vidspotai-shared 1.0.82 → 1.0.84

package/lib/services/aiGen/providers/kling/klingRequests.js

@@ -0,0 +1,194 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildVideoGenerateRequest = buildVideoGenerateRequest;
+exports.buildExtendBody = buildExtendBody;
+exports.buildOmniVideoBody = buildOmniVideoBody;
+exports.buildMotionControlBody = buildMotionControlBody;
+exports.buildAvatarRequest = buildAvatarRequest;
+exports.buildLipSyncBody = buildLipSyncBody;
+const types_1 = require("../../types");
+const cameraAdapter_1 = require("./cameraAdapter");
+/**
+ * Pure request-body builders mapping our provider-agnostic
+ * VideoGenerationParams onto Kling's per-endpoint request shapes. No I/O —
+ * KlingService calls these, then submits the result. Keeping them here makes
+ * the per-endpoint field wiring testable in isolation and the service class a
+ * thin dispatcher.
+ */
+/**
+ * text2video / image2video body. Routes by the presence of inputImageUrl and
+ * wires the shared optional fields (negative prompt, cfg, camera control,
+ * audio/sound tier) plus the i2v-only mask / tail-frame fields.
+ */
+function buildVideoGenerateRequest(params, modelId) {
+    // Common optional fields shared by text2video and image2video endpoints.
+    const optional = {};
+    if (params.negativePrompt)
+        optional.negative_prompt = params.negativePrompt;
+    if (params.cfgScale !== undefined)
+        optional.cfg_scale = params.cfgScale;
+    if (params.callbackUrl)
+        optional.callback_url = params.callbackUrl;
+    if (params.externalTaskId)
+        optional.external_task_id = params.externalTaskId;
+    if (params.cameraControl) {
+        const cc = (0, cameraAdapter_1.toKlingCameraControl)(params.cameraControl);
+        if (cc)
+            optional.camera_control = cc;
+    }
+    // v2.6 uses `sound: "on"|"off"` as a pricing-tier toggle. v3 uses
+    // `generate_audio: boolean` for native audio synthesis. Route by model.
+    if (params.audio !== undefined) {
+        if (params.modelKey === "kling-v3.0") {
+            optional.generate_audio = Boolean(params.audio);
+        }
+        else if (params.modelKey === "kling-v2.6") {
+            optional.sound = params.audio ? "on" : "off";
+        }
+    }
+    const isImageToVideo = !!params.inputImageUrl;
+    if (isImageToVideo) {
+        const i2v = {
+            model_name: modelId,
+            prompt: params.prompt,
+            image: params.inputImageUrl,
+            duration: params.duration || 5,
+            mode: params.mode || types_1.EVideoMode.STANDARD,
+            ...optional,
+        };
+        if (params.aspectRatio)
+            i2v.aspect_ratio = params.aspectRatio;
+        if (params.lastFrameImageUrl)
+            i2v.image_tail = params.lastFrameImageUrl;
+        if (params.staticMaskUrl)
+            i2v.static_mask = params.staticMaskUrl;
+        if (params.dynamicMasks?.length) {
+            i2v.dynamic_masks = params.dynamicMasks.slice(0, 6).map((d) => ({
+                mask: d.maskUrl,
+                trajectories: d.trajectories,
+            }));
+        }
+        return i2v;
+    }
+    return {
+        model_name: modelId,
+        prompt: params.prompt,
+        aspect_ratio: params.aspectRatio || "16:9",
+        duration: params.duration || 5,
+        mode: params.mode || types_1.EVideoMode.STANDARD,
+        ...optional,
+    };
+}
+/** Video-extend body (continue a prior Kling task by its video_id). */
+function buildExtendBody(params) {
+    const body = { video_id: params.sourceTaskId };
+    if (params.prompt)
+        body.prompt = params.prompt;
+    if (params.negativePrompt)
+        body.negative_prompt = params.negativePrompt;
+    if (params.cfgScale !== undefined)
+        body.cfg_scale = params.cfgScale;
+    if (params.callbackUrl)
+        body.callback_url = params.callbackUrl;
+    if (params.externalTaskId)
+        body.external_task_id = params.externalTaskId;
+    return body;
+}
+/** OmniVideo body: start/end/reference frames, reference videos, multi-shot. */
+function buildOmniVideoBody(params, modelId) {
+    const body = {
+        model_name: modelId,
+        mode: params.mode || types_1.EVideoMode.STANDARD,
+        duration: String(params.duration ?? 5),
+    };
+    if (params.prompt)
+        body.prompt = params.prompt;
+    if (params.aspectRatio)
+        body.aspect_ratio = params.aspectRatio;
+    if (params.callbackUrl)
+        body.callback_url = params.callbackUrl;
+    if (params.externalTaskId)
+        body.external_task_id = params.externalTaskId;
+    if (params.audio !== undefined)
+        body.sound = params.audio ? "on" : "off";
+    // Build image_list: start frame, end frame, plain reference images.
+    const imageList = [];
+    if (params.inputImageUrl) {
+        imageList.push({ image_url: params.inputImageUrl, type: "first_frame" });
+    }
+    if (params.lastFrameImageUrl) {
+        imageList.push({ image_url: params.lastFrameImageUrl, type: "end_frame" });
+    }
+    for (const url of params.referenceImageUrls ?? []) {
+        imageList.push({ image_url: url });
+    }
+    if (imageList.length)
+        body.image_list = imageList;
+    // Build video_list: reference videos (feature type) or base videos (editing).
+    if (params.referenceVideoUrls?.length) {
+        body.video_list = params.referenceVideoUrls.map((url) => ({
+            video_url: url,
+            refer_type: "feature",
+        }));
+    }
+    // Multi-shot support. MultiShot is Shot[] directly (not { shots: Shot[] }).
+    if (params.multiShot?.length) {
+        body.multi_shot = true;
+        body.shot_type = "customize";
+        body.multi_prompt = params.multiShot.map((s, i) => ({
+            index: i + 1,
+            prompt: s.prompt,
+            ...(s.duration !== undefined ? { duration: String(s.duration) } : {}),
+        }));
+    }
+    return body;
+}
+/** Motion-control body (character image + motion reference video). */
+function buildMotionControlBody(params, modelId) {
+    const body = {
+        model_name: modelId,
+        image_url: params.inputImageUrl,
+        video_url: params.inputVideoUrl,
+    };
+    if (params.prompt)
+        body.prompt = params.prompt;
+    if (params.mode)
+        body.mode = params.mode;
+    if (params.callbackUrl)
+        body.callback_url = params.callbackUrl;
+    if (params.externalTaskId)
+        body.external_task_id = params.externalTaskId;
+    return body;
+}
+/** Avatar (image+audio → lipsync video) body. */
+function buildAvatarRequest(params) {
+    return {
+        image: params.inputImageUrl,
+        sound_file: params.inputAudioUrl,
+        prompt: params.prompt,
+        mode: params.mode || "std",
+        ...(params.callbackUrl ? { callback_url: params.callbackUrl } : {}),
+        ...(params.externalTaskId ? { external_task_id: params.externalTaskId } : {}),
+    };
+}
+/**
+ * Advanced-lip-sync body. Takes the resolved face (from identify-face) and the
+ * session id; auto-selects the first detected face's window for the audio.
+ */
+function buildLipSyncBody(params, sessionId, face) {
+    const audioDurationMs = params.audioDurationMs ?? 60000;
+    return {
+        session_id: sessionId,
+        face_choose: [{
+                face_id: face.face_id,
+                sound_file: params.inputAudioUrl,
+                sound_insert_time: face.start_time,
+                sound_start_time: 0,
+                sound_end_time: audioDurationMs,
+                sound_volume: 1,
+                original_audio_volume: 1,
+            }],
+        ...(params.callbackUrl ? { callback_url: params.callbackUrl } : {}),
+        ...(params.externalTaskId ? { external_task_id: params.externalTaskId } : {}),
+    };
+}

package/lib/services/aiGen/providers/kling/klingStatus.d.ts

@@ -0,0 +1,16 @@
+import { VideoStatusParams, VideoStatusResult } from "../types";
+/**
+ * Kling status polling + result stashing. Extracted from KlingService so the
+ * class stays a thin transport/dispatch layer. These take a `request` dep (the
+ * service's bound requestWithTimeoutRetry) plus the submit timeout, so they
+ * reuse the JWT auth + IPv4-pinned agents without holding a class reference.
+ */
+export interface KlingStatusDeps {
+    /** Bound KlingService.requestWithTimeoutRetry. */
+    request: <T>(endpoint: string, method: "POST" | "GET", body?: any, maxAttempts?: number, timeout?: number) => Promise<T>;
+    /** Submit-endpoint timeout (also used for the potentially-large video download). */
+    generateTimeout: number;
+}
+export declare function checkRegularVideoStatus(deps: KlingStatusDeps, { task, outputFilename, outputFilePath }: VideoStatusParams): Promise<VideoStatusResult>;
+export declare function checkAvatarVideoStatus(deps: KlingStatusDeps, { task, outputFilename, outputFilePath }: VideoStatusParams): Promise<VideoStatusResult>;
+//# sourceMappingURL=klingStatus.d.ts.map

package/lib/services/aiGen/providers/kling/klingStatus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"klingStatus.d.ts","sourceRoot":"","sources":["../../../../../src/services/aiGen/providers/kling/klingStatus.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAGhE;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,kDAAkD;IAClD,OAAO,EAAE,CAAC,CAAC,EACT,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GAAG,KAAK,EACtB,IAAI,CAAC,EAAE,GAAG,EACV,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,KACb,OAAO,CAAC,CAAC,CAAC,CAAC;IAChB,oFAAoF;IACpF,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,eAAe,EACrB,EAAE,IAAI,EAAE,cAAc,EAAE,cAAyB,EAAE,EAAE,iBAAiB,GACrE,OAAO,CAAC,iBAAiB,CAAC,CAyE5B;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,eAAe,EACrB,EAAE,IAAI,EAAE,cAAc,EAAE,cAAyB,EAAE,EAAE,iBAAiB,GACrE,OAAO,CAAC,iBAAiB,CAAC,CAqG5B"}

package/lib/services/aiGen/providers/kling/klingStatus.js

@@ -0,0 +1,173 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkRegularVideoStatus = checkRegularVideoStatus;
+exports.checkAvatarVideoStatus = checkAvatarVideoStatus;
+const axios_1 = __importDefault(require("axios"));
+const http_1 = __importDefault(require("http"));
+const https_1 = __importDefault(require("https"));
+const types_1 = require("../../../../globals/types");
+const firebase_1 = require("../../../../libs/firebase");
+const logger_1 = require("../../../../utils/logger");
+async function checkRegularVideoStatus(deps, { task, outputFilename, outputFilePath = "videos" }) {
+    const startTime = Date.now();
+    // Try each Kling status endpoint in order until one returns non-404.
+    // We don't persist which endpoint was used at submit time, so we probe all of them.
+    const statusEndpoints = [
+        `/v1/videos/text2video/${task}`,
+        `/v1/videos/image2video/${task}`,
+        `/v1/videos/video-extend/${task}`,
+        `/v1/videos/omni-video/${task}`,
+        `/v1/videos/motion-control/${task}`,
+        `/v1/videos/advanced-lip-sync/${task}`,
+    ];
+    let result;
+    for (const ep of statusEndpoints) {
+        try {
+            result = await deps.request(ep, "GET");
+            break; // found it
+        }
+        catch (err) {
+            if (err.response?.status !== 404)
+                throw err;
+            // 404 → try next endpoint
+        }
+    }
+    if (!result) {
+        return {
+            status: types_1.EVideoSceneStatus.FAILED,
+            errorMessage: `Task ${task} not found on any Kling status endpoint`,
+        };
+    }
+    logger_1.logger.info("Kling checkVideoStatus polled", { task, durationMs: Date.now() - startTime, status: result.data.task_status });
+    if (result.data.task_status === "succeed") {
+        const videoUrl = result.data.task_result?.videos?.[0]?.url;
+        if (!videoUrl) {
+            return {
+                status: types_1.EVideoSceneStatus.FAILED,
+                errorMessage: "No video URL in response",
+            };
+        }
+        const filePath = `${outputFilePath}/${outputFilename}.mp4`;
+        const file = (0, firebase_1.getBucket)().file(filePath);
+        // Download video using axios — use generateTimeout since video files can be large
+        const videoResp = await axios_1.default.get(videoUrl, {
+            responseType: "arraybuffer",
+            timeout: deps.generateTimeout,
+        });
+        const buffer = Buffer.from(videoResp.data);
+        await file.save(buffer, { contentType: "video/mp4" });
+        const [signedUrl] = await file.getSignedUrl({
+            action: "read",
+            expires: "03-09-2491",
+        });
+        return {
+            videoUrl: signedUrl,
+            status: types_1.EVideoSceneStatus.COMPLETED,
+        };
+    }
+    if (result.data.task_status === "failed") {
+        return {
+            status: types_1.EVideoSceneStatus.FAILED,
+            errorMessage: result.data.task_status_msg || result.message || "Kling task failed (no reason provided)",
+        };
+    }
+    return { status: types_1.EVideoSceneStatus.PENDING };
+}
+async function checkAvatarVideoStatus(deps, { task, outputFilename, outputFilePath = "videos" }) {
+    const startTime = Date.now();
+    const result = await deps.request(`/v1/videos/avatar/image2video/${task}`, "GET");
+    logger_1.logger.info("Kling checkAvatarVideoStatus polled", { task, durationMs: Date.now() - startTime, status: result?.data?.task_status, statusMsg: result?.data?.task_status_msg || undefined });
+    if (!result) {
+        return {
+            status: types_1.EVideoSceneStatus.FAILED,
+            errorMessage: "No response from Kling Avatar API",
+        };
+    }
+    if (result.data.task_status === "succeed") {
+        const videoUrl = result.data.task_result?.videos?.[0]?.url;
+        if (!videoUrl) {
+            return {
+                status: types_1.EVideoSceneStatus.FAILED,
+                errorMessage: "No video URL in avatar response",
+            };
+        }
+        // Kling task is done. Now download from Kling's CDN, push to GCS, and
+        // mint a signed URL. Any of these three can hiccup (Kling CDN slow,
+        // GCS 503, signedURL service blip) — historically the whole call threw
+        // and the outer TaskPoller burned a poll attempt re-asking Kling for a
+        // status that's already known. Wrap the post-success work in its own
+        // bounded retry so a transient blip doesn't poison the poll loop.
+        const filePath = `${outputFilePath}/${outputFilename}.mp4`;
+        const file = (0, firebase_1.getBucket)().file(filePath);
+        const maxAttempts = 3;
+        let lastErr;
+        // Force IPv4 on the download. The Kling-returned video URL frequently
+        // resolves to a CDN host where IPv6 is broken or routes us to a
+        // geo-blocked PoP, producing an AggregateError(ETIMEDOUT) where both
+        // happy-eyeballs sockets fail. Pinning v4 avoids the IPv6 dead-end.
+        const v4Http = new http_1.default.Agent({ family: 4, keepAlive: true });
+        const v4Https = new https_1.default.Agent({ family: 4, keepAlive: true });
+        // Parse host so we can log which CDN we couldn't reach.
+        let downloadHost = "unknown";
+        try {
+            downloadHost = new URL(videoUrl).host;
+        }
+        catch {
+            /* leave as unknown */
+        }
+        for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+            try {
+                const videoResp = await axios_1.default.get(videoUrl, {
+                    responseType: "arraybuffer",
+                    timeout: deps.generateTimeout,
+                    httpAgent: v4Http,
+                    httpsAgent: v4Https,
+                });
+                const buffer = Buffer.from(videoResp.data);
+                await file.save(buffer, { contentType: "video/mp4" });
+                const [signedUrl] = await file.getSignedUrl({
+                    action: "read",
+                    expires: "03-09-2491",
+                });
+                return {
+                    videoUrl: signedUrl,
+                    status: types_1.EVideoSceneStatus.COMPLETED,
+                };
+            }
+            catch (err) {
+                lastErr = err;
+                const isErr = err instanceof Error;
+                logger_1.logger.warn("Kling avatar post-success stash failed", {
+                    task,
+                    attempt,
+                    maxAttempts,
+                    downloadHost,
+                    errName: isErr ? err.name : typeof err,
+                    errCode: isErr ? err.code : undefined,
+                    httpStatus: isErr ? err.response?.status : undefined,
+                    msg: isErr ? err.message : String(err),
+                });
+                if (attempt < maxAttempts) {
+                    await new Promise((r) => setTimeout(r, 2000 * 2 ** (attempt - 1)));
+                }
+            }
+        }
+        // All internal retries exhausted — surface as pending so the outer
+        // TaskPoller retries the WHOLE checkVideoStatus call (with its own
+        // budget). Throwing here would burn an outer attempt with no extra
+        // signal beyond what we already logged.
+        throw lastErr instanceof Error
+            ? lastErr
+            : new Error(`Kling avatar stash failed after ${maxAttempts} attempts`);
+    }
+    if (result.data.task_status === "failed") {
+        return {
+            status: types_1.EVideoSceneStatus.FAILED,
+            errorMessage: result.data.task_status_msg || result.message || "Kling avatar task failed (no reason provided)",
+        };
+    }
+    return { status: types_1.EVideoSceneStatus.PENDING };
+}

package/lib/services/bullmq.service.d.ts

@@ -42,11 +42,72 @@ declare class BullMQService {
     private getConnection;
     /** Initialize BullMQ service (like your initRedis) */
     init(): Promise<void>;
+    /**
+     * Dev enqueue gate (single source of truth for ALL queues).
+     *
+     * When iterating on the Firebase Functions locally you don't want every test
+     * request to drop a real job into Redis — the node worker (whenever it next
+     * runs) would drain the whole backlog and burn provider credits. In dev we
+     * therefore SKIP enqueue by default; opt back in by setting `ENABLE_QUEUE=true`
+     * (or the legacy `ENABLE_VIDEO_QUEUE=true`) in the env of whichever process is
+     * enqueuing — set it in BOTH functions + node when you want the full pipeline.
+     *
+     * In production this is always false (NODE_ENV=production), so prod always
+     * enqueues. Centralised here so it covers video, poster, render, image, agent
+     * and social queues uniformly rather than per-controller flags.
+     */
+    private enqueueDisabledInDev;
     /** Add a job */
     addJob(queueName: string, data: JobData, opts?: {
         jobId?: string;
         delay?: number;
+        /** Retry attempts (default BullMQ = 1, i.e. no retry). */
+        attempts?: number;
+        /** Backoff between retries when `attempts` > 1. */
+        backoff?: {
+            type: "fixed" | "exponential";
+            delay: number;
+        };
+        /**
+         * Override the default completed/failed retention. Numbers cap by count;
+         * objects can cap by `{ age, count }`. Defaults below keep Redis from
+         * filling up on the 30MB Redis Cloud hobby plan.
+         */
+        removeOnComplete?: number | {
+            age?: number;
+            count?: number;
+        };
+        removeOnFail?: number | {
+            age?: number;
+            count?: number;
+        };
     }): Promise<void>;
+    /** Get (or lazily create) the Queue handle for a name, reusing the cache. */
+    private getQueue;
+    /**
+     * Admin: obliterate the given queues — removes ALL jobs in every state
+     * (wait/active/completed/failed/delayed) AND the leftover per-job hashes.
+     * `force` so it proceeds even if jobs are mid-flight. Used by the
+     * `queue:flush:*` scripts. Returns the queue names actually processed.
+     */
+    obliterateQueues(queueNames: string[]): Promise<string[]>;
+    /** Admin: per-queue depth + orphaned per-job hash count (read-only). */
+    getQueueStats(queueNames: string[]): Promise<Array<{
+        queue: string;
+        wait: number;
+        active: number;
+        delayed: number;
+        completed: number;
+        failed: number;
+        hashes: number;
+    }>>;
+    /** Admin: Redis memory snapshot (read-only). */
+    redisMemoryInfo(): Promise<{
+        usedHuman: string;
+        usedRaw: number;
+        maxRaw: number;
+        dbsize: number;
+    }>;
     startWorkers(queueNames: string[], processor: (job: Job) => Promise<void>, perQueueOptions?: Record<string, {
         lockDuration?: number;
         stalledInterval?: number;

package/lib/services/bullmq.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bullmq.service.d.ts","sourceRoot":"","sources":["../../src/services/bullmq.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,GAAG,EAAE,MAAM,QAAQ,CAAC;AAC5C,OAAgB,EAAwB,YAAY,EAAE,MAAM,SAAS,CAAC;AAItE,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAc1C,UAAU,oBAAoB;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,cAAM,aAAa;IACjB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAgB;IACvC,OAAO,CAAC,MAAM,CAAiC;IAC/C,OAAO,CAAC,OAAO,CAAgB;IAC/B,OAAO,CAAC,YAAY,CAAgB;IAIpC,OAAO,CAAC,UAAU,CAAC,CAAc;IACjC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAAS;IAE7B,OAAO;WAQO,WAAW,CAAC,OAAO,EAAE,oBAAoB;IAOvD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,aAAa;IAOrB,sDAAsD;IACzC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBlC,gBAAgB;IACH,MAAM,CACjB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,EACb,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAUpC,YAAY,CACjB,UAAU,EAAE,MAAM,EAAE,EACpB,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,EACtC,eAAe,CAAC,EAAE,MAAM,CACtB,MAAM,EACN;QACE,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CACF;CAyIJ;AASD,eAAO,MAAM,MAAM,eAGjB,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,GAAG,CAAC"}
+{"version":3,"file":"bullmq.service.d.ts","sourceRoot":"","sources":["../../src/services/bullmq.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,GAAG,EAAE,MAAM,QAAQ,CAAC;AAC5C,OAAgB,EAAwB,YAAY,EAAE,MAAM,SAAS,CAAC;AAItE,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAc1C,UAAU,oBAAoB;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,cAAM,aAAa;IACjB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAgB;IACvC,OAAO,CAAC,MAAM,CAAiC;IAC/C,OAAO,CAAC,OAAO,CAAgB;IAC/B,OAAO,CAAC,YAAY,CAAgB;IAIpC,OAAO,CAAC,UAAU,CAAC,CAAc;IACjC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAAS;IAE7B,OAAO;WAQO,WAAW,CAAC,OAAO,EAAE,oBAAoB;IAOvD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,aAAa;IAOrB,sDAAsD;IACzC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBlC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,oBAAoB;IAQ5B,gBAAgB;IACH,MAAM,CACjB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,EACb,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,0DAA0D;QAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,mDAAmD;QACnD,OAAO,CAAC,EAAE;YAAE,IAAI,EAAE,OAAO,GAAG,aAAa,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAC3D;;;;WAIG;QACH,gBAAgB,CAAC,EAAE,MAAM,GAAG;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC7D,YAAY,CAAC,EAAE,MAAM,GAAG;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC1D;IA+BH,6EAA6E;IAC7E,OAAO,CAAC,QAAQ;IAQhB;;;;;OAKG;IACU,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAUtE,wEAAwE;IAC3D,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CACvD,KAAK,CAAC;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC,CACH;IAgCD,gDAAgD;IACnC,eAAe,IAAI,OAAO,CAAC;QACtC,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IAWK,YAAY,CACjB,UAAU,EAAE,MAAM,EAAE,EACpB,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,EACtC,eAAe,CAAC,EAAE,MAAM,CACtB,MAAM,EACN;QACE,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CACF;CAyIJ;AASD,eAAO,MAAM,MAAM,eAGjB,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,GAAG,CAAC"}

package/lib/services/bullmq.service.js

@@ -83,14 +83,114 @@ class BullMQService {
             throw err;
         }
     }
+    /**
+     * Dev enqueue gate (single source of truth for ALL queues).
+     *
+     * When iterating on the Firebase Functions locally you don't want every test
+     * request to drop a real job into Redis — the node worker (whenever it next
+     * runs) would drain the whole backlog and burn provider credits. In dev we
+     * therefore SKIP enqueue by default; opt back in by setting `ENABLE_QUEUE=true`
+     * (or the legacy `ENABLE_VIDEO_QUEUE=true`) in the env of whichever process is
+     * enqueuing — set it in BOTH functions + node when you want the full pipeline.
+     *
+     * In production this is always false (NODE_ENV=production), so prod always
+     * enqueues. Centralised here so it covers video, poster, render, image, agent
+     * and social queues uniformly rather than per-controller flags.
+     */
+    enqueueDisabledInDev() {
+        if (process.env.NODE_ENV !== "development")
+            return false;
+        const enabled = process.env.ENABLE_QUEUE === "true" ||
+            process.env.ENABLE_VIDEO_QUEUE === "true";
+        return !enabled;
+    }
     /** Add a job */
     async addJob(queueName, data, opts) {
+        // Dev gate — skip the actual enqueue unless explicitly opted in. Logged so
+        // it's obvious in the emulator output why nothing showed up in the queue.
+        if (this.enqueueDisabledInDev()) {
+            logger_1.logger.info("[BullMQ] enqueue skipped (dev): set ENABLE_QUEUE=true to enqueue", { queueName, jobId: opts?.jobId });
+            return;
+        }
         if (!this.initialized)
             await this.init();
         const queue = this.queues.get(queueName) ??
             new bullmq_1.Queue(queueName, { connection: this.getConnection() });
         this.queues.set(queueName, queue);
-        await queue.add(opts?.jobId || "default", data, { delay: opts?.delay });
+        await queue.add(opts?.jobId || "default", data, {
+            delay: opts?.delay,
+            attempts: opts?.attempts,
+            backoff: opts?.backoff,
+            // Auto-evict finished jobs so their hashes don't accumulate forever.
+            // Without this BullMQ keeps every completed/failed job hash with no TTL
+            // (this is what filled prod Redis to ~75% of 30MB / 41k orphan keys).
+            // Completed: keep 1 day or last 1000. Failed: keep longer (7 days /
+            // last 5000) since failures are worth inspecting.
+            removeOnComplete: opts?.removeOnComplete ?? { age: 24 * 3600, count: 1000 },
+            removeOnFail: opts?.removeOnFail ?? { age: 7 * 24 * 3600, count: 5000 },
+        });
+    }
+    /** Get (or lazily create) the Queue handle for a name, reusing the cache. */
+    getQueue(queueName) {
+        const queue = this.queues.get(queueName) ??
+            new bullmq_1.Queue(queueName, { connection: this.getConnection() });
+        this.queues.set(queueName, queue);
+        return queue;
+    }
+    /**
+     * Admin: obliterate the given queues — removes ALL jobs in every state
+     * (wait/active/completed/failed/delayed) AND the leftover per-job hashes.
+     * `force` so it proceeds even if jobs are mid-flight. Used by the
+     * `queue:flush:*` scripts. Returns the queue names actually processed.
+     */
+    async obliterateQueues(queueNames) {
+        if (!this.initialized)
+            await this.init();
+        const done = [];
+        for (const name of queueNames) {
+            await this.getQueue(name).obliterate({ force: true });
+            done.push(name);
+        }
+        return done;
+    }
+    /** Admin: per-queue depth + orphaned per-job hash count (read-only). */
+    async getQueueStats(queueNames) {
+        if (!this.initialized)
+            await this.init();
+        const conn = this.getConnection();
+        const out = [];
+        for (const queue of queueNames) {
+            const [wait, active, delayed, completed, failed] = await Promise.all([
+                conn.llen(`bull:${queue}:wait`),
+                conn.llen(`bull:${queue}:active`),
+                conn.zcard(`bull:${queue}:delayed`),
+                conn.zcard(`bull:${queue}:completed`),
+                conn.zcard(`bull:${queue}:failed`),
+            ]);
+            // Count bull:<queue>:<numericId> hashes — the orphans that accumulate
+            // when removeOnComplete/removeOnFail isn't set.
+            let hashes = 0;
+            let cursor = "0";
+            do {
+                const [next, keys] = await conn.scan(cursor, "MATCH", `bull:${queue}:*`, "COUNT", 1000);
+                cursor = next;
+                hashes += keys.filter((k) => /:\d+$/.test(k)).length;
+            } while (cursor !== "0");
+            out.push({ queue, wait, active, delayed, completed, failed, hashes });
+        }
+        return out;
+    }
+    /** Admin: Redis memory snapshot (read-only). */
+    async redisMemoryInfo() {
+        if (!this.initialized)
+            await this.init();
+        const conn = this.getConnection();
+        const mem = await conn.info("memory");
+        const usedHuman = /used_memory_human:(.+)/.exec(mem)?.[1]?.trim() ?? "?";
+        const usedRaw = Number(/used_memory:(\d+)/.exec(mem)?.[1] ?? 0);
+        const maxRaw = Number(/maxmemory:(\d+)/.exec(mem)?.[1] ?? 0);
+        const dbsize = await conn.dbsize();
+        return { usedHuman, usedRaw, maxRaw, dbsize };
     }
     startWorkers(queueNames, processor, perQueueOptions) {
         const start = async () => {

package/lib/services/crypto/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./tokenVault";
+//# sourceMappingURL=index.d.ts.map

package/lib/services/crypto/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/crypto/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC"}

package/lib/services/crypto/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./tokenVault"), exports);

package/lib/services/crypto/tokenVault.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Token vault — symmetric encryption for secrets stored at rest in Firestore.
+ *
+ * Social-account OAuth tokens (access + refresh) must NEVER live in Firestore as
+ * plaintext: anyone with a DB export (or an over-broad security rule) would
+ * inherit publish/DM/analytics access to every connected account. We encrypt
+ * them with AES-256-GCM (authenticated encryption) before write and decrypt only
+ * inside workers / Cloud Functions at call time.
+ *
+ * Key management: the 32-byte key comes from `SOCIAL_TOKEN_ENC_KEY` (hex or
+ * base64). In dev it can sit in `.env`; in prod it should be sourced from GCP
+ * Secret Manager and injected as an env var. Rotating the key is supported via
+ * a key-id prefix on the ciphertext (`v1:`) so a future key can decrypt old
+ * blobs by id — see `EncryptedBlob` format below.
+ *
+ * Ciphertext wire format (single string, safe for Firestore):
+ *   `<keyId>:<base64(iv)>:<base64(authTag)>:<base64(ciphertext)>`
+ * keyId lets us roll keys without a migration; iv is random per-encrypt (GCM
+ * must never reuse an iv under the same key).
+ */
+/** True when at least the current key is configured. Use to gate features. */
+export declare function isTokenVaultConfigured(): boolean;
+/**
+ * Encrypt a plaintext secret. Returns the opaque wire-format string to store.
+ * Empty/whitespace input throws — callers should not persist empty tokens.
+ */
+export declare function encryptToken(plaintext: string): string;
+/**
+ * Decrypt a wire-format string produced by `encryptToken`. Throws if the blob is
+ * malformed, the key id is unknown, or the auth tag fails (tampering / wrong
+ * key). Never logs the plaintext.
+ */
+export declare function decryptToken(blob: string): string;
+/**
+ * Safe wrapper: decrypt, returning null instead of throwing. Use on read paths
+ * where a single corrupt/rotated blob shouldn't crash a batch (e.g. analytics
+ * poller iterating many accounts).
+ */
+export declare function tryDecryptToken(blob: string | undefined | null): string | null;
+/**
+ * Constant-time compare for opaque secrets (e.g. OAuth `state`, webhook
+ * signatures). Avoids leaking length/contents via early-exit timing.
+ */
+export declare function safeEqual(a: string, b: string): boolean;
+/** Test-only: reset the memoized key cache so env changes take effect. */
+export declare function __resetTokenVaultCacheForTests(): void;
+//# sourceMappingURL=tokenVault.d.ts.map

package/lib/services/crypto/tokenVault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenVault.d.ts","sourceRoot":"","sources":["../../../src/services/crypto/tokenVault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AA8DH,8EAA8E;AAC9E,wBAAgB,sBAAsB,IAAI,OAAO,CAMhD;AAcD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAgBtD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA6BjD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAO9E;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAKvD;AAED,0EAA0E;AAC1E,wBAAgB,8BAA8B,IAAI,IAAI,CAErD"}