@pipedog/core 0.0.0 → 0.1.0

package/dist/utils/http.js

@@ -0,0 +1,53 @@
+// Copyright (c) 2024-2026, Daily
+// Copyright (c) 2026, pipedog contributors
+// SPDX-License-Identifier: BSD-2-Clause
+//
+// Ported from pipecat: src/pipecat/utils/http.py
+/**
+ * Compatibility helpers for the HTTP client families service SDKs use.
+ *
+ * Upstream bridges the httpx and httpx2 Python packages: service SDKs are
+ * migrating from one to the other, so the objects Pipecat hands to an SDK
+ * client — and the exceptions it catches from one — can't name a single
+ * family at import time.
+ *
+ * In JavaScript every SDK talks through `fetch`, so there is one family. The
+ * same names are kept so ported services read like upstream:
+ *
+ * - `AsyncHTTPClient` is whatever client object a caller hands to an SDK.
+ * - `TIMEOUT_EXCEPTIONS` are the timeout error types to catch around SDK calls.
+ * - `connectionLimits()` builds a plain limits object.
+ */
+import { TimeoutError } from "@pipedog/asyncio";
+/**
+ * Timeout exception types to catch around SDK calls. SDKs wrap request-level
+ * timeouts in their own error type, but a timeout while iterating a response
+ * stream surfaces as the underlying transport exception.
+ *
+ * DIVERGENCE: upstream lists httpx/httpx2 `TimeoutException`. Here it is the
+ * asyncio `TimeoutError`; a `fetch` aborted by `AbortSignal.timeout()` rejects
+ * with a `DOMException` named "TimeoutError", which `isTimeoutException`
+ * also recognizes.
+ */
+export const TIMEOUT_EXCEPTIONS = [TimeoutError];
+/** Whether `e` is one of `TIMEOUT_EXCEPTIONS` (or a fetch timeout `DOMException`). */
+export function isTimeoutException(e) {
+    if (TIMEOUT_EXCEPTIONS.some((cls) => e instanceof cls))
+        return true;
+    return e instanceof Error && e.name === "TimeoutError";
+}
+/**
+ * Build a connection-limits object accepted by the HTTP client.
+ *
+ * DIVERGENCE: upstream returns an httpx `Limits` instance. `fetch` has no
+ * such object, so this returns the plain options for an SDK or agent that
+ * reads them field by field.
+ *
+ * @param options Limits fields (`maxConnections`, `maxKeepaliveConnections`,
+ *   `keepaliveExpiry`).
+ * @returns A limits object.
+ */
+export function connectionLimits(options = {}) {
+    return { ...options };
+}
+//# sourceMappingURL=http.js.map

package/dist/utils/image.d.ts

@@ -0,0 +1,15 @@
+/** Image encoding helpers. */
+/**
+ * Encode an image for a model to look at.
+ *
+ * An image whose format is a MIME type is already encoded and keeps its
+ * bytes. Raw pixels are encoded as a JPEG.
+ *
+ * @param image The image bytes, raw pixels or already encoded.
+ * @param size The image's width and height.
+ * @param format The pixel format, such as `"RGB"` or `"RGBA"`, or the MIME
+ *   type of an encoded image. Raw pixels are taken as RGB when not given.
+ * @returns The encoded bytes and their MIME type.
+ */
+export declare function encodeImage(image: Uint8Array, size: [number, number], format: string | null): Promise<[Uint8Array, string]>;
+//# sourceMappingURL=image.d.ts.map

package/dist/utils/image.js

@@ -0,0 +1,30 @@
+// Copyright (c) 2024-2026, Daily
+// Copyright (c) 2026, pipedog contributors
+// SPDX-License-Identifier: BSD-2-Clause
+//
+// Ported from pipecat: src/pipecat/utils/image.py
+/** Image encoding helpers. */
+/**
+ * Encode an image for a model to look at.
+ *
+ * An image whose format is a MIME type is already encoded and keeps its
+ * bytes. Raw pixels are encoded as a JPEG.
+ *
+ * @param image The image bytes, raw pixels or already encoded.
+ * @param size The image's width and height.
+ * @param format The pixel format, such as `"RGB"` or `"RGBA"`, or the MIME
+ *   type of an encoded image. Raw pixels are taken as RGB when not given.
+ * @returns The encoded bytes and their MIME type.
+ */
+export async function encodeImage(image, size, format) {
+    if (format?.startsWith("image/")) {
+        return [image, format];
+    }
+    return [await encodeJpeg(image, size, format || "RGB"), "image/jpeg"];
+}
+// STUB: upstream encodes raw pixels with Pillow (`Image.frombytes(...).save(format="JPEG")`)
+// in a thread. Core has no runtime-agnostic JPEG encoder yet.
+async function encodeJpeg(_image, _size, _format) {
+    throw new Error("not ported yet: encodeImage() cannot JPEG-encode raw pixels; pass an already encoded image (format 'image/...')");
+}
+//# sourceMappingURL=image.js.map

package/dist/utils/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/utils/index.js

@@ -0,0 +1,8 @@
+// Copyright (c) 2024-2026, Daily
+// Copyright (c) 2026, pipedog contributors
+// SPDX-License-Identifier: BSD-2-Clause
+//
+// Ported from pipecat: src/pipecat/utils/__init__.py
+// Upstream's `__init__.py` is empty: import the package's modules directly.
+export {};
+//# sourceMappingURL=index.js.map

package/dist/utils/log_config.d.ts

@@ -0,0 +1,34 @@
+export declare const _LLM_CONTEXT_LOG_ENV_VAR = "PIPECAT_LOG_LLM_CONTEXT";
+/**
+ * How much of the context LLM services include in their DEBUG log lines.
+ *
+ * LLM services log a DEBUG line each time they generate a response, and
+ * realtime services when they set up their server-side conversation. The
+ * context is built only when DEBUG is enabled.
+ *
+ * - FULL: Every message of the context.
+ * - OFF: None of it; the line is logged without the context.
+ */
+export declare const _LLMContextLogMode: {
+    readonly FULL: "full";
+    readonly OFF: "off";
+};
+export type _LLMContextLogMode = (typeof _LLMContextLogMode)[keyof typeof _LLMContextLogMode];
+/**
+ * Return how LLM services log the context.
+ *
+ * The mode named by `PIPECAT_LOG_LLM_CONTEXT`, or `full` when it is unset
+ * or empty. The environment variable is read once, on first use.
+ *
+ * @returns The current LLM context log mode.
+ * @throws InvalidEnvVarValueError If `PIPECAT_LOG_LLM_CONTEXT` is set to an unknown mode.
+ */
+export declare function _getLlmContextLogMode(): _LLMContextLogMode;
+/**
+ * Forget the cached mode so the next `_getLlmContextLogMode()` reads the
+ * environment again. Python tests assign `_llm_context_log_mode = None`; a
+ * module variable can't be assigned from outside in JS.
+ */
+export declare function _resetLlmContextLogMode(): void;
+export declare function _llmContextLogModeFromEnv(): _LLMContextLogMode;
+//# sourceMappingURL=log_config.d.ts.map

package/dist/utils/log_config.js

@@ -0,0 +1,76 @@
+// Copyright (c) 2024-2026, Daily
+// Copyright (c) 2026, pipedog contributors
+// SPDX-License-Identifier: BSD-2-Clause
+//
+// Ported from pipecat: src/pipecat/utils/log_config.py
+/**
+ * Process-wide controls for Pipecat's debug logging.
+ *
+ * Some debug output grows with the length of a session, such as the LLM context
+ * logged on every inference. The settings here choose how much of it to write,
+ * and each is read from an environment variable once, on first use.
+ *
+ * - `PIPECAT_LOG_LLM_CONTEXT`: how much of the context LLM services include
+ *   in their DEBUG log lines. `full` (the default) logs every message;
+ *   `off` logs the line without the context.
+ *
+ * @example
+ * // PIPECAT_LOG_LLM_CONTEXT=off bun bot.ts
+ */
+import { getEnv, InvalidEnvVarValueError } from "./env.js";
+export const _LLM_CONTEXT_LOG_ENV_VAR = "PIPECAT_LOG_LLM_CONTEXT";
+/**
+ * How much of the context LLM services include in their DEBUG log lines.
+ *
+ * LLM services log a DEBUG line each time they generate a response, and
+ * realtime services when they set up their server-side conversation. The
+ * context is built only when DEBUG is enabled.
+ *
+ * - FULL: Every message of the context.
+ * - OFF: None of it; the line is logged without the context.
+ */
+export const _LLMContextLogMode = {
+    FULL: "full",
+    OFF: "off",
+};
+let llmContextLogMode = null;
+/**
+ * Return how LLM services log the context.
+ *
+ * The mode named by `PIPECAT_LOG_LLM_CONTEXT`, or `full` when it is unset
+ * or empty. The environment variable is read once, on first use.
+ *
+ * @returns The current LLM context log mode.
+ * @throws InvalidEnvVarValueError If `PIPECAT_LOG_LLM_CONTEXT` is set to an unknown mode.
+ */
+export function _getLlmContextLogMode() {
+    if (llmContextLogMode === null) {
+        llmContextLogMode = _llmContextLogModeFromEnv();
+    }
+    return llmContextLogMode;
+}
+/**
+ * Forget the cached mode so the next `_getLlmContextLogMode()` reads the
+ * environment again. Python tests assign `_llm_context_log_mode = None`; a
+ * module variable can't be assigned from outside in JS.
+ */
+export function _resetLlmContextLogMode() {
+    llmContextLogMode = null;
+}
+export function _llmContextLogModeFromEnv() {
+    const raw = getEnv(_LLM_CONTEXT_LOG_ENV_VAR);
+    if (raw === undefined || !raw.trim()) {
+        return _LLMContextLogMode.FULL;
+    }
+    const value = raw.trim().toLowerCase();
+    const modes = Object.values(_LLMContextLogMode);
+    if (modes.includes(value)) {
+        return value;
+    }
+    throw new InvalidEnvVarValueError({
+        name: _LLM_CONTEXT_LOG_ENV_VAR,
+        value: raw,
+        expected: modes.join(" or "),
+    });
+}
+//# sourceMappingURL=log_config.js.map

package/dist/utils/logger.d.ts

@@ -0,0 +1,40 @@
+export declare const LOG_LEVELS: {
+    readonly TRACE: 5;
+    readonly DEBUG: 10;
+    readonly INFO: 20;
+    readonly SUCCESS: 25;
+    readonly WARNING: 30;
+    readonly ERROR: 40;
+    readonly CRITICAL: 50;
+};
+export type LogLevel = keyof typeof LOG_LEVELS;
+export interface LogRecord {
+    level: LogLevel;
+    message: string;
+    time: Date;
+    error?: unknown;
+}
+export type LogSink = (record: LogRecord) => void;
+declare class Logger {
+    #private;
+    /** Only records at or above `level` are emitted. */
+    setLevel(level: LogLevel): void;
+    isEnabledFor(level: LogLevel): boolean;
+    /** Replace all sinks (loguru `logger.remove()` + `logger.add(sink)`). */
+    setSink(...sinks: LogSink[]): void;
+    addSink(sink: LogSink): () => void;
+    log(level: LogLevel, message: string, error?: unknown): void;
+    trace(message: string): void;
+    debug(message: string): void;
+    info(message: string): void;
+    success(message: string): void;
+    warning(message: string): void;
+    warn(message: string): void;
+    error(message: string, error?: unknown): void;
+    /** loguru `logger.exception`: an error with its stack. */
+    exception(message: string, error?: unknown): void;
+    critical(message: string, error?: unknown): void;
+}
+export declare const logger: Logger;
+export type { Logger };
+//# sourceMappingURL=logger.d.ts.map

package/dist/utils/logger.js

@@ -0,0 +1,91 @@
+// Copyright (c) 2026, pipedog contributors
+// SPDX-License-Identifier: BSD-2-Clause
+//
+// Stand-in for loguru, which upstream logs through. Same level names, so
+// ported `logger.warning(...)` calls read the same. Replace the sink to route
+// logs elsewhere (pino, console.json, Workers logs...).
+export const LOG_LEVELS = {
+    TRACE: 5,
+    DEBUG: 10,
+    INFO: 20,
+    SUCCESS: 25,
+    WARNING: 30,
+    ERROR: 40,
+    CRITICAL: 50,
+};
+const consoleSink = (record) => {
+    const line = `${record.time.toISOString()} | ${record.level.padEnd(8)} | ${record.message}`;
+    if (LOG_LEVELS[record.level] >= LOG_LEVELS.ERROR) {
+        console.error(line, ...(record.error ? [record.error] : []));
+    }
+    else if (record.level === "WARNING") {
+        console.warn(line);
+    }
+    else {
+        console.log(line);
+    }
+};
+function initialLevel() {
+    const env = globalThis.process
+        ?.env;
+    const value = env?.PIPEDOG_LOG_LEVEL?.toUpperCase();
+    return value && value in LOG_LEVELS ? value : "DEBUG";
+}
+class Logger {
+    #level = LOG_LEVELS[initialLevel()];
+    #sinks = [consoleSink];
+    /** Only records at or above `level` are emitted. */
+    setLevel(level) {
+        this.#level = LOG_LEVELS[level];
+    }
+    isEnabledFor(level) {
+        return LOG_LEVELS[level] >= this.#level;
+    }
+    /** Replace all sinks (loguru `logger.remove()` + `logger.add(sink)`). */
+    setSink(...sinks) {
+        this.#sinks = sinks;
+    }
+    addSink(sink) {
+        this.#sinks.push(sink);
+        return () => {
+            this.#sinks = this.#sinks.filter((s) => s !== sink);
+        };
+    }
+    log(level, message, error) {
+        if (LOG_LEVELS[level] < this.#level)
+            return;
+        const record = { level, message, time: new Date(), error };
+        for (const sink of this.#sinks)
+            sink(record);
+    }
+    trace(message) {
+        this.log("TRACE", message);
+    }
+    debug(message) {
+        this.log("DEBUG", message);
+    }
+    info(message) {
+        this.log("INFO", message);
+    }
+    success(message) {
+        this.log("SUCCESS", message);
+    }
+    warning(message) {
+        this.log("WARNING", message);
+    }
+    warn(message) {
+        this.log("WARNING", message);
+    }
+    error(message, error) {
+        this.log("ERROR", message, error);
+    }
+    /** loguru `logger.exception`: an error with its stack. */
+    exception(message, error) {
+        this.log("ERROR", message, error);
+    }
+    critical(message, error) {
+        this.log("CRITICAL", message, error);
+    }
+}
+export const logger = new Logger();
+//# sourceMappingURL=logger.js.map

package/dist/utils/mixin.d.ts

@@ -0,0 +1,14 @@
+export type Ctor<T = object> = abstract new (...args: any[]) => T;
+export type Mixin<F extends (base: Ctor) => Ctor, I> = F & {
+    [Symbol.hasInstance](value: unknown): value is I;
+};
+export declare function defineMixin<I, F extends <B extends Ctor>(base: B) => Ctor>(name: string, factory: F): Mixin<F, I>;
+/**
+ * Make `instanceof parent` true for instances of `child` without `child`
+ * extending it, like Python's `ABC.register`. Use it when upstream inherits
+ * from two concrete classes, e.g. `InputTextRawFrame(SystemFrame, TextFrame)`:
+ * `class InputTextRawFrame extends SystemFrame` + `addVirtualBase(InputTextRawFrame, TextFrame)`.
+ * The child must declare the parent's fields itself.
+ */
+export declare function addVirtualBase(child: Function, parent: Function): void;
+//# sourceMappingURL=mixin.d.ts.map

package/dist/utils/mixin.js

@@ -0,0 +1,63 @@
+// Copyright (c) 2026, pipedog contributors
+// SPDX-License-Identifier: BSD-2-Clause
+//
+// Python multiple inheritance (`class C(A, B)`) maps to a class-factory mixin:
+// `class C extends B(A)`. `defineMixin` brands every class the factory
+// produces so `x instanceof B` keeps working like `isinstance(x, B)`.
+//
+//   export interface AudioRawFrame { audio: Uint8Array; ... }
+//   export const AudioRawFrame = defineMixin("AudioRawFrame", <B extends Ctor>(Base: B) => {
+//     abstract class AudioRawFrameMixin extends Base { ... }
+//     return AudioRawFrameMixin;
+//   });
+//   export class OutputAudioRawFrame extends AudioRawFrame(DataFrame) { ... }
+//   frame instanceof AudioRawFrame // true
+//
+// Constructors take one options object (Python's **kwargs), so a mixin reads
+// its own keys from `args[0]` and forwards everything to `super(...args)`.
+export function defineMixin(name, factory) {
+    const brand = Symbol.for(`pipedog.mixin.${name}`);
+    const apply = ((base) => {
+        const cls = factory(base);
+        Object.defineProperty(cls.prototype, brand, { value: true });
+        return cls;
+    });
+    Object.defineProperty(apply, "name", { value: name });
+    Object.defineProperty(apply, Symbol.hasInstance, {
+        value: (value) => typeof value === "object" &&
+            value !== null &&
+            value[brand] === true,
+    });
+    return apply;
+}
+const virtualBases = new WeakMap();
+/**
+ * Make `instanceof parent` true for instances of `child` without `child`
+ * extending it, like Python's `ABC.register`. Use it when upstream inherits
+ * from two concrete classes, e.g. `InputTextRawFrame(SystemFrame, TextFrame)`:
+ * `class InputTextRawFrame extends SystemFrame` + `addVirtualBase(InputTextRawFrame, TextFrame)`.
+ * The child must declare the parent's fields itself.
+ */
+export function addVirtualBase(child, parent) {
+    let children = virtualBases.get(parent);
+    if (!children) {
+        children = new Set();
+        virtualBases.set(parent, children);
+        Object.defineProperty(parent, Symbol.hasInstance, {
+            value(value) {
+                if (Function.prototype[Symbol.hasInstance].call(this, value))
+                    return true;
+                const registered = virtualBases.get(this);
+                if (!registered)
+                    return false;
+                for (const c of registered) {
+                    if (Function.prototype[Symbol.hasInstance].call(c, value))
+                        return true;
+                }
+                return false;
+            },
+        });
+    }
+    children.add(child);
+}
+//# sourceMappingURL=mixin.js.map

package/dist/utils/network.d.ts

@@ -0,0 +1,73 @@
+/** Base class for network utilities, providing exponential backoff time calculation. */
+/**
+ * Calculate exponential backoff wait time.
+ *
+ * @param attempt Current attempt number (1-based)
+ * @param minWait Minimum wait time in seconds
+ * @param maxWait Maximum wait time in seconds
+ * @param multiplier Base multiplier for exponential calculation
+ * @returns Wait time in seconds
+ */
+export declare function exponentialBackoffTime(attempt: number, minWait?: number, maxWait?: number, multiplier?: number): number;
+export interface QuickFailureResultOptions {
+    isQuickFailure: boolean;
+    shouldGiveUp: boolean;
+}
+/**
+ * Outcome of recording one failed connection attempt.
+ *
+ * - `isQuickFailure`: Whether this attempt lasted less than the tracker's
+ *   `minStableDuration`.
+ * - `shouldGiveUp`: Whether `maxConsecutiveFailures` quick failures have now
+ *   happened in a row and the caller should stop retrying.
+ */
+export declare class QuickFailureResult {
+    isQuickFailure: boolean;
+    shouldGiveUp: boolean;
+    constructor(options: QuickFailureResultOptions);
+}
+export interface QuickFailureTrackerOptions {
+    /**
+     * Minimum time, in seconds, a connection must survive to be considered
+     * stable rather than a quick failure.
+     */
+    minStableDuration?: number;
+    /**
+     * Number of consecutive quick failures after which `record()` reports that
+     * the caller should give up.
+     */
+    maxConsecutiveFailures?: number;
+}
+/**
+ * Detects a connection that keeps failing immediately after connecting.
+ *
+ * Exponential backoff alone doesn't help when a connection attempt succeeds
+ * just enough to fail again right away (e.g. a server that accepts a
+ * WebSocket handshake but then immediately rejects invalid credentials) —
+ * waiting longer between attempts won't fix that, only stopping will.
+ *
+ * Call `record()` with how long each failed attempt lasted. Once
+ * `maxConsecutiveFailures` attempts in a row each lasted under
+ * `minStableDuration` seconds, the result's `shouldGiveUp` is true,
+ * telling the caller to stop retrying instead of trying again.
+ */
+export declare class QuickFailureTracker {
+    minStableDuration: number;
+    maxConsecutiveFailures: number;
+    count: number;
+    constructor(options?: QuickFailureTrackerOptions);
+    /**
+     * Record a failed connection attempt that lasted `duration` seconds.
+     *
+     * Increments the consecutive-failure streak if this attempt was a quick
+     * failure, or resets it if the attempt was stable.
+     *
+     * @param duration How long the failed attempt lasted, in seconds.
+     * @returns A `QuickFailureResult` describing this attempt and whether the
+     *   caller should give up.
+     */
+    record(duration: number): QuickFailureResult;
+    /** Reset the consecutive-failure streak, e.g. on a fresh connect. */
+    reset(): void;
+}
+//# sourceMappingURL=network.d.ts.map

package/dist/utils/network.js

@@ -0,0 +1,90 @@
+// Copyright (c) 2024-2026, Daily
+// Copyright (c) 2026, pipedog contributors
+// SPDX-License-Identifier: BSD-2-Clause
+//
+// Ported from pipecat: src/pipecat/utils/network.py
+/** Base class for network utilities, providing exponential backoff time calculation. */
+/**
+ * Calculate exponential backoff wait time.
+ *
+ * @param attempt Current attempt number (1-based)
+ * @param minWait Minimum wait time in seconds
+ * @param maxWait Maximum wait time in seconds
+ * @param multiplier Base multiplier for exponential calculation
+ * @returns Wait time in seconds
+ */
+export function exponentialBackoffTime(attempt, minWait = 4, maxWait = 10, multiplier = 1) {
+    const exp = 2 ** (attempt - 1) * multiplier;
+    // Python raises OverflowError for huge exponents; JS yields Infinity/NaN.
+    if (Number.isNaN(exp)) {
+        return maxWait;
+    }
+    const result = Math.max(0, Math.min(exp, maxWait));
+    return Math.max(minWait, result);
+}
+/**
+ * Outcome of recording one failed connection attempt.
+ *
+ * - `isQuickFailure`: Whether this attempt lasted less than the tracker's
+ *   `minStableDuration`.
+ * - `shouldGiveUp`: Whether `maxConsecutiveFailures` quick failures have now
+ *   happened in a row and the caller should stop retrying.
+ */
+export class QuickFailureResult {
+    isQuickFailure;
+    shouldGiveUp;
+    constructor(options) {
+        this.isQuickFailure = options.isQuickFailure;
+        this.shouldGiveUp = options.shouldGiveUp;
+    }
+}
+/**
+ * Detects a connection that keeps failing immediately after connecting.
+ *
+ * Exponential backoff alone doesn't help when a connection attempt succeeds
+ * just enough to fail again right away (e.g. a server that accepts a
+ * WebSocket handshake but then immediately rejects invalid credentials) —
+ * waiting longer between attempts won't fix that, only stopping will.
+ *
+ * Call `record()` with how long each failed attempt lasted. Once
+ * `maxConsecutiveFailures` attempts in a row each lasted under
+ * `minStableDuration` seconds, the result's `shouldGiveUp` is true,
+ * telling the caller to stop retrying instead of trying again.
+ */
+export class QuickFailureTracker {
+    minStableDuration;
+    maxConsecutiveFailures;
+    count = 0;
+    constructor(options = {}) {
+        this.minStableDuration = options.minStableDuration ?? 5.0;
+        this.maxConsecutiveFailures = options.maxConsecutiveFailures ?? 3;
+    }
+    /**
+     * Record a failed connection attempt that lasted `duration` seconds.
+     *
+     * Increments the consecutive-failure streak if this attempt was a quick
+     * failure, or resets it if the attempt was stable.
+     *
+     * @param duration How long the failed attempt lasted, in seconds.
+     * @returns A `QuickFailureResult` describing this attempt and whether the
+     *   caller should give up.
+     */
+    record(duration) {
+        const isQuickFailure = duration < this.minStableDuration;
+        if (isQuickFailure) {
+            this.count += 1;
+        }
+        else {
+            this.count = 0;
+        }
+        return new QuickFailureResult({
+            isQuickFailure,
+            shouldGiveUp: isQuickFailure && this.count >= this.maxConsecutiveFailures,
+        });
+    }
+    /** Reset the consecutive-failure streak, e.g. on a fresh connect. */
+    reset() {
+        this.count = 0;
+    }
+}
+//# sourceMappingURL=network.js.map

package/dist/utils/security/allowed_origins.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Return allowed origins from the `PIPECAT_ALLOWED_ORIGINS` env var.
+ *
+ * Parses a comma-separated list of origin strings. Returns an empty list
+ * (allow all) when the variable is unset or empty.
+ */
+export declare function defaultAllowedOrigins(): string[];
+/**
+ * Return whether `origin` is permitted by `allowedOrigins`.
+ *
+ * @param origin The value of the `Origin` header, or an empty string if absent.
+ * @param allowedOrigins List of allowed origin strings. An empty list allows
+ *   all origins. When non-empty, a missing or disallowed origin is rejected.
+ */
+export declare function isOriginAllowed(origin: string, allowedOrigins: string[]): boolean;
+//# sourceMappingURL=allowed_origins.d.ts.map

package/dist/utils/security/allowed_origins.js

@@ -0,0 +1,34 @@
+// Copyright (c) 2024-2026, Daily
+// Copyright (c) 2026, pipedog contributors
+// SPDX-License-Identifier: BSD-2-Clause
+//
+// Ported from pipecat: src/pipecat/utils/security/allowed_origins.py
+/** Origin validation utilities. */
+import { getEnv } from "../env.js";
+/**
+ * Return allowed origins from the `PIPECAT_ALLOWED_ORIGINS` env var.
+ *
+ * Parses a comma-separated list of origin strings. Returns an empty list
+ * (allow all) when the variable is unset or empty.
+ */
+export function defaultAllowedOrigins() {
+    const val = getEnv("PIPECAT_ALLOWED_ORIGINS") ?? "";
+    return val
+        .split(",")
+        .map((o) => o.trim())
+        .filter((o) => o);
+}
+/**
+ * Return whether `origin` is permitted by `allowedOrigins`.
+ *
+ * @param origin The value of the `Origin` header, or an empty string if absent.
+ * @param allowedOrigins List of allowed origin strings. An empty list allows
+ *   all origins. When non-empty, a missing or disallowed origin is rejected.
+ */
+export function isOriginAllowed(origin, allowedOrigins) {
+    if (allowedOrigins.length === 0) {
+        return true;
+    }
+    return new Set(allowedOrigins.map((o) => o.toLowerCase())).has(origin.toLowerCase());
+}
+//# sourceMappingURL=allowed_origins.js.map

package/dist/utils/security/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/utils/security/index.js

@@ -0,0 +1,7 @@
+// Copyright (c) 2024-2026, Daily
+// Copyright (c) 2026, pipedog contributors
+// SPDX-License-Identifier: BSD-2-Clause
+//
+// Ported from pipecat: src/pipecat/utils/security/__init__.py
+export {};
+//# sourceMappingURL=index.js.map