@shogo-ai/voice 2.4.1 → 2.4.3

package/dist/{chunk-XE4LLC7Z.js → chunk-IOFWML5L.js}

@@ -1025,6 +1025,15 @@ function checkVoiceOpModel(op, fields) {
   return { ok: true };
 }
 
+// src/runtime-token.ts
+var WORKSPACE_RUNTIME_TOKEN_MESSAGE = "RUNTIME_AUTH_SECRET is the workspace runtime token; app code needs its project token (rt_v1_\u2026). Start the app through the preview (server_sync / restart), not from a workspace shell.";
+function readRuntimeAuthSecret(env = typeof process === "undefined" ? void 0 : process.env) {
+  const token = env?.RUNTIME_AUTH_SECRET;
+  if (!token) return void 0;
+  if (token.startsWith("wrt_v1_")) throw new Error(WORKSPACE_RUNTIME_TOKEN_MESSAGE);
+  return token;
+}
+
 export {
   DEFAULT_MEMORY_BLOCK,
   stripMemoryBlock,
@@ -1062,6 +1071,8 @@ export {
   parseVoiceOpJsonBody,
   parseVoiceOpForm,
   voiceOpUpstreamBody,
-  voiceOpPathParams
+  voiceOpPathParams,
+  WORKSPACE_RUNTIME_TOKEN_MESSAGE,
+  readRuntimeAuthSecret
 };
-//# sourceMappingURL=chunk-XE4LLC7Z.js.map
+//# sourceMappingURL=chunk-IOFWML5L.js.map

package/dist/{chunk-UH75UVM2.js → chunk-RALZRMFL.js}

@@ -1,6 +1,6 @@
 import {
   createVoiceHandlers
-} from "./chunk-CLF25CZC.js";
+} from "./chunk-U5UC7ZVS.js";
 
 // src/route/index.ts
 function defaultHandlers() {
@@ -29,4 +29,4 @@ export {
   defaultHandlers,
   createVoiceRoute
 };
-//# sourceMappingURL=chunk-UH75UVM2.js.map
+//# sourceMappingURL=chunk-RALZRMFL.js.map

package/dist/{chunk-CLF25CZC.js → chunk-U5UC7ZVS.js}

@@ -9,13 +9,14 @@ import {
   getVoiceOp,
   parseVoiceOpForm,
   parseVoiceOpJsonBody,
+  readRuntimeAuthSecret,
   resolveConvaiTtsModel,
   voiceOpForwardPath,
   voiceOpPathParams,
   voiceOpReturnsAudio,
   voiceOpUpstreamBody,
   voiceOpUpstreamPath
-} from "./chunk-XE4LLC7Z.js";
+} from "./chunk-IOFWML5L.js";
 import {
   AUDIO_TAGS,
   AUDIO_TAG_GROUPS,
@@ -90,7 +91,7 @@ function resolveProxyOptions(config) {
       LOG_WARN_CACHE.apiKeyIgnored(config.logger);
     }
     if (typeof process === "undefined" || !process.env) return null;
-    const runtimeToken = process.env.RUNTIME_AUTH_SECRET;
+    const runtimeToken = readRuntimeAuthSecret();
     const projectId = process.env.PROJECT_ID;
     if (!runtimeToken || !projectId) return null;
     return {
@@ -984,4 +985,4 @@ export {
   createVoiceHandlers,
   toNodeListener
 };
-//# sourceMappingURL=chunk-CLF25CZC.js.map
+//# sourceMappingURL=chunk-U5UC7ZVS.js.map

package/dist/index.cjs

@@ -58,6 +58,7 @@ __export(index_exports, {
   VOICE_STS_MODEL_IDS: () => VOICE_STS_MODEL_IDS,
   VOICE_TTS_MODELS: () => VOICE_TTS_MODELS,
   VOICE_TTS_MODEL_IDS: () => VOICE_TTS_MODEL_IDS,
+  WORKSPACE_RUNTIME_TOKEN_MESSAGE: () => WORKSPACE_RUNTIME_TOKEN_MESSAGE,
   buildPreviewLine: () => buildPreviewLine,
   composeAgentPrompt: () => composeAgentPrompt,
   composeExpressivityBlock: () => composeExpressivityBlock,
@@ -74,6 +75,7 @@ __export(index_exports, {
   parseVoiceOpJsonBody: () => parseVoiceOpJsonBody,
   readAudioTags: () => readAudioTags,
   readExpressivity: () => readExpressivity,
+  readRuntimeAuthSecret: () => readRuntimeAuthSecret,
   readVoiceSettings: () => readVoiceSettings,
   resolveConvaiTtsModel: () => resolveConvaiTtsModel,
   resolveConvaiTtsModelDetailed: () => resolveConvaiTtsModelDetailed,
@@ -2060,6 +2062,15 @@ var ShogoLiveClient = class {
     return body;
   }
 };
+
+// src/runtime-token.ts
+var WORKSPACE_RUNTIME_TOKEN_MESSAGE = "RUNTIME_AUTH_SECRET is the workspace runtime token; app code needs its project token (rt_v1_\u2026). Start the app through the preview (server_sync / restart), not from a workspace shell.";
+function readRuntimeAuthSecret(env = typeof process === "undefined" ? void 0 : process.env) {
+  const token = env?.RUNTIME_AUTH_SECRET;
+  if (!token) return void 0;
+  if (token.startsWith("wrt_v1_")) throw new Error(WORKSPACE_RUNTIME_TOKEN_MESSAGE);
+  return token;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AUDIO_TAGS,
@@ -2100,6 +2111,7 @@ var ShogoLiveClient = class {
   VOICE_STS_MODEL_IDS,
   VOICE_TTS_MODELS,
   VOICE_TTS_MODEL_IDS,
+  WORKSPACE_RUNTIME_TOKEN_MESSAGE,
   buildPreviewLine,
   composeAgentPrompt,
   composeExpressivityBlock,
@@ -2116,6 +2128,7 @@ var ShogoLiveClient = class {
   parseVoiceOpJsonBody,
   readAudioTags,
   readExpressivity,
+  readRuntimeAuthSecret,
   readVoiceSettings,
   resolveConvaiTtsModel,
   resolveConvaiTtsModelDetailed,

package/dist/index.d.cts

@@ -799,4 +799,27 @@ declare class MockTelephonyClient implements TelephonyClient {
  */
 declare function isVoiceMockEnv(): boolean;
 
-export { type AvailableNumber, type ComposeAgentPromptOptions, type CreateTelephonyOptions, DEFAULT_MEMORY_BLOCK, DEFAULT_TWILIO_BASE_URL, DirectTelephonyClient, type DirectTelephonyOptions, Expressivity, HostedRuntimeTokenClient, type HostedRuntimeTokenOptions, HostedTelephonyClient, type HostedTelephonyOptions, type IncomingNumber, MockTelephonyClient, type OutboundCallOptions, type OutboundCallResult, type ProvisionNumberOptions, type ProvisionNumberResult, type ReleaseNumberResult, TelephonyApiError, type TelephonyClient, TelephonyConfigError, TwilioApiError, TwilioClient, type TwilioClientConfig, VOICE_OPS, VOICE_OP_IDS, type VoiceOp, type VoiceOpCost, type VoiceOpCostUnit, type VoiceOpId, type VoiceOpPermission, type VoiceOpTransport, type VoiceUsageRange, type VoiceUsageSummary, composeAgentPrompt, createTelephonyClient, extractBasePrompt, getVoiceOp, isVoiceMockEnv, parseVoiceOpForm, parseVoiceOpJsonBody, stripMemoryBlock, voiceOpCredentialError, voiceOpForwardPath, voiceOpIsMultipart, voiceOpPathParams, voiceOpReturnsAudio, voiceOpUpstreamBody, voiceOpUpstreamPath };
+/**
+ * The one reader for `RUNTIME_AUTH_SECRET` in the SDK and `@shogo-ai/voice`.
+ *
+ * A Shogo-managed pod injects its **project** token (`rt_v1_<projectId>_<hmac>`)
+ * there, and every SDK surface (LLM gateway, voice/music, TTS, tools) uses it
+ * as the credential for that one project.
+ *
+ * A **workspace** runtime is different: its own `RUNTIME_AUTH_SECRET` is the
+ * workspace token (`wrt_v1_<workspaceId>_<hmac>`), which the API accepts on the
+ * Git LFS routes only. Code that inherits it — an app server started from a
+ * workspace shell, an MCP server, a build — used to send it and get a bare 401
+ * from every SDK call. Say that plainly instead: the fix is to run the app
+ * through the preview, which swaps in the project token.
+ */
+/** Thrown when app code picks up a workspace runtime token instead of its project's. */
+declare const WORKSPACE_RUNTIME_TOKEN_MESSAGE: string;
+/**
+ * `RUNTIME_AUTH_SECRET` from `env`, or undefined when unset. Throws when it is
+ * a workspace token: no SDK call can succeed with one, so failing here beats a
+ * 401 several layers down.
+ */
+declare function readRuntimeAuthSecret(env?: NodeJS.ProcessEnv | undefined): string | undefined;
+
+export { type AvailableNumber, type ComposeAgentPromptOptions, type CreateTelephonyOptions, DEFAULT_MEMORY_BLOCK, DEFAULT_TWILIO_BASE_URL, DirectTelephonyClient, type DirectTelephonyOptions, Expressivity, HostedRuntimeTokenClient, type HostedRuntimeTokenOptions, HostedTelephonyClient, type HostedTelephonyOptions, type IncomingNumber, MockTelephonyClient, type OutboundCallOptions, type OutboundCallResult, type ProvisionNumberOptions, type ProvisionNumberResult, type ReleaseNumberResult, TelephonyApiError, type TelephonyClient, TelephonyConfigError, TwilioApiError, TwilioClient, type TwilioClientConfig, VOICE_OPS, VOICE_OP_IDS, type VoiceOp, type VoiceOpCost, type VoiceOpCostUnit, type VoiceOpId, type VoiceOpPermission, type VoiceOpTransport, type VoiceUsageRange, type VoiceUsageSummary, WORKSPACE_RUNTIME_TOKEN_MESSAGE, composeAgentPrompt, createTelephonyClient, extractBasePrompt, getVoiceOp, isVoiceMockEnv, parseVoiceOpForm, parseVoiceOpJsonBody, readRuntimeAuthSecret, stripMemoryBlock, voiceOpCredentialError, voiceOpForwardPath, voiceOpIsMultipart, voiceOpPathParams, voiceOpReturnsAudio, voiceOpUpstreamBody, voiceOpUpstreamPath };

package/dist/index.d.ts

@@ -799,4 +799,27 @@ declare class MockTelephonyClient implements TelephonyClient {
  */
 declare function isVoiceMockEnv(): boolean;
 
-export { type AvailableNumber, type ComposeAgentPromptOptions, type CreateTelephonyOptions, DEFAULT_MEMORY_BLOCK, DEFAULT_TWILIO_BASE_URL, DirectTelephonyClient, type DirectTelephonyOptions, Expressivity, HostedRuntimeTokenClient, type HostedRuntimeTokenOptions, HostedTelephonyClient, type HostedTelephonyOptions, type IncomingNumber, MockTelephonyClient, type OutboundCallOptions, type OutboundCallResult, type ProvisionNumberOptions, type ProvisionNumberResult, type ReleaseNumberResult, TelephonyApiError, type TelephonyClient, TelephonyConfigError, TwilioApiError, TwilioClient, type TwilioClientConfig, VOICE_OPS, VOICE_OP_IDS, type VoiceOp, type VoiceOpCost, type VoiceOpCostUnit, type VoiceOpId, type VoiceOpPermission, type VoiceOpTransport, type VoiceUsageRange, type VoiceUsageSummary, composeAgentPrompt, createTelephonyClient, extractBasePrompt, getVoiceOp, isVoiceMockEnv, parseVoiceOpForm, parseVoiceOpJsonBody, stripMemoryBlock, voiceOpCredentialError, voiceOpForwardPath, voiceOpIsMultipart, voiceOpPathParams, voiceOpReturnsAudio, voiceOpUpstreamBody, voiceOpUpstreamPath };
+/**
+ * The one reader for `RUNTIME_AUTH_SECRET` in the SDK and `@shogo-ai/voice`.
+ *
+ * A Shogo-managed pod injects its **project** token (`rt_v1_<projectId>_<hmac>`)
+ * there, and every SDK surface (LLM gateway, voice/music, TTS, tools) uses it
+ * as the credential for that one project.
+ *
+ * A **workspace** runtime is different: its own `RUNTIME_AUTH_SECRET` is the
+ * workspace token (`wrt_v1_<workspaceId>_<hmac>`), which the API accepts on the
+ * Git LFS routes only. Code that inherits it — an app server started from a
+ * workspace shell, an MCP server, a build — used to send it and get a bare 401
+ * from every SDK call. Say that plainly instead: the fix is to run the app
+ * through the preview, which swaps in the project token.
+ */
+/** Thrown when app code picks up a workspace runtime token instead of its project's. */
+declare const WORKSPACE_RUNTIME_TOKEN_MESSAGE: string;
+/**
+ * `RUNTIME_AUTH_SECRET` from `env`, or undefined when unset. Throws when it is
+ * a workspace token: no SDK call can succeed with one, so failing here beats a
+ * 401 several layers down.
+ */
+declare function readRuntimeAuthSecret(env?: NodeJS.ProcessEnv | undefined): string | undefined;
+
+export { type AvailableNumber, type ComposeAgentPromptOptions, type CreateTelephonyOptions, DEFAULT_MEMORY_BLOCK, DEFAULT_TWILIO_BASE_URL, DirectTelephonyClient, type DirectTelephonyOptions, Expressivity, HostedRuntimeTokenClient, type HostedRuntimeTokenOptions, HostedTelephonyClient, type HostedTelephonyOptions, type IncomingNumber, MockTelephonyClient, type OutboundCallOptions, type OutboundCallResult, type ProvisionNumberOptions, type ProvisionNumberResult, type ReleaseNumberResult, TelephonyApiError, type TelephonyClient, TelephonyConfigError, TwilioApiError, TwilioClient, type TwilioClientConfig, VOICE_OPS, VOICE_OP_IDS, type VoiceOp, type VoiceOpCost, type VoiceOpCostUnit, type VoiceOpId, type VoiceOpPermission, type VoiceOpTransport, type VoiceUsageRange, type VoiceUsageSummary, WORKSPACE_RUNTIME_TOKEN_MESSAGE, composeAgentPrompt, createTelephonyClient, extractBasePrompt, getVoiceOp, isVoiceMockEnv, parseVoiceOpForm, parseVoiceOpJsonBody, readRuntimeAuthSecret, stripMemoryBlock, voiceOpCredentialError, voiceOpForwardPath, voiceOpIsMultipart, voiceOpPathParams, voiceOpReturnsAudio, voiceOpUpstreamBody, voiceOpUpstreamPath };

package/dist/index.js

@@ -23,6 +23,7 @@ import {
   VOICE_STS_MODEL_IDS,
   VOICE_TTS_MODELS,
   VOICE_TTS_MODEL_IDS,
+  WORKSPACE_RUNTIME_TOKEN_MESSAGE,
   composeAgentPrompt,
   extractBasePrompt,
   getVoiceOp,
@@ -30,6 +31,7 @@ import {
   isModelRelatedTtsFailure,
   parseVoiceOpForm,
   parseVoiceOpJsonBody,
+  readRuntimeAuthSecret,
   resolveConvaiTtsModel,
   resolveConvaiTtsModelDetailed,
   stripMemoryBlock,
@@ -40,7 +42,7 @@ import {
   voiceOpReturnsAudio,
   voiceOpUpstreamBody,
   voiceOpUpstreamPath
-} from "./chunk-XE4LLC7Z.js";
+} from "./chunk-IOFWML5L.js";
 import {
   AUDIO_TAGS,
   AUDIO_TAG_GROUPS,
@@ -760,6 +762,7 @@ export {
   VOICE_STS_MODEL_IDS,
   VOICE_TTS_MODELS,
   VOICE_TTS_MODEL_IDS,
+  WORKSPACE_RUNTIME_TOKEN_MESSAGE,
   buildPreviewLine,
   composeAgentPrompt,
   composeExpressivityBlock,
@@ -776,6 +779,7 @@ export {
   parseVoiceOpJsonBody,
   readAudioTags,
   readExpressivity,
+  readRuntimeAuthSecret,
   readVoiceSettings,
   resolveConvaiTtsModel,
   resolveConvaiTtsModelDetailed,

package/dist/route/agent.cjs

@@ -1173,6 +1173,15 @@ function checkVoiceOpModel(op, fields) {
   return { ok: true };
 }
 
+// src/runtime-token.ts
+var WORKSPACE_RUNTIME_TOKEN_MESSAGE = "RUNTIME_AUTH_SECRET is the workspace runtime token; app code needs its project token (rt_v1_\u2026). Start the app through the preview (server_sync / restart), not from a workspace shell.";
+function readRuntimeAuthSecret(env = typeof process === "undefined" ? void 0 : process.env) {
+  const token = env?.RUNTIME_AUTH_SECRET;
+  if (!token) return void 0;
+  if (token.startsWith("wrt_v1_")) throw new Error(WORKSPACE_RUNTIME_TOKEN_MESSAGE);
+  return token;
+}
+
 // src/server.ts
 function json(data, status = 200, extraHeaders = {}) {
   return new Response(JSON.stringify(data), {
@@ -1232,7 +1241,7 @@ function resolveProxyOptions(config) {
       LOG_WARN_CACHE.apiKeyIgnored(config.logger);
     }
     if (typeof process === "undefined" || !process.env) return null;
-    const runtimeToken = process.env.RUNTIME_AUTH_SECRET;
+    const runtimeToken = readRuntimeAuthSecret();
     const projectId = process.env.PROJECT_ID;
     if (!runtimeToken || !projectId) return null;
     return {

package/dist/route/agent.js

@@ -1,8 +1,8 @@
 import {
   defaultHandlers
-} from "../chunk-UH75UVM2.js";
-import "../chunk-CLF25CZC.js";
-import "../chunk-XE4LLC7Z.js";
+} from "../chunk-RALZRMFL.js";
+import "../chunk-U5UC7ZVS.js";
+import "../chunk-IOFWML5L.js";
 import "../chunk-Q3TJAJ54.js";
 
 // src/route/agent.ts

package/dist/route/audio-tags.cjs

@@ -1171,6 +1171,15 @@ function checkVoiceOpModel(op, fields) {
   return { ok: true };
 }
 
+// src/runtime-token.ts
+var WORKSPACE_RUNTIME_TOKEN_MESSAGE = "RUNTIME_AUTH_SECRET is the workspace runtime token; app code needs its project token (rt_v1_\u2026). Start the app through the preview (server_sync / restart), not from a workspace shell.";
+function readRuntimeAuthSecret(env = typeof process === "undefined" ? void 0 : process.env) {
+  const token = env?.RUNTIME_AUTH_SECRET;
+  if (!token) return void 0;
+  if (token.startsWith("wrt_v1_")) throw new Error(WORKSPACE_RUNTIME_TOKEN_MESSAGE);
+  return token;
+}
+
 // src/server.ts
 function json(data, status = 200, extraHeaders = {}) {
   return new Response(JSON.stringify(data), {
@@ -1230,7 +1239,7 @@ function resolveProxyOptions(config) {
       LOG_WARN_CACHE.apiKeyIgnored(config.logger);
     }
     if (typeof process === "undefined" || !process.env) return null;
-    const runtimeToken = process.env.RUNTIME_AUTH_SECRET;
+    const runtimeToken = readRuntimeAuthSecret();
     const projectId = process.env.PROJECT_ID;
     if (!runtimeToken || !projectId) return null;
     return {

package/dist/route/audio-tags.js

@@ -1,8 +1,8 @@
 import {
   defaultHandlers
-} from "../chunk-UH75UVM2.js";
-import "../chunk-CLF25CZC.js";
-import "../chunk-XE4LLC7Z.js";
+} from "../chunk-RALZRMFL.js";
+import "../chunk-U5UC7ZVS.js";
+import "../chunk-IOFWML5L.js";
 import "../chunk-Q3TJAJ54.js";
 
 // src/route/audio-tags.ts

package/dist/route/index.cjs

@@ -1172,6 +1172,15 @@ function checkVoiceOpModel(op, fields) {
   return { ok: true };
 }
 
+// src/runtime-token.ts
+var WORKSPACE_RUNTIME_TOKEN_MESSAGE = "RUNTIME_AUTH_SECRET is the workspace runtime token; app code needs its project token (rt_v1_\u2026). Start the app through the preview (server_sync / restart), not from a workspace shell.";
+function readRuntimeAuthSecret(env = typeof process === "undefined" ? void 0 : process.env) {
+  const token = env?.RUNTIME_AUTH_SECRET;
+  if (!token) return void 0;
+  if (token.startsWith("wrt_v1_")) throw new Error(WORKSPACE_RUNTIME_TOKEN_MESSAGE);
+  return token;
+}
+
 // src/server.ts
 function json(data, status = 200, extraHeaders = {}) {
   return new Response(JSON.stringify(data), {
@@ -1231,7 +1240,7 @@ function resolveProxyOptions(config) {
       LOG_WARN_CACHE.apiKeyIgnored(config.logger);
     }
     if (typeof process === "undefined" || !process.env) return null;
-    const runtimeToken = process.env.RUNTIME_AUTH_SECRET;
+    const runtimeToken = readRuntimeAuthSecret();
     const projectId = process.env.PROJECT_ID;
     if (!runtimeToken || !projectId) return null;
     return {

package/dist/route/index.js

@@ -1,9 +1,9 @@
 import {
   createVoiceRoute,
   defaultHandlers
-} from "../chunk-UH75UVM2.js";
-import "../chunk-CLF25CZC.js";
-import "../chunk-XE4LLC7Z.js";
+} from "../chunk-RALZRMFL.js";
+import "../chunk-U5UC7ZVS.js";
+import "../chunk-IOFWML5L.js";
 import "../chunk-Q3TJAJ54.js";
 export {
   createVoiceRoute,

package/dist/route/music.cjs

@@ -1171,6 +1171,15 @@ function checkVoiceOpModel(op, fields) {
   return { ok: true };
 }
 
+// src/runtime-token.ts
+var WORKSPACE_RUNTIME_TOKEN_MESSAGE = "RUNTIME_AUTH_SECRET is the workspace runtime token; app code needs its project token (rt_v1_\u2026). Start the app through the preview (server_sync / restart), not from a workspace shell.";
+function readRuntimeAuthSecret(env = typeof process === "undefined" ? void 0 : process.env) {
+  const token = env?.RUNTIME_AUTH_SECRET;
+  if (!token) return void 0;
+  if (token.startsWith("wrt_v1_")) throw new Error(WORKSPACE_RUNTIME_TOKEN_MESSAGE);
+  return token;
+}
+
 // src/server.ts
 function json(data, status = 200, extraHeaders = {}) {
   return new Response(JSON.stringify(data), {
@@ -1230,7 +1239,7 @@ function resolveProxyOptions(config) {
       LOG_WARN_CACHE.apiKeyIgnored(config.logger);
     }
     if (typeof process === "undefined" || !process.env) return null;
-    const runtimeToken = process.env.RUNTIME_AUTH_SECRET;
+    const runtimeToken = readRuntimeAuthSecret();
     const projectId = process.env.PROJECT_ID;
     if (!runtimeToken || !projectId) return null;
     return {

package/dist/route/music.js

@@ -1,8 +1,8 @@
 import {
   defaultHandlers
-} from "../chunk-UH75UVM2.js";
-import "../chunk-CLF25CZC.js";
-import "../chunk-XE4LLC7Z.js";
+} from "../chunk-RALZRMFL.js";
+import "../chunk-U5UC7ZVS.js";
+import "../chunk-IOFWML5L.js";
 import "../chunk-Q3TJAJ54.js";
 
 // src/route/music.ts

package/dist/route/op.cjs

@@ -1173,6 +1173,15 @@ function checkVoiceOpModel(op, fields) {
   return { ok: true };
 }
 
+// src/runtime-token.ts
+var WORKSPACE_RUNTIME_TOKEN_MESSAGE = "RUNTIME_AUTH_SECRET is the workspace runtime token; app code needs its project token (rt_v1_\u2026). Start the app through the preview (server_sync / restart), not from a workspace shell.";
+function readRuntimeAuthSecret(env = typeof process === "undefined" ? void 0 : process.env) {
+  const token = env?.RUNTIME_AUTH_SECRET;
+  if (!token) return void 0;
+  if (token.startsWith("wrt_v1_")) throw new Error(WORKSPACE_RUNTIME_TOKEN_MESSAGE);
+  return token;
+}
+
 // src/server.ts
 function json(data, status = 200, extraHeaders = {}) {
   return new Response(JSON.stringify(data), {
@@ -1232,7 +1241,7 @@ function resolveProxyOptions(config) {
       LOG_WARN_CACHE.apiKeyIgnored(config.logger);
     }
     if (typeof process === "undefined" || !process.env) return null;
-    const runtimeToken = process.env.RUNTIME_AUTH_SECRET;
+    const runtimeToken = readRuntimeAuthSecret();
     const projectId = process.env.PROJECT_ID;
     if (!runtimeToken || !projectId) return null;
     return {

package/dist/route/op.js

@@ -1,10 +1,10 @@
 import {
   defaultHandlers
-} from "../chunk-UH75UVM2.js";
-import "../chunk-CLF25CZC.js";
+} from "../chunk-RALZRMFL.js";
+import "../chunk-U5UC7ZVS.js";
 import {
   VOICE_OPS
-} from "../chunk-XE4LLC7Z.js";
+} from "../chunk-IOFWML5L.js";
 import "../chunk-Q3TJAJ54.js";
 
 // src/route/op.ts

package/dist/route/signed-url.cjs

@@ -1171,6 +1171,15 @@ function checkVoiceOpModel(op, fields) {
   return { ok: true };
 }
 
+// src/runtime-token.ts
+var WORKSPACE_RUNTIME_TOKEN_MESSAGE = "RUNTIME_AUTH_SECRET is the workspace runtime token; app code needs its project token (rt_v1_\u2026). Start the app through the preview (server_sync / restart), not from a workspace shell.";
+function readRuntimeAuthSecret(env = typeof process === "undefined" ? void 0 : process.env) {
+  const token = env?.RUNTIME_AUTH_SECRET;
+  if (!token) return void 0;
+  if (token.startsWith("wrt_v1_")) throw new Error(WORKSPACE_RUNTIME_TOKEN_MESSAGE);
+  return token;
+}
+
 // src/server.ts
 function json(data, status = 200, extraHeaders = {}) {
   return new Response(JSON.stringify(data), {
@@ -1230,7 +1239,7 @@ function resolveProxyOptions(config) {
       LOG_WARN_CACHE.apiKeyIgnored(config.logger);
     }
     if (typeof process === "undefined" || !process.env) return null;
-    const runtimeToken = process.env.RUNTIME_AUTH_SECRET;
+    const runtimeToken = readRuntimeAuthSecret();
     const projectId = process.env.PROJECT_ID;
     if (!runtimeToken || !projectId) return null;
     return {

package/dist/route/signed-url.js

@@ -1,8 +1,8 @@
 import {
   defaultHandlers
-} from "../chunk-UH75UVM2.js";
-import "../chunk-CLF25CZC.js";
-import "../chunk-XE4LLC7Z.js";
+} from "../chunk-RALZRMFL.js";
+import "../chunk-U5UC7ZVS.js";
+import "../chunk-IOFWML5L.js";
 import "../chunk-Q3TJAJ54.js";
 
 // src/route/signed-url.ts

package/dist/route/tts-preview.cjs

@@ -1171,6 +1171,15 @@ function checkVoiceOpModel(op, fields) {
   return { ok: true };
 }
 
+// src/runtime-token.ts
+var WORKSPACE_RUNTIME_TOKEN_MESSAGE = "RUNTIME_AUTH_SECRET is the workspace runtime token; app code needs its project token (rt_v1_\u2026). Start the app through the preview (server_sync / restart), not from a workspace shell.";
+function readRuntimeAuthSecret(env = typeof process === "undefined" ? void 0 : process.env) {
+  const token = env?.RUNTIME_AUTH_SECRET;
+  if (!token) return void 0;
+  if (token.startsWith("wrt_v1_")) throw new Error(WORKSPACE_RUNTIME_TOKEN_MESSAGE);
+  return token;
+}
+
 // src/server.ts
 function json(data, status = 200, extraHeaders = {}) {
   return new Response(JSON.stringify(data), {
@@ -1230,7 +1239,7 @@ function resolveProxyOptions(config) {
       LOG_WARN_CACHE.apiKeyIgnored(config.logger);
     }
     if (typeof process === "undefined" || !process.env) return null;
-    const runtimeToken = process.env.RUNTIME_AUTH_SECRET;
+    const runtimeToken = readRuntimeAuthSecret();
     const projectId = process.env.PROJECT_ID;
     if (!runtimeToken || !projectId) return null;
     return {

package/dist/route/tts-preview.js

@@ -1,8 +1,8 @@
 import {
   defaultHandlers
-} from "../chunk-UH75UVM2.js";
-import "../chunk-CLF25CZC.js";
-import "../chunk-XE4LLC7Z.js";
+} from "../chunk-RALZRMFL.js";
+import "../chunk-U5UC7ZVS.js";
+import "../chunk-IOFWML5L.js";
 import "../chunk-Q3TJAJ54.js";
 
 // src/route/tts-preview.ts

package/dist/server.cjs

@@ -1172,6 +1172,15 @@ function checkVoiceOpModel(op, fields) {
   return { ok: true };
 }
 
+// src/runtime-token.ts
+var WORKSPACE_RUNTIME_TOKEN_MESSAGE = "RUNTIME_AUTH_SECRET is the workspace runtime token; app code needs its project token (rt_v1_\u2026). Start the app through the preview (server_sync / restart), not from a workspace shell.";
+function readRuntimeAuthSecret(env = typeof process === "undefined" ? void 0 : process.env) {
+  const token = env?.RUNTIME_AUTH_SECRET;
+  if (!token) return void 0;
+  if (token.startsWith("wrt_v1_")) throw new Error(WORKSPACE_RUNTIME_TOKEN_MESSAGE);
+  return token;
+}
+
 // src/server.ts
 function json(data, status = 200, extraHeaders = {}) {
   return new Response(JSON.stringify(data), {
@@ -1231,7 +1240,7 @@ function resolveProxyOptions(config) {
       LOG_WARN_CACHE.apiKeyIgnored(config.logger);
     }
     if (typeof process === "undefined" || !process.env) return null;
-    const runtimeToken = process.env.RUNTIME_AUTH_SECRET;
+    const runtimeToken = readRuntimeAuthSecret();
     const projectId = process.env.PROJECT_ID;
     if (!runtimeToken || !projectId) return null;
     return {

package/dist/server.js

@@ -1,8 +1,8 @@
 import {
   createVoiceHandlers,
   toNodeListener
-} from "./chunk-CLF25CZC.js";
-import "./chunk-XE4LLC7Z.js";
+} from "./chunk-U5UC7ZVS.js";
+import "./chunk-IOFWML5L.js";
 import "./chunk-Q3TJAJ54.js";
 export {
   createVoiceHandlers,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shogo-ai/voice",
-  "version": "2.4.1",
+  "version": "2.4.3",
   "description": "Shogo Voice — ElevenLabs/Twilio voice agent infrastructure with React + React Native UI primitives.",
   "license": "MIT",
   "type": "module",