@happyvertical/speech 0.96.1 → 0.98.0

package/dist/index.js

@@ -1,45 +1,137 @@
-//#region src/shared/errors.ts
-var SpeechError = class extends Error {
-	code;
-	adapter;
-	constructor(message, code, adapter) {
-		super(message);
-		this.code = code;
-		this.adapter = adapter;
-		this.name = "SpeechError";
-	}
-};
-var SpeechConfigurationError = class extends SpeechError {
-	constructor(message, adapter) {
-		super(message, "SPEECH_CONFIGURATION_ERROR", adapter);
-		this.name = "SpeechConfigurationError";
-	}
-};
-var InvalidSpeechAdapterError = class extends SpeechError {
-	constructor(type, kind) {
-		super(`Invalid ${kind} speech adapter type: ${type}`, "INVALID_ADAPTER");
-		this.name = "InvalidSpeechAdapterError";
-	}
+import { C as SpeechProviderError, S as SpeechError, _ as mimeTypeToAudioExtension, a as TRANSCRIBER_ENV_KEYS, b as InvalidSpeechAdapterError, c as hasTranscriberEnv, d as parseOptionalInteger, f as readEnv, g as DEFAULT_MAX_AUDIO_BYTES, h as reportSpeechUsage, i as registeredOptionalTranscribers, l as mergeHeaderInits, m as audioSecondsFromProviderUsage, n as optionalTranscriberEntry, o as defaultEnv, p as resolveTranscriberConfig, s as hasAnyEnv, t as getOptionalTranscriberFactory, u as parseHeadersEnv, v as normalizeAudioInput, x as SpeechConfigurationError, y as normalizeMimeType } from "./chunks/registry-DfID41Ew.js";
+//#region src/shared/retry.ts
+/**
+* Retry with exponential backoff for speech provider calls. Retries only
+* rate-limit (429) and server (5xx) responses, honours `Retry-After`, and
+* stops immediately when the caller aborts.
+*/
+var DEFAULT_SPEECH_RETRY = {
+	maxRetries: 2,
+	initialDelayMs: 500,
+	maxDelayMs: 3e4
 };
-var SpeechProviderError = class extends SpeechError {
-	status;
-	responseBody;
-	constructor(adapter, message, options = {}) {
-		super(message, "SPEECH_PROVIDER_ERROR", adapter);
-		this.name = "SpeechProviderError";
-		this.status = options.status;
-		this.responseBody = options.responseBody;
-		if (options.cause !== void 0) this.cause = options.cause;
+function resolveRetryOptions(retry, defaults = DEFAULT_SPEECH_RETRY) {
+	if (retry === false) return false;
+	if (retry === void 0) return defaults;
+	const base = defaults || DEFAULT_SPEECH_RETRY;
+	return {
+		maxRetries: Math.floor(finiteRetryValue("maxRetries", retry.maxRetries, base.maxRetries)),
+		initialDelayMs: finiteRetryValue("initialDelayMs", retry.initialDelayMs, base.initialDelayMs),
+		maxDelayMs: finiteRetryValue("maxDelayMs", retry.maxDelayMs, base.maxDelayMs)
+	};
+}
+/**
+* Rejects non-finite values (`NaN`, `Infinity`): they would make the retry
+* budget or delay cap unbounded. Negative values clamp to `0`.
+*/
+function finiteRetryValue(name, value, fallback) {
+	if (value === void 0) return Math.max(0, fallback);
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new SpeechConfigurationError(`Speech retry option ${name} must be a finite number`);
+	return Math.max(0, value);
+}
+function isRetryableStatus(status) {
+	return status === 429 || status !== void 0 && status >= 500;
+}
+/**
+* Parses a `Retry-After` header (delta-seconds or HTTP-date) into
+* milliseconds. Returns `undefined` when absent or unparseable.
+*/
+function parseRetryAfter(value, now = Date.now()) {
+	if (!value?.trim()) return;
+	const trimmed = value.trim();
+	if (/^\d+(\.\d+)?$/.test(trimmed)) return Math.round(Number(trimmed) * 1e3);
+	const date = Date.parse(trimmed);
+	return Number.isNaN(date) ? void 0 : Math.max(0, date - now);
+}
+/**
+* Runs `attempt` until it succeeds, throws a non-retryable error, or the
+* retry budget is exhausted. Retryable errors are {@link SpeechProviderError}
+* instances whose `status` is 429 or 5xx.
+*/
+async function withSpeechRetry(attempt, retry, signal) {
+	const maxRetries = retry ? retry.maxRetries : 0;
+	for (let attemptNumber = 0;; attemptNumber += 1) try {
+		return await attempt(attemptNumber);
+	} catch (error) {
+		if (!retry || attemptNumber >= maxRetries || signal?.aborted || !(error instanceof SpeechProviderError) || !isRetryableStatus(error.status)) throw error;
+		const backoff = Math.min(retry.maxDelayMs, retry.initialDelayMs * 2 ** attemptNumber);
+		const retryAfterMs = error.retryAfterMs;
+		if (retryAfterMs !== void 0 && retryAfterMs > retry.maxDelayMs) throw error;
+		await sleep(Math.max(backoff, retryAfterMs ?? 0), signal);
 	}
-};
+}
+function sleep(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) {
+			reject(signal.reason);
+			return;
+		}
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(signal?.reason);
+		};
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
 //#endregion
 //#region src/shared/http.ts
+/**
+* Parses a base URL, dropping any fragment and keeping any query string.
+* Throws {@link SpeechConfigurationError} for a blank or unparseable value.
+* The value is not echoed in the error because it may carry credentials.
+*/
+function parseBaseUrl(baseUrl) {
+	const trimmed = baseUrl.trim();
+	if (!trimmed) throw new SpeechConfigurationError("Speech adapter baseUrl is required");
+	let url;
+	try {
+		url = new URL(trimmed);
+	} catch {
+		throw new SpeechConfigurationError("Speech adapter baseUrl is not a valid absolute URL");
+	}
+	url.hash = "";
+	return url;
+}
+/**
+* Returns `baseUrl` with a trailing `/` on its path so relative paths resolve
+* beneath it. The query string is preserved and any fragment is dropped.
+*/
 function normalizeBaseUrl(baseUrl) {
-	if (!baseUrl.trim()) throw new SpeechConfigurationError("Speech adapter baseUrl is required");
-	return baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
+	const url = parseBaseUrl(baseUrl);
+	if (!url.pathname.endsWith("/")) url.pathname = `${url.pathname}/`;
+	return url.toString();
 }
+/**
+* Resolves `path` against `baseUrl`. A relative path without its own query
+* inherits the base URL's query (for example a gateway `api-version`); an
+* absolute URL is returned unchanged.
+*/
 function resolveSpeechUrl(baseUrl, path) {
-	return new URL(path.replace(/^\//, ""), normalizeBaseUrl(baseUrl)).toString();
+	const base = new URL(normalizeBaseUrl(baseUrl));
+	const isAbsolute = /^[a-z][a-z\d+.-]*:/i.test(path);
+	const resolved = new URL(isAbsolute ? path : path.replace(/^\//, ""), base);
+	if (!isAbsolute && !resolved.search && base.search) resolved.search = base.search;
+	return resolved.toString();
+}
+/**
+* Resolves an OpenAI-compatible endpoint from a base URL. Accepts a server
+* root (`https://api.openai.com` → `/v1/<resource>`), an API root ending in a
+* version segment (`http://gateway/stt/v1` → `/<resource>`), or the full
+* endpoint URL (used as-is). Only the path is rewritten: the query string is
+* preserved and any fragment is dropped.
+*/
+function resolveOpenAICompatibleUrl(baseUrl, resource) {
+	const trimmedResource = resource.replace(/^\/+|\/+$/g, "");
+	const url = parseBaseUrl(baseUrl);
+	const pathname = url.pathname.replace(/\/+$/, "");
+	if (pathname.endsWith(`/${trimmedResource}`)) url.pathname = pathname;
+	else if (/\/v\d+$/.test(pathname)) url.pathname = `${pathname}/${trimmedResource}`;
+	else url.pathname = `${pathname}/v1/${trimmedResource}`;
+	return url.toString();
 }
 function resolveFetch(fetchOverride) {
 	if (fetchOverride) return fetchOverride;
@@ -68,11 +160,21 @@ var HttpSpeechAdapter = class {
 		this.headers = options.headers;
 		this.timeoutMs = options.timeoutMs;
 	}
-	async post(adapterName, path, init, readResponse) {
+	/**
+	* POSTs to `path` (relative to `baseUrl`, or an absolute URL). The optional
+	* `retry` policy retries 429/5xx responses; `timeoutMs` applies per attempt.
+	* The request body must be re-sendable (string, Blob, FormData) when
+	* retries are enabled.
+	*/
+	async post(adapterName, path, init, readResponse, retry = false) {
+		return withSpeechRetry(() => this.postOnce(adapterName, path, init, readResponse), retry, init.signal ?? void 0);
+	}
+	async postOnce(adapterName, path, init, readResponse) {
 		const timeoutController = this.timeoutMs && this.timeoutMs > 0 ? new AbortController() : void 0;
 		const timeout = timeoutController && this.timeoutMs ? setTimeout(() => timeoutController.abort(), this.timeoutMs) : void 0;
 		const requestSignal = composeAbortSignals(init.signal, timeoutController?.signal);
 		try {
+			requestSignal.signal?.throwIfAborted();
 			const response = await this.fetchImpl(resolveSpeechUrl(this.baseUrl, path), {
 				...init,
 				method: "POST",
@@ -82,7 +184,7 @@ var HttpSpeechAdapter = class {
 				}, init.headers),
 				signal: requestSignal.signal
 			});
-			await assertOk(response, adapterName);
+			await assertOk(response, adapterName, this.apiKey);
 			return await readResponse(response);
 		} finally {
 			if (timeout) clearTimeout(timeout);
@@ -122,26 +224,19 @@ function composeAbortSignals(...signals) {
 		cleanup
 	};
 }
-async function assertOk(response, adapterName) {
+async function assertOk(response, adapterName, apiKey) {
 	if (response.ok) return;
 	const responseBody = await response.text().catch(() => void 0);
 	throw new SpeechProviderError(adapterName, `${adapterName} speech request failed with HTTP ${response.status}`, {
 		status: response.status,
-		responseBody
+		responseBody: redactSecret(responseBody, apiKey),
+		retryAfterMs: parseRetryAfter(response.headers.get("retry-after"))
 	});
 }
-function appendAudioInput(form, audio, fieldName = "audio") {
-	const filename = audio.filename ?? "audio";
-	const data = audio.data;
-	if (typeof Blob !== "undefined" && data instanceof Blob) {
-		const contentType = audio.contentType ?? (data.type || "application/octet-stream");
-		const blob = data.type === contentType ? data : new Blob([data], { type: contentType });
-		form.append(fieldName, blob, filename);
-		return;
-	}
-	const contentType = audio.contentType ?? "application/octet-stream";
-	const blobPart = data instanceof Uint8Array ? arrayBufferFromBytes(data) : data;
-	form.append(fieldName, new Blob([blobPart], { type: contentType }), filename);
+/** Removes an API key from provider-supplied text before it is surfaced. */
+function redactSecret(text, secret) {
+	if (!text || !secret) return text;
+	return text.split(secret).join("[REDACTED]");
 }
 function appendOptionalFormValue(form, name, value) {
 	if (value === void 0 || value === null) return;
@@ -280,15 +375,1556 @@ function parseHeaderNumber(response, headerName) {
 	return Number.isFinite(parsed) ? parsed : void 0;
 }
 //#endregion
+//#region src/shared/websocket.ts
+/**
+* Minimal WebSocket surface used by streaming adapters. Browser, Node 22+
+* (`globalThis.WebSocket`), Deno, Bun, and the `ws` package all satisfy it.
+*/
+/** True in browsers and web workers, where API keys must never be used. */
+function isBrowserRuntime() {
+	const scope = globalThis;
+	if (scope.process?.versions?.node) return false;
+	return typeof scope.document !== "undefined" || typeof scope.WorkerGlobalScope !== "undefined";
+}
+/**
+* Resolves a socket factory from explicit options, falling back to
+* `globalThis.WebSocket`. Headers are only passed when present, so standard
+* constructors that cannot send them are never handed an options object.
+*/
+function resolveWebSocketFactory(adapter, options) {
+	if (options.createWebSocket) return options.createWebSocket;
+	const Ctor = options.WebSocket ?? globalThis.WebSocket;
+	if (!Ctor) throw new SpeechConfigurationError("No WebSocket implementation available; pass `WebSocket` or `createWebSocket`", adapter);
+	return (url, init) => Object.keys(init.headers).length > 0 ? new Ctor(url, {
+		protocols: init.protocols,
+		headers: init.headers
+	}) : new Ctor(url, init.protocols);
+}
+/** Converts `http(s)://` to `ws(s)://`; leaves `ws(s)://` unchanged. */
+function toWebSocketUrl(url, adapter) {
+	const parsed = new URL(url);
+	if (parsed.protocol === "http:") parsed.protocol = "ws:";
+	else if (parsed.protocol === "https:") parsed.protocol = "wss:";
+	else if (parsed.protocol !== "ws:" && parsed.protocol !== "wss:") throw new SpeechConfigurationError(`Unsupported streaming URL protocol: ${parsed.protocol}`, adapter);
+	return parsed.toString();
+}
+/** Converts a message payload to text; returns `undefined` for unsupported data. */
+function messageDataToText(data) {
+	if (typeof data === "string") return data;
+	if (data instanceof ArrayBuffer) return new TextDecoder().decode(data);
+	if (ArrayBuffer.isView(data)) return new TextDecoder().decode(data);
+}
+//#endregion
+//#region src/shared/realtime-auth.ts
+/**
+* Credential handling shared by realtime (WebSocket) adapters.
+*
+* Node callers authenticate with a long-lived `apiKey` in the
+* `Authorization` header. Browsers cannot set WebSocket headers and must never
+* hold a long-lived key, so they pass a short-lived `clientSecret`, which is
+* sent as a WebSocket subprotocol.
+*/
+/** Subprotocol prefix that carries a client secret (OpenAI's convention). */
+var CLIENT_SECRET_SUBPROTOCOL_PREFIX = "openai-insecure-api-key.";
+/**
+* Long-lived OpenAI-style keys (`sk-…`, `sk-proj-…`, `sk-svcacct-…`). A
+* browser `clientSecret` that looks like one is refused: browsers accept only
+* short-lived tokens such as OpenAI's `ek_…` client secrets.
+*/
+var LONG_LIVED_KEY = /^sk-/;
+/** Throws when an adapter is given a long-lived `apiKey` in a browser. */
+function assertNoBrowserApiKey(adapter, apiKey) {
+	if (apiKey && isBrowserRuntime()) throw new SpeechConfigurationError(`${adapter} refuses apiKey in a browser; mint a short-lived clientSecret on your server instead`, adapter);
+}
+/** Resolves a static or per-session client secret and validates its shape. */
+async function resolveClientSecret(adapter, secret) {
+	const trimmed = (typeof secret === "function" ? await secret() : secret)?.trim();
+	if (trimmed === void 0) return;
+	if (!/^[\x21-\x7e]+$/.test(trimmed)) throw new SpeechConfigurationError("clientSecret must be a non-empty token without spaces", adapter);
+	if (isBrowserRuntime() && LONG_LIVED_KEY.test(trimmed)) throw new SpeechConfigurationError("clientSecret looks like a long-lived API key; browsers accept only short-lived tokens minted by your server (see createStreamingClientSecret)", adapter);
+	return trimmed;
+}
+/**
+* Builds the per-session `connect` callback: refuses handshake headers in a
+* browser, resolves the client secret, and sets `Authorization` from
+* `apiKey` unless a header already supplies it.
+*/
+function realtimeConnector(options) {
+	if (isBrowserRuntime() && Object.keys(options.headers).length > 0) throw new SpeechConfigurationError("Browsers cannot send WebSocket headers; remove `headers` or connect from a server", options.adapter);
+	return async () => {
+		const secret = await resolveClientSecret(options.adapter, options.clientSecret);
+		const headers = { ...options.headers };
+		const secrets = headerSecrets(headers);
+		if (secret) secrets.push(secret);
+		if (options.apiKey) {
+			secrets.push(options.apiKey);
+			if (!hasHeader(headers, "authorization")) headers.authorization = `Bearer ${options.apiKey}`;
+		}
+		return {
+			url: options.url,
+			protocols: options.protocols(secret),
+			headers,
+			secrets
+		};
+	};
+}
+/** Values of other headers shorter than this are not treated as credentials. */
+var MIN_HEADER_SECRET_LENGTH = 8;
+/**
+* Header names that carry credentials (`authorization`, `x-api-key`,
+* `x-bf-vk`, `*-token`, `*-secret`, …). Their values are redacted at any
+* length.
+*/
+var CREDENTIAL_HEADER = /auth|key|token|secret|password|credential|-vk$/i;
+/**
+* Values of caller-supplied headers to redact from provider error text.
+* Credential-named headers are redacted whatever their length; for
+* `Authorization`, the credential after the scheme is included too. Other
+* headers may also carry tenant secrets, so their values are redacted when
+* they are at least 8 characters long, which keeps short values such as
+* `1` from mangling messages.
+*/
+function headerSecrets(headers) {
+	const secrets = [];
+	for (const [key, value] of Object.entries(mergeHeaderRecords(headers))) {
+		const credential = CREDENTIAL_HEADER.test(key);
+		const candidates = [value];
+		if (key.toLowerCase() === "authorization") candidates.push(value.replace(/^\S+\s+/, ""));
+		for (const candidate of candidates) {
+			const trimmed = candidate.trim();
+			const long = trimmed.length >= MIN_HEADER_SECRET_LENGTH;
+			if (trimmed && (credential || long) && !secrets.includes(trimmed)) secrets.push(trimmed);
+		}
+	}
+	return secrets.sort((left, right) => right.length - left.length);
+}
+function mergeHeaderRecords(...sets) {
+	const merged = {};
+	for (const set of sets) if (set) new Headers(set).forEach((value, key) => {
+		merged[key] = value;
+	});
+	return merged;
+}
+function hasHeader(headers, name) {
+	return Object.keys(headers).some((key) => key.toLowerCase() === name);
+}
+//#endregion
+//#region src/shared/pcm.ts
+/**
+* Raw-audio helpers for streaming adapters: byte views, base64 encoding,
+* duration from byte counts, and WAV/`audio/L16` unwrapping for the
+* record-then-send wrapper. Nothing here decodes compressed audio or resamples.
+*/
+var ENCODING_BYTES_PER_SAMPLE = {
+	pcm16: 2,
+	g711_ulaw: 1,
+	g711_alaw: 1
+};
+/** Returns a byte view over a chunk without copying. */
+function chunkToBytes(chunk, adapter) {
+	if (chunk instanceof Uint8Array) return chunk;
+	if (chunk instanceof ArrayBuffer) return new Uint8Array(chunk);
+	if (ArrayBuffer.isView(chunk)) return new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength);
+	throw new SpeechConfigurationError("Streaming audio chunks must be Uint8Array, ArrayBuffer, or an ArrayBuffer view", adapter);
+}
+function encodeBase64(bytes) {
+	if (typeof Buffer !== "undefined") return Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString("base64");
+	let binary = "";
+	const step = 32768;
+	for (let index = 0; index < bytes.length; index += step) binary += String.fromCharCode(...bytes.subarray(index, index + step));
+	return btoa(binary);
+}
+/** Bytes per second of audio in `format`. */
+function bytesPerSecond(format) {
+	return format.sampleRate * format.channels * ENCODING_BYTES_PER_SAMPLE[format.encoding];
+}
+/** Audio duration in seconds for `bytes` of `format`, rounded to milliseconds. */
+function audioSecondsForBytes(bytes, format) {
+	return Math.round(bytes / bytesPerSecond(format) * 1e3) / 1e3;
+}
+var WAV_TYPES = /* @__PURE__ */ new Set([
+	"audio/wav",
+	"audio/wave",
+	"audio/x-wav",
+	"audio/vnd.wave"
+]);
+var RAW_PCM_TYPES = /* @__PURE__ */ new Set([
+	"audio/pcm",
+	"audio/l16",
+	"audio/raw",
+	"audio/x-raw"
+]);
+/** Untyped bytes: the streaming transcriber's default format applies. */
+var UNTYPED = "application/octet-stream";
+var MULAW_TYPES = /* @__PURE__ */ new Set([
+	"audio/pcmu",
+	"audio/basic",
+	"audio/x-mulaw"
+]);
+var ALAW_TYPES = /* @__PURE__ */ new Set(["audio/pcma", "audio/x-alaw"]);
+/**
+* Interprets a finished recording as raw audio for a streaming session.
+* Accepts PCM/G.711 WAV files, `audio/pcm`/`audio/L16` (with optional `rate`
+* and `channels` parameters), `audio/pcmu`/`audio/pcma`, and untyped bytes.
+* Compressed containers are rejected with a `SpeechConfigurationError`.
+*/
+function unwrapRawAudio(bytes, mimeType, adapter) {
+	const essence = normalizeMimeType(mimeType) ?? "application/octet-stream";
+	const params = parseMimeParameters(mimeType);
+	const rate = parsePositiveInt(params.rate);
+	const channels = parsePositiveInt(params.channels);
+	if (WAV_TYPES.has(essence) || isRiffWave(bytes)) return parseWav(bytes, adapter);
+	if (essence === UNTYPED) return {
+		bytes,
+		format: compact({
+			sampleRate: rate,
+			channels
+		})
+	};
+	if (RAW_PCM_TYPES.has(essence)) {
+		if (essence === "audio/l16" && bytes.byteLength % 2 !== 0) throw new SpeechConfigurationError(`audio/L16 payload has an odd byte length (${bytes.byteLength}); 16-bit samples need an even number of bytes`, adapter);
+		return {
+			bytes: essence === "audio/l16" ? swapBytePairs(bytes) : bytes,
+			format: compact({
+				encoding: "pcm16",
+				sampleRate: rate,
+				channels
+			})
+		};
+	}
+	if (MULAW_TYPES.has(essence)) return {
+		bytes,
+		format: compact({
+			encoding: "g711_ulaw",
+			sampleRate: rate,
+			channels
+		})
+	};
+	if (ALAW_TYPES.has(essence)) return {
+		bytes,
+		format: compact({
+			encoding: "g711_alaw",
+			sampleRate: rate,
+			channels
+		})
+	};
+	throw new SpeechConfigurationError(`${adapter} streams raw audio and cannot decode ${essence}; send PCM WAV or raw PCM, or use an HTTP transcriber for compressed recordings`, adapter);
+}
+/** Returns a copy with each 16-bit sample's bytes swapped. */
+function swapBytePairs(bytes) {
+	const swapped = new Uint8Array(bytes.byteLength);
+	for (let index = 0; index + 1 < bytes.byteLength; index += 2) {
+		swapped[index] = bytes[index + 1] ?? 0;
+		swapped[index + 1] = bytes[index] ?? 0;
+	}
+	return swapped;
+}
+function isRiffWave(bytes) {
+	return bytes.byteLength >= 12 && ascii(bytes, 0, 4) === "RIFF" && ascii(bytes, 8, 4) === "WAVE";
+}
+function parseWav(bytes, adapter) {
+	if (!isRiffWave(bytes)) throw new SpeechConfigurationError("Invalid WAV header", adapter);
+	const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+	let offset = 12;
+	let format;
+	while (offset + 8 <= bytes.byteLength) {
+		const id = ascii(bytes, offset, 4);
+		const size = view.getUint32(offset + 4, true);
+		const body = offset + 8;
+		if (id === "fmt " && body + 16 <= bytes.byteLength) {
+			const audioFormat = view.getUint16(body, true);
+			const channels = view.getUint16(body + 2, true);
+			const sampleRate = view.getUint32(body + 4, true);
+			format = {
+				encoding: wavEncoding(audioFormat, view.getUint16(body + 14, true), adapter),
+				sampleRate,
+				channels
+			};
+		} else if (id === "data") {
+			if (!format) throw new SpeechConfigurationError("WAV data chunk precedes its fmt chunk", adapter);
+			const end = Math.min(bytes.byteLength, body + size);
+			return {
+				bytes: bytes.subarray(body, end),
+				format
+			};
+		}
+		offset = body + size + size % 2;
+	}
+	throw new SpeechConfigurationError("WAV file has no data chunk", adapter);
+}
+function wavEncoding(audioFormat, bitsPerSample, adapter) {
+	if ((audioFormat === 1 || audioFormat === 65534) && bitsPerSample === 16) return "pcm16";
+	if (audioFormat === 7 && bitsPerSample === 8) return "g711_ulaw";
+	if (audioFormat === 6 && bitsPerSample === 8) return "g711_alaw";
+	throw new SpeechConfigurationError(`Unsupported WAV encoding (format ${audioFormat}, ${bitsPerSample}-bit); expected 16-bit PCM or 8-bit G.711`, adapter);
+}
+function ascii(bytes, offset, length) {
+	return String.fromCharCode(...bytes.subarray(offset, offset + length));
+}
+function parseMimeParameters(mimeType) {
+	const params = {};
+	for (const part of mimeType.split(";").slice(1)) {
+		const [key, value] = part.split("=");
+		if (key && value) params[key.trim().toLowerCase()] = value.trim();
+	}
+	return params;
+}
+function parsePositiveInt(value) {
+	if (!value) return;
+	const parsed = Number.parseInt(value, 10);
+	return Number.isFinite(parsed) && parsed > 0 ? parsed : void 0;
+}
+function compact(format) {
+	return Object.fromEntries(Object.entries(format).filter(([, value]) => value !== void 0));
+}
+//#endregion
+//#region src/shared/turn-limit.ts
+/**
+* Per-turn audio limits for realtime sessions.
+*
+* Some providers cap the audio of one turn rather than of a session: vLLM's
+* realtime endpoint keeps a turn's audio and generated tokens in one model
+* context (`max_model_len`) and clears it after each final commit. A
+* {@link TurnSplitter} measures the audio of the current turn from byte counts
+* and the negotiated format, and picks where to roll over to a new turn: at
+* the first quiet stretch inside a window before the limit, or at the limit
+* itself when no quiet stretch turns up. The silence check is a plain RMS
+* energy test, not a voice-activity model.
+*/
+/** Default per-turn audio cap for providers that need one (`voxtral-realtime`). */
+var DEFAULT_MAX_TURN_SECONDS = 270;
+/** How long before the cap the rollover starts looking for silence. */
+var DEFAULT_ROLLOVER_WINDOW_SECONDS = 15;
+/** RMS level (0-1 of full scale, about -40 dBFS) below which audio is quiet. */
+var DEFAULT_ROLLOVER_SILENCE_THRESHOLD = .01;
+/** Quiet audio needed before the rollover commits. */
+var DEFAULT_ROLLOVER_MIN_SILENCE_MS = 300;
+/** Energy is measured over frames of this length. */
+var ANALYSIS_FRAME_MS = 20;
+var BYTES_PER_SAMPLE = {
+	pcm16: 2,
+	g711_ulaw: 1,
+	g711_alaw: 1
+};
+/**
+* Resolves the turn limit from settings, highest priority first (session
+* options, then adapter options, which already carry environment values),
+* falling back to `defaultMaxTurnSeconds`. Returns `undefined` when no limit
+* applies or `maxTurnSeconds` is `Infinity`.
+*/
+function resolveTurnLimit(adapter, defaultMaxTurnSeconds, ...settings) {
+	const maxTurnSeconds = settings.find((entry) => entry?.maxTurnSeconds !== void 0)?.maxTurnSeconds ?? defaultMaxTurnSeconds;
+	if (maxTurnSeconds === void 0) return;
+	if (typeof maxTurnSeconds !== "number" || Number.isNaN(maxTurnSeconds) || maxTurnSeconds <= 0) throw new SpeechConfigurationError(`maxTurnSeconds must be a positive number of seconds or Infinity (got ${String(maxTurnSeconds)})`, adapter);
+	if (maxTurnSeconds === Number.POSITIVE_INFINITY) return;
+	const rollover = settings.find((entry) => entry?.rollover !== void 0)?.rollover;
+	const tuning = (key) => settings.map((entry) => entry?.rollover).find((value) => typeof value === "object" && value !== null && value[key] !== void 0)?.[key];
+	const limit = {
+		maxTurnSeconds,
+		rollover: rollover !== false,
+		windowSeconds: tuning("windowSeconds") ?? 15,
+		silenceThreshold: tuning("silenceThreshold") ?? .01,
+		minSilenceMs: tuning("minSilenceMs") ?? 300
+	};
+	assertNonNegative(adapter, "rollover.windowSeconds", limit.windowSeconds);
+	assertNonNegative(adapter, "rollover.minSilenceMs", limit.minSilenceMs);
+	assertNonNegative(adapter, "rollover.silenceThreshold", limit.silenceThreshold);
+	if (limit.silenceThreshold > 1) throw new SpeechConfigurationError(`rollover.silenceThreshold is an RMS level from 0 to 1 (got ${limit.silenceThreshold})`, adapter);
+	return limit;
+}
+function assertNonNegative(adapter, name, value) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) throw new SpeechConfigurationError(`${name} must be a non-negative finite number (got ${String(value)})`, adapter);
+}
+/** Bytes of one sample frame (one sample per channel). */
+function blockAlign(format) {
+	return BYTES_PER_SAMPLE[format.encoding] * format.channels;
+}
+/** Whole sample frames in `seconds` of audio, as bytes (rounded down). */
+function bytesForSeconds(seconds, format) {
+	const align = blockAlign(format);
+	return Math.floor(seconds * bytesPerSecond(format) / align + 1e-9) * align;
+}
+/** Digital silence in `format`: zero samples, encoded. */
+function silence(bytes, format) {
+	const fill = format.encoding === "g711_ulaw" ? 255 : format.encoding === "g711_alaw" ? 213 : 0;
+	return new Uint8Array(bytes).fill(fill);
+}
+/** Bytes of audio one turn may hold: whole sample frames, at least one. */
+function turnCapBytes(limit, format) {
+	return Math.max(blockAlign(format), bytesForSeconds(limit.maxTurnSeconds, format));
+}
+/** The public view of a resolved limit for a session format. */
+function describeTurnLimit(limit, format) {
+	return limit && {
+		maxTurnSeconds: limit.maxTurnSeconds,
+		rollover: limit.rollover,
+		maxTurnBytes: turnCapBytes(limit, format)
+	};
+}
+/**
+* Tracks the audio of the current turn and finds rollover points.
+*
+* Feed every chunk in write order to {@link split} (rollover on) or
+* {@link add} (rollover off), and call {@link reset} whenever the turn ends
+* for another reason (a manual commit).
+*/
+var TurnSplitter = class {
+	/** Bytes of the current turn so far. */
+	turnBytes = 0;
+	capBytes;
+	windowStartBytes;
+	frameBytes;
+	minSilenceBytes;
+	threshold;
+	encoding;
+	sampleBytes;
+	frameFill = 0;
+	frameSumSquares = 0;
+	frameSamples = 0;
+	/** Trailing bytes of a sample split across chunks. */
+	carry = [];
+	/** Consecutive quiet bytes ending at the last complete frame. */
+	quietRun = 0;
+	constructor(limit, format) {
+		const align = blockAlign(format);
+		this.capBytes = turnCapBytes(limit, format);
+		this.windowStartBytes = Math.max(0, this.capBytes - bytesForSeconds(limit.windowSeconds, format));
+		this.frameBytes = Math.max(align, bytesForSeconds(ANALYSIS_FRAME_MS / 1e3, format));
+		this.minSilenceBytes = Math.max(this.frameBytes, bytesForSeconds(limit.minSilenceMs / 1e3, format));
+		this.threshold = limit.silenceThreshold;
+		this.encoding = format.encoding;
+		this.sampleBytes = BYTES_PER_SAMPLE[format.encoding];
+	}
+	/** Ends the current turn: the next byte starts a new one. */
+	reset() {
+		this.turnBytes = 0;
+		this.frameFill = 0;
+		this.frameSumSquares = 0;
+		this.frameSamples = 0;
+		this.carry = [];
+		this.quietRun = 0;
+	}
+	/** Whether `bytes` more would push the current turn past the cap. */
+	wouldOverflow(bytes) {
+		return this.turnBytes + bytes > this.capBytes;
+	}
+	/** Counts `bytes` toward the current turn without analysing them. */
+	add(bytes) {
+		this.turnBytes += bytes;
+	}
+	/**
+	* Feeds one chunk and returns the offsets inside it where the turn should
+	* end (each in `1..chunk.byteLength`, ascending). The splitter resets at
+	* each offset, so bytes after it count toward the next turn.
+	*/
+	split(chunk) {
+		const cuts = [];
+		let offset = 0;
+		while (offset < chunk.byteLength) {
+			if (this.turnBytes < this.windowStartBytes) {
+				const skip = Math.min(chunk.byteLength - offset, this.windowStartBytes - this.turnBytes);
+				offset += skip;
+				this.turnBytes += skip;
+				if (this.turnBytes >= this.capBytes) {
+					cuts.push(offset);
+					this.reset();
+				}
+				continue;
+			}
+			const take = Math.min(chunk.byteLength - offset, this.frameBytes - this.frameFill, this.capBytes - this.turnBytes);
+			this.measure(chunk, offset, take);
+			offset += take;
+			this.turnBytes += take;
+			this.frameFill += take;
+			let cut = false;
+			if (this.frameFill >= this.frameBytes) {
+				const quiet = this.frameIsQuiet();
+				this.quietRun = quiet ? this.quietRun + this.frameFill : 0;
+				this.frameFill = 0;
+				this.frameSumSquares = 0;
+				this.frameSamples = 0;
+				cut = this.quietRun >= this.minSilenceBytes;
+			}
+			if (cut || this.turnBytes >= this.capBytes) {
+				cuts.push(offset);
+				this.reset();
+			}
+		}
+		return cuts;
+	}
+	frameIsQuiet() {
+		if (this.frameSamples === 0) return false;
+		return Math.sqrt(this.frameSumSquares / this.frameSamples) / 32768 < this.threshold;
+	}
+	measure(chunk, start, length) {
+		const end = start + length;
+		let index = start;
+		while (this.carry.length > 0 && index < end) {
+			this.carry.push(chunk[index] ?? 0);
+			index += 1;
+			if (this.carry.length === this.sampleBytes) {
+				this.addSample(this.carry);
+				this.carry = [];
+			}
+		}
+		for (; index + this.sampleBytes <= end; index += this.sampleBytes) this.addSampleAt(chunk, index);
+		for (; index < end; index += 1) this.carry.push(chunk[index] ?? 0);
+	}
+	addSample(bytes) {
+		this.addLinear(this.encoding === "pcm16" ? pcm16Sample(bytes[0] ?? 0, bytes[1] ?? 0) : this.decodeG711(bytes[0] ?? 0));
+	}
+	addSampleAt(chunk, index) {
+		this.addLinear(this.encoding === "pcm16" ? pcm16Sample(chunk[index] ?? 0, chunk[index + 1] ?? 0) : this.decodeG711(chunk[index] ?? 0));
+	}
+	addLinear(sample) {
+		this.frameSumSquares += sample * sample;
+		this.frameSamples += 1;
+	}
+	decodeG711(byte) {
+		return this.encoding === "g711_ulaw" ? decodeMuLaw(byte) : decodeALaw(byte);
+	}
+};
+/** Signed 16-bit little-endian sample. */
+function pcm16Sample(low, high) {
+	const value = low | high << 8;
+	return value >= 32768 ? value - 65536 : value;
+}
+/** G.711 mu-law byte to a 16-bit linear sample (ITU-T G.711). */
+function decodeMuLaw(byte) {
+	const value = ~byte & 255;
+	const exponent = value >> 4 & 7;
+	const magnitude = (((value & 15) << 3) + 132 << exponent) - 132;
+	return value & 128 ? -magnitude : magnitude;
+}
+/** G.711 A-law byte to a 16-bit linear sample (ITU-T G.711). */
+function decodeALaw(byte) {
+	const value = byte ^ 85;
+	const exponent = value >> 4 & 7;
+	const mantissa = value & 15;
+	const magnitude = exponent === 0 ? (mantissa << 4) + 8 : (mantissa << 4) + 264 << exponent - 1;
+	return value & 128 ? magnitude : -magnitude;
+}
+var DRAIN_POLL_MS = 10;
+var noop = () => void 0;
+var RealtimeTranscriptionSession = class {
+	state = "connecting";
+	sessionId;
+	ready;
+	init;
+	provider;
+	resolveReady = noop;
+	rejectReady = noop;
+	socket;
+	opened = false;
+	secrets = [];
+	queue = [];
+	queued = 0;
+	pumping = false;
+	totalBytes = 0;
+	uncommittedBytes = 0;
+	outstandingCommits = 0;
+	/** Per outstanding commit, in order: whether it carried audio. */
+	commitHadAudio = [];
+	turnOpen = false;
+	/** `Date.now()` of the last server message; bounds inactivity waits. */
+	lastServerMessageAt = 0;
+	itemOrder = [];
+	pendingItems = /* @__PURE__ */ new Set();
+	vadStoppedItems = /* @__PURE__ */ new Set();
+	partials = /* @__PURE__ */ new Map();
+	finals = [];
+	listeners = /* @__PURE__ */ new Map();
+	error;
+	endPromise;
+	endWaiter;
+	connectTimer;
+	endTimer;
+	closeEmitted = false;
+	/** Measures the current turn in write order when a turn limit applies. */
+	splitter;
+	onAbort = () => {
+		this.fail(toError(this.init.signal?.reason, this.provider));
+	};
+	constructor(init) {
+		this.init = init;
+		this.provider = init.protocol.provider;
+		assertTurnLimitFitsProtocol(init.protocol, init.turnLimit);
+		if (init.turnLimit) this.splitter = new TurnSplitter(init.turnLimit, init.config.format);
+		this.ready = new Promise((resolve, reject) => {
+			this.resolveReady = resolve;
+			this.rejectReady = reject;
+		});
+		this.ready.catch(noop);
+		if (init.signal?.aborted) {
+			this.fail(toError(init.signal.reason, this.provider));
+			return;
+		}
+		init.signal?.addEventListener("abort", this.onAbort, { once: true });
+		this.connect();
+	}
+	get queuedBytes() {
+		return this.queued;
+	}
+	write(chunk) {
+		const promise = this.enqueueAudio(chunk);
+		promise.catch(noop);
+		return promise;
+	}
+	commit() {
+		if (this.isTerminal() || this.endPromise) return;
+		this.queue.push({
+			kind: "commit",
+			final: false
+		});
+		this.splitter?.reset();
+		this.pump();
+	}
+	end() {
+		if (this.endPromise) return this.endPromise;
+		if (this.error) {
+			this.endPromise = Promise.reject(this.error);
+			return this.endPromise;
+		}
+		this.state = "ending";
+		this.queue.push({
+			kind: "commit",
+			final: true
+		});
+		const settled = new Promise((resolve, reject) => {
+			this.endWaiter = {
+				resolve,
+				reject
+			};
+		});
+		this.armEndTimer();
+		this.endPromise = settled.then(() => this.finish());
+		this.pump();
+		this.checkEnded();
+		return this.endPromise;
+	}
+	/**
+	* (Re)starts the end timeout. It measures provider inactivity: every server
+	* message restarts it, so a long recording that is still being transcribed
+	* is not cut off, while a silent provider still fails after `timeoutMs`.
+	*/
+	armEndTimer() {
+		clearTimeout(this.endTimer);
+		this.endTimer = setTimeout(() => {
+			this.fail(new SpeechProviderError(this.provider, `${this.provider} timed out after ${this.init.timeoutMs} ms waiting for the final transcript`));
+		}, this.init.timeoutMs);
+	}
+	abort(reason) {
+		this.fail(toError(reason, this.provider));
+	}
+	on(event, listener) {
+		let set = this.listeners.get(event);
+		if (!set) {
+			set = /* @__PURE__ */ new Set();
+			this.listeners.set(event, set);
+		}
+		set.add(listener);
+		return () => this.off(event, listener);
+	}
+	off(event, listener) {
+		this.listeners.get(event)?.delete(listener);
+	}
+	enqueueAudio(chunk) {
+		if (this.error) return Promise.reject(this.error);
+		if (this.endPromise || this.isTerminal()) return Promise.reject(new SpeechError("Cannot write to a streaming session after end()", "SPEECH_SESSION_ENDED", this.provider));
+		let bytes;
+		try {
+			bytes = chunkToBytes(chunk, this.provider);
+		} catch (error) {
+			return Promise.reject(error);
+		}
+		if (bytes.byteLength === 0) return Promise.resolve();
+		if (this.queued + bytes.byteLength > this.init.maxBufferedBytes) return Promise.reject(new SpeechError(`Streaming write would queue more than maxBufferedBytes (${this.init.maxBufferedBytes}); await write() before sending more audio`, "SPEECH_BACKPRESSURE", this.provider));
+		const splitter = this.splitter;
+		let cuts = [];
+		if (splitter && !this.init.turnLimit?.rollover) {
+			if (splitter.wouldOverflow(bytes.byteLength)) return Promise.reject(new SpeechError(`Streaming write would push the current turn past maxTurnSeconds (${this.init.turnLimit?.maxTurnSeconds} s); call commit() before writing more audio`, "SPEECH_TURN_TOO_LONG", this.provider));
+			splitter.add(bytes.byteLength);
+		} else if (splitter) cuts = splitter.split(bytes);
+		return new Promise((resolve, reject) => {
+			const pushPart = (start, end) => {
+				const part = bytes.subarray(start, end);
+				this.queue.push({
+					kind: "audio",
+					base64: encodeBase64(part),
+					bytes: part.byteLength,
+					resolve: end === bytes.byteLength ? resolve : noop,
+					reject
+				});
+				this.queued += part.byteLength;
+			};
+			let start = 0;
+			for (const cut of cuts) {
+				pushPart(start, cut);
+				this.queue.push({
+					kind: "commit",
+					final: false
+				});
+				start = cut;
+			}
+			if (start < bytes.byteLength) pushPart(start, bytes.byteLength);
+			this.pump();
+		});
+	}
+	async connect() {
+		this.connectTimer = setTimeout(() => {
+			this.fail(new SpeechProviderError(this.provider, `${this.provider} connection timed out after ${this.init.connectTimeoutMs} ms`));
+		}, this.init.connectTimeoutMs);
+		try {
+			const connection = await this.init.connect();
+			if (this.isTerminal()) return;
+			this.secrets = connection.secrets;
+			const socket = this.init.createWebSocket(connection.url, {
+				protocols: connection.protocols,
+				headers: connection.headers
+			});
+			this.socket = socket;
+			try {
+				socket.binaryType = "arraybuffer";
+			} catch {}
+			socket.addEventListener("open", () => this.onOpen());
+			socket.addEventListener("message", (event) => this.onMessage(event.data));
+			socket.addEventListener("error", () => {
+				this.fail(new SpeechProviderError(this.provider, `${this.provider} WebSocket error`));
+			});
+			socket.addEventListener("close", (event) => this.onClose(event));
+		} catch (error) {
+			this.fail(toError(error, this.provider));
+		}
+	}
+	onOpen() {
+		clearTimeout(this.connectTimer);
+		if (this.isTerminal()) {
+			this.closeSocket();
+			return;
+		}
+		this.opened = true;
+		for (const message of this.init.protocol.sessionMessages(this.init.config)) if (!this.send(message)) return;
+		if (this.state === "connecting") this.state = "open";
+		this.resolveReady();
+		this.emit("open", { sessionId: this.sessionId });
+		this.pump();
+	}
+	onMessage(data) {
+		if (this.isTerminal()) return;
+		this.lastServerMessageAt = Date.now();
+		if (this.endWaiter) this.armEndTimer();
+		const text = messageDataToText(data);
+		if (text === void 0) return;
+		let parsed;
+		try {
+			parsed = JSON.parse(text);
+		} catch {
+			return;
+		}
+		let events;
+		try {
+			events = this.init.protocol.parse(parsed);
+		} catch (error) {
+			this.fail(toError(error, this.provider));
+			return;
+		}
+		for (const event of events) {
+			if (this.isTerminal()) return;
+			this.handle(event);
+		}
+		this.checkEnded();
+	}
+	handle(event) {
+		switch (event.type) {
+			case "session":
+				this.sessionId = event.sessionId ?? this.sessionId;
+				return;
+			case "committed":
+				if (event.itemId && !this.pendingItems.has(event.itemId)) {
+					this.pendingItems.add(event.itemId);
+					this.itemOrder.push(event.itemId);
+				}
+				if (this.init.protocol.commitAck === "committed" && !(event.itemId && this.vadStoppedItems.has(event.itemId))) this.ackCommit();
+				return;
+			case "commit_empty":
+				this.ackCommit();
+				return;
+			case "partial": {
+				const key = event.itemId ?? "";
+				const text = (this.partials.get(key) ?? "") + event.delta;
+				this.partials.set(key, text);
+				this.emit("partial", {
+					delta: event.delta,
+					text,
+					itemId: event.itemId
+				});
+				return;
+			}
+			case "final": {
+				let serverEnded = false;
+				if (this.init.protocol.commitAck === "final") {
+					if (this.outstandingCommits === 0) serverEnded = true;
+					else if (this.ackCommit() && event.audioConsumed === false) {
+						this.fail(new SpeechProviderError(this.provider, `${this.provider} finished a turn without transcribing its audio (the server's turn state is out of sync, e.g. after a commit crossed a server-ended turn); start a new session`));
+						return;
+					}
+				}
+				if (event.itemId) this.pendingItems.delete(event.itemId);
+				this.partials.delete(event.itemId ?? "");
+				this.finals.push({
+					itemId: event.itemId,
+					text: event.text,
+					providerUsage: event.providerUsage,
+					raw: event.raw,
+					arrival: this.finals.length
+				});
+				this.emit("final", {
+					text: event.text,
+					itemId: event.itemId,
+					providerUsage: event.providerUsage,
+					raw: event.raw
+				});
+				if (serverEnded) this.fail(new SpeechProviderError(this.provider, `${this.provider} ended a turn before it was committed (for example at a server generation limit); audio sent after that point was not transcribed. Call commit() more often and start a new session`));
+				return;
+			}
+			case "speech_started":
+				this.emit(event.type, {
+					itemId: event.itemId,
+					audioMs: event.audioMs
+				});
+				return;
+			case "speech_stopped":
+				if (event.itemId) this.vadStoppedItems.add(event.itemId);
+				this.emit(event.type, {
+					itemId: event.itemId,
+					audioMs: event.audioMs
+				});
+				return;
+			case "error":
+				this.fail(new SpeechProviderError(this.provider, this.redact(`${this.provider} error${event.code ? ` (${event.code})` : ""}: ${event.message}`) ?? `${this.provider} error`, { responseBody: event.raw === void 0 ? void 0 : this.redact(JSON.stringify(event.raw)) }));
+				return;
+		}
+	}
+	/** Acknowledges the oldest outstanding commit; returns whether it carried audio. */
+	ackCommit() {
+		this.outstandingCommits = Math.max(0, this.outstandingCommits - 1);
+		return this.commitHadAudio.shift() ?? false;
+	}
+	async pump() {
+		if (this.pumping || !this.opened) return;
+		this.pumping = true;
+		try {
+			while (this.queue.length > 0 && !this.isTerminal()) {
+				await this.waitForDrain();
+				if (!await this.openTurnIfNeeded()) break;
+				const item = this.queue.shift();
+				if (!item || this.isTerminal()) {
+					if (item?.kind === "audio") item.reject(this.error ?? /* @__PURE__ */ new Error("Session closed"));
+					break;
+				}
+				if (item.kind === "commit") {
+					this.sendCommit(item.final);
+					continue;
+				}
+				this.queued -= item.bytes;
+				if (!this.send(this.init.protocol.appendMessage(item.base64))) {
+					item.reject(this.error ?? /* @__PURE__ */ new Error("Session closed"));
+					break;
+				}
+				this.totalBytes += item.bytes;
+				this.uncommittedBytes += item.bytes;
+				await this.waitForDrain();
+				if (this.error) item.reject(this.error);
+				else item.resolve();
+			}
+		} finally {
+			this.pumping = false;
+		}
+		this.checkEnded();
+	}
+	sendCommit(final) {
+		if (!(this.uncommittedBytes > 0 || final && this.init.protocol.endCommit === "always") || !this.padShortTurn()) return;
+		if (this.send(this.init.protocol.commitMessage({ final }))) {
+			this.commitHadAudio.push(this.uncommittedBytes > 0);
+			this.uncommittedBytes = 0;
+			this.outstandingCommits += 1;
+			this.turnOpen = false;
+		}
+	}
+	/**
+	* In a session with a turn limit, tops up a non-empty turn shorter than the
+	* protocol's `minCommitSeconds` with silence (not counted as streamed
+	* audio). Rollover can leave such a tail, which the provider would
+	* otherwise reject as empty and drop. Returns false when the send failed.
+	*/
+	padShortTurn() {
+		const minSeconds = this.init.protocol.minCommitSeconds;
+		if (!this.init.turnLimit || !minSeconds || this.uncommittedBytes === 0) return true;
+		const format = this.init.config.format;
+		const align = blockAlign(format);
+		const missing = Math.ceil(minSeconds * bytesPerSecond(format) / align - 1e-9) * align - this.uncommittedBytes;
+		if (missing <= 0) return true;
+		if (!this.send(this.init.protocol.appendMessage(encodeBase64(silence(missing, format))))) return false;
+		this.uncommittedBytes += missing;
+		return true;
+	}
+	/**
+	* For protocols with an explicit turn start: before the next audio, waits
+	* for every outstanding turn to be acknowledged, then opens a new turn. Like
+	* the end timeout, the wait is bounded by provider inactivity: it fails only
+	* after `timeoutMs` without any server message. Returns false when the
+	* session has failed.
+	*/
+	async openTurnIfNeeded() {
+		const start = this.init.protocol.turnStartMessage;
+		if (!start || this.turnOpen || this.queue[0]?.kind !== "audio") return true;
+		const waitStartedAt = Date.now();
+		while (!this.isTerminal() && this.outstandingCommits > 0) {
+			const lastActivity = Math.max(waitStartedAt, this.lastServerMessageAt);
+			if (Date.now() - lastActivity >= this.init.timeoutMs) {
+				this.fail(new SpeechProviderError(this.provider, `${this.provider} timed out after ${this.init.timeoutMs} ms without a server message while waiting for the previous turn to finish`));
+				break;
+			}
+			await new Promise((resolve) => setTimeout(resolve, DRAIN_POLL_MS));
+		}
+		if (this.isTerminal() || !this.send(start.call(this.init.protocol))) return false;
+		this.turnOpen = true;
+		return true;
+	}
+	/**
+	* Waits until the socket's send buffer is at or below `highWaterMark`. A
+	* socket that stays congested for `timeoutMs` fails the session, so a
+	* stalled connection can never leave `write()` pending forever.
+	*/
+	async waitForDrain() {
+		const deadline = Date.now() + this.init.timeoutMs;
+		while (!this.isTerminal() && this.socket && this.socket.bufferedAmount > this.init.highWaterMark) {
+			if (Date.now() >= deadline) {
+				this.fail(new SpeechProviderError(this.provider, `${this.provider} socket did not drain below highWaterMark within ${this.init.timeoutMs} ms`));
+				return;
+			}
+			await new Promise((resolve) => setTimeout(resolve, DRAIN_POLL_MS));
+		}
+	}
+	send(message) {
+		try {
+			this.socket?.send(JSON.stringify(message));
+			return true;
+		} catch (error) {
+			this.fail(toError(error, this.provider));
+			return false;
+		}
+	}
+	checkEnded() {
+		if (!this.endWaiter || this.isTerminal() || !this.opened || this.pumping || this.queue.length > 0 || this.outstandingCommits > 0 || this.pendingItems.size > 0) return;
+		clearTimeout(this.endTimer);
+		const waiter = this.endWaiter;
+		this.endWaiter = void 0;
+		waiter.resolve();
+	}
+	async finish() {
+		this.state = "closed";
+		this.cleanup();
+		this.closeSocket();
+		const ordered = [...this.finals].sort((left, right) => this.rank(left) - this.rank(right));
+		const segments = ordered.map((final) => final.text.trim()).filter(Boolean).map((text) => ({ text }));
+		const providerUsage = sumUsage(ordered.map((final) => final.providerUsage));
+		const durationSeconds = audioSecondsForBytes(this.totalBytes, this.init.config.format);
+		const usage = {
+			operation: "transcription",
+			provider: this.provider,
+			model: this.init.config.model,
+			audioSeconds: audioSecondsFromProviderUsage(providerUsage) ?? durationSeconds,
+			bytes: this.totalBytes,
+			providerUsage
+		};
+		const result = {
+			text: segments.map((segment) => segment.text).join(" "),
+			language: this.init.config.language,
+			durationSeconds,
+			segments,
+			provider: this.provider,
+			model: this.init.config.model,
+			raw: {
+				sessionId: this.sessionId,
+				finals: ordered.map((final) => final.raw)
+			},
+			usage
+		};
+		await reportSpeechUsage(usage, ...this.init.onUsage);
+		return result;
+	}
+	rank(final) {
+		const index = final.itemId ? this.itemOrder.indexOf(final.itemId) : -1;
+		return index >= 0 ? index : this.itemOrder.length + final.arrival;
+	}
+	onClose(event) {
+		clearTimeout(this.connectTimer);
+		if (!this.isTerminal()) {
+			const code = event.code ?? 1005;
+			this.fail(new SpeechProviderError(this.provider, `${this.provider} socket closed unexpectedly (code ${code}${event.reason ? `: ${this.redact(event.reason)}` : ""})`));
+		}
+		if (!this.closeEmitted) {
+			this.closeEmitted = true;
+			this.emit("close", {
+				code: event.code ?? 1005,
+				reason: this.redact(event.reason ?? "") ?? ""
+			});
+		}
+	}
+	fail(error) {
+		if (this.isTerminal()) return;
+		this.error = error;
+		this.state = "failed";
+		this.cleanup();
+		const queue = this.queue;
+		this.queue = [];
+		this.queued = 0;
+		for (const item of queue) if (item.kind === "audio") item.reject(error);
+		this.rejectReady(error);
+		const waiter = this.endWaiter;
+		this.endWaiter = void 0;
+		waiter?.reject(error);
+		this.emit("error", error);
+		this.closeSocket();
+	}
+	cleanup() {
+		clearTimeout(this.connectTimer);
+		clearTimeout(this.endTimer);
+		this.init.signal?.removeEventListener("abort", this.onAbort);
+	}
+	closeSocket() {
+		try {
+			this.socket?.close(1e3);
+		} catch {}
+	}
+	emit(event, payload) {
+		for (const listener of [...this.listeners.get(event) ?? []]) try {
+			listener(payload);
+		} catch (error) {
+			if (event !== "error" && event !== "close") this.fail(toError(error, this.provider));
+		}
+	}
+	isTerminal() {
+		return this.state === "closed" || this.state === "failed";
+	}
+	redact(text) {
+		let result = text;
+		for (const secret of this.secrets) result = redactSecret(result, secret);
+		return result;
+	}
+};
+/**
+* Throws when a turn cap is below the provider's minimum commit length:
+* padding a short turn up to that minimum would then exceed the cap.
+*/
+function assertTurnLimitFitsProtocol(protocol, limit) {
+	const minimum = protocol.minCommitSeconds;
+	if (limit && minimum && limit.maxTurnSeconds < minimum) throw new SpeechConfigurationError(`maxTurnSeconds (${limit.maxTurnSeconds}) is below ${protocol.provider}'s minimum commit of ${minimum} s`, protocol.provider);
+}
+function toError(value, provider) {
+	if (value instanceof Error) return value;
+	return new SpeechError(value === void 0 ? "Streaming session aborted" : String(value), "SPEECH_ABORTED", provider);
+}
+/**
+* Sums numeric fields of per-turn provider usage blocks (recursively), keeping
+* the first value of non-numeric fields such as `type`.
+*/
+function sumUsage(blocks) {
+	const present = blocks.filter((block) => Boolean(block) && typeof block === "object");
+	if (present.length === 0) return;
+	const total = {};
+	for (const block of present) for (const [key, value] of Object.entries(block)) {
+		const current = total[key];
+		if (typeof value === "number") total[key] = (typeof current === "number" ? current : 0) + value;
+		else if (value && typeof value === "object" && !Array.isArray(value)) total[key] = sumUsage([current, value]);
+		else if (current === void 0) total[key] = value;
+	}
+	return total;
+}
+//#endregion
+//#region src/adapters/openai-realtime.ts
+/**
+* OpenAI Realtime transcription adapter (`openai-realtime`).
+*
+* Targets the GA Realtime API transcription session (no `OpenAI-Beta`
+* header): connect to `wss://api.openai.com/v1/realtime?intent=transcription`,
+* send `session.update` with `session.type: "transcription"`, stream
+* `input_audio_buffer.append`, and read
+* `conversation.item.input_audio_transcription.delta` / `.completed`.
+* Reference: https://developers.openai.com/api/docs/guides/realtime-transcription
+* and https://developers.openai.com/api/reference/resources/realtime/client-events
+*/
+var ADAPTER$1 = "openai-realtime";
+var OPENAI_REALTIME_DEFAULT_URL = "wss://api.openai.com/v1/realtime";
+var OPENAI_REALTIME_DEFAULT_MODEL = "gpt-4o-transcribe";
+/** GA realtime input formats: 24 kHz mono PCM16, or 8 kHz mono G.711. */
+var WIRE_FORMATS = {
+	pcm16: {
+		type: "audio/pcm",
+		sampleRate: 24e3
+	},
+	g711_ulaw: {
+		type: "audio/pcmu",
+		sampleRate: 8e3
+	},
+	g711_alaw: {
+		type: "audio/pcma",
+		sampleRate: 8e3
+	}
+};
+/** The OpenAI Realtime transcription wire protocol. */
+var openAIRealtimeProtocol = (extras = {}) => ({
+	provider: ADAPTER$1,
+	commitAck: "committed",
+	endCommit: "if-audio",
+	minCommitSeconds: .1,
+	sessionMessages(config) {
+		return [{
+			type: "session.update",
+			session: openAIRealtimeTranscriptionSession(config, extras)
+		}];
+	},
+	appendMessage(base64Audio) {
+		return {
+			type: "input_audio_buffer.append",
+			audio: base64Audio
+		};
+	},
+	commitMessage() {
+		return { type: "input_audio_buffer.commit" };
+	},
+	parse: parseOpenAIRealtimeEvent
+});
+/**
+* The GA transcription session object (`session.type: "transcription"`),
+* shared by `session.update` and the client-secret mint request.
+*/
+function openAIRealtimeTranscriptionSession(config, extras = {}) {
+	const input = {
+		format: config.format.encoding === "pcm16" ? {
+			type: "audio/pcm",
+			rate: config.format.sampleRate
+		} : { type: WIRE_FORMATS[config.format.encoding].type },
+		transcription: {
+			...compactJson(extras.transcriptionOptions ?? {}),
+			...compactJson({
+				model: config.model,
+				language: config.language,
+				prompt: config.prompt
+			})
+		},
+		turn_detection: turnDetectionToWire(config.turnDetection)
+	};
+	if (extras.noiseReduction) input.noise_reduction = { type: extras.noiseReduction };
+	return compactJson({
+		type: "transcription",
+		audio: { input },
+		include: extras.include
+	});
+}
+/** Maps one OpenAI Realtime server event to normalised session events. */
+function parseOpenAIRealtimeEvent(message) {
+	if (!message || typeof message !== "object") return [];
+	const event = message;
+	const itemId = stringField(event, "item_id");
+	switch (event.type) {
+		case "session.created":
+		case "session.updated":
+		case "transcription_session.created":
+		case "transcription_session.updated": {
+			const session = event.session;
+			return [{
+				type: "session",
+				sessionId: session && stringField(session, "id")
+			}];
+		}
+		case "input_audio_buffer.committed": return [{
+			type: "committed",
+			itemId
+		}];
+		case "input_audio_buffer.speech_started": return [{
+			type: "speech_started",
+			itemId,
+			audioMs: numberField(event, "audio_start_ms")
+		}];
+		case "input_audio_buffer.speech_stopped": return [{
+			type: "speech_stopped",
+			itemId,
+			audioMs: numberField(event, "audio_end_ms")
+		}];
+		case "conversation.item.input_audio_transcription.delta": {
+			const delta = stringField(event, "delta");
+			return delta ? [{
+				type: "partial",
+				itemId,
+				delta
+			}] : [];
+		}
+		case "conversation.item.input_audio_transcription.completed": {
+			const usage = event.usage;
+			return [{
+				type: "final",
+				itemId,
+				text: stringField(event, "transcript") ?? "",
+				providerUsage: usage && typeof usage === "object" && !Array.isArray(usage) ? usage : void 0,
+				raw: event
+			}];
+		}
+		case "conversation.item.input_audio_transcription.failed": {
+			const error = event.error ?? {};
+			return [{
+				type: "error",
+				message: stringField(error, "message") ?? "transcription failed",
+				code: stringField(error, "code"),
+				raw: event
+			}];
+		}
+		case "error": {
+			const error = event.error ?? {};
+			const code = stringField(error, "code");
+			if (code === "input_audio_buffer_commit_empty") return [{ type: "commit_empty" }];
+			return [{
+				type: "error",
+				message: stringField(error, "message") ?? "unknown error",
+				code,
+				raw: event
+			}];
+		}
+		default: return [];
+	}
+}
+/**
+* Realtime transcriber for OpenAI and OpenAI-Realtime-compatible servers.
+*
+* Auth: `apiKey` is sent as `Authorization: Bearer` (Node only). In browsers,
+* pass `clientSecret` (an ephemeral client secret minted by your server); it
+* is sent as the `openai-insecure-api-key.<secret>` subprotocol. Supplying
+* `apiKey` or `headers` in a browser throws.
+*/
+var OpenAIRealtimeTranscriber = class {
+	type = ADAPTER$1;
+	audioFormat;
+	options;
+	url;
+	createWebSocket;
+	protocol;
+	constructor(options = {}) {
+		assertNoBrowserApiKey(ADAPTER$1, options.apiKey);
+		this.options = options;
+		this.url = resolveRealtimeUrl(options.baseUrl ?? "wss://api.openai.com/v1/realtime");
+		this.createWebSocket = resolveWebSocketFactory(ADAPTER$1, options);
+		this.audioFormat = resolveOpenAIRealtimeFormat(options.format);
+		this.protocol = openAIRealtimeProtocol(options);
+		resolveTurnLimit(ADAPTER$1, void 0, options);
+	}
+	/**
+	* A turn limit applies only to `manual` sessions with `maxTurnSeconds` set;
+	* under server or semantic VAD the provider ends turns itself.
+	*/
+	turnLimit(options = {}) {
+		return describeTurnLimit(this.resolveTurnLimit(options), this.sessionFormat(options));
+	}
+	sessionFormat(options) {
+		return resolveOpenAIRealtimeFormat(options.format?.encoding && options.format.encoding !== this.audioFormat.encoding ? options.format : {
+			...this.audioFormat,
+			...options.format
+		});
+	}
+	resolveTurnLimit(options) {
+		const limit = resolveTurnLimit(ADAPTER$1, this.protocol.maxTurnSeconds, options, this.options);
+		if (this.turnDetection(options).type !== "manual") return;
+		assertTurnLimitFitsProtocol(this.protocol, limit);
+		return limit;
+	}
+	turnDetection(options) {
+		return options.turnDetection ?? this.options.turnDetection ?? { type: "server_vad" };
+	}
+	start(options = {}) {
+		const format = this.sessionFormat(options);
+		const connect = realtimeConnector({
+			adapter: ADAPTER$1,
+			url: this.url,
+			apiKey: this.options.apiKey,
+			headers: mergeHeaderRecords(this.options.headers, options.headers),
+			clientSecret: options.clientSecret ?? this.options.clientSecret,
+			protocols: (secret) => secret ? ["realtime", `${CLIENT_SECRET_SUBPROTOCOL_PREFIX}${secret}`] : ["realtime"]
+		});
+		return new RealtimeTranscriptionSession({
+			protocol: this.protocol,
+			config: {
+				model: options.model?.trim() || this.options.model?.trim() || "gpt-4o-transcribe",
+				format,
+				turnDetection: this.turnDetection(options),
+				language: options.language ?? this.options.language,
+				prompt: options.prompt ?? this.options.prompt
+			},
+			connect,
+			createWebSocket: this.createWebSocket,
+			timeoutMs: this.options.timeoutMs ?? 3e4,
+			connectTimeoutMs: this.options.connectTimeoutMs ?? 1e4,
+			highWaterMark: this.options.highWaterMark ?? 1048576,
+			maxBufferedBytes: this.options.maxBufferedBytes ?? 16777216,
+			signal: options.signal,
+			onUsage: [this.options.onUsage, options.onUsage],
+			turnLimit: this.resolveTurnLimit(options)
+		});
+	}
+};
+/**
+* Resolves a realtime WebSocket URL: `http(s)` becomes `ws(s)`, a server root
+* gets `/v1/realtime`, a versioned API root gets `/realtime`, and
+* `intent=transcription` is added unless an `intent` is already present. No
+* `model` query parameter is added: the model travels in `session.update`.
+*/
+function resolveRealtimeUrl(baseUrl) {
+	const url = new URL(toWebSocketUrl(resolveOpenAICompatibleUrl(baseUrl, "realtime"), ADAPTER$1));
+	if (!url.searchParams.has("intent")) url.searchParams.set("intent", "transcription");
+	return url.toString();
+}
+function resolveOpenAIRealtimeFormat(format) {
+	const encoding = format?.encoding ?? "pcm16";
+	const wire = WIRE_FORMATS[encoding];
+	if (!wire) throw new SpeechConfigurationError(`openai-realtime does not support encoding ${String(encoding)}`, ADAPTER$1);
+	const resolved = {
+		encoding,
+		sampleRate: format?.sampleRate ?? wire.sampleRate,
+		channels: format?.channels ?? 1
+	};
+	if (resolved.sampleRate !== wire.sampleRate || resolved.channels !== 1) throw new SpeechConfigurationError(`openai-realtime requires ${encoding} at ${wire.sampleRate} Hz mono (got ${resolved.sampleRate} Hz, ${resolved.channels} channel(s)); resample before streaming`, ADAPTER$1);
+	return resolved;
+}
+function turnDetectionToWire(turnDetection) {
+	switch (turnDetection.type) {
+		case "manual": return null;
+		case "server_vad": return compactJson({
+			type: "server_vad",
+			threshold: turnDetection.threshold,
+			prefix_padding_ms: turnDetection.prefixPaddingMs,
+			silence_duration_ms: turnDetection.silenceDurationMs
+		});
+		case "semantic_vad": return compactJson({
+			type: "semantic_vad",
+			eagerness: turnDetection.eagerness
+		});
+		default: throw new SpeechConfigurationError(`Unknown turn detection type: ${String(turnDetection.type)}`, ADAPTER$1);
+	}
+}
+function stringField(record, key) {
+	const value = record[key];
+	return typeof value === "string" ? value : void 0;
+}
+function numberField(record, key) {
+	const value = record[key];
+	return typeof value === "number" ? value : void 0;
+}
+//#endregion
+//#region src/adapters/voxtral-realtime.ts
+/**
+* vLLM realtime transcription adapter (`voxtral-realtime`), for Mistral's
+* Voxtral Realtime models (e.g. `mistralai/Voxtral-Mini-4B-Realtime-2602`)
+* served by vLLM at `/v1/realtime`.
+*
+* vLLM's protocol borrows OpenAI event names but is not OpenAI-compatible.
+* Verified against vLLM's `entrypoints/speech_to_text/realtime` source and a
+* live server:
+*
+* 1. The server sends `session.created` (`{ id, created }`) on connect.
+* 2. The client sends `session.update` with a top-level `model` (no nested
+*    `session` object, no acknowledgement; an unknown model yields an
+*    `error` with code `model_not_found`).
+* 3. A non-final `input_audio_buffer.commit` starts generation for a turn.
+* 4. `input_audio_buffer.append` carries base64 PCM16 at 16 kHz mono. Audio
+*    appended before the start commit is kept.
+* 5. The server streams `transcription.delta` (`{ delta }`, often empty) while
+*    audio arrives, at roughly real-time speed.
+* 6. `input_audio_buffer.commit` with `final: true` ends the turn; the server
+*    replies `transcription.done` (`{ text, usage }`, token usage only) and
+*    clears its buffer. A further start commit opens the next turn on the same
+*    socket.
+* 7. Errors arrive as `{ type: 'error', error: string, code }` and leave the
+*    socket open; this adapter treats every error as fatal.
+* 8. A turn whose audio and tokens exceed `max_model_len` (~12.5 tokens per
+*    audio second plus a 39-token prompt) ends in `error` `processing_error`
+*    and can take the engine down. The limit is per turn: after a final
+*    commit vLLM clears the turn's context. The session therefore rolls over
+*    to a new turn before `maxTurnSeconds` (default 270) of audio.
+* 9. A stray final commit leaves a stale end marker: the next turn ends at once
+*    with `prompt_tokens: 1` (any audio costs 39) and its audio is dropped.
+*    The session fails closed on that, and on any `done` for a turn it did
+*    not commit, rather than losing audio silently.
+*/
+var ADAPTER = "voxtral-realtime";
+/** vLLM's default served model name for Voxtral Mini Realtime. */
+var VOXTRAL_REALTIME_DEFAULT_MODEL = "mistralai/Voxtral-Mini-4B-Realtime-2602";
+/** The only input format vLLM's realtime endpoint accepts. */
+var VOXTRAL_REALTIME_AUDIO_FORMAT = Object.freeze({
+	encoding: "pcm16",
+	sampleRate: 16e3,
+	channels: 1
+});
+/** The vLLM realtime wire protocol. */
+var voxtralRealtimeProtocol = () => ({
+	provider: ADAPTER,
+	commitAck: "final",
+	endCommit: "if-audio",
+	maxTurnSeconds: 270,
+	sessionMessages(config) {
+		return [{
+			type: "session.update",
+			model: config.model
+		}];
+	},
+	turnStartMessage() {
+		return { type: "input_audio_buffer.commit" };
+	},
+	appendMessage(base64Audio) {
+		return {
+			type: "input_audio_buffer.append",
+			audio: base64Audio
+		};
+	},
+	commitMessage() {
+		return {
+			type: "input_audio_buffer.commit",
+			final: true
+		};
+	},
+	parse: parseVoxtralRealtimeEvent
+});
+/** Maps one vLLM realtime server event to normalised session events. */
+function parseVoxtralRealtimeEvent(message) {
+	if (!message || typeof message !== "object") return [];
+	const event = message;
+	switch (event.type) {
+		case "session.created": return [{
+			type: "session",
+			sessionId: typeof event.id === "string" ? event.id : void 0
+		}];
+		case "transcription.delta": {
+			const delta = typeof event.delta === "string" ? event.delta : "";
+			return delta ? [{
+				type: "partial",
+				delta
+			}] : [];
+		}
+		case "transcription.done": {
+			const usage = event.usage && typeof event.usage === "object" && !Array.isArray(event.usage) ? event.usage : void 0;
+			const promptTokens = usage?.prompt_tokens;
+			return [{
+				type: "final",
+				text: typeof event.text === "string" ? event.text.trim() : "",
+				providerUsage: usage,
+				raw: event,
+				audioConsumed: typeof promptTokens === "number" ? promptTokens > 1 : void 0
+			}];
+		}
+		case "error": return [{
+			type: "error",
+			message: typeof event.error === "string" ? event.error : "unknown error",
+			code: typeof event.code === "string" ? event.code : void 0,
+			raw: event
+		}];
+		default: return [];
+	}
+}
+/**
+* Realtime transcriber for Voxtral Realtime served by vLLM.
+*
+* - Audio: PCM16, 16 kHz, mono only; write whole samples (even byte counts).
+* - Turns: manual only. vLLM has no VAD; it streams partials continuously and
+*   produces one final per `commit()` / `end()`, plus one per automatic
+*   rollover when a turn reaches `maxTurnSeconds` (default 270).
+* - `language` and `prompt` are not sent: vLLM's realtime session accepts
+*   only `model`.
+* - Auth: `apiKey` → `Authorization: Bearer` (Node only). vLLM has no
+*   ephemeral tokens, so browsers must connect through the consumer's own
+*   proxy or token gateway, passing that gateway's short-lived `clientSecret`
+*   (sent as the `openai-insecure-api-key.<secret>` subprotocol next to
+*   `realtime`; the gateway must echo `realtime`).
+*/
+var VoxtralRealtimeTranscriber = class {
+	type = ADAPTER;
+	audioFormat = { ...VOXTRAL_REALTIME_AUDIO_FORMAT };
+	options;
+	url;
+	createWebSocket;
+	protocol = voxtralRealtimeProtocol();
+	constructor(options = {}) {
+		assertNoBrowserApiKey(ADAPTER, options.apiKey);
+		if (!options.baseUrl?.trim()) throw new SpeechConfigurationError("voxtral-realtime requires baseUrl (the vLLM server, e.g. http://localhost:8000 or its /v1 root)", ADAPTER);
+		this.options = options;
+		this.url = resolveVoxtralRealtimeUrl(options.baseUrl);
+		this.createWebSocket = resolveWebSocketFactory(ADAPTER, options);
+		assertFormat(options.format);
+		assertTurnDetection(options.turnDetection);
+		this.resolveTurnLimit();
+	}
+	turnLimit(options = {}) {
+		assertFormat(options.format);
+		return describeTurnLimit(this.resolveTurnLimit(options), VOXTRAL_REALTIME_AUDIO_FORMAT);
+	}
+	resolveTurnLimit(options = {}) {
+		return resolveTurnLimit(ADAPTER, this.protocol.maxTurnSeconds, options, this.options);
+	}
+	start(options = {}) {
+		assertFormat(options.format);
+		assertTurnDetection(options.turnDetection);
+		const turnLimit = this.resolveTurnLimit(options);
+		const connect = realtimeConnector({
+			adapter: ADAPTER,
+			url: this.url,
+			apiKey: this.options.apiKey,
+			headers: mergeHeaderRecords(this.options.headers, options.headers),
+			clientSecret: options.clientSecret ?? this.options.clientSecret,
+			protocols: (secret) => secret ? ["realtime", `${CLIENT_SECRET_SUBPROTOCOL_PREFIX}${secret}`] : []
+		});
+		return new RealtimeTranscriptionSession({
+			protocol: this.protocol,
+			config: {
+				model: options.model?.trim() || this.options.model?.trim() || "mistralai/Voxtral-Mini-4B-Realtime-2602",
+				format: { ...VOXTRAL_REALTIME_AUDIO_FORMAT },
+				turnDetection: { type: "manual" },
+				language: options.language ?? this.options.language
+			},
+			connect,
+			createWebSocket: this.createWebSocket,
+			timeoutMs: this.options.timeoutMs ?? 3e4,
+			connectTimeoutMs: this.options.connectTimeoutMs ?? 1e4,
+			highWaterMark: this.options.highWaterMark ?? 1048576,
+			maxBufferedBytes: this.options.maxBufferedBytes ?? 16777216,
+			signal: options.signal,
+			onUsage: [this.options.onUsage, options.onUsage],
+			turnLimit
+		});
+	}
+};
+/**
+* Resolves vLLM's realtime WebSocket URL: `http(s)` becomes `ws(s)`, a server
+* root gets `/v1/realtime`, a versioned API root (e.g. a gateway's
+* `/stt/v1`) gets `/realtime`, and a URL ending in `/realtime` is kept.
+*/
+function resolveVoxtralRealtimeUrl(baseUrl) {
+	return toWebSocketUrl(resolveOpenAICompatibleUrl(baseUrl, "realtime"), ADAPTER);
+}
+function assertFormat(format) {
+	const expected = VOXTRAL_REALTIME_AUDIO_FORMAT;
+	if (format && (format.encoding !== void 0 && format.encoding !== expected.encoding || format.sampleRate !== void 0 && format.sampleRate !== expected.sampleRate || format.channels !== void 0 && format.channels !== expected.channels)) throw new SpeechConfigurationError(`voxtral-realtime requires pcm16 at 16000 Hz mono (got ${format.encoding ?? "pcm16"} at ${format.sampleRate ?? 16e3} Hz, ${format.channels ?? 1} channel(s)); resample before streaming`, ADAPTER);
+}
+function assertTurnDetection(turnDetection) {
+	if (turnDetection && turnDetection.type !== "manual") throw new SpeechConfigurationError(`voxtral-realtime has no server turn detection (got ${turnDetection.type}); use manual turns with commit()/end()`, ADAPTER);
+}
+//#endregion
 //#region src/adapters/openai-compatible.ts
 var OpenAICompatibleSpeechSynthesizer = class extends HttpSpeechAdapter {
 	type = "openai-compatible";
+	/** Explicit override, resolved relative to `baseUrl` (or absolute). */
 	speechPath;
 	defaultModel;
 	defaultVoice;
 	constructor(options) {
 		super(options);
-		this.speechPath = options.speechPath ?? "/v1/audio/speech";
+		this.speechPath = options.speechPath;
 		this.defaultModel = options.defaultModel ?? "tts-1";
 		this.defaultVoice = options.defaultVoice ?? "alloy";
 	}
@@ -301,7 +1937,8 @@ var OpenAICompatibleSpeechSynthesizer = class extends HttpSpeechAdapter {
 			response_format: outputFormat,
 			speed: request.speed
 		});
-		const speech = await this.post(this.type, this.speechPath, {
+		const endpoint = this.speechPath ?? resolveOpenAICompatibleUrl(this.baseUrl, "audio/speech");
+		const speech = await this.post(this.type, endpoint, {
 			headers: { "content-type": "application/json" },
 			body: JSON.stringify(payload),
 			signal: request.signal
@@ -314,6 +1951,118 @@ var OpenAICompatibleSpeechSynthesizer = class extends HttpSpeechAdapter {
 	}
 };
 //#endregion
+//#region src/adapters/openai-compatible-transcriber.ts
+var DEFAULT_MODEL = "whisper-1";
+/**
+* Models that only accept `json`/`text` and reject `verbose_json` and
+* `timestamp_granularities[]` (e.g. `gpt-4o-transcribe`,
+* `gpt-4o-mini-transcribe`, optionally gateway-prefixed like
+* `openai/gpt-4o-transcribe`).
+*/
+var JSON_ONLY_MODEL = /(^|\/)gpt-4o[\w.-]*-transcribe/i;
+/** Provider 400/422 bodies that indicate an unsupported format option. */
+var UNSUPPORTED_FORMAT_ERROR = /verbose_json|response_format|timestamp_granularit/i;
+function isJsonOnlyTranscriptionModel(model) {
+	return JSON_ONLY_MODEL.test(model);
+}
+/**
+* OpenAI-compatible speech-to-text adapter (`POST <base>/audio/transcriptions`).
+* Works with OpenAI, Groq, Fireworks, LiteLLM/Bifrost gateways, vLLM,
+* speaches/faster-whisper-server, and whisper.cpp server.
+*
+* Server-side only: the adapter holds the API key.
+*/
+var OpenAICompatibleTranscriber = class extends HttpSpeechAdapter {
+	type = "openai-compatible";
+	endpoint;
+	model;
+	responseFormat;
+	maxBytes;
+	retry;
+	onUsage;
+	constructor(options) {
+		super(options);
+		this.endpoint = resolveOpenAICompatibleUrl(options.baseUrl, "audio/transcriptions");
+		this.model = options.model?.trim() || DEFAULT_MODEL;
+		this.responseFormat = options.responseFormat;
+		this.maxBytes = options.maxBytes ?? 26214400;
+		this.retry = resolveRetryOptions(options.retry);
+		this.onUsage = options.onUsage;
+	}
+	async transcribe(request) {
+		const audio = await normalizeAudioInput(request.audio, {
+			mimeType: request.mimeType,
+			maxBytes: request.maxBytes ?? this.maxBytes,
+			adapter: this.type,
+			signal: request.signal
+		});
+		const wire = this.resolveWireOptions(request);
+		const send = (options) => {
+			const form = new FormData();
+			form.append("file", audio.blob, audio.filename);
+			form.set("model", options.model);
+			appendOptionalFormValue(form, "language", request.language);
+			appendOptionalFormValue(form, "prompt", request.prompt);
+			appendOptionalFormValue(form, "temperature", request.temperature);
+			form.set("response_format", options.responseFormat);
+			for (const granularity of options.timestampGranularities ?? []) form.append("timestamp_granularities[]", granularity);
+			return this.post(this.type, this.endpoint, {
+				body: form,
+				headers: request.headers,
+				signal: request.signal
+			}, (response) => readTranscriptResponse(response, this.type), this.retry);
+		};
+		let transcript;
+		try {
+			transcript = await send(wire);
+		} catch (error) {
+			if (!isUnsupportedFormatError(error, wire)) throw error;
+			transcript = await send({
+				model: wire.model,
+				responseFormat: "json"
+			});
+		}
+		const providerUsage = extractProviderUsage(transcript.raw);
+		const usage = {
+			operation: "transcription",
+			provider: this.type,
+			model: transcript.model ?? wire.model,
+			audioSeconds: transcript.durationSeconds ?? audioSecondsFromProviderUsage(providerUsage) ?? audio.durationSeconds,
+			bytes: audio.bytes,
+			providerUsage
+		};
+		const result = {
+			...transcript,
+			text: transcript.raw === void 0 ? transcript.text.trim() : transcript.text,
+			provider: this.type,
+			model: transcript.model ?? wire.model,
+			usage
+		};
+		await reportSpeechUsage(usage, this.onUsage, request.onUsage);
+		return result;
+	}
+	resolveWireOptions(request) {
+		const model = request.model?.trim() || this.model;
+		const jsonOnly = isJsonOnlyTranscriptionModel(model);
+		let responseFormat = request.responseFormat ?? this.responseFormat ?? (jsonOnly ? "json" : "verbose_json");
+		if (jsonOnly && responseFormat === "verbose_json") responseFormat = "json";
+		const timestampGranularities = responseFormat === "verbose_json" && request.timestampGranularities?.length ? [...new Set(request.timestampGranularities)] : void 0;
+		return {
+			model,
+			responseFormat,
+			timestampGranularities
+		};
+	}
+};
+function isUnsupportedFormatError(error, wire) {
+	return error instanceof SpeechProviderError && (error.status === 400 || error.status === 422) && (wire.responseFormat === "verbose_json" || Boolean(wire.timestampGranularities?.length)) && UNSUPPORTED_FORMAT_ERROR.test(error.responseBody ?? "");
+}
+function extractProviderUsage(raw) {
+	if (!raw || typeof raw !== "object") return;
+	const usage = raw.usage;
+	return usage && typeof usage === "object" && !Array.isArray(usage) ? usage : void 0;
+}
+//#endregion
 //#region src/adapters/qwen3.ts
 var Qwen3SpeechSynthesizer = class extends HttpSpeechAdapter {
 	type = "qwen3-tts";
@@ -349,11 +2098,19 @@ var StudioServerTranscriber = class extends HttpSpeechAdapter {
 		this.transcribePath = options.transcribePath ?? "/v1/transcribe";
 	}
 	async transcribe(request) {
+		const audio = await normalizeAudioInput(request.audio, {
+			mimeType: request.mimeType,
+			maxBytes: request.maxBytes,
+			adapter: this.type,
+			signal: request.signal,
+			deriveExtension: false
+		});
 		const form = new FormData();
-		appendAudioInput(form, request.audio);
+		form.append("audio", audio.blob, audio.filename);
 		appendOptionalFormValue(form, "language", request.language);
 		return this.post(this.type, this.transcribePath, {
 			body: form,
+			headers: request.headers,
 			signal: request.signal
 		}, (response) => readTranscriptResponse(response, this.type));
 	}
@@ -376,6 +2133,143 @@ var StudioServerSpeechSynthesizer = class extends HttpSpeechAdapter {
 	}
 };
 //#endregion
+//#region src/shared/streaming-factory.ts
+/**
+* Streaming transcriber factory, environment configuration, and the
+* record-then-send `Transcriber` wrapper.
+*/
+/** Streaming adapters `getStreamingTranscriber()` can build. */
+var STREAMING_TRANSCRIBER_TYPES = ["openai-realtime", "voxtral-realtime"];
+/** Environment variable names read for each streaming setting, in priority order. */
+var STREAMING_TRANSCRIBER_ENV_KEYS = {
+	type: ["HAVE_SPEECH_STREAMING_TYPE"],
+	baseUrl: ["HAVE_SPEECH_STREAMING_BASE_URL"],
+	model: ["HAVE_SPEECH_STREAMING_MODEL"],
+	apiKey: ["HAVE_SPEECH_STREAMING_API_KEY"],
+	language: ["HAVE_SPEECH_STREAMING_LANGUAGE"],
+	turnDetection: ["HAVE_SPEECH_STREAMING_TURN_DETECTION"],
+	timeoutMs: ["HAVE_SPEECH_STREAMING_TIMEOUT", "HAVE_SPEECH_STREAMING_TIMEOUT_MS"],
+	connectTimeoutMs: ["HAVE_SPEECH_STREAMING_CONNECT_TIMEOUT_MS"],
+	headers: ["HAVE_SPEECH_STREAMING_HEADERS"],
+	maxTurnSeconds: ["HAVE_SPEECH_STREAMING_MAX_TURN_SECONDS"]
+};
+function isStreamingTranscriberType(type) {
+	return type !== void 0 && STREAMING_TRANSCRIBER_TYPES.includes(type);
+}
+/**
+* Creates a realtime streaming transcriber. Explicit options win over
+* `HAVE_SPEECH_STREAMING_*` environment variables. The type defaults to
+* `openai-realtime`.
+*/
+function getStreamingTranscriber(options = {}, context = {}) {
+	const env = context.env ?? defaultEnv();
+	const keys = STREAMING_TRANSCRIBER_ENV_KEYS;
+	const type = options.type ?? readEnv(env, ...keys.type) ?? "openai-realtime";
+	if (!isStreamingTranscriberType(type)) throw new InvalidSpeechAdapterError(type, "streaming STT");
+	const headers = mergeHeaderInits(parseHeadersEnv(env, keys.headers), context.headers, options.headers);
+	const resolved = {
+		...options,
+		type,
+		baseUrl: (options.baseUrl ?? readEnv(env, ...keys.baseUrl))?.trim(),
+		model: options.model ?? readEnv(env, ...keys.model),
+		apiKey: options.apiKey ?? readEnv(env, ...keys.apiKey),
+		language: options.language ?? readEnv(env, ...keys.language),
+		turnDetection: options.turnDetection ?? parseTurnDetection(readEnv(env, ...keys.turnDetection)),
+		timeoutMs: options.timeoutMs ?? parseOptionalInteger(readEnv(env, ...keys.timeoutMs)),
+		connectTimeoutMs: options.connectTimeoutMs ?? parseOptionalInteger(readEnv(env, ...keys.connectTimeoutMs)),
+		maxTurnSeconds: options.maxTurnSeconds ?? parseMaxTurnSeconds(readEnv(env, ...keys.maxTurnSeconds)),
+		headers
+	};
+	switch (type) {
+		case "openai-realtime": return new OpenAIRealtimeTranscriber({
+			...resolved,
+			type
+		});
+		case "voxtral-realtime": return new VoxtralRealtimeTranscriber({
+			...resolved,
+			type
+		});
+		default: throw new InvalidSpeechAdapterError(type, "streaming STT");
+	}
+}
+function parseTurnDetection(value) {
+	if (!value) return;
+	const normalized = value.toLowerCase();
+	if (normalized === "server_vad" || normalized === "semantic_vad") return { type: normalized };
+	if (normalized === "manual" || normalized === "none") return { type: "manual" };
+	throw new SpeechConfigurationError("HAVE_SPEECH_STREAMING_TURN_DETECTION must be server_vad, semantic_vad, or manual");
+}
+/**
+* Parses `HAVE_SPEECH_STREAMING_MAX_TURN_SECONDS`: a positive number of
+* seconds, or `Infinity` for no limit.
+*/
+function parseMaxTurnSeconds(value) {
+	if (!value) return;
+	const parsed = Number(value);
+	if (Number.isNaN(parsed) || parsed <= 0) throw new SpeechConfigurationError("HAVE_SPEECH_STREAMING_MAX_TURN_SECONDS must be a positive number of seconds or Infinity");
+	return parsed;
+}
+/**
+* Adapts a streaming transcriber to the request/response `Transcriber`
+* interface for record-then-send callers. Each `transcribe()` opens one
+* session, streams the recording, and returns `session.end()`.
+*
+* Input must be raw audio: a PCM16/G.711 WAV file, `audio/pcm` or
+* `audio/L16` (optionally with `rate`/`channels` parameters), `audio/pcmu`,
+* `audio/pcma`, or untyped bytes in the adapter's default format. WAV headers
+* and MIME parameters set the session format; compressed recordings are
+* rejected, so use an HTTP transcriber for WebM/MP4/Ogg.
+*
+* A clip longer than the adapter's per-turn limit (`maxTurnSeconds`) is
+* never sent as one turn: with rollover (the default) the session splits it
+* into several turns at quiet boundaries, and with `rollover: false` the clip
+* is rejected with `SPEECH_TURN_TOO_LONG` before connecting.
+*/
+function wrapStreamingTranscriber(streaming, options = {}) {
+	const chunkBytes = options.chunkBytes ?? 64 * 1024;
+	if (!Number.isInteger(chunkBytes) || chunkBytes <= 0) throw new SpeechConfigurationError("chunkBytes must be a positive integer", streaming.type);
+	return {
+		type: streaming.type,
+		async transcribe(request) {
+			const audio = await normalizeAudioInput(request.audio, {
+				mimeType: request.mimeType,
+				maxBytes: request.maxBytes ?? options.maxBytes ?? 26214400,
+				adapter: streaming.type,
+				signal: request.signal,
+				deriveExtension: false
+			});
+			const raw = unwrapRawAudio(new Uint8Array(await audio.blob.arrayBuffer()), audio.mimeType, streaming.type);
+			const declared = request.audio && typeof request.audio === "object" && "data" in request.audio ? request.audio : void 0;
+			const format = {
+				...raw.format,
+				sampleRate: raw.format.sampleRate ?? declared?.sampleRate,
+				channels: raw.format.channels ?? declared?.channels
+			};
+			const sessionOptions = {
+				format: Object.fromEntries(Object.entries(format).filter(([, value]) => value !== void 0)),
+				language: request.language,
+				model: request.model,
+				prompt: request.prompt,
+				headers: request.headers,
+				signal: request.signal,
+				onUsage: request.onUsage,
+				metadata: request.metadata,
+				turnDetection: options.turnDetection ?? { type: "manual" }
+			};
+			const limit = streaming.turnLimit?.(sessionOptions);
+			if (limit && !limit.rollover && raw.bytes.byteLength > limit.maxTurnBytes) throw new SpeechError(`The recording is longer than one turn may be (maxTurnSeconds ${limit.maxTurnSeconds} s) and rollover is disabled; enable rollover or split the recording`, "SPEECH_TURN_TOO_LONG", streaming.type);
+			const session = streaming.start(sessionOptions);
+			try {
+				for (let offset = 0; offset < raw.bytes.byteLength; offset += chunkBytes) await session.write(raw.bytes.subarray(offset, offset + chunkBytes));
+			} catch (error) {
+				session.abort(error);
+				throw error;
+			}
+			return session.end();
+		}
+	};
+}
+//#endregion
 //#region src/shared/factory.ts
 /**
 * Creates a speech service from explicit options and/or environment variables.
@@ -401,9 +2295,14 @@ async function getSpeech(options = {}, context = {}) {
 	};
 }
 async function getTranscriber(options = {}, context = {}) {
+	const streamingType = options.type ?? readEnv(context.env ?? defaultEnv(), ...TRANSCRIBER_ENV_KEYS.type);
+	if (isStreamingTranscriberType(streamingType)) return getWrappedStreamingTranscriber(streamingType, options, context);
+	const optional = await getRegisteredTranscriber(options, context);
+	if (optional) return optional;
 	const resolved = normalizeTranscriberOptions(options, context);
 	switch (resolved.type) {
 		case "studio-server": return new StudioServerTranscriber(resolved);
+		case "openai-compatible": return new OpenAICompatibleTranscriber(resolved);
 		default: throw new InvalidSpeechAdapterError(resolved.type ?? "unknown", "STT");
 	}
 }
@@ -418,7 +2317,13 @@ async function getSpeechSynthesizer(options, context = {}) {
 }
 function getAvailableSpeechAdapters() {
 	return {
-		transcribers: ["studio-server"],
+		transcribers: [
+			"studio-server",
+			"openai-compatible",
+			...registeredOptionalTranscribers(),
+			...STREAMING_TRANSCRIBER_TYPES
+		],
+		streamingTranscribers: [...STREAMING_TRANSCRIBER_TYPES],
 		synthesizers: [
 			"studio-server",
 			"qwen3-tts",
@@ -426,6 +2331,43 @@ function getAvailableSpeechAdapters() {
 		]
 	};
 }
+/**
+* Builds a streaming adapter from `getTranscriber()` options and wraps it as
+* a record-then-send `Transcriber`. Settings come from explicit options, then
+* `options.streaming`, then `HAVE_SPEECH_STREAMING_*`.
+*/
+function getWrappedStreamingTranscriber(type, options, context) {
+	return wrapStreamingTranscriber(getStreamingTranscriber({
+		...options.streaming,
+		...compactJson({
+			type,
+			baseUrl: options.baseUrl,
+			apiKey: options.apiKey,
+			model: options.model,
+			headers: options.headers,
+			timeoutMs: options.timeoutMs,
+			onUsage: options.onUsage
+		})
+	}, {
+		env: context.env,
+		headers: context.headers
+	}), { maxBytes: options.maxBytes });
+}
+/**
+* Builds opt-in adapters (e.g. `local`) registered by their subpath entry.
+* Returns `undefined` for built-in types.
+*/
+async function getRegisteredTranscriber(options, context) {
+	const type = resolveTranscriberConfig(options, context).type;
+	const entry = type ? optionalTranscriberEntry(type) : void 0;
+	if (!type || !entry) return;
+	const factory = getOptionalTranscriberFactory(type);
+	if (!factory) throw new SpeechConfigurationError(`The '${type}' transcriber is opt-in: import '${entry}' before calling getTranscriber()`, type);
+	return factory({
+		...options,
+		type
+	}, context);
+}
 async function getOptionalTranscriber(options, context) {
 	if (!options && !hasTranscriberEnv(context.env ?? defaultEnv())) return;
 	return getTranscriber(options, context);
@@ -435,20 +2377,30 @@ async function getOptionalSpeechSynthesizer(options, context) {
 	return getSpeechSynthesizer(options, context);
 }
 function normalizeTranscriberOptions(options = {}, context) {
-	const env = context.env ?? defaultEnv();
-	const type = options.type ?? readEnv(env, "HAVE_SPEECH_STT_TYPE", "HAVE_SPEECH_STT_ADAPTER", "STT_ADAPTER") ?? "studio-server";
-	const baseUrl = options.baseUrl ?? readEnv(env, "HAVE_SPEECH_STT_BASE_URL", "STT_BASE_URL");
-	if (type !== "studio-server") throw new InvalidSpeechAdapterError(type, "STT");
-	if (!baseUrl?.trim()) throw new SpeechConfigurationError("STT baseUrl is required", type);
+	const resolved = resolveTranscriberConfig(options, context);
+	const type = resolved.type ?? "studio-server";
+	if (type !== "studio-server" && type !== "openai-compatible") throw new InvalidSpeechAdapterError(type, "STT");
+	if (!resolved.baseUrl) throw new SpeechConfigurationError("STT baseUrl is required", type);
+	const shared = {
+		baseUrl: resolved.baseUrl,
+		fetch: resolved.fetch,
+		headers: resolved.headers,
+		apiKey: resolved.apiKey,
+		timeoutMs: resolved.timeoutMs
+	};
+	if (type === "openai-compatible") return {
+		...shared,
+		type,
+		model: resolved.model,
+		responseFormat: options.responseFormat,
+		maxBytes: resolved.maxBytes,
+		retry: options.retry,
+		onUsage: options.onUsage
+	};
 	return {
-		...options,
+		...shared,
 		type,
-		baseUrl: baseUrl.trim(),
-		fetch: options.fetch ?? context.fetch,
-		headers: options.headers ?? context.headers,
-		apiKey: options.apiKey ?? readEnv(env, "HAVE_SPEECH_STT_API_KEY", "STT_API_KEY", "SPEECH_API_KEY"),
-		timeoutMs: options.timeoutMs ?? parseOptionalInteger(readEnv(env, "HAVE_SPEECH_STT_TIMEOUT_MS", "STT_TIMEOUT_MS")),
-		transcribePath: options.transcribePath ?? readEnv(env, "HAVE_SPEECH_STT_PATH", "STT_PATH")
+		transcribePath: options.transcribePath ?? resolved.path
 	};
 }
 function normalizeSpeechSynthesizerOptions(options, context) {
@@ -488,30 +2440,141 @@ function normalizeSpeechSynthesizerOptions(options, context) {
 	};
 	throw new InvalidSpeechAdapterError(type, "TTS");
 }
-function hasTranscriberEnv(env) {
-	return hasAnyEnv(env, "HAVE_SPEECH_STT_TYPE", "HAVE_SPEECH_STT_ADAPTER", "HAVE_SPEECH_STT_BASE_URL", "STT_ADAPTER", "STT_BASE_URL");
-}
 function hasSynthesizerEnv(env) {
 	return hasAnyEnv(env, "HAVE_SPEECH_TTS_TYPE", "HAVE_SPEECH_TTS_ADAPTER", "HAVE_SPEECH_TTS_BASE_URL", "TTS_ADAPTER", "TTS_BASE_URL");
 }
-function readEnv(env, ...keys) {
-	for (const key of keys) {
-		const value = env[key];
-		if (value?.trim()) return value.trim();
-	}
-}
-function hasAnyEnv(env, ...keys) {
-	return keys.some((key) => Boolean(env[key]?.trim()));
+//#endregion
+//#region src/shared/streaming-client-secret.ts
+/**
+* Server-side minting of short-lived browser credentials for realtime
+* transcription.
+*
+* A browser must never hold the long-lived provider key. Your server calls
+* {@link createStreamingClientSecret} once per tenant session (after its own
+* auth check), records the returned tenant/session attribution, and hands the
+* browser only `value` and `expiresAt`. The browser passes `value` as the
+* streaming adapter's `clientSecret`.
+*
+* - `openai-realtime`: `POST /v1/realtime/client_secrets` with
+*   `expires_after: { anchor: 'created_at', seconds }` and a
+*   `session.type: "transcription"` config, returning an `ek_…` secret
+*   (https://developers.openai.com/api/reference/resources/realtime/subresources/client_secrets/methods/create).
+* - `voxtral-realtime`: vLLM has no ephemeral-token mechanism, so this throws
+*   `SpeechConfigurationError`. Browser Voxtral needs your own proxy or token
+*   gateway in front of vLLM.
+*/
+/** Default client-secret lifetime: long enough to connect, short if leaked. */
+var DEFAULT_CLIENT_SECRET_TTL_SECONDS = 60;
+/** OpenAI's accepted `expires_after.seconds` range. */
+var CLIENT_SECRET_TTL_RANGE = {
+	min: 10,
+	max: 7200
+};
+var OPENAI_CLIENT_SECRET_ENDPOINT = "realtime/client_secrets";
+/**
+* Mints a short-lived, session-scoped client secret for browser streaming.
+* Server-side only: throws in a browser runtime, and for adapters without an
+* ephemeral-token mechanism (`voxtral-realtime`).
+*/
+async function createStreamingClientSecret(options = {}, context = {}) {
+	const env = context.env ?? defaultEnv();
+	const keys = STREAMING_TRANSCRIBER_ENV_KEYS;
+	const type = options.type ?? readEnv(env, ...keys.type) ?? "openai-realtime";
+	if (!isStreamingTranscriberType(type)) throw new InvalidSpeechAdapterError(type, "streaming STT");
+	if (isBrowserRuntime()) throw new SpeechConfigurationError("createStreamingClientSecret runs on your server: it needs the long-lived API key, which must never reach a browser", type);
+	if (type === "voxtral-realtime") throw new SpeechConfigurationError("voxtral-realtime cannot mint browser credentials: vLLM has no ephemeral-token mechanism. Put your own proxy or token gateway in front of vLLM, mint its short-lived tokens yourself, and never send the vLLM API key to a browser", type);
+	const ttlSeconds = options.ttlSeconds ?? 60;
+	if (!Number.isInteger(ttlSeconds) || ttlSeconds < CLIENT_SECRET_TTL_RANGE.min || ttlSeconds > CLIENT_SECRET_TTL_RANGE.max) throw new SpeechConfigurationError(`ttlSeconds must be an integer from ${CLIENT_SECRET_TTL_RANGE.min} to ${CLIENT_SECRET_TTL_RANGE.max}`, type);
+	const apiKey = options.apiKey ?? readEnv(env, ...keys.apiKey);
+	if (!apiKey) throw new SpeechConfigurationError("createStreamingClientSecret requires apiKey (or HAVE_SPEECH_STREAMING_API_KEY)", type);
+	const model = options.model?.trim() || readEnv(env, ...keys.model)?.trim() || "gpt-4o-transcribe";
+	const session = openAIRealtimeTranscriptionSession({
+		model,
+		format: resolveOpenAIRealtimeFormat(options.format),
+		turnDetection: options.turnDetection ?? parseTurnDetection(readEnv(env, ...keys.turnDetection)) ?? { type: "server_vad" },
+		language: options.language ?? readEnv(env, ...keys.language),
+		prompt: options.prompt
+	}, options);
+	const endpoint = resolveClientSecretUrl(options.baseUrl?.trim() || readEnv(env, ...keys.baseUrl)?.trim() || "wss://api.openai.com/v1/realtime");
+	const headers = mergeHeaderInits(parseHeadersEnv(env, keys.headers), options.headers);
+	const body = await new ClientSecretClient({
+		baseUrl: endpoint,
+		apiKey,
+		fetch: options.fetch,
+		headers,
+		timeoutMs: options.timeoutMs ?? parseOptionalInteger(readEnv(env, ...keys.timeoutMs)) ?? 1e4
+	}).mint(endpoint, {
+		expires_after: {
+			anchor: "created_at",
+			seconds: ttlSeconds
+		},
+		session
+	}, options.signal).catch((error) => {
+		throw redactProviderError(error, headerSecrets(headers));
+	});
+	const value = body.value;
+	if (typeof value !== "string" || !value) throw new SpeechProviderError(type, "openai-realtime client secret response did not include a value");
+	const expiresAtSeconds = body.expires_at;
+	return {
+		type,
+		value,
+		expiresAt: typeof expiresAtSeconds === "number" && Number.isFinite(expiresAtSeconds) ? expiresAtSeconds * 1e3 : Date.now() + ttlSeconds * 1e3,
+		ttlSeconds,
+		model,
+		tenantId: options.tenantId,
+		sessionId: options.sessionId,
+		metadata: options.metadata,
+		session: body.session && typeof body.session === "object" ? body.session : void 0
+	};
 }
-function parseOptionalInteger(value) {
-	if (!value) return;
-	const parsed = Number.parseInt(value, 10);
-	return Number.isFinite(parsed) ? parsed : void 0;
+/**
+* Resolves the client-secret endpoint from any accepted realtime base:
+* `ws(s)` becomes `http(s)`, a trailing `/realtime` and query are dropped,
+* then `/v1/realtime/client_secrets` (or `/realtime/client_secrets` under a
+* versioned root) is appended.
+*/
+function resolveClientSecretUrl(baseUrl) {
+	const url = new URL(baseUrl);
+	if (url.protocol === "ws:") url.protocol = "http:";
+	else if (url.protocol === "wss:") url.protocol = "https:";
+	url.search = "";
+	url.hash = "";
+	url.pathname = url.pathname.replace(/\/+$/, "").replace(/\/realtime$/, "");
+	return resolveOpenAICompatibleUrl(url.toString(), OPENAI_CLIENT_SECRET_ENDPOINT);
 }
-function defaultEnv() {
-	return globalThis.process?.env ?? {};
+/**
+* The HTTP layer redacts the API key from provider error bodies; this also
+* removes gateway credentials sent in `headers` (e.g. `x-bf-vk`).
+*/
+function redactProviderError(error, secrets) {
+	if (!(error instanceof SpeechProviderError) || secrets.length === 0) return error;
+	let responseBody = error.responseBody;
+	let message = error.message;
+	for (const secret of secrets) {
+		responseBody = redactSecret(responseBody, secret);
+		message = redactSecret(message, secret) ?? message;
+	}
+	if (responseBody === error.responseBody && message === error.message) return error;
+	return new SpeechProviderError(error.adapter ?? "openai-realtime", message, {
+		status: error.status,
+		responseBody,
+		retryAfterMs: error.retryAfterMs
+	});
 }
+var ClientSecretClient = class extends HttpSpeechAdapter {
+	mint(endpoint, payload, signal) {
+		return this.post("openai-realtime", endpoint, {
+			body: JSON.stringify(payload),
+			headers: { "content-type": "application/json" },
+			signal
+		}, async (response) => {
+			const json = await response.json().catch(() => void 0);
+			if (!json || typeof json !== "object" || Array.isArray(json)) throw new SpeechProviderError("openai-realtime", "openai-realtime client secret response was not a JSON object");
+			return json;
+		});
+	}
+};
 //#endregion
-export { InvalidSpeechAdapterError, SpeechConfigurationError, SpeechError, SpeechProviderError, getAvailableSpeechAdapters, getSpeech, getSpeechSynthesizer, getTranscriber };
+export { CLIENT_SECRET_TTL_RANGE, DEFAULT_CLIENT_SECRET_TTL_SECONDS, DEFAULT_MAX_AUDIO_BYTES, DEFAULT_MAX_TURN_SECONDS, DEFAULT_ROLLOVER_MIN_SILENCE_MS, DEFAULT_ROLLOVER_SILENCE_THRESHOLD, DEFAULT_ROLLOVER_WINDOW_SECONDS, InvalidSpeechAdapterError, OPENAI_REALTIME_DEFAULT_MODEL, OPENAI_REALTIME_DEFAULT_URL, RealtimeTranscriptionSession, STREAMING_TRANSCRIBER_ENV_KEYS, STREAMING_TRANSCRIBER_TYPES, SpeechConfigurationError, SpeechError, SpeechProviderError, TRANSCRIBER_ENV_KEYS, VOXTRAL_REALTIME_AUDIO_FORMAT, VOXTRAL_REALTIME_DEFAULT_MODEL, audioSecondsForBytes, bytesPerSecond, createStreamingClientSecret, getAvailableSpeechAdapters, getSpeech, getSpeechSynthesizer, getStreamingTranscriber, getTranscriber, isBrowserRuntime, isStreamingTranscriberType, mimeTypeToAudioExtension, openAIRealtimeProtocol, openAIRealtimeTranscriptionSession, parseMaxTurnSeconds, parseOpenAIRealtimeEvent, parseVoxtralRealtimeEvent, resolveClientSecretUrl, resolveOpenAIRealtimeFormat, resolveRealtimeUrl, resolveVoxtralRealtimeUrl, unwrapRawAudio, voxtralRealtimeProtocol, wrapStreamingTranscriber };
 
 //# sourceMappingURL=index.js.map