@myscheme/voice-navigation-sdk 0.1.8 → 0.1.10

package/dist/server/bedrock-embedding-handler.d.ts

@@ -1,4 +1,5 @@
-type NextApiRequest = {
+import { type GateRequestLike } from "./security.js";
+type NextApiRequest = GateRequestLike & {
     method?: string;
     body?: {
         text?: string | string[];

package/dist/server/bedrock-embedding-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bedrock-embedding-handler.d.ts","sourceRoot":"","sources":["../../src/server/bedrock-embedding-handler.ts"],"names":[],"mappings":"AA4BA,KAAK,cAAc,GAAG;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,eAAe,CAAC;IAC1C,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC;CAC7D,CAAC;AA0MF,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,IAAI,CAAC,CAiBf;AAMD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,QAAQ,CAAC,CAkCnB"}
+{"version":3,"file":"bedrock-embedding-handler.d.ts","sourceRoot":"","sources":["../../src/server/bedrock-embedding-handler.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAgB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAEnE,KAAK,cAAc,GAAG,eAAe,GAAG;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACzB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,eAAe,CAAC;IAC1C,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC;CAC7D,CAAC;AA0OF,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAMD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,QAAQ,CAAC,CAsDnB"}

package/dist/server/bedrock-embedding-handler.js

@@ -1,4 +1,29 @@
 import crypto from "crypto";
+import { evaluateGate } from "./security.js";
+const MAX_EMBEDDING_TEXTS = 16;
+const MAX_EMBEDDING_TEXT_CHARS = 2000;
+const ALLOWED_INPUT_TYPES = new Set([
+    "search_query",
+    "search_document",
+    "classification",
+    "clustering",
+]);
+function sanitizeEmbeddingInput(text, inputType) {
+    const rawTexts = Array.isArray(text) ? text : text != null ? [text] : [];
+    const texts = [];
+    for (const entry of rawTexts.slice(0, MAX_EMBEDDING_TEXTS)) {
+        if (typeof entry === "string" && entry.trim().length > 0) {
+            texts.push(entry.slice(0, MAX_EMBEDDING_TEXT_CHARS));
+        }
+    }
+    if (texts.length === 0) {
+        return { ok: false };
+    }
+    const resolvedType = typeof inputType === "string" && ALLOWED_INPUT_TYPES.has(inputType)
+        ? inputType
+        : "search_query";
+    return { ok: true, texts, inputType: resolvedType };
+}
 function sign(key, msg) {
     return crypto.createHmac("sha256", key).update(msg, "utf8").digest();
 }
@@ -141,43 +166,72 @@ export async function bedrockEmbeddingHandler(req, res) {
         res.status(405).json({ error: "Method not allowed" });
         return;
     }
-    const { text, inputType = "search_query" } = req.body || {};
-    const result = await generateBedrockEmbedding(text, inputType);
+    const gate = evaluateGate(req, { maxRequests: 30, windowMs: 60 * 1000, bucket: "embed" });
+    if (!gate.ok) {
+        res.status(gate.status ?? 403).json({ error: gate.error });
+        return;
+    }
+    const { text, inputType } = req.body || {};
+    const sanitized = sanitizeEmbeddingInput(text, inputType);
+    if (!sanitized.ok) {
+        res.status(400).json({ error: "Invalid text parameter" });
+        return;
+    }
+    const result = await generateBedrockEmbedding(sanitized.texts, sanitized.inputType);
     if (result.success && result.data) {
         res.status(result.statusCode).json(result.data);
     }
     else {
-        res.status(result.statusCode).json(result.error);
+        res
+            .status(result.statusCode >= 500 ? 502 : result.statusCode)
+            .json({ error: "Embedding request failed" });
     }
 }
 export async function BedrockEmbeddingPOST(request) {
+    const headers = { "Content-Type": "application/json" };
+    const gateReq = {
+        method: request.method,
+        headers: {
+            origin: request.headers.get("origin") ?? undefined,
+            referer: request.headers.get("referer") ?? undefined,
+            host: request.headers.get("host") ?? undefined,
+            "x-forwarded-for": request.headers.get("x-forwarded-for") ?? undefined,
+            "x-real-ip": request.headers.get("x-real-ip") ?? undefined,
+        },
+    };
+    const gate = evaluateGate(gateReq, { maxRequests: 30, windowMs: 60 * 1000, bucket: "embed" });
+    if (!gate.ok) {
+        return new Response(JSON.stringify({ error: gate.error }), {
+            status: gate.status ?? 403,
+            headers,
+        });
+    }
     try {
         const body = await request.json();
-        const { text, inputType = "search_query" } = body || {};
-        const result = await generateBedrockEmbedding(text, inputType);
-        const headers = {
-            "Content-Type": "application/json",
-        };
-        if (result.success && result.data) {
-            return new Response(JSON.stringify(result.data), {
-                status: result.statusCode,
+        const { text, inputType } = body || {};
+        const sanitized = sanitizeEmbeddingInput(text, inputType);
+        if (!sanitized.ok) {
+            return new Response(JSON.stringify({ error: "Invalid text parameter" }), {
+                status: 400,
                 headers,
             });
         }
-        else {
-            return new Response(JSON.stringify(result.error), {
+        const result = await generateBedrockEmbedding(sanitized.texts, sanitized.inputType);
+        if (result.success && result.data) {
+            return new Response(JSON.stringify(result.data), {
                 status: result.statusCode,
                 headers,
             });
         }
+        return new Response(JSON.stringify({ error: "Embedding request failed" }), {
+            status: result.statusCode >= 500 ? 502 : result.statusCode,
+            headers,
+        });
     }
-    catch (error) {
-        return new Response(JSON.stringify({
-            error: "Invalid request",
-            message: error instanceof Error ? error.message : "Unknown error",
-        }), {
+    catch {
+        return new Response(JSON.stringify({ error: "Invalid request" }), {
             status: 400,
-            headers: { "Content-Type": "application/json" },
+            headers,
         });
     }
 }

package/dist/server/bedrock-handler.d.ts

@@ -1,4 +1,5 @@
-type NextApiRequest = {
+import { type GateRequestLike } from "./security.js";
+type NextApiRequest = GateRequestLike & {
     method?: string;
     body?: {
         body?: unknown;

package/dist/server/bedrock-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bedrock-handler.d.ts","sourceRoot":"","sources":["../../src/server/bedrock-handler.ts"],"names":[],"mappings":"AA4BA,KAAK,cAAc,GAAG;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QACL,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,eAAe,CAAC;IAC1C,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC;CAC7D,CAAC;AAqLF,wBAAsB,cAAc,CAClC,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,IAAI,CAAC,CAkBf;AAMD,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkCrE"}
+{"version":3,"file":"bedrock-handler.d.ts","sourceRoot":"","sources":["../../src/server/bedrock-handler.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAgB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAEnE,KAAK,cAAc,GAAG,eAAe,GAAG;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QACL,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,eAAe,CAAC;IAC1C,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC;CAC7D,CAAC;AAyRF,wBAAsB,cAAc,CAClC,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,IAAI,CAAC,CA8Bf;AAMD,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAmDrE"}

package/dist/server/bedrock-handler.js

@@ -1,4 +1,82 @@
 import crypto from "crypto";
+import { evaluateGate } from "./security.js";
+const MAX_OUTPUT_TOKENS = 512;
+const DEFAULT_OUTPUT_TOKENS = 256;
+const MAX_MESSAGES = 6;
+const MAX_SYSTEM_CHARS = 20000;
+const MAX_TEXT_CHARS = 20000;
+const MAX_TOTAL_INPUT_CHARS = 40000;
+const clampNumber = (value, min, max, fallback) => {
+    const num = typeof value === "number" && Number.isFinite(value) ? value : fallback;
+    return Math.min(max, Math.max(min, Math.floor(num)));
+};
+const sanitizeContent = (content) => {
+    if (typeof content === "string") {
+        return [{ type: "text", text: content.slice(0, MAX_TEXT_CHARS) }];
+    }
+    if (!Array.isArray(content)) {
+        return [];
+    }
+    const parts = [];
+    for (const part of content) {
+        if (part && typeof part === "object" && part.type === "text") {
+            const text = part.text;
+            if (typeof text === "string") {
+                parts.push({ type: "text", text: text.slice(0, MAX_TEXT_CHARS) });
+            }
+        }
+    }
+    return parts;
+};
+function sanitizeClaudeRequest(input) {
+    const raw = input && typeof input === "object" && "body" in input
+        ? input.body
+        : input;
+    if (!raw || typeof raw !== "object") {
+        return { ok: false };
+    }
+    const source = raw;
+    const rawMessages = Array.isArray(source.messages) ? source.messages : [];
+    if (rawMessages.length === 0) {
+        return { ok: false };
+    }
+    let totalChars = 0;
+    const messages = [];
+    for (const message of rawMessages.slice(0, MAX_MESSAGES)) {
+        if (!message || typeof message !== "object") {
+            continue;
+        }
+        const role = message.role;
+        if (role !== "user" && role !== "assistant") {
+            continue;
+        }
+        const content = sanitizeContent(message.content);
+        if (content.length === 0) {
+            continue;
+        }
+        for (const part of content) {
+            totalChars += part.text.length;
+        }
+        messages.push({ role, content });
+    }
+    if (messages.length === 0 || totalChars > MAX_TOTAL_INPUT_CHARS) {
+        return { ok: false };
+    }
+    const body = {
+        anthropic_version: typeof source.anthropic_version === "string"
+            ? source.anthropic_version
+            : "bedrock-2023-05-31",
+        max_tokens: clampNumber(source.max_tokens, 1, MAX_OUTPUT_TOKENS, DEFAULT_OUTPUT_TOKENS),
+        messages,
+    };
+    if (typeof source.system === "string") {
+        body.system = source.system.slice(0, MAX_SYSTEM_CHARS);
+    }
+    if (source.temperature != null) {
+        body.temperature = clampNumber(source.temperature, 0, 1, 0);
+    }
+    return { ok: true, body };
+}
 function sign(key, msg) {
     return crypto.createHmac("sha256", key).update(msg, "utf8").digest();
 }
@@ -129,43 +207,70 @@ export async function bedrockHandler(req, res) {
         res.status(405).json({ error: "Method not allowed" });
         return;
     }
-    const requestBody = req.body?.body;
-    const result = await invokeBedrock(requestBody);
+    const gate = evaluateGate(req, { maxRequests: 30, windowMs: 60 * 1000, bucket: "bedrock" });
+    if (!gate.ok) {
+        res.status(gate.status ?? 403).json({ error: gate.error });
+        return;
+    }
+    const sanitized = sanitizeClaudeRequest(req.body);
+    if (!sanitized.ok) {
+        res.status(400).json({ error: "Invalid request body" });
+        return;
+    }
+    const result = await invokeBedrock(sanitized.body);
     if (result.success && result.data) {
         res.status(result.statusCode).json(result.data);
     }
     else {
-        res.status(result.statusCode).json(result.error);
+        res
+            .status(result.statusCode >= 500 ? 502 : result.statusCode)
+            .json({ error: "Bedrock request failed" });
     }
 }
 export async function BedrockPOST(request) {
+    const headers = { "Content-Type": "application/json" };
+    const gateReq = {
+        method: request.method,
+        headers: {
+            origin: request.headers.get("origin") ?? undefined,
+            referer: request.headers.get("referer") ?? undefined,
+            host: request.headers.get("host") ?? undefined,
+            "x-forwarded-for": request.headers.get("x-forwarded-for") ?? undefined,
+            "x-real-ip": request.headers.get("x-real-ip") ?? undefined,
+        },
+    };
+    const gate = evaluateGate(gateReq, { maxRequests: 30, windowMs: 60 * 1000, bucket: "bedrock" });
+    if (!gate.ok) {
+        return new Response(JSON.stringify({ error: gate.error }), {
+            status: gate.status ?? 403,
+            headers,
+        });
+    }
     try {
         const body = await request.json();
-        const requestBody = body?.body;
-        const result = await invokeBedrock(requestBody);
-        const headers = {
-            "Content-Type": "application/json",
-        };
-        if (result.success && result.data) {
-            return new Response(JSON.stringify(result.data), {
-                status: result.statusCode,
+        const sanitized = sanitizeClaudeRequest(body);
+        if (!sanitized.ok) {
+            return new Response(JSON.stringify({ error: "Invalid request body" }), {
+                status: 400,
                 headers,
             });
         }
-        else {
-            return new Response(JSON.stringify(result.error), {
+        const result = await invokeBedrock(sanitized.body);
+        if (result.success && result.data) {
+            return new Response(JSON.stringify(result.data), {
                 status: result.statusCode,
                 headers,
             });
         }
+        return new Response(JSON.stringify({ error: "Bedrock request failed" }), {
+            status: result.statusCode >= 500 ? 502 : result.statusCode,
+            headers,
+        });
     }
-    catch (error) {
-        return new Response(JSON.stringify({
-            error: "Invalid request",
-            message: error instanceof Error ? error.message : "Unknown error",
-        }), {
+    catch {
+        return new Response(JSON.stringify({ error: "Invalid request" }), {
             status: 400,
-            headers: { "Content-Type": "application/json" },
+            headers,
         });
     }
 }

package/dist/server/index.d.ts

@@ -7,4 +7,9 @@ export { BedrockPOST } from "./bedrock-handler.js";
 export { BedrockEmbeddingPOST } from "./bedrock-embedding-handler.js";
 export { createOpenSearchProxyHandler, DEFAULT_OPENSEARCH_PROXY_PATH, } from "./opensearch-handler.js";
 export type { VectorSearchProxyRequest, VectorSearchProxyResponse, } from "./opensearch-handler.js";
+export { attachSarvamSttRelay } from "./sarvam-stt-relay.js";
+export type { SarvamSttRelayOptions } from "./sarvam-stt-relay.js";
+export { evaluateGate, isOriginAllowed, getClientId, checkRateLimit, isTrustProxyEnabled, parseAllowedOrigins, } from "./security.js";
+export type { GateRequestLike, GateOptions, GateResult } from "./security.js";
+export { SARVAM_TTS_LANGUAGES, SARVAM_STT_LANGUAGES, DEFAULT_LANGUAGE, } from "../languages.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAGtE,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAGtE,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAInE,OAAO,EACL,YAAY,EACZ,eAAe,EACf,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAG9E,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC"}

package/dist/server/index.js

@@ -6,3 +6,6 @@ export { POST } from "./azure-speech-handler.js";
 export { BedrockPOST } from "./bedrock-handler.js";
 export { BedrockEmbeddingPOST } from "./bedrock-embedding-handler.js";
 export { createOpenSearchProxyHandler, DEFAULT_OPENSEARCH_PROXY_PATH, } from "./opensearch-handler.js";
+export { attachSarvamSttRelay } from "./sarvam-stt-relay.js";
+export { evaluateGate, isOriginAllowed, getClientId, checkRateLimit, isTrustProxyEnabled, parseAllowedOrigins, } from "./security.js";
+export { SARVAM_TTS_LANGUAGES, SARVAM_STT_LANGUAGES, DEFAULT_LANGUAGE, } from "../languages.js";

package/dist/server/opensearch-env-handler.d.ts

@@ -1,4 +1,5 @@
-type NextApiRequest = {
+import { type GateRequestLike } from "./security.js";
+type NextApiRequest = GateRequestLike & {
     method?: string;
     headers?: {
         [key: string]: string | string[] | undefined;

package/dist/server/opensearch-env-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opensearch-env-handler.d.ts","sourceRoot":"","sources":["../../src/server/opensearch-env-handler.ts"],"names":[],"mappings":"AAuBA,KAAK,cAAc,GAAG;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;KAAE,CAAC;IAC3D,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,KAAK,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7C,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrC,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,eAAe,CAAC;IAC1C,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC;IAC1B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC;CAC7D,CAAC;AAmFF,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,IAAI,CAAC,CA6Hf;AAMD,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,IAAI,CAAC,CAgFf"}
+{"version":3,"file":"opensearch-env-handler.d.ts","sourceRoot":"","sources":["../../src/server/opensearch-env-handler.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAgB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAGnE,KAAK,cAAc,GAAG,eAAe,GAAG;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;KAAE,CAAC;IAC3D,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,KAAK,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7C,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrC,CAAC;AAMF,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,eAAe,CAAC;IAC1C,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC;IAC1B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC;CAC7D,CAAC;AAuCF,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,IAAI,CAAC,CA8Hf;AAMD,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,IAAI,CAAC,CA8Ef"}

package/dist/server/opensearch-env-handler.js

@@ -1,32 +1,5 @@
-const rateLimitMap = new Map();
-function checkRateLimit(identifier, maxRequests, windowMs) {
-    const now = Date.now();
-    const record = rateLimitMap.get(identifier);
-    if (!record || now > record.resetTime) {
-        rateLimitMap.set(identifier, {
-            count: 1,
-            resetTime: now + windowMs,
-        });
-        return true;
-    }
-    if (record.count >= maxRequests) {
-        return false;
-    }
-    record.count++;
-    return true;
-}
-function getClientIdentifier(req) {
-    const forwardedFor = req.headers?.["x-forwarded-for"];
-    if (forwardedFor) {
-        const ip = Array.isArray(forwardedFor) ? forwardedFor[0] : forwardedFor;
-        return ip.split(",")[0].trim();
-    }
-    const realIp = req.headers?.["x-real-ip"];
-    if (realIp) {
-        return Array.isArray(realIp) ? realIp[0] : realIp;
-    }
-    return req.socket?.remoteAddress || "unknown";
-}
+import { evaluateGate } from "./security.js";
+const SEARCH_SOURCE_FIELDS = ["name", "path", "keywords", "description"];
 let opensearchClient = null;
 async function getOpenSearchClient() {
     if (!opensearchClient) {
@@ -56,12 +29,13 @@ export async function openSearchSearchHandler(req, res) {
         res.status(405).json({ error: "Method not allowed" });
         return;
     }
-    const clientId = getClientIdentifier(req);
-    if (!checkRateLimit(clientId, 20, 60 * 1000)) {
-        res.status(429).json({
-            error: "Too many requests",
-            message: "Rate limit exceeded. Please try again later.",
-        });
+    const gate = evaluateGate(req, {
+        maxRequests: 20,
+        windowMs: 60 * 1000,
+        bucket: "ossearch",
+    });
+    if (!gate.ok) {
+        res.status(gate.status ?? 403).json({ error: gate.error });
         return;
     }
     const { query, vector, size = 10 } = req.body || {};
@@ -122,14 +96,15 @@ export async function openSearchSearchHandler(req, res) {
                     body: {
                         size: Math.min(size, 100),
                         query: {
-                            query_string: {
+                            simple_query_string: {
                                 query: query,
-                                default_operator: "OR",
-                                analyze_wildcard: true,
+                                fields: ["name^3", "keywords^2", "description", "text"],
+                                default_operator: "and",
+                                flags: "NONE",
                                 lenient: true,
                             },
                         },
-                        _source: true,
+                        _source: SEARCH_SOURCE_FIELDS,
                     },
                 });
             }
@@ -146,10 +121,7 @@ export async function openSearchSearchHandler(req, res) {
     }
     catch (error) {
         console.error("[VoiceNavigation] OpenSearch search error:", error);
-        res.status(500).json({
-            error: "Search failed",
-            message: error instanceof Error ? error.message : "Unknown error",
-        });
+        res.status(500).json({ error: "Search failed" });
     }
 }
 export async function openSearchSuggestHandler(req, res) {
@@ -158,12 +130,13 @@ export async function openSearchSuggestHandler(req, res) {
         res.status(405).json({ error: "Method not allowed" });
         return;
     }
-    const clientId = getClientIdentifier(req);
-    if (!checkRateLimit(clientId, 30, 60 * 1000)) {
-        res.status(429).json({
-            error: "Too many requests",
-            message: "Rate limit exceeded. Please try again later.",
-        });
+    const gate = evaluateGate(req, {
+        maxRequests: 30,
+        windowMs: 60 * 1000,
+        bucket: "ossuggest",
+    });
+    if (!gate.ok) {
+        res.status(gate.status ?? 403).json({ error: gate.error });
         return;
     }
     const { query } = req.body || {};
@@ -213,9 +186,6 @@ export async function openSearchSuggestHandler(req, res) {
     }
     catch (error) {
         console.error("[VoiceNavigation] OpenSearch suggest error:", error);
-        res.status(500).json({
-            error: "Suggestion failed",
-            message: error instanceof Error ? error.message : "Unknown error",
-        });
+        res.status(500).json({ error: "Suggestion failed" });
     }
 }

package/dist/server/sarvam-stt-relay.d.ts

@@ -0,0 +1,8 @@
+import type { Server as HttpServer } from "http";
+import { WebSocketServer } from "ws";
+export interface SarvamSttRelayOptions {
+    path?: string;
+    connectTimeoutMs?: number;
+}
+export declare function attachSarvamSttRelay(server: HttpServer, options?: SarvamSttRelayOptions): WebSocketServer;
+//# sourceMappingURL=sarvam-stt-relay.d.ts.map

package/dist/server/sarvam-stt-relay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarvam-stt-relay.d.ts","sourceRoot":"","sources":["../../src/server/sarvam-stt-relay.ts"],"names":[],"mappings":"AA0CA,OAAO,KAAK,EAAE,MAAM,IAAI,UAAU,EAAmB,MAAM,MAAM,CAAC;AAElE,OAAO,EAA8B,eAAe,EAAE,MAAM,IAAI,CAAC;AAiDjE,MAAM,WAAW,qBAAqB;IAEpC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAUD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,EAClB,OAAO,GAAE,qBAA0B,GAClC,eAAe,CA2HjB"}

package/dist/server/sarvam-stt-relay.js

@@ -0,0 +1,111 @@
+import { WebSocket as NodeWebSocket, WebSocketServer } from "ws";
+import { isOriginAllowed, getClientId, checkRateLimit } from "./security.js";
+import { SARVAM_STT_LANGUAGES, DEFAULT_LANGUAGE } from "../languages.js";
+const ALLOWED_STT_MODELS = new Set(["saaras:v3", "saarika:v2.5"]);
+const ALLOWED_SAMPLE_RATES = new Set(["8000", "16000"]);
+const ALLOWED_BOOLEANS = new Set(["true", "false"]);
+function buildSafeUpstreamQuery(clientParams) {
+    const out = new URLSearchParams();
+    const language = clientParams.get("language-code") ?? "";
+    out.set("language-code", SARVAM_STT_LANGUAGES.includes(language) ? language : DEFAULT_LANGUAGE);
+    const model = clientParams.get("model") ?? "";
+    out.set("model", ALLOWED_STT_MODELS.has(model) ? model : "saaras:v3");
+    const sampleRate = clientParams.get("sample_rate") ?? "";
+    out.set("sample_rate", ALLOWED_SAMPLE_RATES.has(sampleRate) ? sampleRate : "16000");
+    out.set("input_audio_codec", "wav");
+    for (const key of ["high_vad_sensitivity", "vad_signals", "flush_signal"]) {
+        const value = clientParams.get(key);
+        if (value !== null && ALLOWED_BOOLEANS.has(value)) {
+            out.set(key, value);
+        }
+    }
+    return out.toString();
+}
+function rejectUpgrade(socket, status, reason) {
+    try {
+        socket.write(`HTTP/1.1 ${status} ${reason}\r\nConnection: close\r\n\r\n`);
+    }
+    catch {
+    }
+    socket.destroy();
+}
+const DEFAULT_PATH = "/api/speech/sarvam-stt";
+const DEFAULT_CONNECT_TIMEOUT_MS = 10000;
+const SARVAM_STT_WS_URL = "wss://api.sarvam.ai/speech-to-text/ws";
+export function attachSarvamSttRelay(server, options = {}) {
+    const path = options.path ?? DEFAULT_PATH;
+    const connectTimeoutMs = options.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;
+    const wss = new WebSocketServer({ noServer: true });
+    server.on("upgrade", (req, socket, head) => {
+        const requestUrl = new URL(req.url ?? "", "http://localhost");
+        if (requestUrl.pathname !== path) {
+            return;
+        }
+        if (!isOriginAllowed(req)) {
+            rejectUpgrade(socket, 403, "Forbidden");
+            return;
+        }
+        if (!checkRateLimit(`stt:${getClientId(req)}`, 15, 60 * 1000)) {
+            rejectUpgrade(socket, 429, "Too Many Requests");
+            return;
+        }
+        const apiKey = process.env.SARVAM_API_KEY;
+        if (!apiKey) {
+            console.error("[VoiceNavigation] Missing SARVAM_API_KEY. Set it in your .env file to enable the Sarvam STT relay.");
+            socket.destroy();
+            return;
+        }
+        const safeQuery = buildSafeUpstreamQuery(requestUrl.searchParams);
+        const upstream = new NodeWebSocket(`${SARVAM_STT_WS_URL}?${safeQuery}`, [`api-subscription-key.${apiKey}`], { headers: { "Api-Subscription-Key": apiKey } });
+        const connectTimeout = setTimeout(() => {
+            upstream.terminate();
+        }, connectTimeoutMs);
+        upstream.once("open", () => {
+            clearTimeout(connectTimeout);
+            wss.handleUpgrade(req, socket, head, (clientSocket) => {
+                let closedByClient = false;
+                let closedByUpstream = false;
+                upstream.on("message", (data, isBinary) => {
+                    if (clientSocket.readyState === clientSocket.OPEN) {
+                        clientSocket.send(data, { binary: isBinary });
+                    }
+                });
+                upstream.on("close", () => {
+                    closedByUpstream = true;
+                    if (!closedByClient &&
+                        clientSocket.readyState === clientSocket.OPEN) {
+                        clientSocket.close();
+                    }
+                });
+                upstream.on("error", (error) => {
+                    console.error("[VoiceNavigation] Sarvam STT upstream error:", error);
+                    if (clientSocket.readyState === clientSocket.OPEN) {
+                        clientSocket.close();
+                    }
+                });
+                clientSocket.on("message", (data, isBinary) => {
+                    if (upstream.readyState === upstream.OPEN) {
+                        upstream.send(data, { binary: isBinary });
+                    }
+                });
+                clientSocket.on("close", () => {
+                    closedByClient = true;
+                    if (!closedByUpstream && upstream.readyState === upstream.OPEN) {
+                        upstream.close();
+                    }
+                });
+                clientSocket.on("error", () => {
+                    if (upstream.readyState === upstream.OPEN) {
+                        upstream.close();
+                    }
+                });
+            });
+        });
+        upstream.once("error", (error) => {
+            clearTimeout(connectTimeout);
+            console.error("[VoiceNavigation] Failed to connect to Sarvam STT upstream:", error);
+            socket.destroy();
+        });
+    });
+    return wss;
+}

package/dist/server/security.d.ts

@@ -0,0 +1,26 @@
+export interface GateRequestLike {
+    method?: string;
+    headers?: {
+        [key: string]: string | string[] | undefined;
+    };
+    socket?: {
+        remoteAddress?: string;
+    };
+}
+export interface GateOptions {
+    maxRequests: number;
+    windowMs: number;
+    bucket?: string;
+}
+export interface GateResult {
+    ok: boolean;
+    status?: number;
+    error?: string;
+}
+export declare function isTrustProxyEnabled(): boolean;
+export declare function parseAllowedOrigins(): string[];
+export declare function getClientId(req: GateRequestLike): string;
+export declare function isOriginAllowed(req: GateRequestLike): boolean;
+export declare function checkRateLimit(identifier: string, maxRequests: number, windowMs: number): boolean;
+export declare function evaluateGate(req: GateRequestLike, options: GateOptions): GateResult;
+//# sourceMappingURL=security.d.ts.map

package/dist/server/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/server/security.ts"],"names":[],"mappings":"AA4BA,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;KAAE,CAAC;IAC3D,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrC;AAED,MAAM,WAAW,WAAW;IAE1B,WAAW,EAAE,MAAM,CAAC;IAEpB,QAAQ,EAAE,MAAM,CAAC;IAKjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA4BD,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAGD,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAK9C;AAOD,wBAAgB,WAAW,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAYxD;AAQD,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAqB7D;AAMD,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CA0BT;AAMD,wBAAgB,YAAY,CAC1B,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,WAAW,GACnB,UAAU,CAWZ"}