@open-everywhere/adapters 0.4.0 → 0.6.0

package/dist/agent/meetings/native-meet.js

@@ -0,0 +1,176 @@
+// The Google Meet native-transcript reader (OPE-2471): the Meet REST API v2, read through the organisation's
+// service account with domain-wide delegation, acting as the meeting's organiser.
+//
+//   1. token:       a JWT signed with the service account's key (RS256), `sub` = the organiser, scope
+//                   `meetings.space.readonly`, exchanged at oauth2.googleapis.com/token
+//   2. records:     GET /v2/conferenceRecords?filter=space.meeting_code="<code>" — one per session
+//   3. transcripts: GET /v2/<record>/transcripts — state STARTED, ENDED or FILE_GENERATED
+//   4. entries:     GET /v2/<transcript>/entries — the spoken lines, each naming a participant
+//   5. names:       GET /v2/<record>/participants — the participants' display names
+//
+// WHAT THE ADMIN GRANTS: the Google Meet REST API on the service account's Cloud project, and domain-wide
+// delegation of `https://www.googleapis.com/auth/meetings.space.readonly` to the service account's client id
+// in the Workspace Admin console. The meeting needs transcription on. Google keeps transcript entries for 30
+// days after the conference ends, so an older record is `expired`.
+import { createSign } from "node:crypto";
+import { TokenCache, onHost, readJsonLoose, unexpectedStatus, timedFetch } from "./native-http.js";
+const MEET = "https://meet.googleapis.com/v2";
+const TOKEN_URI = "https://oauth2.googleapis.com/token";
+export const MEET_SCOPE = "https://www.googleapis.com/auth/meetings.space.readonly";
+const MAX_PAGES = 100;
+export const MEET_ACCESS_HINT = "In the Google Workspace Admin console, grant the service account's client id domain-wide delegation of https://www.googleapis.com/auth/meetings.space.readonly, and enable the Google Meet REST API in its Cloud project.";
+const b64url = (v) => Buffer.from(v).toString("base64url");
+/** The signed JWT-bearer assertion for one organiser. The test verifies its signature from the token request. */
+function meetAssertion(key, subject, nowMs) {
+    const iat = Math.floor(nowMs / 1000);
+    const head = b64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+    const claims = b64url(JSON.stringify({ iss: key.client_email, sub: subject, scope: MEET_SCOPE, aud: TOKEN_URI, iat, exp: iat + 3600 }));
+    const signer = createSign("RSA-SHA256");
+    signer.update(`${head}.${claims}`);
+    return `${head}.${claims}.${b64url(signer.sign(key.private_key))}`;
+}
+function str(o, k) {
+    const v = o?.[k];
+    return typeof v === "string" ? v : undefined;
+}
+export function meetTranscriptSource(fetchImpl = timedFetch, now = Date.now) {
+    const tokens = new TokenCache();
+    async function token(keyJson, subject) {
+        let key;
+        try {
+            const k = JSON.parse(keyJson);
+            if (typeof k.client_email !== "string" || typeof k.private_key !== "string")
+                throw new Error("shape");
+            key = { client_email: k.client_email, private_key: k.private_key };
+        }
+        catch {
+            return { status: "refused", reason: "credential", hint: "The stored service-account key is not a Google JSON key file." };
+        }
+        const cacheKey = `${key.client_email}\n${subject}`;
+        const cached = tokens.get(cacheKey, now());
+        if (cached !== undefined)
+            return cached;
+        let assertion;
+        try {
+            assertion = meetAssertion(key, subject, now());
+        }
+        catch {
+            return { status: "refused", reason: "credential", hint: "The stored service-account key's private key does not sign." };
+        }
+        const res = await fetchImpl(TOKEN_URI, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({ grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer", assertion }).toString(),
+        });
+        const body = await readJsonLoose(res);
+        if (!res.ok) {
+            // `unauthorized_client`: the delegation for this scope is not granted. Anything else on a 4xx is the key.
+            if (body.error === "unauthorized_client")
+                return { status: "refused", reason: "access-off", hint: MEET_ACCESS_HINT };
+            if (res.status >= 400 && res.status < 500)
+                return { status: "refused", reason: "credential", hint: "Google refused the service account's key, or the organiser is not a user in the Workspace." };
+            throw unexpectedStatus("the Google token endpoint", res.status);
+        }
+        if (typeof body.access_token !== "string")
+            throw unexpectedStatus("the Google token endpoint", res.status);
+        tokens.set(cacheKey, body.access_token, body.expires_in, now());
+        return body.access_token;
+    }
+    async function get(url, bearer, what) {
+        if (!onHost(url, "meet.googleapis.com"))
+            throw new Error(`${what}: refusing to send the token off meet.googleapis.com`);
+        const res = await fetchImpl(url, { headers: { authorization: `Bearer ${bearer}` } });
+        if (res.status === 401)
+            return { ok: false, result: { status: "refused", reason: "credential", hint: "Google refused the service account's token." } };
+        if (res.status === 403)
+            return { ok: false, result: { status: "refused", reason: "access-off", hint: MEET_ACCESS_HINT } };
+        if (res.status === 404)
+            return { ok: false, result: { status: "refused", reason: "expired" } };
+        if (!res.ok)
+            throw unexpectedStatus(what, res.status);
+        return { ok: true, body: await readJsonLoose(res) };
+    }
+    /** Every page of a list, by `nextPageToken`. A refusal on any page is the answer. */
+    async function list(base, field, bearer, what) {
+        const out = [];
+        let pageToken;
+        for (let page = 0; page < MAX_PAGES; page++) {
+            const sep = base.includes("?") ? "&" : "?";
+            const got = await get(`${base}${sep}pageSize=100${pageToken !== undefined ? `&pageToken=${encodeURIComponent(pageToken)}` : ""}`, bearer, what);
+            if (!got.ok)
+                return got.result;
+            const items = got.body[field];
+            if (Array.isArray(items))
+                out.push(...items);
+            pageToken = str(got.body, "nextPageToken");
+            if (pageToken === undefined || pageToken === "")
+                break;
+        }
+        return out;
+    }
+    return {
+        platform: "meet",
+        disclosure: "OE reads the transcript Google Meet made, through the Meet REST API, with the organisation's own service account acting as the organiser (domain-wide delegation, read-only).",
+        async read(ref, ctx) {
+            const m = ctx.policy.meet;
+            if (m === undefined)
+                return { status: "refused", reason: "credential", hint: "The meeting policy declares no Google Meet credential." };
+            const subject = ref.organiserEmail;
+            if (subject === undefined || !m.domains.includes(subject.slice(subject.lastIndexOf("@") + 1)))
+                return { status: "refused", reason: "not-found" };
+            const tok = await token(await ctx.secret(m.serviceAccountKeyRef), subject);
+            if (typeof tok !== "string")
+                return tok;
+            const filter = `space.meeting_code = "${ref.roomId}"`;
+            const listed = await list(`${MEET}/conferenceRecords?filter=${encodeURIComponent(filter)}`, "conferenceRecords", tok, "the Meet conference list");
+            if (!Array.isArray(listed))
+                return listed.status === "refused" && listed.reason === "expired" ? { status: "refused", reason: "not-found" } : listed;
+            const records = listed
+                .map((r) => ({ name: str(r, "name") ?? "", ...(str(r, "startTime") ? { startTime: str(r, "startTime") } : {}), ...(str(r, "endTime") ? { endTime: str(r, "endTime") } : {}), ...(str(r, "expireTime") ? { expireTime: str(r, "expireTime") } : {}) }))
+                .filter((r) => r.name.startsWith("conferenceRecords/") && (ref.startedAfter === undefined || Date.parse(r.startTime ?? "") >= ref.startedAfter))
+                .sort((a, b) => Date.parse(b.startTime ?? "") - Date.parse(a.startTime ?? ""));
+            const rec = records[0];
+            // No session yet, or the session is on now.
+            if (rec === undefined || rec.endTime === undefined)
+                return { status: "pending" };
+            if (rec.expireTime !== undefined && Date.parse(rec.expireTime) <= now())
+                return { status: "refused", reason: "expired" };
+            const transcripts = await list(`${MEET}/${rec.name}/transcripts`, "transcripts", tok, "the Meet transcript list");
+            if (!Array.isArray(transcripts))
+                return transcripts;
+            if (transcripts.length === 0)
+                return { status: "refused", reason: "not-transcribed" };
+            const done = transcripts.filter((t) => str(t, "state") === "ENDED" || str(t, "state") === "FILE_GENERATED");
+            if (done.length < transcripts.length)
+                return { status: "pending" };
+            const people = await list(`${MEET}/${rec.name}/participants`, "participants", tok, "the Meet participant list");
+            if (!Array.isArray(people))
+                return people;
+            const names = new Map();
+            for (const p of people) {
+                const o = p;
+                const who = str(o.signedinUser, "displayName") ?? str(o.anonymousUser, "displayName") ?? str(o.phoneUser, "displayName");
+                const name = str(o, "name");
+                if (name !== undefined && who !== undefined)
+                    names.set(name, who);
+            }
+            const start = Date.parse(rec.startTime ?? "");
+            const segments = [];
+            for (const t of done) {
+                const entries = await list(`${MEET}/${str(t, "name")}/entries`, "transcriptEntries", tok, "the Meet transcript entries");
+                if (!Array.isArray(entries))
+                    return entries;
+                for (const e of entries) {
+                    const text = str(e, "text");
+                    if (text === undefined)
+                        continue;
+                    const at = Date.parse(str(e, "startTime") ?? "");
+                    segments.push({ speaker: names.get(str(e, "participant") ?? "") ?? "", text, ...(Number.isFinite(at) && Number.isFinite(start) ? { startMs: Math.max(0, at - start) } : {}) });
+                }
+            }
+            segments.sort((a, b) => (a.startMs ?? 0) - (b.startMs ?? 0));
+            return { status: "ready", segments, ...(rec.startTime !== undefined ? { startedAt: rec.startTime } : {}), endedAt: rec.endTime };
+        },
+    };
+}
+//# sourceMappingURL=native-meet.js.map

package/dist/agent/meetings/native-meet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-meet.js","sourceRoot":"","sources":["../../../agent/meetings/native-meet.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,kFAAkF;AAClF,EAAE;AACF,sGAAsG;AACtG,wFAAwF;AACxF,mGAAmG;AACnG,0FAA0F;AAC1F,+FAA+F;AAC/F,oFAAoF;AACpF,EAAE;AACF,0GAA0G;AAC1G,6GAA6G;AAC7G,6GAA6G;AAC7G,mEAAmE;AAEnE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAoB,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAErH,MAAM,IAAI,GAAG,gCAAgC,CAAC;AAC9C,MAAM,SAAS,GAAG,qCAAqC,CAAC;AACxD,MAAM,CAAC,MAAM,UAAU,GAAG,yDAAyD,CAAC;AACpF,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,MAAM,CAAC,MAAM,gBAAgB,GAC3B,2NAA2N,CAAC;AAE9N,MAAM,MAAM,GAAG,CAAC,CAAkB,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEpF,iHAAiH;AACjH,SAAS,aAAa,CAAC,GAAoE,EAAE,OAAe,EAAE,KAAa;IACzH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IACxI,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC,CAAC;IACnC,OAAO,GAAG,IAAI,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC;AASD,SAAS,GAAG,CAAC,CAAU,EAAE,CAAS;IAChC,MAAM,CAAC,GAAI,CAAoC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAS,GAAgB,UAAU,EAAE,GAAG,GAAiB,IAAI,CAAC,GAAG;IACpG,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;IAEhC,KAAK,UAAU,KAAK,CAAC,OAAe,EAAE,OAAe;QACnD,IAAI,GAAkD,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;YACzD,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;YACtG,GAAG,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,+DAA+D,EAAE,CAAC;QAC5H,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,6DAA6D,EAAE,CAAC;QAC1H,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,6CAA6C,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE;SAC/G,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,0GAA0G;YAC1G,IAAI,IAAI,CAAC,KAAK,KAAK,qBAAqB;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;YACrH,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,4FAA4F,EAAE,CAAC;YAClM,MAAM,gBAAgB,CAAC,2BAA2B,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;YAAE,MAAM,gBAAgB,CAAC,2BAA2B,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3G,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAID,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,MAAc,EAAE,IAAY;QAC1D,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,qBAAqB,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,sDAAsD,CAAC,CAAC;QACxH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACrF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,6CAA6C,EAAE,EAAE,CAAC;QACvJ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,CAAC;QAC1H,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC;QAC/F,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,qFAAqF;IACrF,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,KAAa,EAAE,MAAc,EAAE,IAAY;QAC3E,MAAM,GAAG,GAAc,EAAE,CAAC;QAC1B,IAAI,SAA6B,CAAC;QAClC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,GAAG,eAAe,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAChJ,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,GAAG,CAAC,MAAM,CAAC;YAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YAC7C,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC3C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE;gBAAE,MAAM;QACzD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,+KAA+K;QAC3L,KAAK,CAAC,IAAI,CAAC,GAAqB,EAAE,GAAsB;YACtD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,wDAAwD,EAAE,CAAC;YACxI,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,CAAC;YACnC,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YACjJ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC,CAAC;YAC3E,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC;YAExC,MAAM,MAAM,GAAG,yBAAyB,GAAG,CAAC,MAAM,GAAG,CAAC;YACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,6BAA6B,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;YAClJ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YACpJ,MAAM,OAAO,GAAc,MAAM;iBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,EAAE,WAAW,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,SAAS,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,EAAE,YAAY,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;iBACxP,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;iBAC/I,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;YACjF,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACvB,4CAA4C;YAC5C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACjF,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,EAAE;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAEzH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,IAAI,cAAc,EAAE,aAAa,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;YAClH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;gBAAE,OAAO,WAAW,CAAC;YACpD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;YACtF,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,OAAO,IAAI,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,gBAAgB,CAAC,CAAC;YAC5G,IAAI,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAEnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,IAAI,eAAe,EAAE,cAAc,EAAE,GAAG,EAAE,2BAA2B,CAAC,CAAC;YAChH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;YAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;YACxC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,CAA4B,CAAC;gBACvC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,YAAY,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;gBACzH,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;gBAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS;oBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YAC9C,MAAM,QAAQ,GAA8B,EAAE,CAAC;YAC/C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,mBAAmB,EAAE,GAAG,EAAE,6BAA6B,CAAC,CAAC;gBACzH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;oBAAE,OAAO,OAAO,CAAC;gBAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;oBAC5B,IAAI,IAAI,KAAK,SAAS;wBAAE,SAAS;oBACjC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;oBACjD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACjL,CAAC;YACH,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;YAC7D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QACnI,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/agent/meetings/native-sources.d.ts

@@ -0,0 +1,2 @@
+export declare function registerNativeTranscriptSources(): void;
+//# sourceMappingURL=native-sources.d.ts.map

package/dist/agent/meetings/native-sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-sources.d.ts","sourceRoot":"","sources":["../../../agent/meetings/native-sources.ts"],"names":[],"mappings":"AASA,wBAAgB,+BAA+B,IAAI,IAAI,CAItD"}

package/dist/agent/meetings/native-sources.js

@@ -0,0 +1,13 @@
+// Boot registration of the three native-transcript readers (OPE-2471). Each one reads only when the meeting
+// policy's `native` block declares its platform and a member approves a `meeting.recap` card, so registering
+// all three is harmless on a deployment that uses none.
+import { registerNativeTranscriptSource } from "@open-everywhere/core/agent/adapter-api.js";
+import { teamsTranscriptSource } from "./native-teams.js";
+import { meetTranscriptSource } from "./native-meet.js";
+import { zoomTranscriptSource } from "./native-zoom.js";
+export function registerNativeTranscriptSources() {
+    registerNativeTranscriptSource(teamsTranscriptSource());
+    registerNativeTranscriptSource(meetTranscriptSource());
+    registerNativeTranscriptSource(zoomTranscriptSource());
+}
+//# sourceMappingURL=native-sources.js.map

package/dist/agent/meetings/native-sources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-sources.js","sourceRoot":"","sources":["../../../agent/meetings/native-sources.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,6GAA6G;AAC7G,wDAAwD;AAExD,OAAO,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,UAAU,+BAA+B;IAC7C,8BAA8B,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACxD,8BAA8B,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACvD,8BAA8B,CAAC,oBAAoB,EAAE,CAAC,CAAC;AACzD,CAAC"}

package/dist/agent/meetings/native-teams.d.ts

@@ -0,0 +1,6 @@
+import type { NativeTranscriptSource } from "@open-everywhere/core/agent/adapter-api.js";
+import { type NativeFetch } from "./native-http.js";
+/** The fixed hint for a 403: what an admin grants. Never response text. */
+export declare const TEAMS_ACCESS_HINT = "In Microsoft Entra, grant the app OnlineMeetings.Read.All and OnlineMeetingTranscript.Read.All (application, admin consent), and add an application access policy that covers the organiser (Grant-CsApplicationAccessPolicy). The Teams meeting policy must allow transcription.";
+export declare function teamsTranscriptSource(fetchImpl?: NativeFetch, now?: () => number): NativeTranscriptSource;
+//# sourceMappingURL=native-teams.d.ts.map

package/dist/agent/meetings/native-teams.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-teams.d.ts","sourceRoot":"","sources":["../../../agent/meetings/native-teams.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAA0B,sBAAsB,EAAuC,MAAM,4CAA4C,CAAC;AAEtJ,OAAO,EAAuE,KAAK,WAAW,EAAc,MAAM,kBAAkB,CAAC;AAMrI,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB,sRACuP,CAAC;AAQtR,wBAAgB,qBAAqB,CAAC,SAAS,GAAE,WAAwB,EAAE,GAAG,GAAE,MAAM,MAAiB,GAAG,sBAAsB,CAoF/H"}

package/dist/agent/meetings/native-teams.js

@@ -0,0 +1,118 @@
+// The Microsoft Teams native-transcript reader (OPE-2471): Microsoft Graph `callTranscript`, read app-only
+// with the organisation's Entra app registration (client credentials).
+//
+//   1. token:      POST login.microsoftonline.com/<tenant>/oauth2/v2.0/token (client_credentials, `.default`)
+//   2. meeting:    GET /users/<organiser>/onlineMeetings?$filter=JoinWebUrl eq '<link>'
+//   3. transcripts: GET /users/<organiser>/onlineMeetings/<id>/transcripts
+//   4. content:    GET …/transcripts/<id>/content?$format=text/vtt — WebVTT with `<v Speaker>` voice spans
+//
+// WHAT THE ADMIN GRANTS (docs/capabilities/meetings.md says it exactly): the application permissions
+// `OnlineMeetings.Read.All` and `OnlineMeetingTranscript.Read.All` with admin consent, and an application
+// access policy that covers the organisers (Graph refuses app-only meeting reads without one). A 403 at any
+// step is the `access-off` refusal: the grant, the policy, or the tenant's transcript switches are off.
+//
+// Graph names a transcript only after the meeting ends, so "no transcript yet" is `pending`, and the watch's
+// deadline turns a meeting that was never transcribed into a plain sentence in the thread.
+import { parseWebVtt } from "@open-everywhere/core/agent/adapter-api.js";
+import { TokenCache, onHost, readCappedText, readJsonLoose, unexpectedStatus, timedFetch } from "./native-http.js";
+const GRAPH = "https://graph.microsoft.com/v1.0";
+const LOGIN = "https://login.microsoftonline.com";
+const MAX_PAGES = 10;
+/** The fixed hint for a 403: what an admin grants. Never response text. */
+export const TEAMS_ACCESS_HINT = "In Microsoft Entra, grant the app OnlineMeetings.Read.All and OnlineMeetingTranscript.Read.All (application, admin consent), and add an application access policy that covers the organiser (Grant-CsApplicationAccessPolicy). The Teams meeting policy must allow transcription.";
+export function teamsTranscriptSource(fetchImpl = timedFetch, now = Date.now) {
+    const tokens = new TokenCache();
+    async function token(tenant, clientId, secret) {
+        const key = `${tenant}\n${clientId}`;
+        const cached = tokens.get(key, now());
+        if (cached !== undefined)
+            return cached;
+        const res = await fetchImpl(`${LOGIN}/${encodeURIComponent(tenant)}/oauth2/v2.0/token`, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({ client_id: clientId, client_secret: secret, scope: "https://graph.microsoft.com/.default", grant_type: "client_credentials" }).toString(),
+        });
+        const body = await readJsonLoose(res);
+        if (res.status === 400 || res.status === 401)
+            return { status: "refused", reason: "credential", hint: "Microsoft Entra refused the app's client id or client secret." };
+        if (!res.ok || typeof body.access_token !== "string")
+            throw unexpectedStatus("the Entra token endpoint", res.status);
+        tokens.set(key, body.access_token, body.expires_in, now());
+        return body.access_token;
+    }
+    /** One Graph GET. A refusal comes back as a result; anything unexpected throws (checked again later). */
+    async function graph(url, bearer, what, on404) {
+        if (!onHost(url, "graph.microsoft.com"))
+            throw new Error(`${what}: refusing to send the token off graph.microsoft.com`);
+        const res = await fetchImpl(url, { headers: { authorization: `Bearer ${bearer}` } });
+        if (res.status === 401)
+            return { status: "refused", reason: "credential", hint: "Microsoft Graph refused the app's token." };
+        if (res.status === 403)
+            return { status: "refused", reason: "access-off", hint: TEAMS_ACCESS_HINT };
+        if (res.status === 404)
+            return on404;
+        if (!res.ok)
+            throw unexpectedStatus(what, res.status);
+        return res;
+    }
+    return {
+        platform: "teams",
+        disclosure: "OE reads the transcript Microsoft Teams made, through Microsoft Graph, with the organisation's own Entra app registration (not any person's account).",
+        async read(ref, ctx) {
+            const t = ctx.policy.teams;
+            if (t === undefined)
+                return { status: "refused", reason: "credential", hint: "The meeting policy declares no Teams credential." };
+            if (ref.tenantId === undefined || ref.organizerId === undefined || !t.tenants.includes(ref.tenantId))
+                return { status: "refused", reason: "not-found" };
+            const tok = await token(ref.tenantId, t.clientId, await ctx.secret(t.clientSecretRef));
+            if (typeof tok !== "string")
+                return tok;
+            const user = `${GRAPH}/users/${encodeURIComponent(ref.organizerId)}/onlineMeetings`;
+            const filter = `JoinWebUrl eq '${ref.url.replace(/'/g, "''")}'`;
+            const found = await graph(`${user}?$filter=${encodeURIComponent(filter)}`, tok, "the Graph meeting lookup", { status: "refused", reason: "not-found" });
+            if (!(found instanceof Response))
+                return found;
+            const meetings = (await readJsonLoose(found)).value;
+            const meetingId = Array.isArray(meetings) && typeof meetings[0]?.id === "string" ? meetings[0].id : undefined;
+            if (meetingId === undefined)
+                return { status: "refused", reason: "not-found" };
+            const transcripts = [];
+            let next = `${user}/${encodeURIComponent(meetingId)}/transcripts`;
+            for (let page = 0; next !== undefined && page < MAX_PAGES; page++) {
+                const listed = await graph(next, tok, "the Graph transcript list", { status: "refused", reason: "not-found" });
+                if (!(listed instanceof Response))
+                    return listed;
+                const body = await readJsonLoose(listed);
+                for (const v of Array.isArray(body.value) ? body.value : []) {
+                    const o = v;
+                    if (typeof o.id === "string") {
+                        transcripts.push({
+                            id: o.id,
+                            ...(typeof o.createdDateTime === "string" ? { createdDateTime: o.createdDateTime } : {}),
+                            ...(typeof o.endDateTime === "string" ? { endDateTime: o.endDateTime } : {}),
+                        });
+                    }
+                }
+                next = typeof body["@odata.nextLink"] === "string" ? body["@odata.nextLink"] : undefined;
+            }
+            // A recurring meeting keeps one join link, so its transcripts span every occurrence: newest first, and
+            // only a session that started inside the ask's window.
+            const eligible = transcripts
+                .filter((x) => ref.startedAfter === undefined || (x.createdDateTime !== undefined && Date.parse(x.createdDateTime) >= ref.startedAfter))
+                .sort((a, b) => Date.parse(b.createdDateTime ?? "") - Date.parse(a.createdDateTime ?? ""));
+            const pick = eligible[0];
+            // No transcript yet (the meeting has not ended), or one Teams is still writing.
+            if (pick === undefined || pick.endDateTime === undefined)
+                return { status: "pending" };
+            const content = await graph(`${user}/${encodeURIComponent(meetingId)}/transcripts/${encodeURIComponent(pick.id)}/content?$format=text/vtt`, tok, "the Graph transcript content", {
+                status: "refused",
+                reason: "expired",
+            });
+            if (!(content instanceof Response))
+                return content;
+            const segments = parseWebVtt(await readCappedText(content));
+            return { status: "ready", segments, ...(pick.createdDateTime !== undefined ? { startedAt: pick.createdDateTime } : {}), endedAt: pick.endDateTime };
+        },
+    };
+}
+//# sourceMappingURL=native-teams.js.map

package/dist/agent/meetings/native-teams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-teams.js","sourceRoot":"","sources":["../../../agent/meetings/native-teams.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,uEAAuE;AACvE,EAAE;AACF,8GAA8G;AAC9G,wFAAwF;AACxF,2EAA2E;AAC3E,2GAA2G;AAC3G,EAAE;AACF,qGAAqG;AACrG,0GAA0G;AAC1G,4GAA4G;AAC5G,wGAAwG;AACxG,EAAE;AACF,6GAA6G;AAC7G,2FAA2F;AAG3F,OAAO,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAoB,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAErI,MAAM,KAAK,GAAG,kCAAkC,CAAC;AACjD,MAAM,KAAK,GAAG,mCAAmC,CAAC;AAClD,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAC5B,mRAAmR,CAAC;AAQtR,MAAM,UAAU,qBAAqB,CAAC,SAAS,GAAgB,UAAU,EAAE,GAAG,GAAiB,IAAI,CAAC,GAAG;IACrG,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;IAEhC,KAAK,UAAU,KAAK,CAAC,MAAc,EAAE,QAAgB,EAAE,MAAc;QACnE,MAAM,GAAG,GAAG,GAAG,MAAM,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,KAAK,IAAI,kBAAkB,CAAC,MAAM,CAAC,oBAAoB,EAAE;YACtF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,sCAAsC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC,QAAQ,EAAE;SACtK,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,+DAA+D,EAAE,CAAC;QACxK,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;YAAE,MAAM,gBAAgB,CAAC,0BAA0B,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACrH,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,yGAAyG;IACzG,KAAK,UAAU,KAAK,CAAC,GAAW,EAAE,MAAc,EAAE,IAAY,EAAE,KAA6B;QAC3F,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,qBAAqB,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,sDAAsD,CAAC,CAAC;QACxH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACrF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,0CAA0C,EAAE,CAAC;QAC7H,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QACpG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,UAAU,EAAE,uJAAuJ;QACnK,KAAK,CAAC,IAAI,CAAC,GAAqB,EAAE,GAAsB;YACtD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;YAC3B,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,kDAAkD,EAAE,CAAC;YAClI,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YACxJ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;YACvF,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC;YACxC,MAAM,IAAI,GAAG,GAAG,KAAK,UAAU,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,iBAAiB,CAAC;YAEpF,MAAM,MAAM,GAAG,kBAAkB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;YAChE,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,YAAY,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,0BAA0B,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACxJ,IAAI,CAAC,CAAC,KAAK,YAAY,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC/C,MAAM,QAAQ,GAAG,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;YACpD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAQ,QAAQ,CAAC,CAAC,CAAkC,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAQ,CAAC,CAAC,CAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACpK,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YAE/E,MAAM,WAAW,GAAiB,EAAE,CAAC;YACrC,IAAI,IAAI,GAAuB,GAAG,IAAI,IAAI,kBAAkB,CAAC,SAAS,CAAC,cAAc,CAAC;YACtF,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;gBAClE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,2BAA2B,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC/G,IAAI,CAAC,CAAC,MAAM,YAAY,QAAQ,CAAC;oBAAE,OAAO,MAAM,CAAC;gBACjD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;gBACzC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBAC5D,MAAM,CAAC,GAAG,CAA4B,CAAC;oBACvC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;wBAC7B,WAAW,CAAC,IAAI,CAAC;4BACf,EAAE,EAAE,CAAC,CAAC,EAAE;4BACR,GAAG,CAAC,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACxF,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBAC7E,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBACD,IAAI,GAAG,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3F,CAAC;YACD,uGAAuG;YACvG,uDAAuD;YACvD,MAAM,QAAQ,GAAG,WAAW;iBACzB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;iBACvI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7F,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACzB,gFAAgF;YAChF,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAEvF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,SAAS,CAAC,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE,8BAA8B,EAAE;gBAC/K,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,OAAO,YAAY,QAAQ,CAAC;gBAAE,OAAO,OAAO,CAAC;YACnD,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QACtJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/agent/meetings/native-zoom.d.ts

@@ -0,0 +1,7 @@
+import type { NativeTranscriptSource } from "@open-everywhere/core/agent/adapter-api.js";
+import { type NativeFetch } from "./native-http.js";
+/** After this long with a finished recording and no transcript file, the transcript is not coming. */
+export declare const ZOOM_TRANSCRIPT_GRACE_MS: number;
+export declare const ZOOM_ACCESS_HINT = "In the Zoom App Marketplace, give the Server-to-Server OAuth app the scope cloud_recording:read:list_recording_files:admin (classic: recording:read:admin), and turn on cloud recording with Create audio transcript in the account settings.";
+export declare function zoomTranscriptSource(fetchImpl?: NativeFetch, now?: () => number): NativeTranscriptSource;
+//# sourceMappingURL=native-zoom.d.ts.map

package/dist/agent/meetings/native-zoom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-zoom.d.ts","sourceRoot":"","sources":["../../../agent/meetings/native-zoom.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAA0B,sBAAsB,EAAuC,MAAM,4CAA4C,CAAC;AAEtJ,OAAO,EAAuE,KAAK,WAAW,EAAc,MAAM,kBAAkB,CAAC;AAIrI,sGAAsG;AACtG,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AAEzD,eAAO,MAAM,gBAAgB,kPACoN,CAAC;AASlP,wBAAgB,oBAAoB,CAAC,SAAS,GAAE,WAAwB,EAAE,GAAG,GAAE,MAAM,MAAiB,GAAG,sBAAsB,CA6D9H"}

package/dist/agent/meetings/native-zoom.js

@@ -0,0 +1,98 @@
+// The Zoom native-transcript reader (OPE-2471): the cloud recording's audio transcript, read with the
+// organisation's own Server-to-Server OAuth app.
+//
+//   1. token:      POST zoom.us/oauth/token?grant_type=account_credentials&account_id=<account> (Basic auth)
+//   2. recording:  GET api.zoom.us/v2/meetings/<meeting id>/recordings — the newest session's files
+//   3. transcript: the `TRANSCRIPT` file's `download_url`, with the token — WebVTT whose cues start
+//                  "Speaker Name: text"
+//
+// WHAT THE ADMIN GRANTS: a Server-to-Server OAuth app on the org's Zoom account with the scope
+// `cloud_recording:read:list_recording_files:admin` (classic scope: `recording:read:admin`), and, in the
+// account settings, cloud recording with "Create audio transcript" on. Zoom needs a paid plan for both.
+//
+// HOW READY IS LEARNED: Zoom has a `recording.transcript_completed` webhook, and it is reported unreliable;
+// OE polls this endpoint instead (meetings/native-recap.ts). Zoom writes the transcript after the recording,
+// so a recording without a transcript file is `pending` until a day after it ended, then `not-transcribed`.
+// The token goes only to zoom.us hosts: a `download_url` anywhere else is refused, never fetched.
+import { parseWebVtt } from "@open-everywhere/core/agent/adapter-api.js";
+import { TokenCache, onHost, readCappedText, readJsonLoose, unexpectedStatus, timedFetch } from "./native-http.js";
+const API = "https://api.zoom.us/v2";
+const TOKEN = "https://zoom.us/oauth/token";
+/** After this long with a finished recording and no transcript file, the transcript is not coming. */
+export const ZOOM_TRANSCRIPT_GRACE_MS = 24 * 60 * 60_000;
+export const ZOOM_ACCESS_HINT = "In the Zoom App Marketplace, give the Server-to-Server OAuth app the scope cloud_recording:read:list_recording_files:admin (classic: recording:read:admin), and turn on cloud recording with Create audio transcript in the account settings.";
+export function zoomTranscriptSource(fetchImpl = timedFetch, now = Date.now) {
+    const tokens = new TokenCache();
+    async function token(accountId, clientId, secret) {
+        const key = `${accountId}\n${clientId}`;
+        const cached = tokens.get(key, now());
+        if (cached !== undefined)
+            return cached;
+        const res = await fetchImpl(`${TOKEN}?grant_type=account_credentials&account_id=${encodeURIComponent(accountId)}`, {
+            method: "POST",
+            headers: { authorization: `Basic ${Buffer.from(`${clientId}:${secret}`).toString("base64")}` },
+        });
+        const body = await readJsonLoose(res);
+        if (res.status === 400 || res.status === 401)
+            return { status: "refused", reason: "credential", hint: "Zoom refused the Server-to-Server app's account id, client id or client secret." };
+        if (!res.ok || typeof body.access_token !== "string")
+            throw unexpectedStatus("the Zoom token endpoint", res.status);
+        tokens.set(key, body.access_token, body.expires_in, now());
+        return body.access_token;
+    }
+    return {
+        platform: "zoom",
+        disclosure: "OE reads the audio transcript of the meeting's Zoom cloud recording, through the Zoom API, with the organisation's own Server-to-Server OAuth app (not any person's account).",
+        async read(ref, ctx) {
+            const z = ctx.policy.zoom;
+            if (z === undefined)
+                return { status: "refused", reason: "credential", hint: "The meeting policy declares no Zoom credential." };
+            const tok = await token(z.accountId, z.clientId, await ctx.secret(z.clientSecretRef));
+            if (typeof tok !== "string")
+                return tok;
+            const res = await fetchImpl(`${API}/meetings/${encodeURIComponent(ref.roomId)}/recordings`, { headers: { authorization: `Bearer ${tok}` } });
+            const body = await readJsonLoose(res);
+            if (res.status === 401)
+                return { status: "refused", reason: "credential", hint: "Zoom refused the app's token." };
+            if (res.status === 403)
+                return { status: "refused", reason: "access-off", hint: ZOOM_ACCESS_HINT };
+            if (res.status === 404) {
+                // 3301 "This recording does not exist": no cloud recording yet (or never). 3001: no such meeting on this account.
+                if (body.code === 3001)
+                    return { status: "refused", reason: "not-found" };
+                return { status: "pending" };
+            }
+            // A missing scope can come back as a 400 (code 4711, "does not contain scopes") as well as a 403; code 200 is "no permission".
+            if (res.status === 400 && (body.code === 200 || body.code === 4711))
+                return { status: "refused", reason: "access-off", hint: ZOOM_ACCESS_HINT };
+            if (!res.ok)
+                throw unexpectedStatus("the Zoom recordings endpoint", res.status);
+            const startedAt = typeof body.start_time === "string" ? body.start_time : undefined;
+            // A recurring meeting answers with its newest session: one from before the ask's window is not the meeting asked for.
+            if (ref.startedAfter !== undefined && (startedAt === undefined || Date.parse(startedAt) < ref.startedAfter))
+                return { status: "pending" };
+            const files = (Array.isArray(body.recording_files) ? body.recording_files : []);
+            const transcript = files.find((f) => f.file_type === "TRANSCRIPT");
+            if (transcript === undefined || transcript.status !== "completed" || typeof transcript.download_url !== "string") {
+                const ends = files.map((f) => Date.parse(f.recording_end ?? "")).filter((t) => Number.isFinite(t));
+                const finished = files.length > 0 && files.every((f) => f.status === "completed") && ends.length > 0;
+                if (transcript === undefined && finished && now() - Math.max(...ends) > ZOOM_TRANSCRIPT_GRACE_MS)
+                    return { status: "refused", reason: "not-transcribed" };
+                return { status: "pending" };
+            }
+            if (!onHost(transcript.download_url, "zoom.us"))
+                throw new Error("the Zoom transcript download_url is not on zoom.us, so the token is not sent there");
+            const dl = await fetchImpl(transcript.download_url, { headers: { authorization: `Bearer ${tok}` } });
+            if (dl.status === 404)
+                return { status: "refused", reason: "expired" };
+            if (dl.status === 401 || dl.status === 403)
+                return { status: "refused", reason: "access-off", hint: ZOOM_ACCESS_HINT };
+            if (!dl.ok)
+                throw unexpectedStatus("the Zoom transcript download", dl.status);
+            const segments = parseWebVtt(await readCappedText(dl), { namePrefix: true });
+            const ends = files.map((f) => f.recording_end).filter((t) => typeof t === "string").sort();
+            return { status: "ready", segments, ...(startedAt !== undefined ? { startedAt } : {}), ...(ends.length > 0 ? { endedAt: ends[ends.length - 1] } : {}) };
+        },
+    };
+}
+//# sourceMappingURL=native-zoom.js.map

package/dist/agent/meetings/native-zoom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-zoom.js","sourceRoot":"","sources":["../../../agent/meetings/native-zoom.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,iDAAiD;AACjD,EAAE;AACF,6GAA6G;AAC7G,oGAAoG;AACpG,oGAAoG;AACpG,wCAAwC;AACxC,EAAE;AACF,+FAA+F;AAC/F,yGAAyG;AACzG,wGAAwG;AACxG,EAAE;AACF,4GAA4G;AAC5G,6GAA6G;AAC7G,4GAA4G;AAC5G,kGAAkG;AAGlG,OAAO,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAoB,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAErI,MAAM,GAAG,GAAG,wBAAwB,CAAC;AACrC,MAAM,KAAK,GAAG,6BAA6B,CAAC;AAC5C,sGAAsG;AACtG,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAEzD,MAAM,CAAC,MAAM,gBAAgB,GAC3B,+OAA+O,CAAC;AASlP,MAAM,UAAU,oBAAoB,CAAC,SAAS,GAAgB,UAAU,EAAE,GAAG,GAAiB,IAAI,CAAC,GAAG;IACpG,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;IAEhC,KAAK,UAAU,KAAK,CAAC,SAAiB,EAAE,QAAgB,EAAE,MAAc;QACtE,MAAM,GAAG,GAAG,GAAG,SAAS,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,KAAK,8CAA8C,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE;YACjH,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE;SAC/F,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,iFAAiF,EAAE,CAAC;QAC1L,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;YAAE,MAAM,gBAAgB,CAAC,yBAAyB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACpH,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,+KAA+K;QAC3L,KAAK,CAAC,IAAI,CAAC,GAAqB,EAAE,GAAsB;YACtD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,iDAAiD,EAAE,CAAC;YACjI,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;YACtF,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC;YAExC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,GAAG,aAAa,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7I,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC;YAClH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;YACnG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,kHAAkH;gBAClH,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;oBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;gBAC1E,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC/B,CAAC;YACD,+HAA+H;YAC/H,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;YAChJ,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,gBAAgB,CAAC,8BAA8B,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAEhF,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YACpF,sHAAsH;YACtH,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC1I,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAoB,CAAC;YACnG,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC;YACnE,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,OAAO,UAAU,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;gBACjH,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnG,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;gBACrG,IAAI,UAAU,KAAK,SAAS,IAAI,QAAQ,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,wBAAwB;oBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;gBAC1J,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC/B,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,EAAE,SAAS,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;YACvJ,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YACrG,IAAI,EAAE,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACvE,IAAI,EAAE,CAAC,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;YACvH,IAAI,CAAC,EAAE,CAAC,EAAE;gBAAE,MAAM,gBAAgB,CAAC,8BAA8B,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;YAC9E,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,cAAc,CAAC,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7E,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACxG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3J,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/agent/model/gateway.d.ts

@@ -5,6 +5,13 @@ type GatewayModel = ReturnType<typeof gateway>;
 export declare const DEFAULT_GATEWAY_HOST = "ai-gateway.vercel.sh";
 /** The one host the model call reaches: the retarget's host, else the default. An unparseable retarget falls back to the default host. */
 export declare function gatewayHost(baseUrl: string | undefined): string;
+/** The one host this deployment's gateway calls reach — what every host-plane push must keep declaring. */
+export declare const GATEWAY_TARGET_HOST: string;
+/** Add `hosts` to this process's host plane and return the shared fetch (undefined off the proxy tier). */
+export declare function sharedHostPlaneFetch(hosts: readonly string[]): typeof fetch | undefined;
+/** The gateway provider this backend resolves model ids through — retargeted only when
+ *  {@link GATEWAY_BASE_URL} names a different host. */
+declare const provider: import("@ai-sdk/gateway").GatewayProvider;
 /** Static defaults for one routed slot — mirrors what a plain string config said. */
 export interface GatewayRoutedDefaults {
     /** Default gateway model id (what unrouted channels use), e.g. "zai/glm-5.2". */
@@ -23,6 +30,9 @@ export declare function applyGatewayOptions(route: ModelRoute, options: RoutedCa
     readonly id: string;
     readonly defaultId: string;
 }, defaults?: Record<string, unknown>): RoutedCallOptions;
+/** A gateway TRANSCRIPTION model, on the same provider (retarget and host-plane fetch included) the turn
+ *  model uses. The meeting bot's `gateway` route (meeting-gateway.ts) reads it. */
+export declare function gatewayTranscriptionModel(id: string): ReturnType<typeof provider.transcriptionModel>;
 /** The gateway ModelBackend (see core ModelBackend). */
 export declare function gatewayModelBackend(defaults?: Record<string, unknown>): ModelBackend<GatewayModel>;
 /**

package/dist/agent/model/gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../../agent/model/gateway.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAiB,MAAM,IAAI,CAAC;AAC5C,OAAO,EACL,KAAK,UAAU,EAEf,KAAK,YAAY,EACjB,KAAK,iBAAiB,EAIvB,MAAM,4CAA4C,CAAC;AAEpD,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;AAQ/C,wHAAwH;AACxH,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D,0IAA0I;AAC1I,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAO/D;AAiBD,qFAAqF;AACrF,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAKD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EACxD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,iBAAiB,CAanB;AAED,wDAAwD;AACxD,wBAAgB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,CAAC,YAAY,CAAC,CAKlG;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,YAAY,CAAC,CAG5H"}
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../../agent/model/gateway.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAiB,MAAM,IAAI,CAAC;AAC5C,OAAO,EACL,KAAK,UAAU,EAEf,KAAK,YAAY,EACjB,KAAK,iBAAiB,EAKvB,MAAM,4CAA4C,CAAC;AAEpD,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC;AAQ/C,wHAAwH;AACxH,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D,0IAA0I;AAC1I,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAO/D;AAED,2GAA2G;AAC3G,eAAO,MAAM,mBAAmB,QAAgC,CAAC;AA8BjE,2GAA2G;AAC3G,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,KAAK,GAAG,SAAS,CAOvF;AAED;uDACuD;AACvD,QAAA,MAAM,QAAQ,2CAGD,CAAC;AAEd,qFAAqF;AACrF,MAAM,WAAW,qBAAqB;IACpC,iFAAiF;IACjF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAKD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EACxD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,iBAAiB,CAanB;AAED;mFACmF;AACnF,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,CAAC,OAAO,QAAQ,CAAC,kBAAkB,CAAC,CAEpG;AAED,wDAAwD;AACxD,wBAAgB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY,CAAC,YAAY,CAAC,CAKlG;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,YAAY,CAAC,CAG5H"}

package/dist/agent/model/gateway.js

@@ -1,7 +1,7 @@
 // The Vercel AI Gateway model backend — the reference `ModelBackend`. Provider SELECTION is not pinned here:
 // that is a gateway-operator concern, and `ModelRoute.providers` is only an optional per-route preference.
 import { gateway, createGateway } from "ai";
-import { hostPlaneFetch, liveIdentity, resolvePrimaryModel, } from "@open-everywhere/core/agent/adapter-api.js";
+import { hostPlaneFetch, hostPlanePolicy, liveIdentity, resolvePrimaryModel, } from "@open-everywhere/core/agent/adapter-api.js";
 /**
  * THE GATEWAY TARGET — `OE_AI_GATEWAY_URL`, read once at module load: a target that changed mid-process would
  * send two calls in one turn to two providers. Unset ⇒ the plain `gateway` export, byte-identical.
@@ -20,13 +20,46 @@ export function gatewayHost(baseUrl) {
         return DEFAULT_GATEWAY_HOST;
     }
 }
+/** The one host this deployment's gateway calls reach — what every host-plane push must keep declaring. */
+export const GATEWAY_TARGET_HOST = gatewayHost(GATEWAY_BASE_URL);
+/**
+ * THE HOST-PLANE UNION (OPE-2470). The proxy REPLACES its host plane on every push; it never merges
+ * (deploy/egress-proxy/control/handlers.ts `setHostPlane`). So this process keeps ONE host set, and every
+ * host-plane call goes through ONE fetch that pushes the whole set: the turn model and the meeting bot's
+ * non-gateway transcription routes never push lists that drop each other. A caller adds its hosts with
+ * {@link sharedHostPlaneFetch} at boot; a grown set builds a new fetch, which pushes the union on its next call.
+ */
+const HOST_PLANE_HOSTS = [GATEWAY_TARGET_HOST];
+let hostPlaneCurrent = hostPlaneFetch(HOST_PLANE_HOSTS);
+let hostPlaneBuiltFor = HOST_PLANE_HOSTS.length;
 /**
  * THE MODEL CALL'S TRANSPORT ON THE SELF-HOST PROXY TIER (OPE-2406). With an egress proxy wired, the model call goes out
- * on the app's HOST PLANE: the proxy decides it against the gateway host alone, never against a session's policy. That is
- * what lets a turn reach its model while the session stays default-deny. Off that tier it is `undefined` and the provider
- * keeps its default fetch, byte-identical to before.
+ * on the app's HOST PLANE: the proxy decides it against the host-plane list (the gateway host, plus the hosts of any
+ * non-gateway transcription route the app registers), never against a session's policy. That is what lets a turn reach
+ * its model while the session stays default-deny. Off that tier it is `undefined` and the provider keeps its default
+ * fetch, byte-identical to before. On it, the fetch always uses the newest union.
  */
-const HOST_PLANE_FETCH = hostPlaneFetch([gatewayHost(GATEWAY_BASE_URL)]);
+const HOST_PLANE_FETCH = hostPlaneCurrent === undefined
+    ? undefined
+    : (input, init) => {
+        if (hostPlaneBuiltFor !== HOST_PLANE_HOSTS.length) {
+            hostPlaneCurrent = hostPlaneFetch(HOST_PLANE_HOSTS);
+            hostPlaneBuiltFor = HOST_PLANE_HOSTS.length;
+        }
+        return hostPlaneCurrent(input, init);
+    };
+/** Add `hosts` to this process's host plane and return the shared fetch (undefined off the proxy tier). */
+export function sharedHostPlaneFetch(hosts) {
+    // Validate BEFORE the list grows: a wildcard host throws here, at registration, and never reaches the shared list,
+    // where it would fail every model turn at the next rebuild. A blank name is skipped.
+    const named = hosts.map((h) => h.trim()).filter((h) => h !== "");
+    if (HOST_PLANE_FETCH !== undefined)
+        hostPlanePolicy([...HOST_PLANE_HOSTS, ...named]);
+    for (const h of named)
+        if (!HOST_PLANE_HOSTS.includes(h))
+            HOST_PLANE_HOSTS.push(h);
+    return HOST_PLANE_FETCH;
+}
 /** The gateway provider this backend resolves model ids through — retargeted only when
  *  {@link GATEWAY_BASE_URL} names a different host. */
 const provider = GATEWAY_BASE_URL || HOST_PLANE_FETCH
@@ -54,6 +87,11 @@ export function applyGatewayOptions(route, options, ids, defaults) {
         return options;
     return { ...options, providerOptions: { ...options.providerOptions, gateway: gatewayOpts } };
 }
+/** A gateway TRANSCRIPTION model, on the same provider (retarget and host-plane fetch included) the turn
+ *  model uses. The meeting bot's `gateway` route (meeting-gateway.ts) reads it. */
+export function gatewayTranscriptionModel(id) {
+    return provider.transcriptionModel(id);
+}
 /** The gateway ModelBackend (see core ModelBackend). */
 export function gatewayModelBackend(defaults) {
     return {