@agent-native/core 0.7.55 → 0.7.57

package/dist/server/google-realtime-session.d.ts

@@ -0,0 +1,14 @@
+interface GoogleRealtimeSessionResponse {
+    websocketUrl: string;
+    sessionToken: string;
+    websocketProtocol?: string;
+}
+export declare function resolveGoogleRealtimeCredentials(opts: {
+    userEmail?: string | null;
+    orgId?: string | null;
+}): Promise<string | null>;
+export declare function createGoogleRealtimeSessionHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<GoogleRealtimeSessionResponse | {
+    error: any;
+}>>;
+export {};
+//# sourceMappingURL=google-realtime-session.d.ts.map

package/dist/server/google-realtime-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-realtime-session.d.ts","sourceRoot":"","sources":["../../src/server/google-realtime-session.ts"],"names":[],"mappings":"AAgBA,UAAU,6BAA6B;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAqCD,wBAAsB,gCAAgC,CAAC,IAAI,EAAE;IAC3D,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA+BzB;AAED,wBAAgB,kCAAkC;;IAqGjD"}

package/dist/server/google-realtime-session.js

@@ -0,0 +1,155 @@
+import { readFile } from "node:fs/promises";
+import { defineEventHandler, getMethod, getRequestHeader, readBody, setResponseStatus, } from "h3";
+import { readAppSecret } from "../secrets/storage.js";
+import { resolveCredential } from "../credentials/index.js";
+import { getSession } from "./auth.js";
+import { getOrgContext } from "../org/context.js";
+import { runWithRequestContext } from "./request-context.js";
+import { resolveBuilderCredentials } from "./credential-provider.js";
+function isSameOriginRequest(event) {
+    const host = getRequestHeader(event, "host");
+    const origin = getRequestHeader(event, "origin");
+    if (origin && host) {
+        try {
+            const parsed = new URL(origin);
+            if (parsed.host === host)
+                return true;
+            if (parsed.protocol === "tauri:" && parsed.hostname === "localhost") {
+                return true;
+            }
+            if ((parsed.protocol === "http:" || parsed.protocol === "https:") &&
+                parsed.hostname === "tauri.localhost" &&
+                (host.startsWith("localhost:") || host.startsWith("127.0.0.1:"))) {
+                return true;
+            }
+            if (parsed.protocol === "http:" &&
+                (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1") &&
+                parsed.port === "1420" &&
+                (host.startsWith("localhost:") || host.startsWith("127.0.0.1:"))) {
+                return true;
+            }
+            return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    const fetchSite = getRequestHeader(event, "sec-fetch-site");
+    if (fetchSite)
+        return fetchSite === "same-origin" || fetchSite === "none";
+    return true;
+}
+export async function resolveGoogleRealtimeCredentials(opts) {
+    if (opts.userEmail) {
+        const userSecret = await readAppSecret({
+            key: "GOOGLE_APPLICATION_CREDENTIALS",
+            scope: "user",
+            scopeId: opts.userEmail,
+        }).catch(() => null);
+        const fromUserSecret = userSecret?.value?.trim();
+        if (fromUserSecret)
+            return fromUserSecret;
+    }
+    const stored = await resolveCredential("GOOGLE_APPLICATION_CREDENTIALS", {
+        userEmail: opts.userEmail ?? undefined,
+        orgId: opts.orgId ?? undefined,
+    }).catch(() => undefined);
+    const fromSettings = stored?.trim();
+    if (fromSettings)
+        return fromSettings;
+    const envValue = process.env.GOOGLE_APPLICATION_CREDENTIALS?.trim();
+    if (!envValue)
+        return null;
+    if (envValue.startsWith("{"))
+        return envValue;
+    try {
+        const fileContents = await readFile(envValue, "utf8");
+        const trimmed = fileContents.trim();
+        return trimmed || null;
+    }
+    catch {
+        throw new Error("GOOGLE_APPLICATION_CREDENTIALS points to a file path the framework server could not read");
+    }
+}
+export function createGoogleRealtimeSessionHandler() {
+    return defineEventHandler(async (event) => {
+        if (getMethod(event) !== "POST") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        if (!isSameOriginRequest(event)) {
+            setResponseStatus(event, 403);
+            return { error: "Cross-origin request rejected" };
+        }
+        const session = await getSession(event).catch(() => null);
+        if (!session?.email) {
+            setResponseStatus(event, 401);
+            return { error: "Authentication required" };
+        }
+        const orgCtx = await getOrgContext(event).catch(() => null);
+        const requestContext = {
+            userEmail: session.email,
+            orgId: orgCtx?.orgId ?? undefined,
+        };
+        return runWithRequestContext(requestContext, async () => {
+            const googleApplicationCredentials = await resolveGoogleRealtimeCredentials({
+                userEmail: session.email,
+                orgId: orgCtx?.orgId ?? undefined,
+            });
+            if (!googleApplicationCredentials) {
+                setResponseStatus(event, 400);
+                return {
+                    error: "Configure GOOGLE_APPLICATION_CREDENTIALS in Settings to use Google realtime transcription.",
+                };
+            }
+            const builderCreds = await resolveBuilderCredentials();
+            if (!builderCreds.privateKey || !builderCreds.publicKey) {
+                setResponseStatus(event, 400);
+                return {
+                    error: "Builder must be connected to mint a managed realtime transcription session.",
+                };
+            }
+            const apiHost = process.env.BUILDER_API_HOST || "https://ai-services.builder.io";
+            const body = ((await readBody(event).catch(() => ({}))) || {});
+            const res = await fetch(`${apiHost}/agent-native/transcribe-stream/session`, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    Authorization: `Bearer ${builderCreds.privateKey}`,
+                    "x-builder-api-key": builderCreds.publicKey,
+                    ...(builderCreds.userId
+                        ? { "x-builder-user-id": builderCreds.userId }
+                        : {}),
+                },
+                body: JSON.stringify({
+                    googleApplicationCredentials,
+                    language: typeof body?.language === "string"
+                        ? body.language.trim()
+                        : undefined,
+                }),
+            }).catch((err) => {
+                throw new Error(err?.message || "Failed to reach realtime transcription service");
+            });
+            if (!res.ok) {
+                const errorBody = await res
+                    .json()
+                    .catch(() => ({ error: `HTTP ${res.status}` }));
+                setResponseStatus(event, res.status);
+                return {
+                    error: typeof errorBody?.error === "string"
+                        ? errorBody.error
+                        : `Realtime session failed (${res.status})`,
+                };
+            }
+            const payload = (await res.json());
+            if (!payload?.websocketUrl) {
+                setResponseStatus(event, 502);
+                return {
+                    error: "Realtime transcription service did not return a websocket URL.",
+                };
+            }
+            return payload;
+        });
+    });
+}
+//# sourceMappingURL=google-realtime-session.js.map

package/dist/server/google-realtime-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-realtime-session.js","sourceRoot":"","sources":["../../src/server/google-realtime-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,gBAAgB,EAChB,QAAQ,EACR,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAQrE,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACtC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IACE,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;gBAC7D,MAAM,CAAC,QAAQ,KAAK,iBAAiB;gBACrC,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EAChE,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IACE,MAAM,CAAC,QAAQ,KAAK,OAAO;gBAC3B,CAAC,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;gBACpE,MAAM,CAAC,IAAI,KAAK,MAAM;gBACtB,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EAChE,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC5D,IAAI,SAAS;QAAE,OAAO,SAAS,KAAK,aAAa,IAAI,SAAS,KAAK,MAAM,CAAC;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,IAGtD;IACC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC;YACrC,GAAG,EAAE,gCAAgC;YACrC,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,IAAI,CAAC,SAAS;SACxB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrB,MAAM,cAAc,GAAG,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACjD,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;IAC5C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,gCAAgC,EAAE;QACvE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;QACtC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;KAC/B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1B,MAAM,YAAY,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;IACpC,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE9C,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;QACpC,OAAO,OAAO,IAAI,IAAI,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kCAAkC;IAChD,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACpB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,cAAc,GAAG;YACrB,SAAS,EAAE,OAAO,CAAC,KAAK;YACxB,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,SAAS;SAClC,CAAC;QAEF,OAAO,qBAAqB,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,4BAA4B,GAChC,MAAM,gCAAgC,CAAC;gBACrC,SAAS,EAAE,OAAO,CAAC,KAAK;gBACxB,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,SAAS;aAClC,CAAC,CAAC;YACL,IAAI,CAAC,4BAA4B,EAAE,CAAC;gBAClC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EACH,4FAA4F;iBAC/F,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,yBAAyB,EAAE,CAAC;YACvD,IAAI,CAAC,YAAY,CAAC,UAAU,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;gBACxD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EACH,6EAA6E;iBAChF,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,gCAAgC,CAAC;YACnE,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAE5D,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,OAAO,yCAAyC,EACnD;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,YAAY,CAAC,UAAU,EAAE;oBAClD,mBAAmB,EAAE,YAAY,CAAC,SAAS;oBAC3C,GAAG,CAAC,YAAY,CAAC,MAAM;wBACrB,CAAC,CAAC,EAAE,mBAAmB,EAAE,YAAY,CAAC,MAAM,EAAE;wBAC9C,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,4BAA4B;oBAC5B,QAAQ,EACN,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ;wBAChC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;wBACtB,CAAC,CAAC,SAAS;iBAChB,CAAC;aACH,CACF,CAAC,KAAK,CAAC,CAAC,GAAQ,EAAE,EAAE;gBACnB,MAAM,IAAI,KAAK,CACb,GAAG,EAAE,OAAO,IAAI,gDAAgD,CACjE,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,SAAS,GAAG,MAAM,GAAG;qBACxB,IAAI,EAAE;qBACN,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;gBAClD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACrC,OAAO;oBACL,KAAK,EACH,OAAO,SAAS,EAAE,KAAK,KAAK,QAAQ;wBAClC,CAAC,CAAC,SAAS,CAAC,KAAK;wBACjB,CAAC,CAAC,4BAA4B,GAAG,CAAC,MAAM,GAAG;iBAChD,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkC,CAAC;YACpE,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;gBAC3B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EACH,gEAAgE;iBACnE,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { readFile } from \"node:fs/promises\";\nimport {\n  defineEventHandler,\n  getMethod,\n  getRequestHeader,\n  readBody,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\nimport { readAppSecret } from \"../secrets/storage.js\";\nimport { resolveCredential } from \"../credentials/index.js\";\nimport { getSession } from \"./auth.js\";\nimport { getOrgContext } from \"../org/context.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\nimport { resolveBuilderCredentials } from \"./credential-provider.js\";\n\ninterface GoogleRealtimeSessionResponse {\n  websocketUrl: string;\n  sessionToken: string;\n  websocketProtocol?: string;\n}\n\nfunction isSameOriginRequest(event: H3Event): boolean {\n  const host = getRequestHeader(event, \"host\");\n  const origin = getRequestHeader(event, \"origin\");\n  if (origin && host) {\n    try {\n      const parsed = new URL(origin);\n      if (parsed.host === host) return true;\n      if (parsed.protocol === \"tauri:\" && parsed.hostname === \"localhost\") {\n        return true;\n      }\n      if (\n        (parsed.protocol === \"http:\" || parsed.protocol === \"https:\") &&\n        parsed.hostname === \"tauri.localhost\" &&\n        (host.startsWith(\"localhost:\") || host.startsWith(\"127.0.0.1:\"))\n      ) {\n        return true;\n      }\n      if (\n        parsed.protocol === \"http:\" &&\n        (parsed.hostname === \"localhost\" || parsed.hostname === \"127.0.0.1\") &&\n        parsed.port === \"1420\" &&\n        (host.startsWith(\"localhost:\") || host.startsWith(\"127.0.0.1:\"))\n      ) {\n        return true;\n      }\n      return false;\n    } catch {\n      return false;\n    }\n  }\n  const fetchSite = getRequestHeader(event, \"sec-fetch-site\");\n  if (fetchSite) return fetchSite === \"same-origin\" || fetchSite === \"none\";\n  return true;\n}\n\nexport async function resolveGoogleRealtimeCredentials(opts: {\n  userEmail?: string | null;\n  orgId?: string | null;\n}): Promise<string | null> {\n  if (opts.userEmail) {\n    const userSecret = await readAppSecret({\n      key: \"GOOGLE_APPLICATION_CREDENTIALS\",\n      scope: \"user\",\n      scopeId: opts.userEmail,\n    }).catch(() => null);\n    const fromUserSecret = userSecret?.value?.trim();\n    if (fromUserSecret) return fromUserSecret;\n  }\n\n  const stored = await resolveCredential(\"GOOGLE_APPLICATION_CREDENTIALS\", {\n    userEmail: opts.userEmail ?? undefined,\n    orgId: opts.orgId ?? undefined,\n  }).catch(() => undefined);\n  const fromSettings = stored?.trim();\n  if (fromSettings) return fromSettings;\n\n  const envValue = process.env.GOOGLE_APPLICATION_CREDENTIALS?.trim();\n  if (!envValue) return null;\n  if (envValue.startsWith(\"{\")) return envValue;\n\n  try {\n    const fileContents = await readFile(envValue, \"utf8\");\n    const trimmed = fileContents.trim();\n    return trimmed || null;\n  } catch {\n    throw new Error(\n      \"GOOGLE_APPLICATION_CREDENTIALS points to a file path the framework server could not read\",\n    );\n  }\n}\n\nexport function createGoogleRealtimeSessionHandler() {\n  return defineEventHandler(async (event: H3Event) => {\n    if (getMethod(event) !== \"POST\") {\n      setResponseStatus(event, 405);\n      return { error: \"Method not allowed\" };\n    }\n    if (!isSameOriginRequest(event)) {\n      setResponseStatus(event, 403);\n      return { error: \"Cross-origin request rejected\" };\n    }\n\n    const session = await getSession(event).catch(() => null);\n    if (!session?.email) {\n      setResponseStatus(event, 401);\n      return { error: \"Authentication required\" };\n    }\n\n    const orgCtx = await getOrgContext(event).catch(() => null);\n    const requestContext = {\n      userEmail: session.email,\n      orgId: orgCtx?.orgId ?? undefined,\n    };\n\n    return runWithRequestContext(requestContext, async () => {\n      const googleApplicationCredentials =\n        await resolveGoogleRealtimeCredentials({\n          userEmail: session.email,\n          orgId: orgCtx?.orgId ?? undefined,\n        });\n      if (!googleApplicationCredentials) {\n        setResponseStatus(event, 400);\n        return {\n          error:\n            \"Configure GOOGLE_APPLICATION_CREDENTIALS in Settings to use Google realtime transcription.\",\n        };\n      }\n\n      const builderCreds = await resolveBuilderCredentials();\n      if (!builderCreds.privateKey || !builderCreds.publicKey) {\n        setResponseStatus(event, 400);\n        return {\n          error:\n            \"Builder must be connected to mint a managed realtime transcription session.\",\n        };\n      }\n\n      const apiHost =\n        process.env.BUILDER_API_HOST || \"https://ai-services.builder.io\";\n      const body = ((await readBody(event).catch(() => ({}))) || {}) as {\n        language?: unknown;\n      };\n      const res = await fetch(\n        `${apiHost}/agent-native/transcribe-stream/session`,\n        {\n          method: \"POST\",\n          headers: {\n            \"Content-Type\": \"application/json\",\n            Authorization: `Bearer ${builderCreds.privateKey}`,\n            \"x-builder-api-key\": builderCreds.publicKey,\n            ...(builderCreds.userId\n              ? { \"x-builder-user-id\": builderCreds.userId }\n              : {}),\n          },\n          body: JSON.stringify({\n            googleApplicationCredentials,\n            language:\n              typeof body?.language === \"string\"\n                ? body.language.trim()\n                : undefined,\n          }),\n        },\n      ).catch((err: any) => {\n        throw new Error(\n          err?.message || \"Failed to reach realtime transcription service\",\n        );\n      });\n\n      if (!res.ok) {\n        const errorBody = await res\n          .json()\n          .catch(() => ({ error: `HTTP ${res.status}` }));\n        setResponseStatus(event, res.status);\n        return {\n          error:\n            typeof errorBody?.error === \"string\"\n              ? errorBody.error\n              : `Realtime session failed (${res.status})`,\n        };\n      }\n\n      const payload = (await res.json()) as GoogleRealtimeSessionResponse;\n      if (!payload?.websocketUrl) {\n        setResponseStatus(event, 502);\n        return {\n          error:\n            \"Realtime transcription service did not return a websocket URL.\",\n        };\n      }\n      return payload;\n    });\n  });\n}\n"]}

package/dist/server/voice-providers-status.d.ts

@@ -4,10 +4,10 @@ export interface VoiceProvidersStatus {
     openai: boolean;
     groq: boolean;
     /**
-     * Google Speech-to-Text realtime streaming is BYOK-only for v1. This only
-     * reports whether a service-account credential is configured; the actual
-     * stream belongs on a dedicated WebSocket -> StreamingRecognize path, not on
-     * the batch transcribe route.
+     * Google Speech-to-Text realtime streaming is BYOK-only for v1. This reports
+     * whether a service-account credential is configured; the actual stream runs
+     * through the dedicated WebSocket -> StreamingRecognize path, not the batch
+     * transcribe route.
      */
     googleRealtime: boolean;
     /** Always true — the Web Speech API is available in WebKit-based clients. */

package/dist/server/voice-providers-status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"voice-providers-status.d.ts","sourceRoot":"","sources":["../../src/server/voice-providers-status.ts"],"names":[],"mappings":"AA4BA,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd;;;;;OAKG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,6EAA6E;IAC7E,OAAO,EAAE,IAAI,CAAC;IACd;;;;;OAKG;IACH,MAAM,EAAE,IAAI,CAAC;CACd;AAED,wBAAgB,iCAAiC;;IAmEhD"}
+{"version":3,"file":"voice-providers-status.d.ts","sourceRoot":"","sources":["../../src/server/voice-providers-status.ts"],"names":[],"mappings":"AA6BA,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd;;;;;OAKG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,6EAA6E;IAC7E,OAAO,EAAE,IAAI,CAAC;IACd;;;;;OAKG;IACH,MAAM,EAAE,IAAI,CAAC;CACd;AAED,wBAAgB,iCAAiC;;IA6EhD"}

package/dist/server/voice-providers-status.js

@@ -20,6 +20,7 @@ import { getSession } from "./auth.js";
 import { resolveHasBuilderPrivateKey } from "./credential-provider.js";
 import { getOrgContext } from "../org/context.js";
 import { runWithRequestContext } from "./request-context.js";
+import { resolveGoogleRealtimeCredentials } from "./google-realtime-session.js";
 export function createVoiceProvidersStatusHandler() {
     return defineEventHandler(async (event) => {
         if (getMethod(event) !== "GET") {
@@ -29,6 +30,16 @@ export function createVoiceProvidersStatusHandler() {
         const session = await getSession(event).catch(() => null);
         async function hasKey(key) {
             try {
+                if (key === "GOOGLE_APPLICATION_CREDENTIALS") {
+                    const orgCtx = session?.email
+                        ? await getOrgContext(event).catch(() => null)
+                        : null;
+                    const resolved = await resolveGoogleRealtimeCredentials({
+                        userEmail: session?.email,
+                        orgId: orgCtx?.orgId ?? undefined,
+                    });
+                    return typeof resolved === "string" && resolved.length > 0;
+                }
                 const ctx = { userEmail: session?.email };
                 if (!session?.email) {
                     const v = await resolveCredential(key, ctx);

package/dist/server/voice-providers-status.js.map

@@ -1 +1 @@
-{"version":3,"file":"voice-providers-status.js","sourceRoot":"","sources":["../../src/server/voice-providers-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAyB7D,MAAM,UAAU,iCAAiC;IAC/C,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAE1D,KAAK,UAAU,MAAM,CAAC,GAAW;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBAC1C,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;oBACpB,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAC5C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC/C,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC;oBACrC,GAAG;oBACH,KAAK,EAAE,MAAM;oBACb,OAAO,EAAE,OAAO,CAAC,KAAK;iBACvB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBACrB,IAAI,UAAU,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAClE,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACnD,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,EAAE,KAAK;gBAC3B,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;gBAC9C,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,2BAA2B,EAAE,CAAC;YACpD,OAAO;gBACL,CAAC,OAAO,EAAE,KAAK;oBACb,CAAC,CAAC,MAAM,qBAAqB,CACzB;wBACE,SAAS,EAAE,OAAO,CAAC,KAAK;wBACxB,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,SAAS;qBAClC,EACD,OAAO,CACR;oBACH,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,IAAI,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QAED,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/D,MAAM,CAAC,gBAAgB,CAAC;YACxB,MAAM,CAAC,gBAAgB,CAAC;YACxB,MAAM,CAAC,cAAc,CAAC;YACtB,MAAM,CAAC,gCAAgC,CAAC;SACzC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAyB;YACnC,OAAO;YACP,MAAM;YACN,MAAM;YACN,IAAI;YACJ,cAAc;YACd,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,IAAI;SACb,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * GET /_agent-native/voice-providers/status\n *\n * Reports which voice transcription providers are configured for the\n * current user. The desktop Settings UI uses this to show \"Connect\" vs\n * \"Connected\" status pills next to each provider option.\n *\n * Resolution mirrors `transcribe-voice.ts`: we try the user-scoped\n * encrypted secret first (set via the sidebar settings UI) and fall back\n * to `resolveCredential()` (env var + SQL settings store). Each lookup is\n * wrapped in try/catch — one provider's failure must never break the\n * whole response.\n *\n * Returns booleans only — never the actual key material.\n */\nimport {\n  defineEventHandler,\n  getMethod,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\nimport { readAppSecret } from \"../secrets/storage.js\";\nimport { resolveCredential } from \"../credentials/index.js\";\nimport { getSession } from \"./auth.js\";\nimport { resolveHasBuilderPrivateKey } from \"./credential-provider.js\";\nimport { getOrgContext } from \"../org/context.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\n\nexport interface VoiceProvidersStatus {\n  builder: boolean;\n  gemini: boolean;\n  openai: boolean;\n  groq: boolean;\n  /**\n   * Google Speech-to-Text realtime streaming is BYOK-only for v1. This only\n   * reports whether a service-account credential is configured; the actual\n   * stream belongs on a dedicated WebSocket -> StreamingRecognize path, not on\n   * the batch transcribe route.\n   */\n  googleRealtime: boolean;\n  /** Always true — the Web Speech API is available in WebKit-based clients. */\n  browser: true;\n  /**\n   * Apple's SFSpeechRecognizer + AVAudioEngine, exposed by the Tauri\n   * desktop client. Always reported as `true` from the server — the\n   * desktop client gates this on macOS at the Tauri-command boundary, so\n   * non-macOS hosts return a clear error instead of attempting to use it.\n   */\n  native: true;\n}\n\nexport function createVoiceProvidersStatusHandler() {\n  return defineEventHandler(async (event: H3Event) => {\n    if (getMethod(event) !== \"GET\") {\n      setResponseStatus(event, 405);\n      return { error: \"Method not allowed\" };\n    }\n\n    const session = await getSession(event).catch(() => null);\n\n    async function hasKey(key: string): Promise<boolean> {\n      try {\n        const ctx = { userEmail: session?.email };\n        if (!session?.email) {\n          const v = await resolveCredential(key, ctx);\n          return typeof v === \"string\" && v.length > 0;\n        }\n        const userSecret = await readAppSecret({\n          key,\n          scope: \"user\",\n          scopeId: session.email,\n        }).catch(() => null);\n        if (userSecret?.value && userSecret.value.length > 0) return true;\n        const fallback = await resolveCredential(key, ctx);\n        return typeof fallback === \"string\" && fallback.length > 0;\n      } catch {\n        return false;\n      }\n    }\n\n    let builder = false;\n    try {\n      const orgCtx = session?.email\n        ? await getOrgContext(event).catch(() => null)\n        : null;\n      const resolve = () => resolveHasBuilderPrivateKey();\n      builder =\n        (session?.email\n          ? await runWithRequestContext(\n              {\n                userEmail: session.email,\n                orgId: orgCtx?.orgId ?? undefined,\n              },\n              resolve,\n            )\n          : await resolve()) === true;\n    } catch {\n      builder = false;\n    }\n\n    const [gemini, openai, groq, googleRealtime] = await Promise.all([\n      hasKey(\"GEMINI_API_KEY\"),\n      hasKey(\"OPENAI_API_KEY\"),\n      hasKey(\"GROQ_API_KEY\"),\n      hasKey(\"GOOGLE_APPLICATION_CREDENTIALS\"),\n    ]);\n\n    const status: VoiceProvidersStatus = {\n      builder,\n      gemini,\n      openai,\n      groq,\n      googleRealtime,\n      browser: true,\n      native: true,\n    };\n    return status;\n  });\n}\n"]}
+{"version":3,"file":"voice-providers-status.js","sourceRoot":"","sources":["../../src/server/voice-providers-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAyBhF,MAAM,UAAU,iCAAiC;IAC/C,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAE1D,KAAK,UAAU,MAAM,CAAC,GAAW;YAC/B,IAAI,CAAC;gBACH,IAAI,GAAG,KAAK,gCAAgC,EAAE,CAAC;oBAC7C,MAAM,MAAM,GAAG,OAAO,EAAE,KAAK;wBAC3B,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;wBAC9C,CAAC,CAAC,IAAI,CAAC;oBACT,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;wBACtD,SAAS,EAAE,OAAO,EAAE,KAAK;wBACzB,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,SAAS;qBAClC,CAAC,CAAC;oBACH,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC7D,CAAC;gBACD,MAAM,GAAG,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBAC1C,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;oBACpB,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAC5C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC/C,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC;oBACrC,GAAG;oBACH,KAAK,EAAE,MAAM;oBACb,OAAO,EAAE,OAAO,CAAC,KAAK;iBACvB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBACrB,IAAI,UAAU,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAClE,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACnD,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,EAAE,KAAK;gBAC3B,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;gBAC9C,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,2BAA2B,EAAE,CAAC;YACpD,OAAO;gBACL,CAAC,OAAO,EAAE,KAAK;oBACb,CAAC,CAAC,MAAM,qBAAqB,CACzB;wBACE,SAAS,EAAE,OAAO,CAAC,KAAK;wBACxB,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,SAAS;qBAClC,EACD,OAAO,CACR;oBACH,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,KAAK,IAAI,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QAED,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/D,MAAM,CAAC,gBAAgB,CAAC;YACxB,MAAM,CAAC,gBAAgB,CAAC;YACxB,MAAM,CAAC,cAAc,CAAC;YACtB,MAAM,CAAC,gCAAgC,CAAC;SACzC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAyB;YACnC,OAAO;YACP,MAAM;YACN,MAAM;YACN,IAAI;YACJ,cAAc;YACd,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,IAAI;SACb,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * GET /_agent-native/voice-providers/status\n *\n * Reports which voice transcription providers are configured for the\n * current user. The desktop Settings UI uses this to show \"Connect\" vs\n * \"Connected\" status pills next to each provider option.\n *\n * Resolution mirrors `transcribe-voice.ts`: we try the user-scoped\n * encrypted secret first (set via the sidebar settings UI) and fall back\n * to `resolveCredential()` (env var + SQL settings store). Each lookup is\n * wrapped in try/catch — one provider's failure must never break the\n * whole response.\n *\n * Returns booleans only — never the actual key material.\n */\nimport {\n  defineEventHandler,\n  getMethod,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\nimport { readAppSecret } from \"../secrets/storage.js\";\nimport { resolveCredential } from \"../credentials/index.js\";\nimport { getSession } from \"./auth.js\";\nimport { resolveHasBuilderPrivateKey } from \"./credential-provider.js\";\nimport { getOrgContext } from \"../org/context.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\nimport { resolveGoogleRealtimeCredentials } from \"./google-realtime-session.js\";\n\nexport interface VoiceProvidersStatus {\n  builder: boolean;\n  gemini: boolean;\n  openai: boolean;\n  groq: boolean;\n  /**\n   * Google Speech-to-Text realtime streaming is BYOK-only for v1. This reports\n   * whether a service-account credential is configured; the actual stream runs\n   * through the dedicated WebSocket -> StreamingRecognize path, not the batch\n   * transcribe route.\n   */\n  googleRealtime: boolean;\n  /** Always true — the Web Speech API is available in WebKit-based clients. */\n  browser: true;\n  /**\n   * Apple's SFSpeechRecognizer + AVAudioEngine, exposed by the Tauri\n   * desktop client. Always reported as `true` from the server — the\n   * desktop client gates this on macOS at the Tauri-command boundary, so\n   * non-macOS hosts return a clear error instead of attempting to use it.\n   */\n  native: true;\n}\n\nexport function createVoiceProvidersStatusHandler() {\n  return defineEventHandler(async (event: H3Event) => {\n    if (getMethod(event) !== \"GET\") {\n      setResponseStatus(event, 405);\n      return { error: \"Method not allowed\" };\n    }\n\n    const session = await getSession(event).catch(() => null);\n\n    async function hasKey(key: string): Promise<boolean> {\n      try {\n        if (key === \"GOOGLE_APPLICATION_CREDENTIALS\") {\n          const orgCtx = session?.email\n            ? await getOrgContext(event).catch(() => null)\n            : null;\n          const resolved = await resolveGoogleRealtimeCredentials({\n            userEmail: session?.email,\n            orgId: orgCtx?.orgId ?? undefined,\n          });\n          return typeof resolved === \"string\" && resolved.length > 0;\n        }\n        const ctx = { userEmail: session?.email };\n        if (!session?.email) {\n          const v = await resolveCredential(key, ctx);\n          return typeof v === \"string\" && v.length > 0;\n        }\n        const userSecret = await readAppSecret({\n          key,\n          scope: \"user\",\n          scopeId: session.email,\n        }).catch(() => null);\n        if (userSecret?.value && userSecret.value.length > 0) return true;\n        const fallback = await resolveCredential(key, ctx);\n        return typeof fallback === \"string\" && fallback.length > 0;\n      } catch {\n        return false;\n      }\n    }\n\n    let builder = false;\n    try {\n      const orgCtx = session?.email\n        ? await getOrgContext(event).catch(() => null)\n        : null;\n      const resolve = () => resolveHasBuilderPrivateKey();\n      builder =\n        (session?.email\n          ? await runWithRequestContext(\n              {\n                userEmail: session.email,\n                orgId: orgCtx?.orgId ?? undefined,\n              },\n              resolve,\n            )\n          : await resolve()) === true;\n    } catch {\n      builder = false;\n    }\n\n    const [gemini, openai, groq, googleRealtime] = await Promise.all([\n      hasKey(\"GEMINI_API_KEY\"),\n      hasKey(\"OPENAI_API_KEY\"),\n      hasKey(\"GROQ_API_KEY\"),\n      hasKey(\"GOOGLE_APPLICATION_CREDENTIALS\"),\n    ]);\n\n    const status: VoiceProvidersStatus = {\n      builder,\n      gemini,\n      openai,\n      groq,\n      googleRealtime,\n      browser: true,\n      native: true,\n    };\n    return status;\n  });\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.7.55",
+  "version": "0.7.57",
   "type": "module",
   "description": "Framework for agent-native application development — where AI agents and UI share state via files",
   "license": "MIT",