@kaydash9999/banker-plugins 0.15.2 → 0.16.1

package/skills/3d-intro-setup/references/azure-adapter.mjs

@@ -36,8 +36,9 @@ function originOf(url) {
     const u = new URL(raw);
     return `${u.protocol}//${u.host}`;
   } catch {
-    const m = raw.match(/^(https?:\/\/[^/]+)/i);
-    return m ? m[1] : raw.replace(/\/+$/, '');
+    // Not a URL: null, never the raw text, which may be a key pasted into the endpoint field.
+    const m = raw.match(/^(https?:\/\/[^/\s]+)/i);
+    return m ? m[1] : null;
   }
 }
 
@@ -50,6 +51,10 @@ function truncate(x, n = 300) {
   return s.length > n ? `${s.slice(0, n)}…(+${s.length - n})` : s;
 }
 
+// Why an azFetch result has no HTTP answer, for error messages: " (EINSECURE)" and the like. The
+// error's code or name only, never its text: fetch can quote a header value, a key included.
+const why = (r) => (r.error ? ` (${r.error.cause?.code || r.error.code || r.error.name})` : '');
+
 // Last n chars of ffmpeg stderr (the useful part) for error messages.
 const tail = (s, n = 400) => { const str = String(s || ''); return str.length > n ? str.slice(-n) : str; };
 
@@ -93,25 +98,42 @@ export function parseConsoleSample(text) {
     if (m) out.deployment = m[1];
   }
 
-  // key: Authorization: Bearer <k> | api-key: <k> (curl header) | api_key="<k>" (python/JS SDK).
-  m = s.match(/Authorization["']?\s*[:=]\s*["']?\s*Bearer\s+([A-Za-z0-9._-]+)/i);
-  if (!m) m = s.match(/api[-_]?key["']?\s*[:=]\s*["']?\s*([A-Za-z0-9._-]+)/i);
+  // key: Authorization: Bearer <k> | api-key: <k> (curl header) | api_key="<k>", "api-key": "<k>",
+  // apiKey: '<k>' (python/JS SDK). An SDK value counts only in quotes: api_key=subscription_key or
+  // apiKey: process.env.X names a variable, and taking that name for the key would replace a real one.
+  m = s.match(/Authorization["']?\s*[:=]\s*["']?\s*Bearer\s+([A-Za-z0-9._-]+)/i)
+    || s.match(/api-key\s*:\s*([A-Za-z0-9._-]+)/i)
+    || s.match(/api[-_]?key["']?\s*[:=]\s*["']([A-Za-z0-9._-]+)["']/i);
   if (m) out.apiKey = m[1];
 
   return out;
 }
 
-/** Parse a KEY=VALUE .env body into a plain object (strips surrounding quotes, skips comments). */
+/**
+ * Parse a KEY=VALUE .env body into a plain object, skipping comment lines. A quoted value keeps
+ * everything inside its quotes. In an unquoted value, a # that follows whitespace starts a comment
+ * (also right after `=`), so a note after a value never becomes part of an endpoint or a key.
+ */
 export function parseEnvFile(text) {
   const env = {};
   for (const line of String(text || '').split(/\r?\n/)) {
     if (line.trimStart().startsWith('#')) continue;
-    const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*?)\s*$/);
-    if (m) env[m[1]] = m[2].replace(/^["']|["']$/g, '');
+    const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=([^\n]*)$/);
+    if (m) env[m[1]] = envValue(m[2]);
   }
   return env;
 }
 
+// `raw` is everything after `=`, so the whitespace before a leading # is still there. A stray
+// trailing \r (a \r\r\n line end) is whitespace too.
+function envValue(raw) {
+  const v = raw.trim();
+  const q = v[0];
+  const end = q === '"' || q === "'" ? v.indexOf(q, 1) : -1;
+  if (end > 0) return v.slice(1, end);
+  return raw.trimEnd().replace(/\s+#.*$/, '').trim().replace(/^["']|["']$/g, '');
+}
+
 /**
  * Load creds from `.env.3d-intro.local` in projectDir, else `~/.config/banker/3d-intro/env`.
  * Returns the parsed KEY=VALUE map plus `_source` (the file used, or null if none found).
@@ -135,7 +157,7 @@ export function persistCreds(creds, { target } = {}) {
   const lines = [];
   for (const [k, v] of Object.entries(creds || {})) {
     if (k.startsWith('_') || v == null) continue;
-    lines.push(`${k}=${String(v)}`);
+    lines.push(`${k}=${envLiteral(String(v))}`);
   }
   const body = lines.length ? `${lines.join('\n')}\n` : '';
   fs.mkdirSync(path.dirname(target), { recursive: true });
@@ -144,22 +166,107 @@ export function persistCreds(creds, { target } = {}) {
   return target;
 }
 
-/** Redact a secret to `abcd…wxyz(len)`; short (<=8) secrets are fully masked; falsy -> "(missing)". */
+// Quote a value that parseEnvFile would otherwise cut at " #", trim, or strip of its quotes.
+function envLiteral(v) {
+  if (!/\s#|^["'\s]|["'\s]$/.test(v)) return v;
+  return v.includes('"') ? `'${v}'` : `"${v}"`;
+}
+
+/**
+ * Redact a secret to its length only, `…(len)`: no character of it, since keys share fixed
+ * prefixes (`sk-ws-`) and a shown tail narrows them down. Falsy -> "(missing)".
+ */
 export function redact(s) {
   if (!s) return '(missing)';
-  const str = String(s);
-  if (str.length <= 8) return `…(${str.length})`;
-  return `${str.slice(0, 4)}…${str.slice(-4)}(${str.length})`;
+  return `…(${String(s).length})`;
 }
 
 // ---------------------------------------------------------------------------
 // HTTP
 // ---------------------------------------------------------------------------
 
+const REDIRECT_STATUS = new Set([301, 302, 303, 307, 308]);
+const SECRET_HEADERS = new Set(['authorization', 'api-key', 'proxy-authorization', 'cookie']);
+const MAX_HOPS = 5;
+const LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]']);
+const localHttp = (u) => u.protocol === 'http:' && LOOPBACK.has(u.hostname);
+const refused = (code, message) => Object.assign(new TypeError(`fetch failed: ${message}`), { cause: { code } });
+const isSecret = (name) => SECRET_HEADERS.has(name.toLowerCase());
+const withoutSecrets = (headers) => Object.fromEntries(Object.entries(headers).filter(([k]) => !isSecret(k)));
+// Every form fetch takes (an object, [name, value] pairs, Headers) as one plain object, so a key is
+// found in any of them. Pairs would otherwise read as headers named "0", "1".
+const plainHeaders = (h) => (Array.isArray(h) || h instanceof Headers ? Object.fromEntries(new Headers(h)) : { ...h });
+
+/** Whether a key may go to this URL: over https, or over http only to this machine (a local mock or proxy). */
+export const safeForKey = (u) => u.protocol === 'https:' || localHttp(u);
+
+// Where a redirect goes. The request was sent already, so a Location that is not a URL, or one that
+// leaves https, ends it with a code that does not read as "nothing sent". http stays allowed only
+// while the request is on this machine over http (a local mock); from anywhere else, an https
+// localhost included, it would reach a service here or on the network.
+function redirectTarget(location, from) {
+  let next;
+  try { next = new URL(location, from); } catch { throw refused('EBADREDIRECT', 'the redirect location is not a URL'); }
+  if (next.protocol === 'https:' || (localHttp(next) && localHttp(from))) return next;
+  throw refused('EINSECUREREDIRECT', 'a redirect away from https is not followed');
+}
+
+// The request for the next hop of a redirect. A request with a body (a prompt, a frame, a paid submit)
+// follows only a 307 or 308 within its origin, which send it again as it was. A 301, 302 or 303 would
+// make it a GET, and another origin is another server: either way the next answer does not answer this
+// request, and its 401 or 429 would read as this key's (a key retired, a submit sent again elsewhere).
+// Without a body, a 303, and a 301 or 302 after a POST, go on as a GET, as browsers do, and a hop to
+// another origin goes without the secret headers.
+function nextHop(req, status, crossOrigin) {
+  if (req.body != null && (crossOrigin || status < 307)) {
+    throw refused(crossOrigin ? 'ECROSSREDIRECT' : 'EBODYREDIRECT', 'a request with a body follows only a 307 or 308 within its origin');
+  }
+  const toGet = status === 303 || ((status === 301 || status === 302) && req.method === 'POST');
+  const next = toGet ? { ...req, method: 'GET', body: undefined } : req;
+  return crossOrigin ? { ...next, headers: withoutSecrets(next.headers) } : next;
+}
+
+/**
+ * fetch that follows redirects by hand (at most 5): a request without a body as fetch would, but to
+ * another origin without the key headers; a request with a body only by a 307 or 308 within its
+ * origin (fetch itself forwards a custom `api-key` header and re-sends the body on 307 and 308 to
+ * any origin, and turns a POST into a GET on 301 to 303). A key goes only where safeForKey allows: an http
+ * URL with one is refused before anything is sent (cause.code EINSECURE), and no redirect leaves
+ * https. Throws as fetch does on a network error.
+ */
+export async function fetchGuarded(url, init = {}) {
+  let target = new URL(String(url));
+  let req = { ...init, headers: plainHeaders(init.headers), redirect: 'manual' };
+  if (!safeForKey(target) && Object.keys(req.headers).some(isSecret)) throw refused('EINSECURE', 'a key is sent only over https');
+  for (let hop = 0; hop <= MAX_HOPS; hop++) {
+    const r = await globalThis.fetch(target.href, req);
+    const location = REDIRECT_STATUS.has(r.status) ? r.headers.get('location') : null;
+    if (!location) return r;
+    try { await r.body?.cancel(); } catch { /* the redirect body is not needed */ }
+    const next = redirectTarget(location, target);
+    req = nextHop(req, r.status, next.origin !== target.origin);
+    target = next;
+  }
+  throw refused('ETOOMANYREDIRECTS', 'too many redirects');
+}
+
+// Retry-After / retry-after-ms response header -> milliseconds (null when absent or unparsable).
+function retryAfterMsOf(headers) {
+  const ms = Number(headers.get('retry-after-ms'));
+  if (headers.get('retry-after-ms') && Number.isFinite(ms)) return Math.max(0, ms);
+  const h = headers.get('retry-after');
+  if (!h) return null;
+  const sec = Number(h);
+  if (Number.isFinite(sec)) return Math.max(0, sec * 1000);
+  const at = Date.parse(h);
+  return Number.isFinite(at) ? Math.max(0, at - Date.now()) : null;
+}
+
 /**
  * Fetch an Azure URL trying the `api-key` header first and, on 401/403, retrying with
  * `Authorization: Bearer`. Never throws on HTTP status; a network error yields {status:0}.
- * @returns {Promise<{status:number, ok:boolean, ct:string, body:any, authStyle:string|null, error?:Error}>}
+ * `retryAfterMs` carries the server's Retry-After hint (null when absent).
+ * @returns {Promise<{status:number, ok:boolean, ct:string, body:any, authStyle:string|null, retryAfterMs:number|null, error?:Error}>}
  */
 export async function azFetch(url, { key, binary = false, headers = {}, method = 'GET', body } = {}) {
   const styles = key ? [{ 'api-key': key }, { Authorization: `Bearer ${key}` }] : [{}];
@@ -169,7 +276,7 @@ export async function azFetch(url, { key, binary = false, headers = {}, method =
     if (body !== undefined) opts.body = body;
     let r;
     try {
-      r = await globalThis.fetch(url, opts);
+      r = await fetchGuarded(url, opts);
     } catch (e) {
       last = { status: 0, ok: false, ct: '', body: null, authStyle: null, error: e };
       break; // network error is not an auth problem — do not retry other styles
@@ -179,7 +286,7 @@ export async function azFetch(url, { key, binary = false, headers = {}, method =
     if (binary) parsed = Buffer.from(await r.arrayBuffer());
     else if (ct.includes('json')) parsed = await r.json().catch(() => null);
     else parsed = await r.text().catch(() => null);
-    last = { status: r.status, ok: r.ok, ct, body: parsed, authStyle: Object.keys(auth)[0] || null };
+    last = { status: r.status, ok: r.ok, ct, body: parsed, authStyle: Object.keys(auth)[0] || null, retryAfterMs: retryAfterMsOf(r.headers) };
     if (r.status !== 401 && r.status !== 403) return last; // accepted (or a non-auth error)
     // else: this auth style was rejected — fall through and try the next
   }
@@ -190,30 +297,44 @@ export async function azFetch(url, { key, binary = false, headers = {}, method =
 // Images
 // ---------------------------------------------------------------------------
 
+// POST JSON, retrying HTTP 429 up to `retries` times. Waits the server's Retry-After when given,
+// else 10s, 20s, 40s…; either way at most 60s per wait. Low-tier (S0) image deployments hit this.
+async function postJsonWith429Retry(url, { key, body, retries, onNote }) {
+  for (let i = 0; ; i++) {
+    const r = await azFetch(url, { key, method: 'POST', headers: { 'Content-Type': 'application/json' }, body });
+    if (r.status !== 429 || i >= retries) return r;
+    const ms = Math.min(60000, r.retryAfterMs ?? 10000 * 2 ** i);
+    if (typeof onNote === 'function') onNote(`HTTP 429; retry ${i + 1}/${retries} in ${ms} ms`);
+    await sleep(ms);
+  }
+}
+
 /**
  * Generate a still via the v1 images path; on failure fall back to the classic
  * `deployments/<dep>` path @2025-04-01-preview (discrete size). Returns a PNG Buffer.
- * `onNote(msg)` (optional) is invoked when the classic fallback is taken.
+ * HTTP 429 is retried on the same path first (`retry429` times) — the classic path shares the
+ * deployment's rate limit, so falling back on 429 would only fail again.
+ * `onNote(msg)` (optional) is invoked on 429 waits and when the classic fallback is taken.
  */
 export async function generateImage({
   endpoint, key, deployment, apiVersion = 'preview',
-  prompt, size = '720x1280', quality = 'low', n = 1, onNote,
+  prompt, size = '720x1280', quality = 'low', n = 1, onNote, retry429 = 3,
 } = {}) {
   const genBody = { model: deployment, prompt, size, quality, n };
-  let r = await azFetch(`${endpoint}/openai/v1/images/generations?api-version=${apiVersion}`, {
-    key, method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(genBody),
+  let r = await postJsonWith429Retry(`${endpoint}/openai/v1/images/generations?api-version=${apiVersion}`, {
+    key, body: JSON.stringify(genBody), retries: retry429, onNote,
   });
   let note = 'v1';
-  if (!(r.ok && r.body?.data?.[0]?.b64_json)) {
+  // no classic retry on 429 (shared limit) or on a lost connection (the v1 call may have billed)
+  if (!(r.ok && r.body?.data?.[0]?.b64_json) && r.status !== 429 && r.status !== 0) {
     note = 'classic-fallback(2025-04-01-preview)';
     if (typeof onNote === 'function') onNote(`generateImage: v1 path failed (HTTP ${r.status}); trying ${note}`);
-    r = await azFetch(`${endpoint}/openai/deployments/${deployment}/images/generations?api-version=2025-04-01-preview`, {
-      key, method: 'POST', headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ ...genBody, size: classicSize(size) }),
+    r = await postJsonWith429Retry(`${endpoint}/openai/deployments/${deployment}/images/generations?api-version=2025-04-01-preview`, {
+      key, body: JSON.stringify({ ...genBody, size: classicSize(size) }), retries: retry429, onNote,
     });
   }
   const b64 = r.body?.data?.[0]?.b64_json;
-  if (!(r.ok && b64)) throw new Error(`generateImage failed (${note}): HTTP ${r.status} ${truncate(r.body)}`);
+  if (!(r.ok && b64)) throw new Error(`generateImage failed (${note}): HTTP ${r.status}${why(r)} ${truncate(r.body)}`);
   return Buffer.from(b64, 'base64');
 }
 
@@ -231,7 +352,7 @@ export async function editImage({
     key, method: 'POST', body: fd,
   });
   const b64 = r.body?.data?.[0]?.b64_json;
-  if (!(r.ok && b64)) throw new Error(`editImage failed: HTTP ${r.status} ${truncate(r.body)}`);
+  if (!(r.ok && b64)) throw new Error(`editImage failed: HTTP ${r.status}${why(r)} ${truncate(r.body)}`);
   return Buffer.from(b64, 'base64');
 }
 
@@ -242,7 +363,7 @@ export async function generateImageFlux({ endpoint, key, prompt, width, height,
     body: JSON.stringify({ prompt, width, height }),
   });
   const b64 = r.body?.data?.[0]?.b64_json || r.body?.b64_json || r.body?.image;
-  if (!(r.ok && b64)) throw new Error(`generateImageFlux failed: HTTP ${r.status} ${truncate(r.body)}`);
+  if (!(r.ok && b64)) throw new Error(`generateImageFlux failed: HTTP ${r.status}${why(r)} ${truncate(r.body)}`);
   return Buffer.from(b64, 'base64');
 }
 
@@ -273,36 +394,55 @@ export async function createVideo({
     fd.append('input_reference', new Blob([inputReferencePng], { type: 'image/png' }), 'input_reference.png');
   }
   const r = await azFetch(`${endpoint}/openai/v1/videos?api-version=${apiVersion}`, { key, method: 'POST', body: fd });
-  if (!(r.ok && r.body?.id)) throw new Error(`createVideo failed: HTTP ${r.status} ${truncate(r.body)}`);
+  if (!(r.ok && r.body?.id)) {
+    // status 0 = network error; errno tells a refused connection (nothing sent) from a lost one
+    const err = new Error(`createVideo failed: HTTP ${r.status}${why(r)} ${truncate(r.body)}`);
+    err.status = r.status;
+    err.errno = r.error?.cause?.code || r.error?.code || null;
+    throw err;
+  }
   return r.body;
 }
 
+const POLL_DEFAULTS = { apiVersion: 'preview', intervalMs: 5000, maxTicks: 180 };
+const POLL_RETRY_4XX = new Set([408, 429]);
+const withoutUndefined = (obj) => Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== undefined));
+
 /**
  * Poll a Sora job until a terminal status (or maxTicks). Polls first, then sleeps, so a job
- * that is already terminal returns without waiting. `onTick(status, i)` is optional.
+ * that is already terminal returns without waiting. `onTick(status, i)` is optional; `sleep`
+ * replaces the wait between polls. 408, 429, 5xx and network errors keep polling. Any other
+ * 4xx throws at once with `err.status` and `err.code`: a job the server no longer knows, or a
+ * key it refuses, never turns terminal.
  * @returns the last status object seen.
  */
-export async function pollVideo({
-  endpoint, key, id, onTick, apiVersion = 'preview', intervalMs = 5000, maxTicks = 180,
-} = {}) {
-  const url = `${endpoint}/openai/v1/videos/${id}?api-version=${apiVersion}`;
+export async function pollVideo(opts = {}) {
+  const o = { ...POLL_DEFAULTS, sleep, ...withoutUndefined(opts) };
+  const url = `${o.endpoint}/openai/v1/videos/${o.id}?api-version=${o.apiVersion}`;
   let st = null;
-  for (let i = 0; i < maxTicks; i++) {
-    const r = await azFetch(url, { key, method: 'GET' });
-    st = r.body || st;
-    if (typeof onTick === 'function') onTick(st, i);
+  for (let i = 0; i < o.maxTicks; i++) {
+    const r = await azFetch(url, { key: o.key, method: 'GET' });
+    throwIfRefused(r, o.id);
+    if (r.ok) st = r.body || st;
+    if (typeof o.onTick === 'function') o.onTick(st, i);
     if (st && TERMINAL_STATUS.has(st.status)) break;
-    await sleep(intervalMs);
+    await o.sleep(o.intervalMs);
   }
   return st;
 }
 
+function throwIfRefused(r, id) {
+  if (r.status < 400 || r.status >= 500 || POLL_RETRY_4XX.has(r.status)) return;
+  const code = r.body?.error?.code || null;
+  throw Object.assign(new Error(`pollVideo: job ${id} answered HTTP ${r.status}${code ? ` ${code}` : ''}`), { status: r.status, code });
+}
+
 /** Download finished video bytes. Returns an mp4 Buffer; throws on non-200 / empty body. */
 export async function downloadVideo({ endpoint, key, id, apiVersion = 'preview' } = {}) {
   const r = await azFetch(`${endpoint}/openai/v1/videos/${id}/content?api-version=${apiVersion}`, {
     key, method: 'GET', binary: true,
   });
-  if (!(r.status === 200 && r.body?.length)) throw new Error(`downloadVideo failed: HTTP ${r.status}`);
+  if (!(r.status === 200 && r.body?.length)) throw new Error(`downloadVideo failed: HTTP ${r.status}${why(r)}`);
   return r.body;
 }
 
@@ -347,7 +487,7 @@ export async function createVideoTwoImage({
     key, method: 'POST', body: fd,
   });
   const id = r.body?.id || r.body?.job_id;
-  if (!(r.ok && id)) throw new Error(`createVideoTwoImage (UNVALIDATED) failed: HTTP ${r.status} ${truncate(r.body)}`);
+  if (!(r.ok && id)) throw new Error(`createVideoTwoImage (UNVALIDATED) failed: HTTP ${r.status}${why(r)} ${truncate(r.body)}`);
   return r.body;
 }
 
@@ -397,6 +537,22 @@ export async function extractLastFrame(mp4, out, { ffmpeg } = {}) {
   return out;
 }
 
+/**
+ * A still as a short clip: the hold of the hold-and-flight mode. The PNG repeats for `seconds`,
+ * encoded as the scrub engine wants (H.264 yuv420p, a keyframe every 8 frames, faststart, no
+ * audio). No generation call, so no cost. Every frame is the still, so a flight whose first or last
+ * frame is this still meets the hold exactly. `size` ('720x1280') scales; even sizes only. Returns out.
+ */
+export async function stillToClip(png, out, { ffmpeg, seconds = 1, fps = 24, size } = {}) {
+  const bin = ffmpeg || await resolveFfmpeg();
+  fs.rmSync(out, { force: true }); // a file from an earlier run must not pass for this one
+  const vf = `${size ? `scale=${String(size).replace('x', ':')},` : ''}format=yuv420p`;
+  const r = runFf(bin, ['-y', '-loop', '1', '-i', png, '-t', String(seconds), '-r', String(fps), '-vf', vf,
+    '-c:v', 'libx264', '-crf', '20', '-g', '8', '-movflags', '+faststart', '-an', out]);
+  if (r.code !== 0 && !fs.existsSync(out)) throw new Error(`stillToClip failed: ${tail(r.stderr)}`);
+  return out;
+}
+
 /** Extract the FIRST frame of an mp4 to a PNG. Returns out. */
 export async function extractFirstFrame(mp4, out, { ffmpeg } = {}) {
   const bin = ffmpeg || await resolveFfmpeg();
@@ -481,15 +637,19 @@ const VIDEO_USD_PER_SEC = 0.10;
 const IMAGE_USD_EACH = 0.02;
 
 /**
- * Rough budget for an intro of `nScenes` scenes. Video billed at $0.10/sec/clip; one image gen
- * per scene (two per scene in two-image mode). Returns per-category USD sub-costs and the total.
+ * Rough budget for an intro of `nScenes` scenes. Video billed at $0.10/sec/clip (the Sora rate:
+ * WAN rates cannot be read through an API); one image gen per scene (two per scene in two-image
+ * mode). mode 'chain' (default) makes one clip of `seconds` per scene; 'holdFlight' makes one
+ * flight of `flightSeconds` between each pair of scenes, the holds being encoded stills (free).
+ * Returns per-category USD sub-costs and the total.
  * @returns {{images:number, videos:number, usd:number}}
  */
-export function estimateCost({ nScenes, seconds = 4, twoImage = false } = {}) {
+export function estimateCost({ nScenes, seconds = 4, twoImage = false, mode = 'chain', flightSeconds = 5 } = {}) {
   const n = Number(nScenes) || 0;
   const imageCount = twoImage ? n * 2 : n;
   const images = round2(imageCount * IMAGE_USD_EACH);
-  const videos = round2(n * seconds * VIDEO_USD_PER_SEC);
+  const clipSeconds = mode === 'holdFlight' ? Math.max(0, n - 1) * flightSeconds : n * seconds;
+  const videos = round2(clipSeconds * VIDEO_USD_PER_SEC);
   const usd = round2(images + videos);
   return { images, videos, usd };
 }