@myscheme/voice-navigation-sdk 0.1.9 → 0.1.10

package/dist/server/bedrock-handler.js

@@ -1,4 +1,82 @@
 import crypto from "crypto";
+import { evaluateGate } from "./security.js";
+const MAX_OUTPUT_TOKENS = 512;
+const DEFAULT_OUTPUT_TOKENS = 256;
+const MAX_MESSAGES = 6;
+const MAX_SYSTEM_CHARS = 20000;
+const MAX_TEXT_CHARS = 20000;
+const MAX_TOTAL_INPUT_CHARS = 40000;
+const clampNumber = (value, min, max, fallback) => {
+    const num = typeof value === "number" && Number.isFinite(value) ? value : fallback;
+    return Math.min(max, Math.max(min, Math.floor(num)));
+};
+const sanitizeContent = (content) => {
+    if (typeof content === "string") {
+        return [{ type: "text", text: content.slice(0, MAX_TEXT_CHARS) }];
+    }
+    if (!Array.isArray(content)) {
+        return [];
+    }
+    const parts = [];
+    for (const part of content) {
+        if (part && typeof part === "object" && part.type === "text") {
+            const text = part.text;
+            if (typeof text === "string") {
+                parts.push({ type: "text", text: text.slice(0, MAX_TEXT_CHARS) });
+            }
+        }
+    }
+    return parts;
+};
+function sanitizeClaudeRequest(input) {
+    const raw = input && typeof input === "object" && "body" in input
+        ? input.body
+        : input;
+    if (!raw || typeof raw !== "object") {
+        return { ok: false };
+    }
+    const source = raw;
+    const rawMessages = Array.isArray(source.messages) ? source.messages : [];
+    if (rawMessages.length === 0) {
+        return { ok: false };
+    }
+    let totalChars = 0;
+    const messages = [];
+    for (const message of rawMessages.slice(0, MAX_MESSAGES)) {
+        if (!message || typeof message !== "object") {
+            continue;
+        }
+        const role = message.role;
+        if (role !== "user" && role !== "assistant") {
+            continue;
+        }
+        const content = sanitizeContent(message.content);
+        if (content.length === 0) {
+            continue;
+        }
+        for (const part of content) {
+            totalChars += part.text.length;
+        }
+        messages.push({ role, content });
+    }
+    if (messages.length === 0 || totalChars > MAX_TOTAL_INPUT_CHARS) {
+        return { ok: false };
+    }
+    const body = {
+        anthropic_version: typeof source.anthropic_version === "string"
+            ? source.anthropic_version
+            : "bedrock-2023-05-31",
+        max_tokens: clampNumber(source.max_tokens, 1, MAX_OUTPUT_TOKENS, DEFAULT_OUTPUT_TOKENS),
+        messages,
+    };
+    if (typeof source.system === "string") {
+        body.system = source.system.slice(0, MAX_SYSTEM_CHARS);
+    }
+    if (source.temperature != null) {
+        body.temperature = clampNumber(source.temperature, 0, 1, 0);
+    }
+    return { ok: true, body };
+}
 function sign(key, msg) {
     return crypto.createHmac("sha256", key).update(msg, "utf8").digest();
 }
@@ -129,43 +207,70 @@ export async function bedrockHandler(req, res) {
         res.status(405).json({ error: "Method not allowed" });
         return;
     }
-    const requestBody = req.body?.body;
-    const result = await invokeBedrock(requestBody);
+    const gate = evaluateGate(req, { maxRequests: 30, windowMs: 60 * 1000, bucket: "bedrock" });
+    if (!gate.ok) {
+        res.status(gate.status ?? 403).json({ error: gate.error });
+        return;
+    }
+    const sanitized = sanitizeClaudeRequest(req.body);
+    if (!sanitized.ok) {
+        res.status(400).json({ error: "Invalid request body" });
+        return;
+    }
+    const result = await invokeBedrock(sanitized.body);
     if (result.success && result.data) {
         res.status(result.statusCode).json(result.data);
     }
     else {
-        res.status(result.statusCode).json(result.error);
+        res
+            .status(result.statusCode >= 500 ? 502 : result.statusCode)
+            .json({ error: "Bedrock request failed" });
     }
 }
 export async function BedrockPOST(request) {
+    const headers = { "Content-Type": "application/json" };
+    const gateReq = {
+        method: request.method,
+        headers: {
+            origin: request.headers.get("origin") ?? undefined,
+            referer: request.headers.get("referer") ?? undefined,
+            host: request.headers.get("host") ?? undefined,
+            "x-forwarded-for": request.headers.get("x-forwarded-for") ?? undefined,
+            "x-real-ip": request.headers.get("x-real-ip") ?? undefined,
+        },
+    };
+    const gate = evaluateGate(gateReq, { maxRequests: 30, windowMs: 60 * 1000, bucket: "bedrock" });
+    if (!gate.ok) {
+        return new Response(JSON.stringify({ error: gate.error }), {
+            status: gate.status ?? 403,
+            headers,
+        });
+    }
     try {
         const body = await request.json();
-        const requestBody = body?.body;
-        const result = await invokeBedrock(requestBody);
-        const headers = {
-            "Content-Type": "application/json",
-        };
-        if (result.success && result.data) {
-            return new Response(JSON.stringify(result.data), {
-                status: result.statusCode,
+        const sanitized = sanitizeClaudeRequest(body);
+        if (!sanitized.ok) {
+            return new Response(JSON.stringify({ error: "Invalid request body" }), {
+                status: 400,
                 headers,
             });
         }
-        else {
-            return new Response(JSON.stringify(result.error), {
+        const result = await invokeBedrock(sanitized.body);
+        if (result.success && result.data) {
+            return new Response(JSON.stringify(result.data), {
                 status: result.statusCode,
                 headers,
             });
         }
+        return new Response(JSON.stringify({ error: "Bedrock request failed" }), {
+            status: result.statusCode >= 500 ? 502 : result.statusCode,
+            headers,
+        });
     }
-    catch (error) {
-        return new Response(JSON.stringify({
-            error: "Invalid request",
-            message: error instanceof Error ? error.message : "Unknown error",
-        }), {
+    catch {
+        return new Response(JSON.stringify({ error: "Invalid request" }), {
             status: 400,
-            headers: { "Content-Type": "application/json" },
+            headers,
         });
     }
 }

package/dist/server/index.d.ts

@@ -7,4 +7,9 @@ export { BedrockPOST } from "./bedrock-handler.js";
 export { BedrockEmbeddingPOST } from "./bedrock-embedding-handler.js";
 export { createOpenSearchProxyHandler, DEFAULT_OPENSEARCH_PROXY_PATH, } from "./opensearch-handler.js";
 export type { VectorSearchProxyRequest, VectorSearchProxyResponse, } from "./opensearch-handler.js";
+export { attachSarvamSttRelay } from "./sarvam-stt-relay.js";
+export type { SarvamSttRelayOptions } from "./sarvam-stt-relay.js";
+export { evaluateGate, isOriginAllowed, getClientId, checkRateLimit, isTrustProxyEnabled, parseAllowedOrigins, } from "./security.js";
+export type { GateRequestLike, GateOptions, GateResult } from "./security.js";
+export { SARVAM_TTS_LANGUAGES, SARVAM_STT_LANGUAGES, DEFAULT_LANGUAGE, } from "../languages.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAGtE,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAGtE,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAInE,OAAO,EACL,YAAY,EACZ,eAAe,EACf,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAG9E,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC"}

package/dist/server/index.js

@@ -6,3 +6,6 @@ export { POST } from "./azure-speech-handler.js";
 export { BedrockPOST } from "./bedrock-handler.js";
 export { BedrockEmbeddingPOST } from "./bedrock-embedding-handler.js";
 export { createOpenSearchProxyHandler, DEFAULT_OPENSEARCH_PROXY_PATH, } from "./opensearch-handler.js";
+export { attachSarvamSttRelay } from "./sarvam-stt-relay.js";
+export { evaluateGate, isOriginAllowed, getClientId, checkRateLimit, isTrustProxyEnabled, parseAllowedOrigins, } from "./security.js";
+export { SARVAM_TTS_LANGUAGES, SARVAM_STT_LANGUAGES, DEFAULT_LANGUAGE, } from "../languages.js";

package/dist/server/opensearch-env-handler.d.ts

@@ -1,4 +1,5 @@
-type NextApiRequest = {
+import { type GateRequestLike } from "./security.js";
+type NextApiRequest = GateRequestLike & {
     method?: string;
     headers?: {
         [key: string]: string | string[] | undefined;

package/dist/server/opensearch-env-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opensearch-env-handler.d.ts","sourceRoot":"","sources":["../../src/server/opensearch-env-handler.ts"],"names":[],"mappings":"AAuBA,KAAK,cAAc,GAAG;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;KAAE,CAAC;IAC3D,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,KAAK,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7C,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrC,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,eAAe,CAAC;IAC1C,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC;IAC1B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC;CAC7D,CAAC;AAmFF,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,IAAI,CAAC,CA6Hf;AAMD,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,IAAI,CAAC,CAgFf"}
+{"version":3,"file":"opensearch-env-handler.d.ts","sourceRoot":"","sources":["../../src/server/opensearch-env-handler.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAgB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAGnE,KAAK,cAAc,GAAG,eAAe,GAAG;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;KAAE,CAAC;IAC3D,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,KAAK,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7C,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrC,CAAC;AAMF,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,eAAe,CAAC;IAC1C,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC;IAC1B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC;CAC7D,CAAC;AAuCF,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,IAAI,CAAC,CA8Hf;AAMD,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,IAAI,CAAC,CA8Ef"}

package/dist/server/opensearch-env-handler.js

@@ -1,32 +1,5 @@
-const rateLimitMap = new Map();
-function checkRateLimit(identifier, maxRequests, windowMs) {
-    const now = Date.now();
-    const record = rateLimitMap.get(identifier);
-    if (!record || now > record.resetTime) {
-        rateLimitMap.set(identifier, {
-            count: 1,
-            resetTime: now + windowMs,
-        });
-        return true;
-    }
-    if (record.count >= maxRequests) {
-        return false;
-    }
-    record.count++;
-    return true;
-}
-function getClientIdentifier(req) {
-    const forwardedFor = req.headers?.["x-forwarded-for"];
-    if (forwardedFor) {
-        const ip = Array.isArray(forwardedFor) ? forwardedFor[0] : forwardedFor;
-        return ip.split(",")[0].trim();
-    }
-    const realIp = req.headers?.["x-real-ip"];
-    if (realIp) {
-        return Array.isArray(realIp) ? realIp[0] : realIp;
-    }
-    return req.socket?.remoteAddress || "unknown";
-}
+import { evaluateGate } from "./security.js";
+const SEARCH_SOURCE_FIELDS = ["name", "path", "keywords", "description"];
 let opensearchClient = null;
 async function getOpenSearchClient() {
     if (!opensearchClient) {
@@ -56,12 +29,13 @@ export async function openSearchSearchHandler(req, res) {
         res.status(405).json({ error: "Method not allowed" });
         return;
     }
-    const clientId = getClientIdentifier(req);
-    if (!checkRateLimit(clientId, 20, 60 * 1000)) {
-        res.status(429).json({
-            error: "Too many requests",
-            message: "Rate limit exceeded. Please try again later.",
-        });
+    const gate = evaluateGate(req, {
+        maxRequests: 20,
+        windowMs: 60 * 1000,
+        bucket: "ossearch",
+    });
+    if (!gate.ok) {
+        res.status(gate.status ?? 403).json({ error: gate.error });
         return;
     }
     const { query, vector, size = 10 } = req.body || {};
@@ -122,14 +96,15 @@ export async function openSearchSearchHandler(req, res) {
                     body: {
                         size: Math.min(size, 100),
                         query: {
-                            query_string: {
+                            simple_query_string: {
                                 query: query,
-                                default_operator: "OR",
-                                analyze_wildcard: true,
+                                fields: ["name^3", "keywords^2", "description", "text"],
+                                default_operator: "and",
+                                flags: "NONE",
                                 lenient: true,
                             },
                         },
-                        _source: true,
+                        _source: SEARCH_SOURCE_FIELDS,
                     },
                 });
             }
@@ -146,10 +121,7 @@ export async function openSearchSearchHandler(req, res) {
     }
     catch (error) {
         console.error("[VoiceNavigation] OpenSearch search error:", error);
-        res.status(500).json({
-            error: "Search failed",
-            message: error instanceof Error ? error.message : "Unknown error",
-        });
+        res.status(500).json({ error: "Search failed" });
     }
 }
 export async function openSearchSuggestHandler(req, res) {
@@ -158,12 +130,13 @@ export async function openSearchSuggestHandler(req, res) {
         res.status(405).json({ error: "Method not allowed" });
         return;
     }
-    const clientId = getClientIdentifier(req);
-    if (!checkRateLimit(clientId, 30, 60 * 1000)) {
-        res.status(429).json({
-            error: "Too many requests",
-            message: "Rate limit exceeded. Please try again later.",
-        });
+    const gate = evaluateGate(req, {
+        maxRequests: 30,
+        windowMs: 60 * 1000,
+        bucket: "ossuggest",
+    });
+    if (!gate.ok) {
+        res.status(gate.status ?? 403).json({ error: gate.error });
         return;
     }
     const { query } = req.body || {};
@@ -213,9 +186,6 @@ export async function openSearchSuggestHandler(req, res) {
     }
     catch (error) {
         console.error("[VoiceNavigation] OpenSearch suggest error:", error);
-        res.status(500).json({
-            error: "Suggestion failed",
-            message: error instanceof Error ? error.message : "Unknown error",
-        });
+        res.status(500).json({ error: "Suggestion failed" });
     }
 }

package/dist/server/sarvam-stt-relay.d.ts

@@ -0,0 +1,8 @@
+import type { Server as HttpServer } from "http";
+import { WebSocketServer } from "ws";
+export interface SarvamSttRelayOptions {
+    path?: string;
+    connectTimeoutMs?: number;
+}
+export declare function attachSarvamSttRelay(server: HttpServer, options?: SarvamSttRelayOptions): WebSocketServer;
+//# sourceMappingURL=sarvam-stt-relay.d.ts.map

package/dist/server/sarvam-stt-relay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarvam-stt-relay.d.ts","sourceRoot":"","sources":["../../src/server/sarvam-stt-relay.ts"],"names":[],"mappings":"AA0CA,OAAO,KAAK,EAAE,MAAM,IAAI,UAAU,EAAmB,MAAM,MAAM,CAAC;AAElE,OAAO,EAA8B,eAAe,EAAE,MAAM,IAAI,CAAC;AAiDjE,MAAM,WAAW,qBAAqB;IAEpC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAUD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,EAClB,OAAO,GAAE,qBAA0B,GAClC,eAAe,CA2HjB"}

package/dist/server/sarvam-stt-relay.js

@@ -0,0 +1,111 @@
+import { WebSocket as NodeWebSocket, WebSocketServer } from "ws";
+import { isOriginAllowed, getClientId, checkRateLimit } from "./security.js";
+import { SARVAM_STT_LANGUAGES, DEFAULT_LANGUAGE } from "../languages.js";
+const ALLOWED_STT_MODELS = new Set(["saaras:v3", "saarika:v2.5"]);
+const ALLOWED_SAMPLE_RATES = new Set(["8000", "16000"]);
+const ALLOWED_BOOLEANS = new Set(["true", "false"]);
+function buildSafeUpstreamQuery(clientParams) {
+    const out = new URLSearchParams();
+    const language = clientParams.get("language-code") ?? "";
+    out.set("language-code", SARVAM_STT_LANGUAGES.includes(language) ? language : DEFAULT_LANGUAGE);
+    const model = clientParams.get("model") ?? "";
+    out.set("model", ALLOWED_STT_MODELS.has(model) ? model : "saaras:v3");
+    const sampleRate = clientParams.get("sample_rate") ?? "";
+    out.set("sample_rate", ALLOWED_SAMPLE_RATES.has(sampleRate) ? sampleRate : "16000");
+    out.set("input_audio_codec", "wav");
+    for (const key of ["high_vad_sensitivity", "vad_signals", "flush_signal"]) {
+        const value = clientParams.get(key);
+        if (value !== null && ALLOWED_BOOLEANS.has(value)) {
+            out.set(key, value);
+        }
+    }
+    return out.toString();
+}
+function rejectUpgrade(socket, status, reason) {
+    try {
+        socket.write(`HTTP/1.1 ${status} ${reason}\r\nConnection: close\r\n\r\n`);
+    }
+    catch {
+    }
+    socket.destroy();
+}
+const DEFAULT_PATH = "/api/speech/sarvam-stt";
+const DEFAULT_CONNECT_TIMEOUT_MS = 10000;
+const SARVAM_STT_WS_URL = "wss://api.sarvam.ai/speech-to-text/ws";
+export function attachSarvamSttRelay(server, options = {}) {
+    const path = options.path ?? DEFAULT_PATH;
+    const connectTimeoutMs = options.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;
+    const wss = new WebSocketServer({ noServer: true });
+    server.on("upgrade", (req, socket, head) => {
+        const requestUrl = new URL(req.url ?? "", "http://localhost");
+        if (requestUrl.pathname !== path) {
+            return;
+        }
+        if (!isOriginAllowed(req)) {
+            rejectUpgrade(socket, 403, "Forbidden");
+            return;
+        }
+        if (!checkRateLimit(`stt:${getClientId(req)}`, 15, 60 * 1000)) {
+            rejectUpgrade(socket, 429, "Too Many Requests");
+            return;
+        }
+        const apiKey = process.env.SARVAM_API_KEY;
+        if (!apiKey) {
+            console.error("[VoiceNavigation] Missing SARVAM_API_KEY. Set it in your .env file to enable the Sarvam STT relay.");
+            socket.destroy();
+            return;
+        }
+        const safeQuery = buildSafeUpstreamQuery(requestUrl.searchParams);
+        const upstream = new NodeWebSocket(`${SARVAM_STT_WS_URL}?${safeQuery}`, [`api-subscription-key.${apiKey}`], { headers: { "Api-Subscription-Key": apiKey } });
+        const connectTimeout = setTimeout(() => {
+            upstream.terminate();
+        }, connectTimeoutMs);
+        upstream.once("open", () => {
+            clearTimeout(connectTimeout);
+            wss.handleUpgrade(req, socket, head, (clientSocket) => {
+                let closedByClient = false;
+                let closedByUpstream = false;
+                upstream.on("message", (data, isBinary) => {
+                    if (clientSocket.readyState === clientSocket.OPEN) {
+                        clientSocket.send(data, { binary: isBinary });
+                    }
+                });
+                upstream.on("close", () => {
+                    closedByUpstream = true;
+                    if (!closedByClient &&
+                        clientSocket.readyState === clientSocket.OPEN) {
+                        clientSocket.close();
+                    }
+                });
+                upstream.on("error", (error) => {
+                    console.error("[VoiceNavigation] Sarvam STT upstream error:", error);
+                    if (clientSocket.readyState === clientSocket.OPEN) {
+                        clientSocket.close();
+                    }
+                });
+                clientSocket.on("message", (data, isBinary) => {
+                    if (upstream.readyState === upstream.OPEN) {
+                        upstream.send(data, { binary: isBinary });
+                    }
+                });
+                clientSocket.on("close", () => {
+                    closedByClient = true;
+                    if (!closedByUpstream && upstream.readyState === upstream.OPEN) {
+                        upstream.close();
+                    }
+                });
+                clientSocket.on("error", () => {
+                    if (upstream.readyState === upstream.OPEN) {
+                        upstream.close();
+                    }
+                });
+            });
+        });
+        upstream.once("error", (error) => {
+            clearTimeout(connectTimeout);
+            console.error("[VoiceNavigation] Failed to connect to Sarvam STT upstream:", error);
+            socket.destroy();
+        });
+    });
+    return wss;
+}

package/dist/server/security.d.ts

@@ -0,0 +1,26 @@
+export interface GateRequestLike {
+    method?: string;
+    headers?: {
+        [key: string]: string | string[] | undefined;
+    };
+    socket?: {
+        remoteAddress?: string;
+    };
+}
+export interface GateOptions {
+    maxRequests: number;
+    windowMs: number;
+    bucket?: string;
+}
+export interface GateResult {
+    ok: boolean;
+    status?: number;
+    error?: string;
+}
+export declare function isTrustProxyEnabled(): boolean;
+export declare function parseAllowedOrigins(): string[];
+export declare function getClientId(req: GateRequestLike): string;
+export declare function isOriginAllowed(req: GateRequestLike): boolean;
+export declare function checkRateLimit(identifier: string, maxRequests: number, windowMs: number): boolean;
+export declare function evaluateGate(req: GateRequestLike, options: GateOptions): GateResult;
+//# sourceMappingURL=security.d.ts.map

package/dist/server/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/server/security.ts"],"names":[],"mappings":"AA4BA,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;KAAE,CAAC;IAC3D,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrC;AAED,MAAM,WAAW,WAAW;IAE1B,WAAW,EAAE,MAAM,CAAC;IAEpB,QAAQ,EAAE,MAAM,CAAC;IAKjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA4BD,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAGD,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAK9C;AAOD,wBAAgB,WAAW,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAYxD;AAQD,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAqB7D;AAMD,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CA0BT;AAMD,wBAAgB,YAAY,CAC1B,GAAG,EAAE,eAAe,EACpB,OAAO,EAAE,WAAW,GACnB,UAAU,CAWZ"}

package/dist/server/security.js

@@ -0,0 +1,89 @@
+const rateLimitMap = new Map();
+const MAX_TRACKED_CLIENTS = 20000;
+function headerString(value) {
+    if (Array.isArray(value)) {
+        return value[0] ?? "";
+    }
+    return value ?? "";
+}
+function hostOf(urlOrOrigin) {
+    try {
+        return new URL(urlOrOrigin).host;
+    }
+    catch {
+        return null;
+    }
+}
+export function isTrustProxyEnabled() {
+    return String(process.env.VOICE_NAV_TRUST_PROXY || "").toLowerCase() === "true";
+}
+export function parseAllowedOrigins() {
+    return String(process.env.VOICE_NAV_ALLOWED_ORIGINS || "")
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+}
+export function getClientId(req) {
+    if (isTrustProxyEnabled()) {
+        const forwardedFor = headerString(req.headers?.["x-forwarded-for"]);
+        if (forwardedFor) {
+            return forwardedFor.split(",")[0].trim();
+        }
+        const realIp = headerString(req.headers?.["x-real-ip"]);
+        if (realIp) {
+            return realIp;
+        }
+    }
+    return req.socket?.remoteAddress || "unknown";
+}
+export function isOriginAllowed(req) {
+    const origin = headerString(req.headers?.origin);
+    const referer = headerString(req.headers?.referer);
+    const host = headerString(req.headers?.host);
+    const candidateHost = origin
+        ? hostOf(origin)
+        : referer
+            ? hostOf(referer)
+            : null;
+    if (!candidateHost) {
+        return false;
+    }
+    const allowed = parseAllowedOrigins();
+    if (allowed.length > 0) {
+        return allowed.some((entry) => (hostOf(entry) || entry) === candidateHost);
+    }
+    return host ? candidateHost === host : false;
+}
+export function checkRateLimit(identifier, maxRequests, windowMs) {
+    const now = Date.now();
+    if (rateLimitMap.size > MAX_TRACKED_CLIENTS) {
+        for (const [key, record] of rateLimitMap) {
+            if (now > record.resetTime) {
+                rateLimitMap.delete(key);
+            }
+        }
+        if (rateLimitMap.size > MAX_TRACKED_CLIENTS) {
+            rateLimitMap.clear();
+        }
+    }
+    const record = rateLimitMap.get(identifier);
+    if (!record || now > record.resetTime) {
+        rateLimitMap.set(identifier, { count: 1, resetTime: now + windowMs });
+        return true;
+    }
+    if (record.count >= maxRequests) {
+        return false;
+    }
+    record.count++;
+    return true;
+}
+export function evaluateGate(req, options) {
+    if (!isOriginAllowed(req)) {
+        return { ok: false, status: 403, error: "Origin not allowed" };
+    }
+    const key = `${options.bucket ?? "default"}:${getClientId(req)}`;
+    if (!checkRateLimit(key, options.maxRequests, options.windowMs)) {
+        return { ok: false, status: 429, error: "Too many requests" };
+    }
+    return { ok: true };
+}

package/dist/services/bedrock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bedrock.d.ts","sourceRoot":"","sources":["../../src/services/bedrock.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,mBAAmB,EAAmB,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,WAAW,aAAa;IAE5B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAG3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAqDD,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAqC;IACnD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,gBAAgB,CAAgB;IACxC,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,QAAQ,CAAkB;gBAEtB,MAAM,EAAE,aAAa;IA6CjC,eAAe,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI;IAO7C,OAAO,CAAC,iBAAiB;IA+BnB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;YAWtD,qBAAqB;YA2ErB,mBAAmB;IAyEjC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,cAAc;IAO9C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAWlC,iBAAiB;YAkFjB,eAAe;IAwFvB,uBAAuB,CAC3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC;YA0BJ,wBAAwB;YAwExB,sBAAsB;CA+DrC"}
+{"version":3,"file":"bedrock.d.ts","sourceRoot":"","sources":["../../src/services/bedrock.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,mBAAmB,EAAmB,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,WAAW,aAAa;IAE5B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAG3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAiED,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAqC;IACnD,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,gBAAgB,CAAgB;IACxC,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,QAAQ,CAAkB;gBAEtB,MAAM,EAAE,aAAa;IA6CjC,eAAe,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI;IAO7C,OAAO,CAAC,iBAAiB;IA+BnB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;YAWtD,qBAAqB;YA2ErB,mBAAmB;IAyEjC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,cAAc;IAO9C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAWlC,iBAAiB;YAkFjB,eAAe;IAwFvB,uBAAuB,CAC3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC;YA2BJ,wBAAwB;YAwExB,sBAAsB;CA+DrC"}

package/dist/services/bedrock.js

@@ -11,12 +11,24 @@ CRITICAL RULES:
 6. FOR PAGE NAVIGATION, USE THE EXACT "navigate_<id>" ACTION PROVIDED FOR THAT PAGE
 7. IF UNCERTAIN, RESPOND WITH {"action": "unknown"}
 
+MULTILINGUAL INPUT:
+- The user may speak in ANY supported Indian language (e.g. Hindi, Tamil, Telugu, Bengali, Marathi, Gujarati, Kannada, Malayalam, Punjabi, Odia, Assamese, Urdu, and others), or mix languages.
+- Understand the MEANING of the command regardless of the input language and map it to the correct action.
+- The "action" value, action IDs, and "navigate_<id>" page IDs are ALWAYS in English/ASCII and MUST NOT be translated or transliterated.
+- For "query" (search) and "text" (type) fields, preserve the user's own words as spoken.
+
 RESPONSE FORMAT:
 - Core actions: {"action": "action_name"}
 - Search: {"action": "search_content", "query": "keywords"}
 - Type text: {"action": "type_text", "text": "text to type"}
 - Page navigation: {"action": "navigate_<page_id>"}
 
+MULTILINGUAL EXAMPLES:
+- User says "नीचे स्क्रॉल करो" (Hindi: scroll down) → {"action": "scroll_down"}
+- User says "डैशबोर्ड खोलो" (Hindi: open dashboard) → {"action": "navigate_dashboard"}
+- User says "மேலே செல்" (Tamil: go up) → {"action": "scroll_up"}
+- User says "వెనక్కి వెళ్ళు" (Telugu: go back) → {"action": "go_back"}
+
 EXAMPLES:
 - User says "go to dashboard" → {"action": "navigate_dashboard"}
 - User says "show me the team page" → {"action": "navigate_team"}
@@ -362,6 +374,7 @@ export class BedrockService {
 Generate brief, natural, conversational feedback messages (maximum 10 words).
 Be specific and clear about what action was performed.
 Use the language: ${language}
+Never output internal action identifiers, underscores, technical codes, or JSON — describe the action only in plain, everyday words a non-technical listener would understand.
 Respond with ONLY the feedback message text, no JSON, no explanations.`;
         const userPrompt = prompt;
         console.log("[Bedrock] Using proxy mode:", this.useProxy);

package/dist/services/sarvam-speech.d.ts

@@ -0,0 +1,47 @@
+export interface SarvamSpeechConfig {
+    ttsUrl?: string;
+    sttUrl?: string;
+    sttModel?: "saaras:v3" | "saarika:v2.5";
+    ttsModel?: "bulbul:v3" | "bulbul:v2";
+    speaker?: string;
+    sttSampleRate?: 8000 | 16000;
+    ttsSampleRate?: 8000 | 16000 | 22050 | 24000 | 32000 | 44100 | 48000;
+}
+export interface SarvamSttHandlers {
+    onPartial?: (text: string) => void;
+    onFinal?: (text: string) => void;
+    onSpeechStart?: () => void;
+    onSpeechEnd?: () => void;
+    onError?: (error: Error) => void;
+    shouldSendAudio?: () => boolean;
+}
+export declare class SarvamSpeechService {
+    private readonly ttsUrl;
+    private readonly sttUrl;
+    private readonly sttModel;
+    private readonly ttsModel;
+    private readonly speaker;
+    private readonly sttSampleRate;
+    private readonly ttsSampleRate;
+    private sttSocket;
+    private sttContext;
+    private sttMediaStream;
+    private sttSourceNode;
+    private sttProcessorNode;
+    private audioElement;
+    private currentBlobUrl;
+    private speechGeneration;
+    private listeningGeneration;
+    constructor(config?: SarvamSpeechConfig);
+    startListening(language: string, handlers: SarvamSttHandlers): Promise<void>;
+    private sendFlush;
+    stopListening(): Promise<void>;
+    speak(text: string, opts?: {
+        language?: string;
+        onAudioStart?: () => void;
+    }): Promise<void>;
+    stopSpeaking(): void;
+    dispose(): Promise<void>;
+    private cleanupAudioElement;
+}
+//# sourceMappingURL=sarvam-speech.d.ts.map