string} Auth mode description
+   */
+  _getAuthMode() {
+    if (this.config.provider === "vertex") {
+      if (this.config.apiKey) {
+        return "Vertex Express (API Key)";
+      } else {
+        return "Vertex ADC (Service Account)";
+      }
+    }
+    return "Gemini AI Studio";
+  }
   async chat(userMessage, systemPrompt = "", options = {}) {
     const messages = [{ role: "user", content: userMessage }];
     const tier = options.tier || "default";
@@ -1124,15 +1193,22 @@ ${msg.content}`;
   }
   async imageGeneration(prompt, systemPrompt, options = {}) {
     var _a, _b, _c, _d, _e, _f, _g, _h, _i;
-    const modelName = normalizeModelId(options.model) || this.models.image || "gemini-3-pro-image";
-    console.log(`[${this.constructor.name}] Generating image with model: ${modelName}`);
+    const modelName = normalizeModelId(options.model) || this.models.image || "gemini-nano-banana-2.1";
+    if (modelName.startsWith("imagen-") || modelName.startsWith("imagegeneration@")) {
+      throw new LLMServiceException(
+        `Imagen models were shut down August 17, 2026. Requested: "${modelName}". Use Gemini image models instead (e.g., "gemini-nano-banana-2.1").`,
+        400
+      );
+    }
+    console.log(`[${this.constructor.name}] Generating image with model: ${modelName} (${this._getAuthMode()})`);
     const hasReferenceImages = options.images && options.images.length > 0;
     const generationConfig = {
       responseModalities: hasReferenceImages ? ["TEXT", "IMAGE"] : ["IMAGE"]
     };
-    if (options.aspectRatio) {
+    if (options.aspectRatio || options.thinkingLevel) {
       generationConfig.imageConfig = {
-        aspectRatio: options.aspectRatio
+        aspectRatio: options.aspectRatio || "1:1",
+        ...options.thinkingLevel ? { thinkingLevel: options.thinkingLevel } : {}
       };
     }
     const parts = [{ text: prompt }];
@@ -2025,53 +2101,173 @@ function sanitizeError(error, context = "general") {
 var import_openai2 = __toESM(require("openai"), 1);
 
 // src/utils/google-auth.js
-var jose = __toESM(require("jose"), 1);
-var GoogleAuth = class {
+var import_node_buffer = require("buffer");
+function validateServiceAccount(sa) {
+  if (!sa || typeof sa !== "object") {
+    throw new Error("Service account must be an object");
+  }
+  if (!sa.client_email) {
+    throw new Error("Service account missing client_email");
+  }
+  if (!sa.private_key) {
+    throw new Error("Service account missing private_key");
+  }
+  if (!sa.project_id) {
+    console.warn("[GoogleAuth] Service account missing project_id - may need to specify project explicitly");
+  }
+  return true;
+}
+var GoogleTokenManager = class {
   /**
-   * @param {Object} credentials - Parsed Service Account JSON
+   * @param {object} serviceAccount - Parsed service account with client_email and private_key
+   * @param {object} options - Optional configuration
+   * @param {string} options.scope - OAuth2 scope (default: cloud-platform)
+   * @param {number} options.tokenLifetime - Token lifetime in seconds (default: 3600)
    */
-  constructor(credentials) {
-    if (!credentials || !credentials.private_key || !credentials.client_email) {
-      throw new Error("Invalid Google credentials. Missing private_key or client_email.");
+  constructor(serviceAccount, options = {}) {
+    validateServiceAccount(serviceAccount);
+    this.clientEmail = serviceAccount.client_email;
+    this.privateKey = serviceAccount.private_key;
+    this.projectId = serviceAccount.project_id;
+    this.scope = options.scope || "https://www.googleapis.com/auth/cloud-platform";
+    this.tokenLifetime = options.tokenLifetime || 3600;
+    this._tokenCache = null;
+    this._expiresAt = 0;
+  }
+  /**
+   * Get a valid access token (cached or fresh)
+   * 
+   * @returns {Promise<string>} OAuth2 access token
+   */
+  async getToken() {
+    const now = Math.floor(Date.now() / 1e3);
+    if (this._tokenCache && now < this._expiresAt - 300) {
+      return this._tokenCache;
     }
-    this.credentials = credentials;
-    this.tokenUrl = "https://oauth2.googleapis.com/token";
-    this.scopes = ["https://www.googleapis.com/auth/cloud-platform"];
+    this._tokenCache = await this._generateToken();
+    this._expiresAt = now + this.tokenLifetime;
+    return this._tokenCache;
+  }
+  /**
+   * Clear cached token (force refresh on next getToken call)
+   */
+  invalidate() {
+    this._tokenCache = null;
+    this._expiresAt = 0;
   }
   /**
-   * Generate a signed JWT for the token exchange
+   * Check if cached token is still valid
+   * 
+   * @returns {boolean} True if token is valid
    */
-  async createSignedJWT() {
-    const alg = "RS256";
-    const privateKey = await jose.importPKCS8(this.credentials.private_key, alg);
-    const jwt = await new jose.SignJWT({
-      scope: this.scopes.join(" ")
-    }).setProtectedHeader({ alg }).setIssuedAt().setIssuer(this.credentials.client_email).setAudience(this.tokenUrl).setExpirationTime("1h").sign(privateKey);
-    return jwt;
+  isValid() {
+    const now = Math.floor(Date.now() / 1e3);
+    return this._tokenCache && now < this._expiresAt - 300;
   }
   /**
-   * Get an access token from Google OAuth2
-   * @returns {Promise<string>} Access Token
+   * Get time until token expires (in seconds)
+   * 
+   * @returns {number} Seconds until expiration (0 if no token or expired)
    */
-  async getAccessToken() {
-    const jwt = await this.createSignedJWT();
-    const params = new URLSearchParams();
-    params.append("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer");
-    params.append("assertion", jwt);
-    const response = await fetch(this.tokenUrl, {
+  getTimeToExpiry() {
+    if (!this._tokenCache) return 0;
+    const now = Math.floor(Date.now() / 1e3);
+    return Math.max(0, this._expiresAt - now);
+  }
+  /**
+   * Generate OAuth2 token via JWT flow
+   * 
+   * @private
+   * @returns {Promise<string>} Access token
+   */
+  async _generateToken() {
+    const now = Math.floor(Date.now() / 1e3);
+    const header = {
+      alg: "RS256",
+      typ: "JWT"
+    };
+    const payload = {
+      iss: this.clientEmail,
+      scope: this.scope,
+      aud: "https://oauth2.googleapis.com/token",
+      exp: now + this.tokenLifetime,
+      iat: now
+    };
+    const jwt = await this._signJWT(header, payload);
+    const response = await fetch("https://oauth2.googleapis.com/token", {
       method: "POST",
       headers: {
         "Content-Type": "application/x-www-form-urlencoded"
       },
-      body: params
+      body: new URLSearchParams({
+        grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+        assertion: jwt
+      })
     });
     if (!response.ok) {
-      const errorText = await response.text();
-      throw new Error(`Failed to get Google Access Token: ${response.status} ${errorText}`);
+      const error = await response.text();
+      throw new Error(`Failed to get OAuth2 token: ${response.status} - ${error}`);
     }
     const data = await response.json();
+    if (!data.access_token) {
+      throw new Error("No access_token in OAuth2 response");
+    }
     return data.access_token;
   }
+  /**
+   * Sign JWT using service account private key
+   * 
+   * @private
+   * @param {object} header - JWT header
+   * @param {object} payload - JWT payload
+   * @returns {Promise<string>} Signed JWT
+   */
+  async _signJWT(header, payload) {
+    const encoder = new TextEncoder();
+    const headerB64 = this._base64UrlEncode(JSON.stringify(header));
+    const payloadB64 = this._base64UrlEncode(JSON.stringify(payload));
+    const unsignedToken = `${headerB64}.${payloadB64}`;
+    const privateKey = await this._importPrivateKey(this.privateKey);
+    const signature = await crypto.subtle.sign(
+      { name: "RSASSA-PKCS1-v1_5" },
+      privateKey,
+      encoder.encode(unsignedToken)
+    );
+    const signatureB64 = this._base64UrlEncode(signature);
+    return `${unsignedToken}.${signatureB64}`;
+  }
+  /**
+   * Import PEM private key for signing
+   * 
+   * @private
+   * @param {string} pemKey - PEM formatted private key
+   * @returns {Promise<CryptoKey>} Imported key
+   */
+  async _importPrivateKey(pemKey) {
+    const pemContents = pemKey.replace(/-----BEGIN PRIVATE KEY-----/, "").replace(/-----END PRIVATE KEY-----/, "").replace(/\\n/g, "").replace(/\n/g, "").trim();
+    const binaryKey = import_node_buffer.Buffer.from(pemContents, "base64");
+    return crypto.subtle.importKey(
+      "pkcs8",
+      binaryKey,
+      {
+        name: "RSASSA-PKCS1-v1_5",
+        hash: "SHA-256"
+      },
+      false,
+      ["sign"]
+    );
+  }
+  /**
+   * Base64 URL encode (without padding)
+   * 
+   * @private
+   * @param {string|ArrayBuffer} input - Data to encode
+   * @returns {string} Base64 URL encoded string
+   */
+  _base64UrlEncode(input) {
+    const buffer = typeof input === "string" ? import_node_buffer.Buffer.from(input, "utf-8") : import_node_buffer.Buffer.from(input);
+    return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  }
 };
 
 // src/transcription-service.js
@@ -2091,7 +2287,7 @@ var TranscriptionService = class {
     if (this.provider === "openai") {
       this.client = new import_openai2.default({ apiKey: this.apiKey });
     } else if (this.provider === "google") {
-      this.googleAuth = new GoogleAuth(config.googleCredentials);
+      this.googleTokenManager = new GoogleTokenManager(config.googleCredentials);
       this.projectId = config.googleCredentials.project_id;
     }
   }
@@ -2172,7 +2368,7 @@ var TranscriptionService = class {
   }
   async _transcribeGoogle(audioFile, model, language) {
     try {
-      const accessToken = await this.googleAuth.getAccessToken();
+      const accessToken = await this.googleTokenManager.getToken();
       const arrayBuffer = await audioFile.arrayBuffer();
       const audioBytes = Buffer.from(arrayBuffer).toString("base64");
       let location = "global";