@allmodels/dsh-speech 0.1.0

package/lib/index.js

@@ -0,0 +1,717 @@
+import z from "@deepseek-ai/schemastery";
+import { credentialRef } from "@deepseek-ai/dsh-credentials";
+import { installSettingsSection, settingsNamespace } from "@deepseek-ai/dsh-settings";
+import WebSocket, { WebSocketServer } from "ws";
+
+//#region src/shared.ts
+const PLUGIN_NAME = "@allmodels/dsh-speech";
+const SETTINGS_NAMESPACE = "dsh-speech";
+const DEFAULT_API_KEY_ENV = "ALLMODELS_API_KEY";
+const DEFAULT_BASE_URL = "https://api.allmodels.io";
+const DEFAULT_LOW_BALANCE_USD = .5;
+const DEFAULT_TOP_UP_USD = 10;
+const CATALOG_TTL_MS = 300 * 1e3;
+const AUDIO_FORMAT = "pcm_16000";
+function stringArray(value) {
+	return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+}
+function finiteNumber(value) {
+	const parsed = typeof value === "number" ? value : typeof value === "string" ? Number(value) : NaN;
+	return Number.isFinite(parsed) ? parsed : void 0;
+}
+/** Normalize only bindings this client can feed with its fixed PCM16/16 kHz pipeline. */
+function normalizeCatalog(raw, fetchedAt = Date.now()) {
+	const providersValue = (raw !== null && typeof raw === "object" ? raw : {}).providers;
+	const providers = providersValue !== null && typeof providersValue === "object" ? providersValue : {};
+	const bindings = [];
+	for (const [provider, value] of Object.entries(providers)) {
+		if (!Array.isArray(value.stt)) continue;
+		const defaultModel = typeof value.defaults?.stt?.model === "string" ? value.defaults.stt.model : void 0;
+		for (const candidate of value.stt) {
+			if (candidate.streaming !== true || candidate.streamingInput === void 0) continue;
+			if (!stringArray(candidate.streamingInput.audioFormats).includes(AUDIO_FORMAT)) continue;
+			if (typeof candidate.id !== "string" || candidate.id.length === 0) continue;
+			const options = stringArray(candidate.streamingInput.portableOptions);
+			const price = candidate.pricing?.unit === "minute" ? finiteNumber(candidate.pricing.unitPrice) : void 0;
+			const canonical = typeof candidate.canonical === "string" && candidate.canonical.includes("/") ? candidate.canonical : `${provider}/${candidate.id}`;
+			bindings.push({
+				provider,
+				model: canonical,
+				canonical,
+				isProviderDefault: candidate.id === defaultModel || canonical === defaultModel,
+				contextSupported: options.includes("context"),
+				interimResultsSupported: options.includes("interim_results"),
+				...stringArray(candidate.languages).length === 0 ? {} : { languages: stringArray(candidate.languages) },
+				...price === void 0 ? {} : { pricePerMinuteUsd: price }
+			});
+		}
+	}
+	bindings.sort((a, b) => a.model.localeCompare(b.model) || a.provider.localeCompare(b.provider));
+	return {
+		bindings,
+		fetchedAt
+	};
+}
+function selectBinding(bindings, locale, preferred) {
+	if (preferred?.model !== void 0) {
+		const preferredModel = preferred.model;
+		const matchesModel = (binding) => binding.model === preferredModel || binding.canonical === preferredModel || !preferredModel.includes("/") && binding.model.endsWith(`/${preferredModel}`);
+		const exact = bindings.find((binding) => matchesModel(binding) && (preferred.provider === void 0 || binding.provider === preferred.provider));
+		if (exact !== void 0) return exact;
+		const sameModel = bindings.find(matchesModel);
+		if (sameModel !== void 0) return sameModel;
+	}
+	const preferredProvider = locale.toLowerCase().startsWith("zh") ? "soniox" : "assemblyai";
+	return bindings.find((binding) => binding.provider === preferredProvider && binding.isProviderDefault) ?? bindings.find((binding) => binding.provider === preferredProvider) ?? bindings[0];
+}
+function targetAllows(targets, provider, model) {
+	const providerModel = model === void 0 || model.includes("/") ? model : `${provider}/${model}`;
+	if (targets === void 0 || targets === null) return true;
+	if (Array.isArray(targets)) {
+		if (targets.length === 0) return true;
+		return targets.some((target) => targetAllows(target, provider, model));
+	}
+	if (typeof targets === "string") return targets === "*" || targets === provider || targets === model || targets === providerModel;
+	if (typeof targets !== "object") return false;
+	const record = targets;
+	const providers = stringArray(record.providers ?? record.provider);
+	const models = stringArray(record.models ?? record.model);
+	const providerOk = providers.length === 0 || provider === void 0 || providers.includes(provider);
+	const modelOk = models.length === 0 || model === void 0 || models.includes(model) || providerModel !== void 0 && models.includes(providerModel);
+	return providerOk && modelOk;
+}
+function summarizeBalance(raw, lowThresholdUsd, selected, now = Date.now()) {
+	const value = raw !== null && typeof raw === "object" ? raw : {};
+	const paidUsd = finiteNumber(value.paid_balance_usd ?? value.spendable_paid_credits_usd) ?? 0;
+	const grantsValue = value.promotion_grants ?? value.promotional_grants ?? [];
+	const grants = Array.isArray(grantsValue) ? grantsValue : [];
+	let promotionUsd = 0;
+	for (const entry of grants) {
+		if (entry === null || typeof entry !== "object") continue;
+		const grant = entry;
+		const remaining = finiteNumber(grant.remaining_usd) ?? 0;
+		const eligible = grant.eligible !== false;
+		const expiresAt = typeof grant.expires_at === "string" ? Date.parse(grant.expires_at) : Number.POSITIVE_INFINITY;
+		if (eligible && expiresAt > now && targetAllows(grant.targets, selected?.provider, selected?.model)) promotionUsd += Math.max(0, remaining);
+	}
+	const usableUsd = Math.round((Math.max(0, paidUsd) + promotionUsd) * 1e9) / 1e9;
+	return {
+		...typeof value.state === "string" ? { state: value.state } : {},
+		paidUsd: Math.max(0, paidUsd),
+		promotionUsd,
+		usableUsd,
+		low: usableUsd < lowThresholdUsd,
+		exhausted: usableUsd <= 0,
+		fetchedAt: now
+	};
+}
+const CJK = /^(zh|ja|ko)(-|$)/i;
+function transcriptSeparator(left, right, language) {
+	if (left.length === 0 || right.length === 0) return "";
+	if (language !== void 0 && CJK.test(language)) return "";
+	if (/\s$/u.test(left) || /^\s/u.test(right)) return "";
+	if (/^[,.;:!?\u3000-\u303f\uff00-\uff65]/u.test(right)) return "";
+	return " ";
+}
+function appendTranscript(left, right, language) {
+	return `${left}${transcriptSeparator(left, right, language)}${right}`;
+}
+function createTranscript(base) {
+	return {
+		base,
+		finals: "",
+		partial: "",
+		lastSequence: -1
+	};
+}
+function transcriptText(state) {
+	return appendTranscript(appendTranscript(state.base, state.finals, state.language), state.partial, state.language);
+}
+function applyTranscriptEvent(state, event) {
+	if (event.sequence <= state.lastSequence) return state;
+	const language = event.languageCode ?? state.language;
+	if (event.kind === "partial") return {
+		...state,
+		partial: event.text,
+		...language === void 0 ? {} : { language },
+		lastSequence: event.sequence
+	};
+	return {
+		...state,
+		finals: appendTranscript(state.finals, event.text, language),
+		partial: "",
+		...language === void 0 ? {} : { language },
+		lastSequence: event.sequence
+	};
+}
+
+//#endregion
+//#region src/allmodels.ts
+const HTTP_TIMEOUT_MS = 15e3;
+var AllModelsError = class extends Error {
+	status;
+	code;
+	constructor(status, code, message) {
+		super(message);
+		this.name = "AllModelsError";
+		this.status = status;
+		this.code = code;
+	}
+};
+function endpoint(baseURL, path) {
+	const base = baseURL.endsWith("/") ? baseURL : `${baseURL}/`;
+	return new URL(path.replace(/^\//u, ""), base);
+}
+function errorMessage(value, fallback) {
+	if (value === null || typeof value !== "object") return fallback;
+	const record = value;
+	const candidate = record.message ?? record.error ?? record.detail;
+	return typeof candidate === "string" && candidate.length <= 500 ? candidate : fallback;
+}
+async function requestJson(baseURL, path, init = {}, apiKey) {
+	const controller = new AbortController();
+	const timeout = setTimeout(() => {
+		controller.abort();
+	}, HTTP_TIMEOUT_MS);
+	try {
+		const headers = new Headers(init.headers);
+		headers.set("accept", "application/json");
+		if (init.body !== void 0) headers.set("content-type", "application/json");
+		if (apiKey !== void 0) headers.set("authorization", `Bearer ${apiKey}`);
+		const response = await fetch(endpoint(baseURL, path), {
+			...init,
+			headers,
+			signal: controller.signal
+		});
+		const body = await response.json().catch(() => void 0);
+		if (!response.ok) throw new AllModelsError(response.status, `HTTP_${String(response.status)}`, errorMessage(body, "AllModels request failed"));
+		return body;
+	} catch (error) {
+		if (error instanceof AllModelsError) throw error;
+		if (controller.signal.aborted) throw new AllModelsError(504, "TIMEOUT", "AllModels request timed out");
+		throw new AllModelsError(502, "NETWORK", "Unable to reach AllModels");
+	} finally {
+		clearTimeout(timeout);
+	}
+}
+var AllModelsClient = class {
+	catalogCache;
+	async catalog(settings, force = false) {
+		const now = Date.now();
+		if (!force && this.catalogCache?.key === settings.baseURL && this.catalogCache.expiresAt > now) return this.catalogCache.value;
+		const value = normalizeCatalog(await requestJson(settings.baseURL, "/v1/providers"), now);
+		if (value.bindings.length === 0) throw new AllModelsError(502, "EMPTY_CATALOG", "No compatible streaming STT models are available");
+		this.catalogCache = {
+			key: settings.baseURL,
+			expiresAt: now + CATALOG_TTL_MS,
+			value
+		};
+		return value;
+	}
+	async balance(settings, apiKey) {
+		return summarizeBalance(await requestJson(settings.baseURL, "/account/balance", {}, apiKey), settings.lowBalanceUsd, {
+			...settings.provider === void 0 ? {} : { provider: settings.provider },
+			...settings.model === void 0 ? {} : { model: settings.model }
+		});
+	}
+	async startAuth(settings, email) {
+		await requestJson(settings.baseURL, "/account/agent-signup", {
+			method: "POST",
+			body: JSON.stringify({ email })
+		});
+	}
+	async verifyAuth(settings, email, code) {
+		const raw = await requestJson(settings.baseURL, "/account/agent-signup/verify", {
+			method: "POST",
+			body: JSON.stringify({
+				email,
+				code
+			})
+		});
+		if (raw === null || typeof raw !== "object" || typeof raw.apiKey !== "string") throw new AllModelsError(502, "INVALID_RESPONSE", "AllModels did not return an API key");
+		return raw.apiKey;
+	}
+	async topUp(settings, apiKey, amountUsd) {
+		const raw = await requestJson(settings.baseURL, "/account/top-up-link", {
+			method: "POST",
+			body: JSON.stringify({ amount_usd: amountUsd })
+		}, apiKey);
+		if (raw === null || typeof raw !== "object") throw new AllModelsError(502, "INVALID_RESPONSE", "Invalid top-up response");
+		const record = raw;
+		const url = record.url ?? record.top_up_url ?? record.checkout_url;
+		if (typeof url !== "string" || !/^https:\/\//u.test(url)) throw new AllModelsError(502, "INVALID_RESPONSE", "AllModels did not return a secure top-up link");
+		return {
+			url,
+			...typeof record.expires_at === "string" ? { expiresAt: record.expires_at } : {}
+		};
+	}
+};
+
+//#endregion
+//#region src/security.ts
+const LOOPBACK = new Set([
+	"127.0.0.1",
+	"::1",
+	"::ffff:127.0.0.1",
+	"localhost"
+]);
+function hostname(value) {
+	if (value === void 0) return "";
+	const trimmed = value.trim();
+	if (trimmed.startsWith("[")) {
+		const end = trimmed.indexOf("]");
+		return end === -1 ? "" : trimmed.slice(1, end);
+	}
+	const colon = trimmed.lastIndexOf(":");
+	return colon === -1 ? trimmed : trimmed.slice(0, colon);
+}
+/** Restrict privileged plugin routes to the loopback Harness page. */
+function isTrustedRequest(req, method) {
+	if (method !== void 0 && req.method !== method) return false;
+	const peer = req.socket.remoteAddress;
+	if (peer === void 0 || !LOOPBACK.has(peer)) return false;
+	const host = typeof req.headers.host === "string" ? hostname(req.headers.host) : "";
+	if (!LOOPBACK.has(host)) return false;
+	const fetchSite = req.headers["sec-fetch-site"];
+	if (typeof fetchSite === "string" && fetchSite !== "same-origin" && fetchSite !== "none") return false;
+	const origin = req.headers.origin;
+	if (typeof origin === "string") try {
+		if (hostname(new URL(origin).host) !== host) return false;
+	} catch {
+		return false;
+	}
+	return true;
+}
+
+//#endregion
+//#region src/stt-proxy.ts
+const MAX_AUDIO_FRAME = 64 * 1024;
+const MAX_CONTROL_FRAME = 4 * 1024;
+const MAX_BUFFERED_BYTES = 1024 * 1024;
+const START_TIMEOUT_MS = 1e4;
+function parseStart(data) {
+	if (typeof data !== "string" && !Buffer.isBuffer(data)) return void 0;
+	const text = typeof data === "string" ? data : data.toString("utf8");
+	if (Buffer.byteLength(text) > MAX_CONTROL_FRAME) return void 0;
+	try {
+		const value = JSON.parse(text);
+		if (value === null || typeof value !== "object") return void 0;
+		const record = value;
+		if (record.type !== "start" || record.audioFormat !== AUDIO_FORMAT || typeof record.locale !== "string") return void 0;
+		return {
+			type: "start",
+			audioFormat: AUDIO_FORMAT,
+			locale: record.locale.slice(0, 64)
+		};
+	} catch {
+		return;
+	}
+}
+function send(socket, value) {
+	if (socket.readyState === WebSocket.OPEN) socket.send(JSON.stringify(value));
+}
+function closeWithError(socket, code, message) {
+	send(socket, {
+		type: "error",
+		code,
+		message
+	});
+	socket.close(1011, code.slice(0, 120));
+}
+function upstreamUrl(settings, binding) {
+	const base = new URL(settings.baseURL);
+	base.protocol = base.protocol === "http:" ? "ws:" : "wss:";
+	base.pathname = "/v1/stt";
+	base.search = "";
+	base.searchParams.set("provider", binding.provider);
+	base.searchParams.set("model", binding.model);
+	base.searchParams.set("audio_format", AUDIO_FORMAT);
+	base.searchParams.set("event_format", "normalized");
+	base.searchParams.set("commit_strategy", "auto");
+	if (binding.interimResultsSupported) base.searchParams.set("interim_results", "true");
+	if (settings.language !== void 0 && settings.language !== "" && settings.language !== "auto") base.searchParams.set("language", settings.language);
+	if (binding.contextSupported && settings.context !== void 0 && settings.context.trim() !== "") base.searchParams.set("context", settings.context.trim());
+	return base;
+}
+function normalizedEvent(data) {
+	try {
+		const text = typeof data === "string" ? data : data.toString("utf8");
+		const value = JSON.parse(text);
+		if (value === null || typeof value !== "object") return void 0;
+		const event = value;
+		const eventType = event.type ?? event.event;
+		const sequenceValue = event.sequence ?? event.seq;
+		const sequence = typeof sequenceValue === "number" ? sequenceValue : 0;
+		const languageCode = typeof event.language_code === "string" ? event.language_code : typeof event.languageCode === "string" ? event.languageCode : void 0;
+		if (eventType === "stt.transcript.partial" && typeof event.text === "string") return {
+			type: "partial",
+			sequence,
+			text: event.text,
+			...languageCode === void 0 ? {} : { languageCode }
+		};
+		if (eventType === "stt.transcript.final" && typeof event.text === "string") return {
+			type: "final",
+			sequence,
+			text: event.text,
+			...languageCode === void 0 ? {} : { languageCode }
+		};
+		if (eventType === "stt.error") return {
+			type: "error",
+			code: typeof event.code === "string" ? event.code : "UPSTREAM_ERROR",
+			message: typeof event.message === "string" ? event.message : "Speech recognition failed"
+		};
+		if (eventType === "stt.session.ended" || eventType === "stt.ended") return { type: "ended" };
+		return;
+	} catch {
+		return;
+	}
+}
+function rawDataBytes(data) {
+	if (typeof data === "string") return Buffer.byteLength(data);
+	if (data instanceof ArrayBuffer) return data.byteLength;
+	if (Array.isArray(data)) return data.reduce((sum, entry) => sum + entry.byteLength, 0);
+	return data.byteLength;
+}
+var SttProxy = class {
+	server = new WebSocketServer({
+		noServer: true,
+		maxPayload: MAX_AUDIO_FRAME
+	});
+	clients = /* @__PURE__ */ new Set();
+	constructor(options) {
+		this.options = options;
+		this.server.on("connection", (socket) => {
+			this.accept(socket);
+		});
+	}
+	handleUpgrade(req, socket, head) {
+		if (!isTrustedRequest(req)) {
+			socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+			socket.destroy();
+			return;
+		}
+		this.server.handleUpgrade(req, socket, head, (client) => {
+			this.server.emit("connection", client, req);
+		});
+	}
+	close() {
+		for (const client of this.clients) client.close(1001, "plugin disposed");
+		this.clients.clear();
+		this.server.close();
+	}
+	accept(client) {
+		this.clients.add(client);
+		let upstream;
+		let started = false;
+		let closing = false;
+		let clientClosed = false;
+		const startTimeout = setTimeout(() => {
+			if (!started) closeWithError(client, "START_TIMEOUT", "Speech session did not start in time");
+		}, START_TIMEOUT_MS);
+		const cleanup = () => {
+			clientClosed = true;
+			clearTimeout(startTimeout);
+			this.clients.delete(client);
+			if (upstream !== void 0 && upstream.readyState < WebSocket.CLOSING) upstream.close(1e3, "client closed");
+		};
+		client.once("close", cleanup);
+		client.on("error", (error) => {
+			this.options.warn(error);
+		});
+		client.on("message", (data, isBinary) => {
+			if (!started) {
+				if (isBinary) {
+					closeWithError(client, "EXPECTED_START", "The first speech frame must be a start message");
+					return;
+				}
+				const start = parseStart(data);
+				if (start === void 0) {
+					closeWithError(client, "INVALID_START", "Invalid speech start message");
+					return;
+				}
+				started = true;
+				clearTimeout(startTimeout);
+				this.openUpstream(client, start).then((value) => {
+					upstream = value;
+					if (clientClosed && value.readyState < WebSocket.CLOSING) value.close(1e3, "client closed");
+				}).catch((error) => {
+					closeWithError(client, "START_FAILED", error instanceof Error ? error.message : "Unable to start speech recognition");
+				});
+				return;
+			}
+			if (isBinary) {
+				if (rawDataBytes(data) > MAX_AUDIO_FRAME) {
+					closeWithError(client, "FRAME_TOO_LARGE", "Audio frame is too large");
+					return;
+				}
+				if (upstream?.readyState !== WebSocket.OPEN) return;
+				if (upstream.bufferedAmount > MAX_BUFFERED_BYTES) {
+					closeWithError(client, "BACKPRESSURE", "The speech provider cannot keep up with audio input");
+					return;
+				}
+				upstream.send(data, { binary: true });
+				return;
+			}
+			if (rawDataBytes(data) > MAX_CONTROL_FRAME || upstream?.readyState !== WebSocket.OPEN) return;
+			try {
+				const control = JSON.parse(data.toString("utf8"));
+				if (control.type === "commit") upstream.send(JSON.stringify({ type: "stt.audio.commit" }));
+				if (control.type === "close" && !closing) {
+					closing = true;
+					upstream.send(JSON.stringify({ type: "stt.session.close" }));
+				}
+			} catch {
+				closeWithError(client, "INVALID_CONTROL", "Invalid speech control message");
+			}
+		});
+	}
+	async openUpstream(client, start) {
+		const settings = this.options.settings();
+		const [credential, catalog] = await Promise.all([this.options.resolveCredential(), this.options.allModels.catalog(settings)]);
+		if (credential === void 0) throw new Error("Connect AllModels in Settings → Speech");
+		const binding = selectBinding(catalog.bindings, start.locale, {
+			...settings.model === void 0 ? {} : { model: settings.model },
+			...settings.provider === void 0 ? {} : { provider: settings.provider }
+		});
+		if (binding === void 0) throw new Error("No compatible streaming STT model is available");
+		const upstream = new WebSocket(upstreamUrl(settings, binding), { headers: { authorization: `Bearer ${credential.value}` } });
+		upstream.on("open", () => {
+			send(client, {
+				type: "ready",
+				model: binding.model,
+				provider: binding.provider
+			});
+		});
+		upstream.on("message", (data) => {
+			const event = normalizedEvent(data);
+			if (event !== void 0) send(client, event);
+		});
+		upstream.on("error", () => {
+			closeWithError(client, "UPSTREAM_CONNECTION", "The speech provider connection failed");
+		});
+		upstream.on("close", () => {
+			send(client, { type: "ended" });
+			if (client.readyState < WebSocket.CLOSING) client.close(1e3, "speech ended");
+		});
+		return upstream;
+	}
+};
+
+//#endregion
+//#region src/index.ts
+const name = PLUGIN_NAME;
+const inject = ["webServer", "credentials"];
+const SPEECH_SETTINGS_NS = settingsNamespace(SETTINGS_NAMESPACE);
+const Config = z.object({
+	apiKeyEnv: z.string().role("credential-ref").default(DEFAULT_API_KEY_ENV),
+	baseURL: z.string().default(DEFAULT_BASE_URL),
+	lowBalanceUsd: z.number().min(0).default(DEFAULT_LOW_BALANCE_USD),
+	defaultTopUpUsd: z.number().min(5).max(1e3).default(DEFAULT_TOP_UP_USD),
+	model: z.string(),
+	provider: z.string(),
+	language: z.string(),
+	context: z.string()
+});
+const UserSettingsConfig = z.object({
+	model: z.string(),
+	provider: z.string(),
+	language: z.string(),
+	context: z.string()
+});
+const MAX_BODY = 16 * 1024;
+async function readJson(req) {
+	let size = 0;
+	const chunks = [];
+	for await (const chunk of req) {
+		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+		size += buffer.length;
+		if (size > MAX_BODY) throw new Error("request body too large");
+		chunks.push(buffer);
+	}
+	const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("expected a JSON object");
+	return parsed;
+}
+function sendJson(res, status, body) {
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store",
+		"x-content-type-options": "nosniff"
+	});
+	res.end(JSON.stringify(body));
+}
+function safeError(error) {
+	if (error instanceof AllModelsError) {
+		const message = /bearer|authorization|secret|api.?key|\bsk-[A-Za-z0-9_-]+/iu.test(error.message) ? "AllModels rejected the credential" : error.message.slice(0, 500);
+		return {
+			status: error.status >= 400 && error.status < 600 ? error.status : 502,
+			body: { error: {
+				code: error.code,
+				message
+			} }
+		};
+	}
+	return {
+		status: 400,
+		body: { error: {
+			code: "INVALID_REQUEST",
+			message: error instanceof Error && !/api.?key|bearer|secret/i.test(error.message) ? error.message.slice(0, 500) : "Request failed"
+		} }
+	};
+}
+function emailField(body) {
+	const email = body.email;
+	if (typeof email !== "string" || email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/u.test(email)) throw new Error("Enter a valid email address");
+	return email;
+}
+function validateSettings(value) {
+	const url = new URL(value.baseURL);
+	if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error("baseURL must use HTTP or HTTPS");
+	if (value.language !== void 0 && value.language !== "auto" && !/^[A-Za-z]{2,8}(?:-[A-Za-z0-9]{1,8})*$/u.test(value.language)) throw new Error("language must be auto or a valid BCP-47 tag");
+	if (value.context !== void 0 && value.context.length > 4e3) throw new Error("context is limited to 4000 characters");
+}
+function apply(ctx, config) {
+	validateSettings(config);
+	const entrySettings = {
+		...config.model === void 0 ? {} : { model: config.model },
+		...config.provider === void 0 ? {} : { provider: config.provider },
+		...config.language === void 0 ? {} : { language: config.language },
+		...config.context === void 0 ? {} : { context: config.context }
+	};
+	let userSettingsSource = () => entrySettings;
+	const settingsSource = () => ({
+		...config,
+		...userSettingsSource()
+	});
+	installSettingsSection(ctx, SPEECH_SETTINGS_NS, UserSettingsConfig, entrySettings, {
+		setSource: (source) => {
+			userSettingsSource = source;
+		},
+		onChange: () => {},
+		validate: (value) => {
+			validateSettings({
+				baseURL: config.baseURL,
+				...value
+			});
+		}
+	});
+	const allModels = new AllModelsClient();
+	const keyFor = () => credentialRef(settingsSource().apiKeyEnv);
+	const resolveCredential = () => ctx.credentials.resolve(keyFor());
+	const register = (method, path, handler) => {
+		ctx.effect(() => ctx.webServer.register({
+			kind: "exact",
+			path,
+			handler: async (req, res) => {
+				if (!isTrustedRequest(req, method)) {
+					sendJson(res, 403, { error: {
+						code: "FORBIDDEN",
+						message: "Forbidden"
+					} });
+					return;
+				}
+				try {
+					sendJson(res, 200, await handler(req));
+				} catch (error) {
+					const safe = safeError(error);
+					sendJson(res, safe.status, safe.body);
+				}
+			}
+		}), `${PLUGIN_NAME}: ${method} ${path}`);
+	};
+	register("GET", "/api/dsh-speech/status", async () => {
+		const settings = settingsSource();
+		const credential = await ctx.credentials.describe(keyFor());
+		const publicSettings = {
+			...settings.model === void 0 ? {} : { model: settings.model },
+			...settings.provider === void 0 ? {} : { provider: settings.provider },
+			...settings.language === void 0 ? {} : { language: settings.language },
+			...settings.context === void 0 ? {} : { context: settings.context },
+			lowBalanceUsd: settings.lowBalanceUsd,
+			defaultTopUpUsd: settings.defaultTopUpUsd
+		};
+		if (!credential.configured) return {
+			credential,
+			settings: publicSettings
+		};
+		const resolved = await resolveCredential();
+		if (resolved === void 0) return {
+			credential: {
+				...credential,
+				configured: false
+			},
+			settings: publicSettings
+		};
+		try {
+			return {
+				credential,
+				settings: publicSettings,
+				balance: await allModels.balance(settings, resolved.value)
+			};
+		} catch (error) {
+			return {
+				credential,
+				settings: publicSettings,
+				balanceError: safeError(error).body.error.message
+			};
+		}
+	});
+	register("GET", "/api/dsh-speech/catalog", async (req) => {
+		const force = new URL(req.url ?? "/", "http://localhost").searchParams.get("refresh") === "1";
+		return allModels.catalog(settingsSource(), force);
+	});
+	register("POST", "/api/dsh-speech/auth/start", async (req) => {
+		await allModels.startAuth(settingsSource(), emailField(await readJson(req)));
+		return {
+			ok: true,
+			expiresInSeconds: 300
+		};
+	});
+	register("POST", "/api/dsh-speech/auth/verify", async (req) => {
+		const body = await readJson(req);
+		const code = body.code;
+		if (typeof code !== "string" || !/^\d{6}$/u.test(code)) throw new Error("Enter the six-digit code");
+		const key = await allModels.verifyAuth(settingsSource(), emailField(body), code);
+		await ctx.credentials.set(keyFor(), key);
+		return { ok: true };
+	});
+	register("POST", "/api/dsh-speech/auth/key", async (req) => {
+		const apiKey = (await readJson(req)).apiKey;
+		if (typeof apiKey !== "string" || apiKey.trim().length < 8 || apiKey.length > 2048) throw new Error("Enter a valid API key");
+		await allModels.balance(settingsSource(), apiKey.trim());
+		await ctx.credentials.set(keyFor(), apiKey.trim());
+		return { ok: true };
+	});
+	register("POST", "/api/dsh-speech/auth/logout", async () => {
+		if (!(await ctx.credentials.describe(keyFor())).writable) throw new Error("This credential is managed outside Harness and cannot be removed here");
+		await ctx.credentials.unset(keyFor());
+		return { ok: true };
+	});
+	register("POST", "/api/dsh-speech/top-up", async (req) => {
+		const amountUsd = (await readJson(req)).amountUsd;
+		if (typeof amountUsd !== "number" || !Number.isFinite(amountUsd) || amountUsd < 5 || amountUsd > 1e3) throw new Error("Top-up amount must be between $5 and $1000");
+		const credential = await resolveCredential();
+		if (credential === void 0) throw new Error("Connect AllModels first");
+		return allModels.topUp(settingsSource(), credential.value, amountUsd);
+	});
+	const proxy = new SttProxy({
+		settings: settingsSource,
+		resolveCredential,
+		allModels,
+		warn: (error) => {
+			ctx.logger.warn(error);
+		}
+	});
+	ctx.effect(() => ctx.webServer.registerUpgrade({
+		path: "/api/dsh-speech/stt",
+		handler: (req, socket, head) => {
+			proxy.handleUpgrade(req, socket, head);
+		}
+	}), `${PLUGIN_NAME}: WebSocket /api/dsh-speech/stt`);
+	ctx.effect(() => () => {
+		proxy.close();
+	}, `${PLUGIN_NAME}: close speech sockets`);
+}
+
+//#endregion
+export { Config, SPEECH_SETTINGS_NS, UserSettingsConfig, appendTranscript, apply, applyTranscriptEvent, createTranscript, inject, name, normalizeCatalog, selectBinding, summarizeBalance, transcriptText };