npm - @agent-native/core - Versions diffs - 0.95.1 → 0.97.0 - Mend

@agent-native/core 0.95.1 → 0.97.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (655) hide show

package/dist/server/realtime-voice.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"realtime-voice.js","sourceRoot":"","sources":["../../src/server/realtime-voice.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EACL,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,CAAC,MAAM,2BAA2B,GACtC,uCAAuC,CAAC;AAC1C,MAAM,CAAC,MAAM,wBAAwB,GAAG,oCAAoC,CAAC;AAC7E,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;AACtD,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5D,MAAM,CAAC,MAAM,oCAAoC,GAAG,MAAM,CAAC;AAE3D,MAAM,yBAAyB,GAAG,0CAA0C,CAAC;AAC7E,MAAM,aAAa,GAAG,kBAAkB,CAAC;AACzC,MAAM,aAAa,GAAG,OAAO,CAAC;AAC9B,MAAM,oBAAoB,GACxB,wVAAwV,CAAC;AAC3V,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AACzC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AACnD,MAAM,OAAO,GAAG,wBAAwB,CAAC;AACzC,MAAM,UAAU,GAAG,0BAA0B,CAAC;AAC9C,MAAM,cAAc,GAAG,uBAAuB,CAAC;AA4D/C,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAyB,EACzB,QAAgB;IAEhB,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QACxD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,QAAgB;IAC/C,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,oBAAoB,CAAC;AACzD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,QAAgB;IACtD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC9C,UAAU;YACR,OAAO,QAAQ,KAAK,QAAQ;gBAC1B,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CACrD,IAAI,MAAM,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,8BAA8B,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,QAAkB,EAClB,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAE5B,CAAC;QACF,IAAI,MAAM,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,KAAK,GAAG,MAAM,CAAC,KAIpB,CAAC;YACF,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;iBAC7C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;iBAC5D,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,UAAU,CACvD,MAAM,EACN,YAAY,CACb,CAAC;IACF,OAAO,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC;AACzC,CAAC;AAED,SAAS,mBAAmB,CAC1B,WAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,qBAAqB;YAAE,OAAO,IAAI,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAY,CAAC;QACjD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAoC;IAEpC,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClD,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,QAAQ,CACnB,qBAAqB,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAC7C,0BAA0B,CAC3B;YACD,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAc,EACd,QAAgB;IAEhB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,GAAG,QAAQ;QAAE,OAAO,UAAU,CAAC;IAErE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpE,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GACR,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAiB,CAAC,CAAC;IAC9E,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ;QACzD,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAAc,EACd,OAAwC;IAExC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,aAAa,GAAG,OAAO,CAAC,YAAY;QACxC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;QACnC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAClB,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;IAC5E,MAAM,YAAY,GAChB,eAAe,IAAI,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC;QACrD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,KAAK;QACL,SAAS,EAAE,OAAO,CAAC,KAAK;QACxB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,OAAoC,EACpC,OAAwC;IAExC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC;IACxD,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE;QAAE,OAAO,oBAAoB,CAAC;IAC1D,OAAO,QAAQ,CACb,qBAAqB,CACnB,GAAG,oBAAoB,OAAO,eAAe,CAAC,IAAI,EAAE,EAAE,CACvD,EACD,sBAAsB,CACvB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,SAAiB;IAEjB,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACpC,gBAAgB,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CACjD,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CACjD,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CACnC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAA6B,EAC7B,OAAwC;IAExC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM;YAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC7D,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC;QACzE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC9C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,KAAK,EACL,4BAA4B,CAC7B,CAAC;QACF,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,+BAA+B,4BAA4B,SAAS;aAC5E,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAChB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC5C,CAAC;QAED,OAAO,qBAAqB,CAC1B;YACE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,YAAY;gBACpB,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE;gBACrC,CAAC,CAAC,SAAS;SACd,EACD,KAAK,IAAI,EAAE;YACT,MAAM,MAAM,GAAG,CAAC,MAAM,aAAa,CAAC,gBAAgB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EACH,6DAA6D;iBAChE,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG;gBACd,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,oBAAoB,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC;gBACzD,YAAY;gBACZ,iBAAiB,EAAE,CAAC,OAAO,CAAC;gBAC5B,KAAK,EAAE;oBACL,KAAK,EAAE;wBACL,aAAa,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE;wBAClD,cAAc,EAAE;4BACd,IAAI,EAAE,cAAc;4BACpB,eAAe,EAAE,IAAI;4BACrB,kBAAkB,EAAE,IAAI;4BACxB,SAAS,EAAE,MAAM;yBAClB;qBACF;oBACD,MAAM,EAAE;wBACN,KAAK,EAAE,oBAAoB,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC;qBAC1D;iBACF;gBACD,KAAK;gBACL,WAAW,EAAE,MAAM;aACpB,CAAC;YAEF,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAE7C,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,yBAAyB,EAAE;oBAChD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,aAAa,EAAE,UAAU,MAAM,EAAE;wBACjC,0BAA0B,EAAE,MAAM,6BAA6B,CAC7D,IAAI,CAAC,SAAS,CACf;qBACF;oBACD,IAAI,EAAE,IAAI;iBACX,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;YAC9D,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC7D,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EAAE,yCAAyC,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;iBACjG,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC;YACvE,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC1C,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;YAC5D,OAAO,SAAS,CAAC;QACnB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IAOtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC9D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,IACE,SAAS,KAAK,SAAS;QACvB,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAC9D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,YAAY,KAAK,SAAS;QAC1B,CAAC,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EACxE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAAwC;IAExC,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC;IAC9B,IACE,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,mBAAmB,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAC3B,MAAM,CAAC,MAAM,EACb,oCAAoC,CACrC,CAAC;IACF,OAAO;QACL,MAAM;QACN,MAAM;QACN,GAAG,CAAC,MAAM,KAAK,mBAAmB;YAClC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YAC7B,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,sBAAsB;YACjD,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE;YACrC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,gBAAqC,EACrC,OAAwC;IAExC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM;YAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC7D,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC;QACzE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC/C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;QAC9D,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAClC,KAAK,EACL,kCAAkC,CACnC,CAAC;QACF,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,kCAAkC,kCAAkC,SAAS;aACrF,CAAC;QACJ,CAAC;QAED,IAAI,UAAmB,CAAC;QACxB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpD,CAAC;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC;QAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS;YAChC,CAAC,CAAC,YAAY,OAAO,CAAC,SAAS,EAAE;YACjC,CAAC,CAAC,YAAY,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,qBAAqB,CAC1B;YACE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE;gBACH,QAAQ;gBACR,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C;SACF,EACD,KAAK,IAAI,EAAE;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,wBAAwB,CACrC,MAAM,OAAO,CAAC,WAAW,CAAC;oBACxB,KAAK;oBACL,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,GAAG,OAAO;iBACX,CAAC,CACH,CAAC;gBACF,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;YAC/C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,QAAiB;oBACzB,MAAM,EAAE,QAAQ,CACd,sBAAsB,CAAC,KAAK,CAAC,IAAI,uBAAuB,EACxD,oCAAoC,CACrC;iBACF,CAAC;YACJ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,wBAAwB,CACtC,QAAa,EACb,OAAoC,EACpC,OAAwC;IAExC,IAAI,OAAO,OAAO,EAAE,WAAW,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,GAAG,CAAC,GAAG,CACL,wBAAwB,EACxB,iBAAiB,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAC7C,CAAC;IACF,OAAO;QACL,WAAW,EAAE,2BAA2B;QACxC,QAAQ,EAAE,wBAAwB;KACnC,CAAC;AACJ,CAAC","sourcesContent":["import {\n defineEventHandler,\n getHeader,\n getMethod,\n readRawBody,\n setResponseHeader,\n setResponseStatus,\n type H3Event,\n} from \"h3\";\n\nimport {\n actionsToEngineTools,\n type ActionEntry,\n} from \"../agent/production-agent.js\";\nimport {\n redactSensitiveFields,\n sanitizeToolErrorText,\n sanitizeToolErrorValue,\n} from \"../agent/tool-error-redaction.js\";\nimport { getSession } from \"./auth.js\";\nimport { resolveSecret } from \"./credential-provider.js\";\nimport { getH3App } from \"./framework-request-handler.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\n\nexport const REALTIME_VOICE_SESSION_PATH =\n \"/_agent-native/realtime-voice/session\";\nexport const REALTIME_VOICE_TOOL_PATH = \"/_agent-native/realtime-voice/tool\";\nexport const REALTIME_VOICE_MAX_SDP_BYTES = 64 * 1024;\nexport const REALTIME_VOICE_MAX_TOOL_BODY_BYTES = 64 * 1024;\nexport const REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS = 16_000;\n\nconst OPENAI_REALTIME_CALLS_URL = \"https://api.openai.com/v1/realtime/calls\";\nconst DEFAULT_MODEL = \"gpt-realtime-2.1\";\nconst DEFAULT_VOICE = \"marin\";\nconst DEFAULT_INSTRUCTIONS =\n \"You are the live voice interface for this Agent Native app. Speak naturally, briefly, and conversationally. Use the available function tools when the user asks you to navigate or take an action. Never claim an action succeeded until its tool result confirms success. If a tool requires approval, explain that the user must approve it in chat.\";\nconst MAX_INSTRUCTIONS_CHARS = 16_000;\nconst MAX_TOOL_DESCRIPTION_CHARS = 2_000;\nconst MAX_TOOL_SCHEMA_CHARS = 64 * 1024;\nconst MAX_APPROVAL_KEY_CHARS = 1_024;\nconst REALTIME_TOOL_NAME = /^[A-Za-z0-9_-]{1,64}$/;\nconst CALL_ID = /^[A-Za-z0-9_-]{1,256}$/;\nconst SESSION_ID = /^[A-Za-z0-9_.:-]{1,256}$/;\nconst BROWSER_TAB_ID = /^[A-Za-z0-9_-]{1,96}$/;\n\nexport interface RealtimeVoiceRequestContext {\n event: H3Event;\n userEmail: string;\n orgId?: string;\n browserTabId?: string;\n}\n\nexport interface RealtimeVoiceToolExecutionRequest extends RealtimeVoiceRequestContext {\n name: string;\n args: Record<string, unknown>;\n callId: string;\n sessionId?: string;\n}\n\nexport interface RealtimeVoiceToolExecutionResult {\n status: \"completed\" \| \"failed\" \| \"approval_required\";\n output: string;\n approvalKey?: string;\n}\n\nexport interface MountRealtimeVoiceRoutesOptions {\n /** Server-controlled model. Defaults to gpt-realtime-2.1. /\n model?: string;\n /* Server-controlled output voice. Defaults to marin. /\n voice?: string;\n /* Static app guidance appended to the safe default voice instructions. /\n instructions?: string;\n /* Per-request app/navigation guidance. It is sent only to OpenAI. /\n getInstructions?: (\n context: RealtimeVoiceRequestContext,\n ) => string \| null \| undefined \| Promise<string \| null \| undefined>;\n /* Optional app-specific active-organization resolver. /\n resolveOrgId?: (\n event: H3Event,\n ) => string \| null \| undefined \| Promise<string \| null \| undefined>;\n /\n Central agent tool executor supplied by the agent-chat plugin. The executor\n * owns validation, approval, journaling, timeout, mutation notification, and\n * action-result normalization; this transport must not call ActionEntry.run.\n /\n executeTool: (\n request: RealtimeVoiceToolExecutionRequest,\n ) =>\n \| RealtimeVoiceToolExecutionResult\n \| Promise<RealtimeVoiceToolExecutionResult>;\n}\n\ninterface RealtimeFunctionTool {\n type: \"function\";\n name: string;\n description: string;\n parameters: Record<string, unknown>;\n}\n\ninterface AuthenticatedVoiceContext extends RealtimeVoiceRequestContext {\n timezone?: string;\n}\n\nfunction readSafeHeader(event: H3Event, name: string): string \| undefined {\n const value = getHeader(event, name);\n if (typeof value !== \"string\") return undefined;\n const trimmed = value.trim();\n return trimmed \|\| undefined;\n}\n\nfunction configuredIdentifier(\n value: string \| undefined,\n fallback: string,\n): string {\n const trimmed = value?.trim();\n return trimmed && /^[A-Za-z0-9_.:-]{1,128}$/.test(trimmed)\n ? trimmed\n : fallback;\n}\n\nfunction truncate(value: string, maxChars: number): string {\n if (value.length <= maxChars) return value;\n return `${value.slice(0, maxChars)}\\n\\n...[truncated]`;\n}\n\nfunction sanitizeOutput(value: unknown, maxChars: number): string {\n let serialized: string;\n try {\n const redacted = redactSensitiveFields(value);\n serialized =\n typeof redacted === \"string\"\n ? redacted\n : (JSON.stringify(redacted, (_key, entry) =>\n typeof entry === \"bigint\" ? entry.toString() : entry,\n ) ?? \"null\");\n } catch {\n serialized = \"[Unserializable tool result]\";\n }\n return truncate(sanitizeToolErrorText(serialized), maxChars);\n}\n\nasync function safeOpenAiErrorDetail(\n response: Response,\n apiKey: string,\n): Promise<string \| null> {\n const raw = await response.text().catch(() => \"\");\n if (!raw) return null;\n let detail = raw;\n try {\n const parsed = JSON.parse(raw) as {\n error?: { message?: unknown; code?: unknown; type?: unknown } \| unknown;\n };\n if (parsed.error && typeof parsed.error === \"object\") {\n const error = parsed.error as {\n message?: unknown;\n code?: unknown;\n type?: unknown;\n };\n detail = [error.message, error.code, error.type]\n .filter((value) => typeof value === \"string\" && value.trim())\n .join(\" · \");\n }\n } catch {\n // Plain-text upstream errors are sanitized below.\n }\n const redacted = sanitizeToolErrorText(detail).replaceAll(\n apiKey,\n \"[REDACTED]\",\n );\n return truncate(redacted, 500) \|\| null;\n}\n\nfunction normalizeToolSchema(\n inputSchema: unknown,\n): Record<string, unknown> \| null {\n try {\n const serialized = JSON.stringify(inputSchema);\n if (!serialized \|\| serialized.length > MAX_TOOL_SCHEMA_CHARS) return null;\n const parsed = JSON.parse(serialized) as unknown;\n if (!parsed \|\| typeof parsed !== \"object\" \|\| Array.isArray(parsed)) {\n return null;\n }\n return parsed as Record<string, unknown>;\n } catch {\n return null;\n }\n}\n\nfunction buildRealtimeTools(\n actions: Record<string, ActionEntry>,\n): RealtimeFunctionTool[] {\n const tools: RealtimeFunctionTool[] = [];\n for (const tool of actionsToEngineTools(actions)) {\n if (!REALTIME_TOOL_NAME.test(tool.name)) continue;\n const parameters = normalizeToolSchema(tool.inputSchema);\n if (!parameters) continue;\n tools.push({\n type: \"function\",\n name: tool.name,\n description: truncate(\n sanitizeToolErrorText(tool.description \|\| \"\"),\n MAX_TOOL_DESCRIPTION_CHARS,\n ),\n parameters,\n });\n }\n return tools;\n}\n\nfunction declaredBodyBytes(event: H3Event): number \| undefined {\n const raw = readSafeHeader(event, \"content-length\");\n if (!raw) return undefined;\n const parsed = Number.parseInt(raw, 10);\n return Number.isFinite(parsed) && parsed >= 0 ? parsed : undefined;\n}\n\nasync function readLimitedRawBody(\n event: H3Event,\n maxBytes: number,\n): Promise<string \| null \| \"oversize\"> {\n const declared = declaredBodyBytes(event);\n if (declared !== undefined && declared > maxBytes) return \"oversize\";\n\n const raw = await readRawBody(event, \"utf8\").catch(() => undefined);\n if (raw == null) return null;\n const text =\n typeof raw === \"string\" ? raw : new TextDecoder().decode(raw as Uint8Array);\n return new TextEncoder().encode(text).byteLength > maxBytes\n ? \"oversize\"\n : text;\n}\n\nasync function authenticateVoiceRequest(\n event: H3Event,\n options: MountRealtimeVoiceRoutesOptions,\n): Promise<AuthenticatedVoiceContext \| null> {\n const session = await getSession(event).catch(() => null);\n if (!session?.email) return null;\n const resolvedOrgId = options.resolveOrgId\n ? await options.resolveOrgId(event)\n : session.orgId;\n const timezone = readSafeHeader(event, \"x-user-timezone\");\n const rawBrowserTabId = readSafeHeader(event, \"x-agent-native-browser-tab\");\n const browserTabId =\n rawBrowserTabId && BROWSER_TAB_ID.test(rawBrowserTabId)\n ? rawBrowserTabId\n : undefined;\n return {\n event,\n userEmail: session.email,\n ...(resolvedOrgId ? { orgId: resolvedOrgId } : {}),\n ...(timezone && timezone.length < 64 ? { timezone } : {}),\n ...(browserTabId ? { browserTabId } : {}),\n };\n}\n\nasync function buildInstructions(\n context: RealtimeVoiceRequestContext,\n options: MountRealtimeVoiceRoutesOptions,\n): Promise<string> {\n const dynamic = await options.getInstructions?.(context);\n const appInstructions = dynamic ?? options.instructions;\n if (!appInstructions?.trim()) return DEFAULT_INSTRUCTIONS;\n return truncate(\n sanitizeToolErrorText(\n `${DEFAULT_INSTRUCTIONS}\\n\\n${appInstructions.trim()}`,\n ),\n MAX_INSTRUCTIONS_CHARS,\n );\n}\n\n/\n Hash the authenticated identity before sending it to OpenAI. The stable\n * digest is useful for abuse detection without disclosing the user's email.\n /\nexport async function realtimeVoiceSafetyIdentifier(\n userEmail: string,\n): Promise<string> {\n const input = new TextEncoder().encode(\n `agent-native:${userEmail.trim().toLowerCase()}`,\n );\n const digest = await globalThis.crypto.subtle.digest(\"SHA-256\", input);\n return Array.from(new Uint8Array(digest), (byte) =>\n byte.toString(16).padStart(2, \"0\"),\n ).join(\"\");\n}\n\nfunction invalidMethod(event: H3Event): { error: string } {\n setResponseStatus(event, 405);\n return { error: \"Method not allowed\" };\n}\n\nfunction createSessionHandler(\n tools: RealtimeFunctionTool[],\n options: MountRealtimeVoiceRoutesOptions,\n) {\n return defineEventHandler(async (event: H3Event) => {\n if (getMethod(event) !== \"POST\") return invalidMethod(event);\n setResponseHeader(event, \"Cache-Control\", \"no-store\");\n\n const auth = await authenticateVoiceRequest(event, options);\n if (!auth) {\n setResponseStatus(event, 401);\n return { error: \"Authentication required\" };\n }\n\n const contentType = readSafeHeader(event, \"content-type\")?.toLowerCase();\n if (!contentType?.includes(\"application/sdp\")) {\n setResponseStatus(event, 415);\n return { error: \"Expected Content-Type: application/sdp\" };\n }\n\n const rawSdp = await readLimitedRawBody(\n event,\n REALTIME_VOICE_MAX_SDP_BYTES,\n );\n if (rawSdp === \"oversize\") {\n setResponseStatus(event, 413);\n return {\n error: `SDP offer is too large (max ${REALTIME_VOICE_MAX_SDP_BYTES} bytes)`,\n };\n }\n const sdp = rawSdp ?? \"\";\n if (!sdp.trim()) {\n setResponseStatus(event, 400);\n return { error: \"SDP offer is required\" };\n }\n\n return runWithRequestContext(\n {\n userEmail: auth.userEmail,\n orgId: auth.orgId,\n timezone: auth.timezone,\n run: auth.browserTabId\n ? { browserTabId: auth.browserTabId }\n : undefined,\n },\n async () => {\n const apiKey = (await resolveSecret(\"OPENAI_API_KEY\"))?.trim();\n if (!apiKey) {\n setResponseStatus(event, 400);\n return {\n error:\n \"Configure OPENAI_API_KEY in Settings to use realtime voice.\",\n };\n }\n\n const instructions = await buildInstructions(auth, options);\n const session = {\n type: \"realtime\",\n model: configuredIdentifier(options.model, DEFAULT_MODEL),\n instructions,\n output_modalities: [\"audio\"],\n audio: {\n input: {\n transcription: { model: \"gpt-4o-mini-transcribe\" },\n turn_detection: {\n type: \"semantic_vad\",\n create_response: true,\n interrupt_response: true,\n eagerness: \"auto\",\n },\n },\n output: {\n voice: configuredIdentifier(options.voice, DEFAULT_VOICE),\n },\n },\n tools,\n tool_choice: \"auto\",\n };\n\n const form = new FormData();\n form.set(\"sdp\", sdp);\n form.set(\"session\", JSON.stringify(session));\n\n let upstream: Response;\n try {\n upstream = await fetch(OPENAI_REALTIME_CALLS_URL, {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${apiKey}`,\n \"OpenAI-Safety-Identifier\": await realtimeVoiceSafetyIdentifier(\n auth.userEmail,\n ),\n },\n body: form,\n });\n } catch {\n setResponseStatus(event, 502);\n return { error: \"Could not reach the OpenAI Realtime API\" };\n }\n\n if (!upstream.ok) {\n const detail = await safeOpenAiErrorDetail(upstream, apiKey);\n setResponseStatus(event, 502);\n return {\n error: `OpenAI rejected the realtime session (${upstream.status})${detail ? `: ${detail}` : \"\"}`,\n };\n }\n\n const answerSdp = await upstream.text().catch(() => \"\");\n if (!answerSdp.trim()) {\n setResponseStatus(event, 502);\n return { error: \"OpenAI returned an empty realtime session answer\" };\n }\n\n setResponseStatus(event, upstream.status);\n setResponseHeader(event, \"Content-Type\", \"application/sdp\");\n return answerSdp;\n },\n );\n });\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n return Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction parseToolRequest(value: unknown): {\n name: string;\n args: Record<string, unknown>;\n callId: string;\n sessionId?: string;\n browserTabId?: string;\n} \| null {\n if (!isRecord(value)) return null;\n const { name, args, callId, sessionId, browserTabId } = value;\n if (typeof name !== \"string\" \|\| !REALTIME_TOOL_NAME.test(name)) return null;\n if (typeof callId !== \"string\" \|\| !CALL_ID.test(callId)) return null;\n if (!isRecord(args)) return null;\n if (\n sessionId !== undefined &&\n (typeof sessionId !== \"string\" \|\| !SESSION_ID.test(sessionId))\n ) {\n return null;\n }\n if (\n browserTabId !== undefined &&\n (typeof browserTabId !== \"string\" \|\| !BROWSER_TAB_ID.test(browserTabId))\n ) {\n return null;\n }\n return {\n name,\n args,\n callId,\n ...(sessionId ? { sessionId } : {}),\n ...(browserTabId ? { browserTabId } : {}),\n };\n}\n\nfunction normalizeExecutionResult(\n result: RealtimeVoiceToolExecutionResult,\n): RealtimeVoiceToolExecutionResult {\n const status = result?.status;\n if (\n status !== \"completed\" &&\n status !== \"failed\" &&\n status !== \"approval_required\"\n ) {\n throw new Error(\"Invalid realtime tool execution status\");\n }\n const output = sanitizeOutput(\n result.output,\n REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS,\n );\n return {\n status,\n output,\n ...(status === \"approval_required\" &&\n typeof result.approvalKey === \"string\" &&\n result.approvalKey.length > 0 &&\n result.approvalKey.length <= MAX_APPROVAL_KEY_CHARS\n ? { approvalKey: result.approvalKey }\n : {}),\n };\n}\n\nfunction createToolHandler(\n allowedToolNames: ReadonlySet<string>,\n options: MountRealtimeVoiceRoutesOptions,\n) {\n return defineEventHandler(async (event: H3Event) => {\n if (getMethod(event) !== \"POST\") return invalidMethod(event);\n setResponseHeader(event, \"Cache-Control\", \"no-store\");\n\n const auth = await authenticateVoiceRequest(event, options);\n if (!auth) {\n setResponseStatus(event, 401);\n return { error: \"Authentication required\" };\n }\n\n const contentType = readSafeHeader(event, \"content-type\")?.toLowerCase();\n if (!contentType?.includes(\"application/json\")) {\n setResponseStatus(event, 415);\n return { error: \"Expected Content-Type: application/json\" };\n }\n\n const raw = await readLimitedRawBody(\n event,\n REALTIME_VOICE_MAX_TOOL_BODY_BYTES,\n );\n if (raw === \"oversize\") {\n setResponseStatus(event, 413);\n return {\n error: `Tool request is too large (max ${REALTIME_VOICE_MAX_TOOL_BODY_BYTES} bytes)`,\n };\n }\n\n let parsedBody: unknown;\n try {\n parsedBody = JSON.parse(raw ?? \"\");\n } catch {\n setResponseStatus(event, 400);\n return { error: \"Invalid realtime tool request\" };\n }\n const request = parseToolRequest(parsedBody);\n if (!request) {\n setResponseStatus(event, 400);\n return { error: \"Invalid realtime tool request\" };\n }\n if (!allowedToolNames.has(request.name)) {\n setResponseStatus(event, 404);\n return { error: \"Unknown realtime voice tool\" };\n }\n\n const browserTabId = request.browserTabId ?? auth.browserTabId;\n const threadId = request.sessionId\n ? `realtime:${request.sessionId}`\n : `realtime:${request.callId}`;\n return runWithRequestContext(\n {\n userEmail: auth.userEmail,\n orgId: auth.orgId,\n timezone: auth.timezone,\n run: {\n threadId,\n ...(browserTabId ? { browserTabId } : {}),\n },\n },\n async () => {\n try {\n const result = normalizeExecutionResult(\n await options.executeTool({\n event,\n userEmail: auth.userEmail,\n orgId: auth.orgId,\n ...request,\n }),\n );\n return { callId: request.callId, ...result };\n } catch (error) {\n setResponseStatus(event, 500);\n return {\n callId: request.callId,\n status: \"failed\" as const,\n output: truncate(\n sanitizeToolErrorValue(error) \|\| \"Tool execution failed\",\n REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS,\n ),\n };\n }\n },\n );\n });\n}\n\n/* Mount the authenticated OpenAI Realtime WebRTC and tool bridge routes. */\nexport function mountRealtimeVoiceRoutes(\n nitroApp: any,\n actions: Record<string, ActionEntry>,\n options: MountRealtimeVoiceRoutesOptions,\n): { sessionPath: string; toolPath: string } {\n if (typeof options?.executeTool !== \"function\") {\n throw new Error(\"mountRealtimeVoiceRoutes requires executeTool\");\n }\n\n const tools = buildRealtimeTools(actions);\n const allowedToolNames = new Set(tools.map((tool) => tool.name));\n const app = getH3App(nitroApp);\n app.use(REALTIME_VOICE_SESSION_PATH, createSessionHandler(tools, options));\n app.use(\n REALTIME_VOICE_TOOL_PATH,\n createToolHandler(allowedToolNames, options),\n );\n return {\n sessionPath: REALTIME_VOICE_SESSION_PATH,\n toolPath: REALTIME_VOICE_TOOL_PATH,\n };\n}\n"]}
1	+ {"version":3,"file":"realtime-voice.js","sourceRoot":"","sources":["../../src/server/realtime-voice.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EACL,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,MAAM,CAAC,MAAM,2BAA2B,GACtC,uCAAuC,CAAC;AAC1C,MAAM,CAAC,MAAM,wBAAwB,GAAG,oCAAoC,CAAC;AAC7E,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;AACtD,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5D,MAAM,CAAC,MAAM,oCAAoC,GAAG,MAAM,CAAC;AAE3D,MAAM,yBAAyB,GAAG,0CAA0C,CAAC;AAC7E,MAAM,aAAa,GAAG,kBAAkB,CAAC;AACzC,MAAM,aAAa,GAAG,OAAO,CAAC;AAC9B,MAAM,oBAAoB,GACxB,wVAAwV,CAAC;AAC3V,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AACzC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AACnD,MAAM,OAAO,GAAG,wBAAwB,CAAC;AACzC,MAAM,UAAU,GAAG,0BAA0B,CAAC;AAC9C,MAAM,cAAc,GAAG,uBAAuB,CAAC;AA4D/C,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAyB,EACzB,QAAgB;IAEhB,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QACxD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,QAAgB;IAC/C,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,oBAAoB,CAAC;AACzD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,QAAgB;IACtD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC9C,UAAU;YACR,OAAO,QAAQ,KAAK,QAAQ;gBAC1B,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CACrD,IAAI,MAAM,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,8BAA8B,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,QAAkB,EAClB,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAE5B,CAAC;QACF,IAAI,MAAM,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,KAAK,GAAG,MAAM,CAAC,KAIpB,CAAC;YACF,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;iBAC7C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;iBAC5D,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,UAAU,CACvD,MAAM,EACN,YAAY,CACb,CAAC;IACF,OAAO,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC;AACzC,CAAC;AAED,SAAS,mBAAmB,CAC1B,WAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,qBAAqB;YAAE,OAAO,IAAI,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAY,CAAC;QACjD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAoC;IAEpC,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClD,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,QAAQ,CACnB,qBAAqB,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAC7C,0BAA0B,CAC3B;YACD,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAc,EACd,QAAgB;IAEhB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,GAAG,QAAQ;QAAE,OAAO,UAAU,CAAC;IAErE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpE,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GACR,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAiB,CAAC,CAAC;IAC9E,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ;QACzD,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAAc,EACd,OAAwC;IAExC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,aAAa,GAAG,OAAO,CAAC,YAAY;QACxC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;QACnC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAClB,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;IAC5E,MAAM,YAAY,GAChB,eAAe,IAAI,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC;QACrD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,KAAK;QACL,SAAS,EAAE,OAAO,CAAC,KAAK;QACxB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,OAAoC,EACpC,OAAwC;IAExC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC;IACxD,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE;QAAE,OAAO,oBAAoB,CAAC;IAC1D,OAAO,QAAQ,CACb,qBAAqB,CACnB,GAAG,oBAAoB,OAAO,eAAe,CAAC,IAAI,EAAE,EAAE,CACvD,EACD,sBAAsB,CACvB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,SAAiB;IAEjB,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACpC,gBAAgB,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CACjD,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CACjD,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CACnC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAA6B,EAC7B,OAAwC;IAExC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM;YAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpD,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC;QACzE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC9C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,KAAK,EACL,4BAA4B,CAC7B,CAAC;QACF,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,+BAA+B,4BAA4B,SAAS;aAC5E,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAChB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC5C,CAAC;QAED,OAAO,qBAAqB,CAC1B;YACE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,YAAY;gBACpB,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE;gBACrC,CAAC,CAAC,SAAS;SACd,EACD,KAAK,IAAI,EAAE;YACT,MAAM,kBAAkB,GAAG,MAAM,yBAAyB,EAAE,CAAC;YAC7D,MAAM,iBAAiB,GAAG,OAAO,CAC/B,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE;gBACrC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,CACrC,CAAC;YACF,MAAM,MAAM,GAAG,iBAAiB;gBAC9B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,gBAAgB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,iBAAiB,IAAI,CAAC,MAAM,EAAE,CAAC;gBAClC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EACH,uEAAuE;oBACzE,IAAI,EAAE,+BAA+B;iBACtC,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG;gBACd,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,oBAAoB,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC;gBACzD,YAAY;gBACZ,iBAAiB,EAAE,CAAC,OAAO,CAAC;gBAC5B,KAAK,EAAE;oBACL,KAAK,EAAE;wBACL,aAAa,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE;wBAClD,cAAc,EAAE;4BACd,IAAI,EAAE,cAAc;4BACpB,eAAe,EAAE,IAAI;4BACrB,kBAAkB,EAAE,IAAI;4BACxB,SAAS,EAAE,MAAM;yBAClB;qBACF;oBACD,MAAM,EAAE;wBACN,KAAK,EAAE,oBAAoB,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC;qBAC1D;iBACF;gBACD,KAAK;gBACL,WAAW,EAAE,MAAM;aACpB,CAAC;YAEF,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,IAAI,iBAAiB,EAAE,CAAC;oBACtB,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,gBAAgB,EAChB,wBAAwB,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;wBACtC,CAAC,CAAC,wBAAwB,EAAE;wBAC5B,CAAC,CAAC,GAAG,wBAAwB,EAAE,GAAG,CACrC,CAAC;oBACF,UAAU,CAAC,YAAY,CAAC,GAAG,CACzB,QAAQ,EACR,kBAAkB,CAAC,SAAU,CAAC,IAAI,EAAE,CACrC,CAAC;oBACF,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE;wBAC5C,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,cAAc,EAAE,kBAAkB;4BAClC,aAAa,EAAE,UAAU,kBAAkB,CAAC,UAAW,CAAC,IAAI,EAAE,EAAE;4BAChE,mBAAmB,EAAE,kBAAkB,CAAC,SAAU,CAAC,IAAI,EAAE;4BACzD,GAAG,+BAA+B,EAAE;4BACpC,GAAG,CAAC,kBAAkB,CAAC,MAAM;gCAC3B,CAAC,CAAC,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,MAAM,EAAE;gCACpD,CAAC,CAAC,EAAE,CAAC;yBACR;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;qBACvC,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;oBAC5B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBACrB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC7C,QAAQ,GAAG,MAAM,KAAK,CAAC,yBAAyB,EAAE;wBAChD,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,aAAa,EAAE,UAAU,MAAM,EAAE;4BACjC,0BAA0B,EAAE,MAAM,6BAA6B,CAC7D,IAAI,CAAC,SAAS,CACf;yBACF;wBACD,IAAI,EAAE,IAAI;qBACX,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EAAE,iBAAiB;wBACtB,CAAC,CAAC,oDAAoD;wBACtD,CAAC,CAAC,yCAAyC;iBAC9C,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CACxC,QAAQ,EACR,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAW,CAAC,CAAC,CAAC,MAAO,CAC7D,CAAC;gBACF,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACpE,OAAO;oBACL,KAAK,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,mCAAmC,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;iBACtI,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,4CAA4C;iBAC/F,CAAC;YACJ,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC1C,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;YAC5D,OAAO,SAAS,CAAC;QACnB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IAOtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC9D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,IACE,SAAS,KAAK,SAAS;QACvB,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAC9D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,YAAY,KAAK,SAAS;QAC1B,CAAC,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EACxE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAAwC;IAExC,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC;IAC9B,IACE,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,mBAAmB,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAC3B,MAAM,CAAC,MAAM,EACb,oCAAoC,CACrC,CAAC;IACF,OAAO;QACL,MAAM;QACN,MAAM;QACN,GAAG,CAAC,MAAM,KAAK,mBAAmB;YAClC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YAC7B,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,sBAAsB;YACjD,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE;YACrC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,gBAAqC,EACrC,OAAwC;IAExC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM;YAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpD,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC;QACzE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC/C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;QAC9D,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAClC,KAAK,EACL,kCAAkC,CACnC,CAAC;QACF,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,kCAAkC,kCAAkC,SAAS;aACrF,CAAC;QACJ,CAAC;QAED,IAAI,UAAmB,CAAC;QACxB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpD,CAAC;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC;QAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS;YAChC,CAAC,CAAC,YAAY,OAAO,CAAC,SAAS,EAAE;YACjC,CAAC,CAAC,YAAY,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,qBAAqB,CAC1B;YACE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE;gBACH,QAAQ;gBACR,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C;SACF,EACD,KAAK,IAAI,EAAE;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,wBAAwB,CACrC,MAAM,OAAO,CAAC,WAAW,CAAC;oBACxB,KAAK;oBACL,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,GAAG,OAAO;iBACX,CAAC,CACH,CAAC;gBACF,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;YAC/C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,QAAiB;oBACzB,MAAM,EAAE,QAAQ,CACd,sBAAsB,CAAC,KAAK,CAAC,IAAI,uBAAuB,EACxD,oCAAoC,CACrC;iBACF,CAAC;YACJ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,wBAAwB,CACtC,QAAa,EACb,OAAoC,EACpC,OAAwC;IAExC,IAAI,OAAO,OAAO,EAAE,WAAW,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,GAAG,CAAC,GAAG,CACL,wBAAwB,EACxB,iBAAiB,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAC7C,CAAC;IACF,OAAO;QACL,WAAW,EAAE,2BAA2B;QACxC,QAAQ,EAAE,wBAAwB;KACnC,CAAC;AACJ,CAAC","sourcesContent":["import {\n defineEventHandler,\n getHeader,\n getMethod,\n readRawBody,\n setResponseHeader,\n setResponseStatus,\n type H3Event,\n} from \"h3\";\n\nimport { getBuilderGatewayRequestHeaders } from \"../agent/engine/builder-gateway-headers.js\";\nimport {\n actionsToEngineTools,\n type ActionEntry,\n} from \"../agent/production-agent.js\";\nimport {\n redactSensitiveFields,\n sanitizeToolErrorText,\n sanitizeToolErrorValue,\n} from \"../agent/tool-error-redaction.js\";\nimport { getSession } from \"./auth.js\";\nimport {\n getBuilderGatewayBaseUrl,\n resolveBuilderCredentials,\n resolveSecret,\n} from \"./credential-provider.js\";\nimport { getH3App } from \"./framework-request-handler.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\nimport { isSameOriginRequest } from \"./request-origin.js\";\n\nexport const REALTIME_VOICE_SESSION_PATH =\n \"/_agent-native/realtime-voice/session\";\nexport const REALTIME_VOICE_TOOL_PATH = \"/_agent-native/realtime-voice/tool\";\nexport const REALTIME_VOICE_MAX_SDP_BYTES = 64 * 1024;\nexport const REALTIME_VOICE_MAX_TOOL_BODY_BYTES = 64 * 1024;\nexport const REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS = 16_000;\n\nconst OPENAI_REALTIME_CALLS_URL = \"https://api.openai.com/v1/realtime/calls\";\nconst DEFAULT_MODEL = \"gpt-realtime-2.1\";\nconst DEFAULT_VOICE = \"marin\";\nconst DEFAULT_INSTRUCTIONS =\n \"You are the live voice interface for this Agent Native app. Speak naturally, briefly, and conversationally. Use the available function tools when the user asks you to navigate or take an action. Never claim an action succeeded until its tool result confirms success. If a tool requires approval, explain that the user must approve it in chat.\";\nconst MAX_INSTRUCTIONS_CHARS = 16_000;\nconst MAX_TOOL_DESCRIPTION_CHARS = 2_000;\nconst MAX_TOOL_SCHEMA_CHARS = 64 * 1024;\nconst MAX_APPROVAL_KEY_CHARS = 1_024;\nconst REALTIME_TOOL_NAME = /^[A-Za-z0-9_-]{1,64}$/;\nconst CALL_ID = /^[A-Za-z0-9_-]{1,256}$/;\nconst SESSION_ID = /^[A-Za-z0-9_.:-]{1,256}$/;\nconst BROWSER_TAB_ID = /^[A-Za-z0-9_-]{1,96}$/;\n\nexport interface RealtimeVoiceRequestContext {\n event: H3Event;\n userEmail: string;\n orgId?: string;\n browserTabId?: string;\n}\n\nexport interface RealtimeVoiceToolExecutionRequest extends RealtimeVoiceRequestContext {\n name: string;\n args: Record<string, unknown>;\n callId: string;\n sessionId?: string;\n}\n\nexport interface RealtimeVoiceToolExecutionResult {\n status: \"completed\" \| \"failed\" \| \"approval_required\";\n output: string;\n approvalKey?: string;\n}\n\nexport interface MountRealtimeVoiceRoutesOptions {\n /** Server-controlled model. Defaults to gpt-realtime-2.1. /\n model?: string;\n /* Server-controlled output voice. Defaults to marin. /\n voice?: string;\n /* Static app guidance appended to the safe default voice instructions. /\n instructions?: string;\n /* Per-request app/navigation guidance. It is sent only to OpenAI. /\n getInstructions?: (\n context: RealtimeVoiceRequestContext,\n ) => string \| null \| undefined \| Promise<string \| null \| undefined>;\n /* Optional app-specific active-organization resolver. /\n resolveOrgId?: (\n event: H3Event,\n ) => string \| null \| undefined \| Promise<string \| null \| undefined>;\n /\n Central agent tool executor supplied by the agent-chat plugin. The executor\n * owns validation, approval, journaling, timeout, mutation notification, and\n * action-result normalization; this transport must not call ActionEntry.run.\n /\n executeTool: (\n request: RealtimeVoiceToolExecutionRequest,\n ) =>\n \| RealtimeVoiceToolExecutionResult\n \| Promise<RealtimeVoiceToolExecutionResult>;\n}\n\ninterface RealtimeFunctionTool {\n type: \"function\";\n name: string;\n description: string;\n parameters: Record<string, unknown>;\n}\n\ninterface AuthenticatedVoiceContext extends RealtimeVoiceRequestContext {\n timezone?: string;\n}\n\nfunction readSafeHeader(event: H3Event, name: string): string \| undefined {\n const value = getHeader(event, name);\n if (typeof value !== \"string\") return undefined;\n const trimmed = value.trim();\n return trimmed \|\| undefined;\n}\n\nfunction configuredIdentifier(\n value: string \| undefined,\n fallback: string,\n): string {\n const trimmed = value?.trim();\n return trimmed && /^[A-Za-z0-9_.:-]{1,128}$/.test(trimmed)\n ? trimmed\n : fallback;\n}\n\nfunction truncate(value: string, maxChars: number): string {\n if (value.length <= maxChars) return value;\n return `${value.slice(0, maxChars)}\\n\\n...[truncated]`;\n}\n\nfunction sanitizeOutput(value: unknown, maxChars: number): string {\n let serialized: string;\n try {\n const redacted = redactSensitiveFields(value);\n serialized =\n typeof redacted === \"string\"\n ? redacted\n : (JSON.stringify(redacted, (_key, entry) =>\n typeof entry === \"bigint\" ? entry.toString() : entry,\n ) ?? \"null\");\n } catch {\n serialized = \"[Unserializable tool result]\";\n }\n return truncate(sanitizeToolErrorText(serialized), maxChars);\n}\n\nasync function safeOpenAiErrorDetail(\n response: Response,\n apiKey: string,\n): Promise<string \| null> {\n const raw = await response.text().catch(() => \"\");\n if (!raw) return null;\n let detail = raw;\n try {\n const parsed = JSON.parse(raw) as {\n error?: { message?: unknown; code?: unknown; type?: unknown } \| unknown;\n };\n if (parsed.error && typeof parsed.error === \"object\") {\n const error = parsed.error as {\n message?: unknown;\n code?: unknown;\n type?: unknown;\n };\n detail = [error.message, error.code, error.type]\n .filter((value) => typeof value === \"string\" && value.trim())\n .join(\" · \");\n }\n } catch {\n // Plain-text upstream errors are sanitized below.\n }\n const redacted = sanitizeToolErrorText(detail).replaceAll(\n apiKey,\n \"[REDACTED]\",\n );\n return truncate(redacted, 500) \|\| null;\n}\n\nfunction normalizeToolSchema(\n inputSchema: unknown,\n): Record<string, unknown> \| null {\n try {\n const serialized = JSON.stringify(inputSchema);\n if (!serialized \|\| serialized.length > MAX_TOOL_SCHEMA_CHARS) return null;\n const parsed = JSON.parse(serialized) as unknown;\n if (!parsed \|\| typeof parsed !== \"object\" \|\| Array.isArray(parsed)) {\n return null;\n }\n return parsed as Record<string, unknown>;\n } catch {\n return null;\n }\n}\n\nfunction buildRealtimeTools(\n actions: Record<string, ActionEntry>,\n): RealtimeFunctionTool[] {\n const tools: RealtimeFunctionTool[] = [];\n for (const tool of actionsToEngineTools(actions)) {\n if (!REALTIME_TOOL_NAME.test(tool.name)) continue;\n const parameters = normalizeToolSchema(tool.inputSchema);\n if (!parameters) continue;\n tools.push({\n type: \"function\",\n name: tool.name,\n description: truncate(\n sanitizeToolErrorText(tool.description \|\| \"\"),\n MAX_TOOL_DESCRIPTION_CHARS,\n ),\n parameters,\n });\n }\n return tools;\n}\n\nfunction declaredBodyBytes(event: H3Event): number \| undefined {\n const raw = readSafeHeader(event, \"content-length\");\n if (!raw) return undefined;\n const parsed = Number.parseInt(raw, 10);\n return Number.isFinite(parsed) && parsed >= 0 ? parsed : undefined;\n}\n\nasync function readLimitedRawBody(\n event: H3Event,\n maxBytes: number,\n): Promise<string \| null \| \"oversize\"> {\n const declared = declaredBodyBytes(event);\n if (declared !== undefined && declared > maxBytes) return \"oversize\";\n\n const raw = await readRawBody(event, \"utf8\").catch(() => undefined);\n if (raw == null) return null;\n const text =\n typeof raw === \"string\" ? raw : new TextDecoder().decode(raw as Uint8Array);\n return new TextEncoder().encode(text).byteLength > maxBytes\n ? \"oversize\"\n : text;\n}\n\nasync function authenticateVoiceRequest(\n event: H3Event,\n options: MountRealtimeVoiceRoutesOptions,\n): Promise<AuthenticatedVoiceContext \| null> {\n const session = await getSession(event).catch(() => null);\n if (!session?.email) return null;\n const resolvedOrgId = options.resolveOrgId\n ? await options.resolveOrgId(event)\n : session.orgId;\n const timezone = readSafeHeader(event, \"x-user-timezone\");\n const rawBrowserTabId = readSafeHeader(event, \"x-agent-native-browser-tab\");\n const browserTabId =\n rawBrowserTabId && BROWSER_TAB_ID.test(rawBrowserTabId)\n ? rawBrowserTabId\n : undefined;\n return {\n event,\n userEmail: session.email,\n ...(resolvedOrgId ? { orgId: resolvedOrgId } : {}),\n ...(timezone && timezone.length < 64 ? { timezone } : {}),\n ...(browserTabId ? { browserTabId } : {}),\n };\n}\n\nasync function buildInstructions(\n context: RealtimeVoiceRequestContext,\n options: MountRealtimeVoiceRoutesOptions,\n): Promise<string> {\n const dynamic = await options.getInstructions?.(context);\n const appInstructions = dynamic ?? options.instructions;\n if (!appInstructions?.trim()) return DEFAULT_INSTRUCTIONS;\n return truncate(\n sanitizeToolErrorText(\n `${DEFAULT_INSTRUCTIONS}\\n\\n${appInstructions.trim()}`,\n ),\n MAX_INSTRUCTIONS_CHARS,\n );\n}\n\n/\n Hash the authenticated identity before sending it to OpenAI. The stable\n * digest is useful for abuse detection without disclosing the user's email.\n /\nexport async function realtimeVoiceSafetyIdentifier(\n userEmail: string,\n): Promise<string> {\n const input = new TextEncoder().encode(\n `agent-native:${userEmail.trim().toLowerCase()}`,\n );\n const digest = await globalThis.crypto.subtle.digest(\"SHA-256\", input);\n return Array.from(new Uint8Array(digest), (byte) =>\n byte.toString(16).padStart(2, \"0\"),\n ).join(\"\");\n}\n\nfunction invalidMethod(event: H3Event): { error: string } {\n setResponseStatus(event, 405);\n return { error: \"Method not allowed\" };\n}\n\nfunction createSessionHandler(\n tools: RealtimeFunctionTool[],\n options: MountRealtimeVoiceRoutesOptions,\n) {\n return defineEventHandler(async (event: H3Event) => {\n if (getMethod(event) !== \"POST\") return invalidMethod(event);\n if (!isSameOriginRequest(event)) {\n setResponseStatus(event, 403);\n return { error: \"Cross-origin request rejected\" };\n }\n setResponseHeader(event, \"Cache-Control\", \"no-store\");\n\n const auth = await authenticateVoiceRequest(event, options);\n if (!auth) {\n setResponseStatus(event, 401);\n return { error: \"Authentication required\" };\n }\n\n const contentType = readSafeHeader(event, \"content-type\")?.toLowerCase();\n if (!contentType?.includes(\"application/sdp\")) {\n setResponseStatus(event, 415);\n return { error: \"Expected Content-Type: application/sdp\" };\n }\n\n const rawSdp = await readLimitedRawBody(\n event,\n REALTIME_VOICE_MAX_SDP_BYTES,\n );\n if (rawSdp === \"oversize\") {\n setResponseStatus(event, 413);\n return {\n error: `SDP offer is too large (max ${REALTIME_VOICE_MAX_SDP_BYTES} bytes)`,\n };\n }\n const sdp = rawSdp ?? \"\";\n if (!sdp.trim()) {\n setResponseStatus(event, 400);\n return { error: \"SDP offer is required\" };\n }\n\n return runWithRequestContext(\n {\n userEmail: auth.userEmail,\n orgId: auth.orgId,\n timezone: auth.timezone,\n run: auth.browserTabId\n ? { browserTabId: auth.browserTabId }\n : undefined,\n },\n async () => {\n const builderCredentials = await resolveBuilderCredentials();\n const builderConfigured = Boolean(\n builderCredentials.privateKey?.trim() &&\n builderCredentials.publicKey?.trim(),\n );\n const apiKey = builderConfigured\n ? null\n : (await resolveSecret(\"OPENAI_API_KEY\"))?.trim();\n if (!builderConfigured && !apiKey) {\n setResponseStatus(event, 409);\n return {\n error:\n \"Connect Builder or configure an OpenAI API key to use realtime voice.\",\n code: \"realtime_voice_setup_required\",\n };\n }\n\n const instructions = await buildInstructions(auth, options);\n const session = {\n type: \"realtime\",\n model: configuredIdentifier(options.model, DEFAULT_MODEL),\n instructions,\n output_modalities: [\"audio\"],\n audio: {\n input: {\n transcription: { model: \"gpt-4o-mini-transcribe\" },\n turn_detection: {\n type: \"semantic_vad\",\n create_response: true,\n interrupt_response: true,\n eagerness: \"auto\",\n },\n },\n output: {\n voice: configuredIdentifier(options.voice, DEFAULT_VOICE),\n },\n },\n tools,\n tool_choice: \"auto\",\n };\n\n let upstream: Response;\n try {\n if (builderConfigured) {\n const gatewayUrl = new URL(\n \"realtime/calls\",\n getBuilderGatewayBaseUrl().endsWith(\"/\")\n ? getBuilderGatewayBaseUrl()\n : `${getBuilderGatewayBaseUrl()}/`,\n );\n gatewayUrl.searchParams.set(\n \"apiKey\",\n builderCredentials.publicKey!.trim(),\n );\n upstream = await fetch(gatewayUrl.toString(), {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n Authorization: `Bearer ${builderCredentials.privateKey!.trim()}`,\n \"x-builder-api-key\": builderCredentials.publicKey!.trim(),\n ...getBuilderGatewayRequestHeaders(),\n ...(builderCredentials.userId\n ? { \"x-builder-user-id\": builderCredentials.userId }\n : {}),\n },\n body: JSON.stringify({ sdp, session }),\n });\n } else {\n const form = new FormData();\n form.set(\"sdp\", sdp);\n form.set(\"session\", JSON.stringify(session));\n upstream = await fetch(OPENAI_REALTIME_CALLS_URL, {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${apiKey}`,\n \"OpenAI-Safety-Identifier\": await realtimeVoiceSafetyIdentifier(\n auth.userEmail,\n ),\n },\n body: form,\n });\n }\n } catch {\n setResponseStatus(event, 502);\n return {\n error: builderConfigured\n ? \"Could not reach the Builder realtime voice gateway\"\n : \"Could not reach the OpenAI Realtime API\",\n };\n }\n\n if (!upstream.ok) {\n const detail = await safeOpenAiErrorDetail(\n upstream,\n builderConfigured ? builderCredentials.privateKey! : apiKey!,\n );\n setResponseStatus(event, builderConfigured ? upstream.status : 502);\n return {\n error: `${builderConfigured ? \"Builder\" : \"OpenAI\"} rejected the realtime session (${upstream.status})${detail ? `: ${detail}` : \"\"}`,\n };\n }\n\n const answerSdp = await upstream.text().catch(() => \"\");\n if (!answerSdp.trim()) {\n setResponseStatus(event, 502);\n return {\n error: `${builderConfigured ? \"Builder\" : \"OpenAI\"} returned an empty realtime session answer`,\n };\n }\n\n setResponseStatus(event, upstream.status);\n setResponseHeader(event, \"Content-Type\", \"application/sdp\");\n return answerSdp;\n },\n );\n });\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n return Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction parseToolRequest(value: unknown): {\n name: string;\n args: Record<string, unknown>;\n callId: string;\n sessionId?: string;\n browserTabId?: string;\n} \| null {\n if (!isRecord(value)) return null;\n const { name, args, callId, sessionId, browserTabId } = value;\n if (typeof name !== \"string\" \|\| !REALTIME_TOOL_NAME.test(name)) return null;\n if (typeof callId !== \"string\" \|\| !CALL_ID.test(callId)) return null;\n if (!isRecord(args)) return null;\n if (\n sessionId !== undefined &&\n (typeof sessionId !== \"string\" \|\| !SESSION_ID.test(sessionId))\n ) {\n return null;\n }\n if (\n browserTabId !== undefined &&\n (typeof browserTabId !== \"string\" \|\| !BROWSER_TAB_ID.test(browserTabId))\n ) {\n return null;\n }\n return {\n name,\n args,\n callId,\n ...(sessionId ? { sessionId } : {}),\n ...(browserTabId ? { browserTabId } : {}),\n };\n}\n\nfunction normalizeExecutionResult(\n result: RealtimeVoiceToolExecutionResult,\n): RealtimeVoiceToolExecutionResult {\n const status = result?.status;\n if (\n status !== \"completed\" &&\n status !== \"failed\" &&\n status !== \"approval_required\"\n ) {\n throw new Error(\"Invalid realtime tool execution status\");\n }\n const output = sanitizeOutput(\n result.output,\n REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS,\n );\n return {\n status,\n output,\n ...(status === \"approval_required\" &&\n typeof result.approvalKey === \"string\" &&\n result.approvalKey.length > 0 &&\n result.approvalKey.length <= MAX_APPROVAL_KEY_CHARS\n ? { approvalKey: result.approvalKey }\n : {}),\n };\n}\n\nfunction createToolHandler(\n allowedToolNames: ReadonlySet<string>,\n options: MountRealtimeVoiceRoutesOptions,\n) {\n return defineEventHandler(async (event: H3Event) => {\n if (getMethod(event) !== \"POST\") return invalidMethod(event);\n if (!isSameOriginRequest(event)) {\n setResponseStatus(event, 403);\n return { error: \"Cross-origin request rejected\" };\n }\n setResponseHeader(event, \"Cache-Control\", \"no-store\");\n\n const auth = await authenticateVoiceRequest(event, options);\n if (!auth) {\n setResponseStatus(event, 401);\n return { error: \"Authentication required\" };\n }\n\n const contentType = readSafeHeader(event, \"content-type\")?.toLowerCase();\n if (!contentType?.includes(\"application/json\")) {\n setResponseStatus(event, 415);\n return { error: \"Expected Content-Type: application/json\" };\n }\n\n const raw = await readLimitedRawBody(\n event,\n REALTIME_VOICE_MAX_TOOL_BODY_BYTES,\n );\n if (raw === \"oversize\") {\n setResponseStatus(event, 413);\n return {\n error: `Tool request is too large (max ${REALTIME_VOICE_MAX_TOOL_BODY_BYTES} bytes)`,\n };\n }\n\n let parsedBody: unknown;\n try {\n parsedBody = JSON.parse(raw ?? \"\");\n } catch {\n setResponseStatus(event, 400);\n return { error: \"Invalid realtime tool request\" };\n }\n const request = parseToolRequest(parsedBody);\n if (!request) {\n setResponseStatus(event, 400);\n return { error: \"Invalid realtime tool request\" };\n }\n if (!allowedToolNames.has(request.name)) {\n setResponseStatus(event, 404);\n return { error: \"Unknown realtime voice tool\" };\n }\n\n const browserTabId = request.browserTabId ?? auth.browserTabId;\n const threadId = request.sessionId\n ? `realtime:${request.sessionId}`\n : `realtime:${request.callId}`;\n return runWithRequestContext(\n {\n userEmail: auth.userEmail,\n orgId: auth.orgId,\n timezone: auth.timezone,\n run: {\n threadId,\n ...(browserTabId ? { browserTabId } : {}),\n },\n },\n async () => {\n try {\n const result = normalizeExecutionResult(\n await options.executeTool({\n event,\n userEmail: auth.userEmail,\n orgId: auth.orgId,\n ...request,\n }),\n );\n return { callId: request.callId, ...result };\n } catch (error) {\n setResponseStatus(event, 500);\n return {\n callId: request.callId,\n status: \"failed\" as const,\n output: truncate(\n sanitizeToolErrorValue(error) \|\| \"Tool execution failed\",\n REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS,\n ),\n };\n }\n },\n );\n });\n}\n\n/* Mount the authenticated OpenAI Realtime WebRTC and tool bridge routes. */\nexport function mountRealtimeVoiceRoutes(\n nitroApp: any,\n actions: Record<string, ActionEntry>,\n options: MountRealtimeVoiceRoutesOptions,\n): { sessionPath: string; toolPath: string } {\n if (typeof options?.executeTool !== \"function\") {\n throw new Error(\"mountRealtimeVoiceRoutes requires executeTool\");\n }\n\n const tools = buildRealtimeTools(actions);\n const allowedToolNames = new Set(tools.map((tool) => tool.name));\n const app = getH3App(nitroApp);\n app.use(REALTIME_VOICE_SESSION_PATH, createSessionHandler(tools, options));\n app.use(\n REALTIME_VOICE_TOOL_PATH,\n createToolHandler(allowedToolNames, options),\n );\n return {\n sessionPath: REALTIME_VOICE_SESSION_PATH,\n toolPath: REALTIME_VOICE_TOOL_PATH,\n };\n}\n"]}

package/dist/server/request-origin.d.ts ADDED Viewed

@@ -0,0 +1,10 @@
+import { type H3Event } from "h3";
+/**
+ * Reject cross-site POSTs. Cookies are `SameSite=None; Secure` over HTTPS so
+ * the browser would otherwise attach the session to a forged form submission
+ * from evil.com, causing us to spend provider credits on the user's behalf.
+ * Same-origin browsers always send `Origin` on POST; if it's missing we fall
+ * back to `Sec-Fetch-Site` so Safari's fetch-spec behavior still works.
+ */
+export declare function isSameOriginRequest(event: H3Event): boolean;
+//# sourceMappingURL=request-origin.d.ts.map

package/dist/server/request-origin.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"request-origin.d.ts","sourceRoot":"","sources":["../../src/server/request-origin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,OAAO,EAAE,MAAM,IAAI,CAAC;AAMpD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAiD3D"}

package/dist/server/request-origin.js ADDED Viewed

@@ -0,0 +1,60 @@
+import { getRequestHeader } from "h3";
+function isLoopbackHost(host) {
+    return host.startsWith("localhost:") || host.startsWith("127.0.0.1:");
+}
+/**
+ * Reject cross-site POSTs. Cookies are `SameSite=None; Secure` over HTTPS so
+ * the browser would otherwise attach the session to a forged form submission
+ * from evil.com, causing us to spend provider credits on the user's behalf.
+ * Same-origin browsers always send `Origin` on POST; if it's missing we fall
+ * back to `Sec-Fetch-Site` so Safari's fetch-spec behavior still works.
+ */
+export function isSameOriginRequest(event) {
+    const host = getRequestHeader(event, "host");
+    const origin = getRequestHeader(event, "origin");
+    if (origin && host) {
+        try {
+            const parsed = new URL(origin);
+            const forwardedProto = getRequestHeader(event, "x-forwarded-proto");
+            const forwardedProtocol = forwardedProto === "https" || forwardedProto === "http"
+                ? `${forwardedProto}:`
+                : null;
+            const matchesScheme = forwardedProtocol
+                ? parsed.protocol === forwardedProtocol
+                : parsed.protocol === "https:" ||
+                    (parsed.protocol === "http:" && isLoopbackHost(host));
+            if (parsed.host === host && matchesScheme)
+                return true;
+            // Tauri desktop dev serves the tray WebView from localhost:1420 while
+            // the app server lives on the template dev port. Production Tauri
+            // WebViews can also send a tauri://localhost origin. Trust that custom
+            // scheme, while limiting the web-scheme desktop origins below to a
+            // loopback app server so arbitrary websites still fail the CSRF check.
+            if (parsed.protocol === "tauri:" && parsed.hostname === "localhost") {
+                return true;
+            }
+            if ((parsed.protocol === "http:" || parsed.protocol === "https:") &&
+                parsed.hostname === "tauri.localhost" &&
+                isLoopbackHost(host)) {
+                return true;
+            }
+            if (parsed.protocol === "http:" &&
+                (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1") &&
+                parsed.port === "1420" &&
+                isLoopbackHost(host)) {
+                return true;
+            }
+            return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    const fetchSite = getRequestHeader(event, "sec-fetch-site");
+    if (fetchSite)
+        return fetchSite === "same-origin" || fetchSite === "none";
+    // No Origin and no Sec-Fetch-Site: likely a non-browser client (curl,
+    // server-side) — safe to allow, CSRF requires a browser with ambient cookies.
+    return true;
+}
+//# sourceMappingURL=request-origin.js.map

package/dist/server/request-origin.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"request-origin.js","sourceRoot":"","sources":["../../src/server/request-origin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAgB,MAAM,IAAI,CAAC;AAEpD,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,cAAc,GAAG,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;YACpE,MAAM,iBAAiB,GACrB,cAAc,KAAK,OAAO,IAAI,cAAc,KAAK,MAAM;gBACrD,CAAC,CAAC,GAAG,cAAc,GAAG;gBACtB,CAAC,CAAC,IAAI,CAAC;YACX,MAAM,aAAa,GAAG,iBAAiB;gBACrC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,iBAAiB;gBACvC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ;oBAC5B,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,aAAa;gBAAE,OAAO,IAAI,CAAC;YACvD,sEAAsE;YACtE,kEAAkE;YAClE,uEAAuE;YACvE,mEAAmE;YACnE,uEAAuE;YACvE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IACE,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;gBAC7D,MAAM,CAAC,QAAQ,KAAK,iBAAiB;gBACrC,cAAc,CAAC,IAAI,CAAC,EACpB,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IACE,MAAM,CAAC,QAAQ,KAAK,OAAO;gBAC3B,CAAC,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;gBACpE,MAAM,CAAC,IAAI,KAAK,MAAM;gBACtB,cAAc,CAAC,IAAI,CAAC,EACpB,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC5D,IAAI,SAAS;QAAE,OAAO,SAAS,KAAK,aAAa,IAAI,SAAS,KAAK,MAAM,CAAC;IAC1E,sEAAsE;IACtE,8EAA8E;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { getRequestHeader, type H3Event } from \"h3\";\n\nfunction isLoopbackHost(host: string): boolean {\n return host.startsWith(\"localhost:\") || host.startsWith(\"127.0.0.1:\");\n}\n\n/**\n * Reject cross-site POSTs. Cookies are `SameSite=None; Secure` over HTTPS so\n * the browser would otherwise attach the session to a forged form submission\n * from evil.com, causing us to spend provider credits on the user's behalf.\n * Same-origin browsers always send `Origin` on POST; if it's missing we fall\n * back to `Sec-Fetch-Site` so Safari's fetch-spec behavior still works.\n */\nexport function isSameOriginRequest(event: H3Event): boolean {\n const host = getRequestHeader(event, \"host\");\n const origin = getRequestHeader(event, \"origin\");\n if (origin && host) {\n try {\n const parsed = new URL(origin);\n const forwardedProto = getRequestHeader(event, \"x-forwarded-proto\");\n const forwardedProtocol =\n forwardedProto === \"https\" || forwardedProto === \"http\"\n ? `${forwardedProto}:`\n : null;\n const matchesScheme = forwardedProtocol\n ? parsed.protocol === forwardedProtocol\n : parsed.protocol === \"https:\" ||\n (parsed.protocol === \"http:\" && isLoopbackHost(host));\n if (parsed.host === host && matchesScheme) return true;\n // Tauri desktop dev serves the tray WebView from localhost:1420 while\n // the app server lives on the template dev port. Production Tauri\n // WebViews can also send a tauri://localhost origin. Trust that custom\n // scheme, while limiting the web-scheme desktop origins below to a\n // loopback app server so arbitrary websites still fail the CSRF check.\n if (parsed.protocol === \"tauri:\" && parsed.hostname === \"localhost\") {\n return true;\n }\n if (\n (parsed.protocol === \"http:\" || parsed.protocol === \"https:\") &&\n parsed.hostname === \"tauri.localhost\" &&\n isLoopbackHost(host)\n ) {\n return true;\n }\n if (\n parsed.protocol === \"http:\" &&\n (parsed.hostname === \"localhost\" || parsed.hostname === \"127.0.0.1\") &&\n parsed.port === \"1420\" &&\n isLoopbackHost(host)\n ) {\n return true;\n }\n return false;\n } catch {\n return false;\n }\n }\n const fetchSite = getRequestHeader(event, \"sec-fetch-site\");\n if (fetchSite) return fetchSite === \"same-origin\" || fetchSite === \"none\";\n // No Origin and no Sec-Fetch-Site: likely a non-browser client (curl,\n // server-side) — safe to allow, CSRF requires a browser with ambient cookies.\n return true;\n}\n"]}

package/dist/server/transcribe-voice.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"transcribe-voice.d.ts","sourceRoot":"","sources":["../../src/server/transcribe-voice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;~~AA8IH~~,wBAAgB,4BAA4B;;;;;;IAkY3C"}
1	+ {"version":3,"file":"transcribe-voice.d.ts","sourceRoot":"","sources":["../../src/server/transcribe-voice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA6FH,wBAAgB,4BAA4B;;;;;;IAkY3C"}

package/dist/server/transcribe-voice.js CHANGED Viewed

@@ -16,7 +16,7 @@
  * audio bodies aren't a clean fit for the action contract (actions are
  * typed JSON-in / JSON-out).
  */
-import { defineEventHandler, getMethod, getRequestHeader, readMultipartFormData, setResponseStatus, } from "h3";
+import { defineEventHandler, getMethod, readMultipartFormData, setResponseStatus, } from "h3";
 import { createBuilderEngine } from "../agent/engine/builder-engine.js";
 import { appStateGet } from "../application-state/store.js";
 import { getOrgContext } from "../org/context.js";
@@ -25,6 +25,7 @@ import { applyVoiceContextReplacements, buildVoiceGuidanceBlock, parseVoiceConte
 import { getSession } from "./auth.js";
 import { resolveHasBuilderPrivateKey, resolveSecret, } from "./credential-provider.js";
 import { runWithRequestContext } from "./request-context.js";
+import { isSameOriginRequest } from "./request-origin.js";
 const WHISPER_URL = "https://api.openai.com/v1/audio/transcriptions";
 const GROQ_URL = "https://api.groq.com/openai/v1/audio/transcriptions";
 const GROQ_CHAT_URL = "https://api.groq.com/openai/v1/chat/completions";
@@ -54,53 +55,6 @@ const BUILDER_GEMINI_TRANSCRIPTION_MODEL = "gemini-3-1-flash-lite";
 // managed provider above handles the newer Gemini 3.1 Flash-Lite preview.
 const GEMINI_MODEL = "gemini-2.0-flash-lite";
 const GEMINI_URL = `https://generativelanguage.googleapis.com/v1beta/models/${GEMINI_MODEL}:generateContent`;
-/**
- * Reject cross-site POSTs. Cookies are `SameSite=None; Secure` over HTTPS so
- * the browser would otherwise attach the session to a forged form submission
- * from evil.com, causing us to spend OpenAI credits on the user's behalf.
- * Same-origin browsers always send `Origin` on POST; if it's missing we fall
- * back to `Sec-Fetch-Site` so Safari's fetch-spec behavior still works.
- */
-function isSameOriginRequest(event) {
-    const host = getRequestHeader(event, "host");
-    const origin = getRequestHeader(event, "origin");
-    if (origin && host) {
-        try {
-            const parsed = new URL(origin);
-            if (parsed.host === host)
-                return true;
-            // Tauri desktop dev serves the tray WebView from localhost:1420 while
-            // the app server lives on the template dev port. Production Tauri
-            // WebViews can also send a tauri://localhost origin. Treat only those
-            // desktop origins as trusted cross-origin callers; arbitrary websites
-            // still fail the CSRF check.
-            if (parsed.protocol === "tauri:" && parsed.hostname === "localhost") {
-                return true;
-            }
-            if ((parsed.protocol === "http:" || parsed.protocol === "https:") &&
-                parsed.hostname === "tauri.localhost" &&
-                (host.startsWith("localhost:") || host.startsWith("127.0.0.1:"))) {
-                return true;
-            }
-            if (parsed.protocol === "http:" &&
-                (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1") &&
-                parsed.port === "1420" &&
-                (host.startsWith("localhost:") || host.startsWith("127.0.0.1:"))) {
-                return true;
-            }
-            return false;
-        }
-        catch {
-            return false;
-        }
-    }
-    const fetchSite = getRequestHeader(event, "sec-fetch-site");
-    if (fetchSite)
-        return fetchSite === "same-origin" || fetchSite === "none";
-    // No Origin and no Sec-Fetch-Site: likely a non-browser client (curl,
-    // server-side) — safe to allow, CSRF requires a browser with ambient cookies.
-    return true;
-}
 /**
  * Derive an AbortSignal that fires when the client disconnects mid-request
  * (e.g. the desktop client's own 8s ceiling firing before a provider call's