@contentgrowth/llm-service 1.3.8 → 1.4.0

package/dist/index.js

@@ -196,7 +196,7 @@ var MODEL_CONFIGS = {
     live: "gemini-3.8-live",
     liveThinking: "gemini-3.8-live-extended-thinking",
     video: "veo",
-    image: "gemini-3-pro-image"
+    image: "gemini-nano-banana-2.1"
   },
   // Vertex AI / Gemini Enterprise Agent Platform
   vertex: {
@@ -208,7 +208,7 @@ var MODEL_CONFIGS = {
     live: "gemini-3.8-live",
     liveThinking: "gemini-3.8-live-extended-thinking",
     video: "veo",
-    image: "gemini-3.1-flash-image"
+    image: "gemini-nano-banana-2.1"
   },
   // Anthropic IDs are "claude-<family>-<major>-<minor>", e.g. claude-sonnet-5-5 (not claude-5.5-sonnet).
   anthropic: {
@@ -223,11 +223,16 @@ var LEGACY_MODEL_ALIASES = {
   // OpenAI: ChatGPT product names, not API model IDs
   "gpt-5.5-instant": "gpt-5.6-luna",
   "gpt-5.5-thinking": "gpt-5.6-sol",
-  // Gemini: never existed
+  // Gemini: never existed or were preview names
   "gemini-3.5-pro": "gemini-3.1-pro-preview",
   "gemini-3.7-pro": "gemini-3.1-pro-preview",
   "gemini-3.5-pro-image-preview": "gemini-3-pro-image",
   "gemini-3.7-pro-image-preview": "gemini-3-pro-image",
+  // Old Gemini image models (pre-Nano Banana branding)
+  "gemini-3-pro-image": "gemini-nano-banana-2.1",
+  "gemini-3.1-flash-image": "gemini-nano-banana-2.1",
+  "gemini-3.1-flash-lite-image": "gemini-nano-banana-2.1",
+  "gemini-2.5-flash-image": "gemini-nano-banana-2.1",
   // Anthropic: wrong segment order
   "claude-4.5-haiku": "claude-haiku-4-5",
   "claude-4.6-sonnet": "claude-sonnet-4-6",
@@ -688,6 +693,14 @@ var GoogleProvider = class extends BaseLLMProvider {
     this.models = normalizeModelMap(config.models);
     this.defaultModel = this.models.default;
     this._pendingOperations = /* @__PURE__ */ new Map();
+    if (config.accessToken) {
+      this.accessToken = config.accessToken;
+      this.project = config.project;
+      this.location = config.location || "global";
+      this.useDirectAPI = true;
+      console.log(`[GoogleProvider] Using pre-generated access token for project: ${this.project}`);
+      return;
+    }
     const httpOptions = config.baseURL ? { baseUrl: config.baseURL } : void 0;
     if (config.provider === "vertex") {
       if (config.apiKey) {
@@ -721,8 +734,65 @@ var GoogleProvider = class extends BaseLLMProvider {
    * the client was constructed.
    */
   async _generateContent(requestOptions) {
+    if (this.useDirectAPI && this.accessToken) {
+      return this._directVertexAPICall(requestOptions);
+    }
     return this.client.models.generateContent(requestOptions);
   }
+  /**
+   * Direct Vertex AI API call using pre-generated access token
+   * @private
+   */
+  async _directVertexAPICall(requestOptions) {
+    var _a, _b, _c;
+    const modelPath = `projects/${this.project}/locations/${this.location}/publishers/google/models/${requestOptions.model}`;
+    const endpoint = `https://${this.location}-aiplatform.googleapis.com/v1/${modelPath}:generateContent`;
+    const body = {
+      contents: requestOptions.contents,
+      generationConfig: requestOptions.config
+    };
+    if ((_a = requestOptions.config) == null ? void 0 : _a.systemInstruction) {
+      body.systemInstruction = requestOptions.config.systemInstruction;
+    }
+    if ((_b = requestOptions.config) == null ? void 0 : _b.tools) {
+      body.tools = requestOptions.config.tools;
+    }
+    const response = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        "Authorization": `Bearer ${this.accessToken}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      let errorData;
+      try {
+        errorData = JSON.parse(errorText);
+      } catch (e) {
+        errorData = { message: errorText };
+      }
+      const errorMessage = ((_c = errorData.error) == null ? void 0 : _c.message) || errorData.message || `Vertex API error: ${response.status}`;
+      throw new LLMServiceException(errorMessage, response.status);
+    }
+    return response.json();
+  }
+  /**
+   * Determine authentication mode from config for logging/debugging
+   * @private
+   * @returns {string} Auth mode description
+   */
+  _getAuthMode() {
+    if (this.config.provider === "vertex") {
+      if (this.config.apiKey) {
+        return "Vertex Express (API Key)";
+      } else {
+        return "Vertex ADC (Service Account)";
+      }
+    }
+    return "Gemini AI Studio";
+  }
   async chat(userMessage, systemPrompt = "", options = {}) {
     const messages = [{ role: "user", content: userMessage }];
     const tier = options.tier || "default";
@@ -1069,15 +1139,22 @@ ${msg.content}`;
   }
   async imageGeneration(prompt, systemPrompt, options = {}) {
     var _a, _b, _c, _d, _e, _f, _g, _h, _i;
-    const modelName = normalizeModelId(options.model) || this.models.image || "gemini-3-pro-image";
-    console.log(`[${this.constructor.name}] Generating image with model: ${modelName}`);
+    const modelName = normalizeModelId(options.model) || this.models.image || "gemini-nano-banana-2.1";
+    if (modelName.startsWith("imagen-") || modelName.startsWith("imagegeneration@")) {
+      throw new LLMServiceException(
+        `Imagen models were shut down August 17, 2026. Requested: "${modelName}". Use Gemini image models instead (e.g., "gemini-nano-banana-2.1").`,
+        400
+      );
+    }
+    console.log(`[${this.constructor.name}] Generating image with model: ${modelName} (${this._getAuthMode()})`);
     const hasReferenceImages = options.images && options.images.length > 0;
     const generationConfig = {
       responseModalities: hasReferenceImages ? ["TEXT", "IMAGE"] : ["IMAGE"]
     };
-    if (options.aspectRatio) {
+    if (options.aspectRatio || options.thinkingLevel) {
       generationConfig.imageConfig = {
-        aspectRatio: options.aspectRatio
+        aspectRatio: options.aspectRatio || "1:1",
+        ...options.thinkingLevel ? { thinkingLevel: options.thinkingLevel } : {}
       };
     }
     const parts = [{ text: prompt }];
@@ -1970,53 +2047,173 @@ function sanitizeError(error, context = "general") {
 import OpenAI2 from "openai";
 
 // src/utils/google-auth.js
-import * as jose from "jose";
-var GoogleAuth = class {
+import { Buffer as Buffer2 } from "buffer";
+function validateServiceAccount(sa) {
+  if (!sa || typeof sa !== "object") {
+    throw new Error("Service account must be an object");
+  }
+  if (!sa.client_email) {
+    throw new Error("Service account missing client_email");
+  }
+  if (!sa.private_key) {
+    throw new Error("Service account missing private_key");
+  }
+  if (!sa.project_id) {
+    console.warn("[GoogleAuth] Service account missing project_id - may need to specify project explicitly");
+  }
+  return true;
+}
+var GoogleTokenManager = class {
   /**
-   * @param {Object} credentials - Parsed Service Account JSON
+   * @param {object} serviceAccount - Parsed service account with client_email and private_key
+   * @param {object} options - Optional configuration
+   * @param {string} options.scope - OAuth2 scope (default: cloud-platform)
+   * @param {number} options.tokenLifetime - Token lifetime in seconds (default: 3600)
    */
-  constructor(credentials) {
-    if (!credentials || !credentials.private_key || !credentials.client_email) {
-      throw new Error("Invalid Google credentials. Missing private_key or client_email.");
+  constructor(serviceAccount, options = {}) {
+    validateServiceAccount(serviceAccount);
+    this.clientEmail = serviceAccount.client_email;
+    this.privateKey = serviceAccount.private_key;
+    this.projectId = serviceAccount.project_id;
+    this.scope = options.scope || "https://www.googleapis.com/auth/cloud-platform";
+    this.tokenLifetime = options.tokenLifetime || 3600;
+    this._tokenCache = null;
+    this._expiresAt = 0;
+  }
+  /**
+   * Get a valid access token (cached or fresh)
+   * 
+   * @returns {Promise<string>} OAuth2 access token
+   */
+  async getToken() {
+    const now = Math.floor(Date.now() / 1e3);
+    if (this._tokenCache && now < this._expiresAt - 300) {
+      return this._tokenCache;
     }
-    this.credentials = credentials;
-    this.tokenUrl = "https://oauth2.googleapis.com/token";
-    this.scopes = ["https://www.googleapis.com/auth/cloud-platform"];
+    this._tokenCache = await this._generateToken();
+    this._expiresAt = now + this.tokenLifetime;
+    return this._tokenCache;
+  }
+  /**
+   * Clear cached token (force refresh on next getToken call)
+   */
+  invalidate() {
+    this._tokenCache = null;
+    this._expiresAt = 0;
+  }
+  /**
+   * Check if cached token is still valid
+   * 
+   * @returns {boolean} True if token is valid
+   */
+  isValid() {
+    const now = Math.floor(Date.now() / 1e3);
+    return this._tokenCache && now < this._expiresAt - 300;
   }
   /**
-   * Generate a signed JWT for the token exchange
+   * Get time until token expires (in seconds)
+   * 
+   * @returns {number} Seconds until expiration (0 if no token or expired)
    */
-  async createSignedJWT() {
-    const alg = "RS256";
-    const privateKey = await jose.importPKCS8(this.credentials.private_key, alg);
-    const jwt = await new jose.SignJWT({
-      scope: this.scopes.join(" ")
-    }).setProtectedHeader({ alg }).setIssuedAt().setIssuer(this.credentials.client_email).setAudience(this.tokenUrl).setExpirationTime("1h").sign(privateKey);
-    return jwt;
+  getTimeToExpiry() {
+    if (!this._tokenCache) return 0;
+    const now = Math.floor(Date.now() / 1e3);
+    return Math.max(0, this._expiresAt - now);
   }
   /**
-   * Get an access token from Google OAuth2
-   * @returns {Promise<string>} Access Token
+   * Generate OAuth2 token via JWT flow
+   * 
+   * @private
+   * @returns {Promise<string>} Access token
    */
-  async getAccessToken() {
-    const jwt = await this.createSignedJWT();
-    const params = new URLSearchParams();
-    params.append("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer");
-    params.append("assertion", jwt);
-    const response = await fetch(this.tokenUrl, {
+  async _generateToken() {
+    const now = Math.floor(Date.now() / 1e3);
+    const header = {
+      alg: "RS256",
+      typ: "JWT"
+    };
+    const payload = {
+      iss: this.clientEmail,
+      scope: this.scope,
+      aud: "https://oauth2.googleapis.com/token",
+      exp: now + this.tokenLifetime,
+      iat: now
+    };
+    const jwt = await this._signJWT(header, payload);
+    const response = await fetch("https://oauth2.googleapis.com/token", {
       method: "POST",
       headers: {
         "Content-Type": "application/x-www-form-urlencoded"
       },
-      body: params
+      body: new URLSearchParams({
+        grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+        assertion: jwt
+      })
     });
     if (!response.ok) {
-      const errorText = await response.text();
-      throw new Error(`Failed to get Google Access Token: ${response.status} ${errorText}`);
+      const error = await response.text();
+      throw new Error(`Failed to get OAuth2 token: ${response.status} - ${error}`);
     }
     const data = await response.json();
+    if (!data.access_token) {
+      throw new Error("No access_token in OAuth2 response");
+    }
     return data.access_token;
   }
+  /**
+   * Sign JWT using service account private key
+   * 
+   * @private
+   * @param {object} header - JWT header
+   * @param {object} payload - JWT payload
+   * @returns {Promise<string>} Signed JWT
+   */
+  async _signJWT(header, payload) {
+    const encoder = new TextEncoder();
+    const headerB64 = this._base64UrlEncode(JSON.stringify(header));
+    const payloadB64 = this._base64UrlEncode(JSON.stringify(payload));
+    const unsignedToken = `${headerB64}.${payloadB64}`;
+    const privateKey = await this._importPrivateKey(this.privateKey);
+    const signature = await crypto.subtle.sign(
+      { name: "RSASSA-PKCS1-v1_5" },
+      privateKey,
+      encoder.encode(unsignedToken)
+    );
+    const signatureB64 = this._base64UrlEncode(signature);
+    return `${unsignedToken}.${signatureB64}`;
+  }
+  /**
+   * Import PEM private key for signing
+   * 
+   * @private
+   * @param {string} pemKey - PEM formatted private key
+   * @returns {Promise<CryptoKey>} Imported key
+   */
+  async _importPrivateKey(pemKey) {
+    const pemContents = pemKey.replace(/-----BEGIN PRIVATE KEY-----/, "").replace(/-----END PRIVATE KEY-----/, "").replace(/\\n/g, "").replace(/\n/g, "").trim();
+    const binaryKey = Buffer2.from(pemContents, "base64");
+    return crypto.subtle.importKey(
+      "pkcs8",
+      binaryKey,
+      {
+        name: "RSASSA-PKCS1-v1_5",
+        hash: "SHA-256"
+      },
+      false,
+      ["sign"]
+    );
+  }
+  /**
+   * Base64 URL encode (without padding)
+   * 
+   * @private
+   * @param {string|ArrayBuffer} input - Data to encode
+   * @returns {string} Base64 URL encoded string
+   */
+  _base64UrlEncode(input) {
+    const buffer = typeof input === "string" ? Buffer2.from(input, "utf-8") : Buffer2.from(input);
+    return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  }
 };
 
 // src/transcription-service.js
@@ -2036,7 +2233,7 @@ var TranscriptionService = class {
     if (this.provider === "openai") {
       this.client = new OpenAI2({ apiKey: this.apiKey });
     } else if (this.provider === "google") {
-      this.googleAuth = new GoogleAuth(config.googleCredentials);
+      this.googleTokenManager = new GoogleTokenManager(config.googleCredentials);
       this.projectId = config.googleCredentials.project_id;
     }
   }
@@ -2117,7 +2314,7 @@ var TranscriptionService = class {
   }
   async _transcribeGoogle(audioFile, model, language) {
     try {
-      const accessToken = await this.googleAuth.getAccessToken();
+      const accessToken = await this.googleTokenManager.getToken();
       const arrayBuffer = await audioFile.arrayBuffer();
       const audioBytes = Buffer.from(arrayBuffer).toString("base64");
       let location = "global";