@alia.onl/sdk 15.7.0 → 15.8.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @alia.onl/sdk
 
+## 15.8.0
+
+- **The SDK declares its CSP, and the voice call needs no `blob:` script.** In an app with a
+  Content-Security-Policy (Mention) the call failed twice over: `connect-src` lacked
+  `wss://api.alia.onl`, and the worklets were `blob:` URLs that `script-src` blocks
+  (`Failed to load worklet module script`). `@alia.onl/sdk/csp` exports `ALIA_SDK_CSP` and
+  `withAliaSdkCsp()` (`OxyCspExtensions` of `@oxy.so/core`), derived from the same origins the
+  SDK's URLs start from (`lib/origins.ts`); a test fails if the source names an origin it does not
+  declare. The worklets are one plain module, `worklets/voice-processors.js`, taking their numbers
+  as `processorOptions` and served by Alia's web app under its content hash
+  (`https://alia.onl/sdk/voice-worklets/<revision>.js`, CORS open, every revision kept), under the
+  `script-src https://alia.onl` the avatar already needs. The API's URL is defined once (the
+  dictation, read-aloud and voice hooks each had their own copy).
+
 ## 15.7.0
 
 - **`AliaAvatarIcon` is her still until she moves.** At icon size it drew Alia through the live 3D

package/README.md

@@ -28,12 +28,25 @@ The chat is built from Bloom (`@oxy.so/bloom`, a peer dependency): mount Bloom's
 Alia's avatar is Bloom's 3D character (`AgentAvatar`). It draws through a runtime of
 static files (about 214 MB), which the chat loads from Alia's own origin
 (`ALIA_CHARACTER_RUNTIME_URL`, served with CORS open), so the app hosts nothing and mounts
-no avatar provider. An app with a strict CSP allows `https://alia.onl` in `script-src` and
-`connect-src` (and `'wasm-unsafe-eval'`). To serve your own copy instead, serve the Bloom
+no avatar provider. To serve your own copy instead, serve the Bloom
 package's `assets/character-runtime/` directory unchanged and pass the URL of `runtime.mjs`
 as `characterRuntimeUrl` to `AliaChatSheet` or `AliaChatScreen`; native avatars run in a
 WebView, so there the URL must be absolute and reachable from the device.
 
+A web app with a Content-Security-Policy composes the SDK's into its own instead of listing
+Alia's origins by hand: `@alia.onl/sdk/csp` exports `ALIA_SDK_CSP` and `withAliaSdkCsp(extensions)`
+in the shape of `@oxy.so/core`'s `OxyCspExtensions` (a leaf entry, safe on a server):
+
+```ts
+import { withAliaSdkCsp } from '@alia.onl/sdk/csp';
+app.use(createOxySecurityHeaders({ csp: withAliaSdkCsp(APP_CSP_EXTENSIONS) }));
+```
+
+It declares the API and its WebSocket (`connect-src`), the avatar runtime and the voice call's
+worklets on `https://alia.onl` (`script-src`, with `'wasm-unsafe-eval'` for the runtime's
+WebAssembly), attachments and read-aloud clips (`img-src`, `media-src`). No `blob:` script:
+the worklets are a content-addressed file on `alia.onl`, not a blob URL.
+
 The empty chat greets the signed-in person by name ("Hi Nate, what's on your mind?"); pass
 `welcomeGreeting` to say something else, or `labels.greeting` / `labels.greetingNamed` to translate it.
 
@@ -44,9 +57,10 @@ The chat's own copy is English. Pass `labels` to `AliaChatSheet` or
 `AliaChatScreen` to translate it (`AliaChatLabels`; anything omitted stays
 English). Bloom's own strings follow `BloomProvider`'s `locale`.
 
-Two entry points:
+Entry points:
 
 - `@alia.onl/sdk` — text chat, dictation, read-aloud, catalogue, primitives.
+- `@alia.onl/sdk/csp` — the CSP the SDK needs from a host page (above).
 - `@alia.onl/sdk/voice` — `VoiceSession` and `useVoiceRoom`, the voice call.
   Pass `VoiceSession` to the shell as `voiceSession` to offer calls; leave it
   out for text-only chat and the call is never compiled.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alia.onl/sdk",
-  "version": "15.7.0",
+  "version": "15.8.0",
   "main": "src/index.ts",
   "react-native": "src/index.ts",
   "source": "src/index.ts",
@@ -9,12 +9,14 @@
     ".": "./src/index.ts",
     "./avatar": "./src/avatar.ts",
     "./content": "./src/lib/content-utils.ts",
+    "./csp": "./src/csp.ts",
     "./tools": "./src/tools.ts",
     "./voice": "./src/voice.ts",
     "./package.json": "./package.json"
   },
   "files": [
     "src",
+    "worklets",
     "NOTICE",
     "tsconfig.json",
     "CHANGELOG.md"

package/src/csp.ts

@@ -0,0 +1,50 @@
+/**
+ * `@alia.onl/sdk/csp` — the Content-Security-Policy the SDK needs from a host page, in the
+ * shape of `@oxy.so/core`'s `OxyCspExtensions`, so a host composes it into its own policy
+ * instead of copying Alia's origins by hand:
+ *
+ * ```ts
+ * import { withAliaSdkCsp } from '@alia.onl/sdk/csp';
+ * createOxySecurityHeaders({ csp: withAliaSdkCsp(APP_CSP_EXTENSIONS) });
+ * ```
+ *
+ * Every source is derived from `lib/origins.ts`, the values the SDK's own URLs start from, and a
+ * test fails if the SDK's source names an origin this does not declare. A leaf entry: no React,
+ * no React Native, safe to import from a server.
+ */
+
+import type { OxyCspDirective, OxyCspExtensions } from '@oxy.so/core/server';
+import { ALIA_API_URL, ALIA_WEB_ORIGIN } from './lib/origins';
+import { voiceSessionUrl } from './lib/voice-protocol';
+
+const api = new URL(ALIA_API_URL).origin;
+const voiceSocket = new URL(voiceSessionUrl(ALIA_API_URL)).origin;
+
+/** What the SDK loads, by directive, and why. */
+export const ALIA_SDK_CSP = Object.freeze({
+  // The API (chat, dictation, speech, the activity socket's polling) and its WebSocket (the
+  // voice call, socket.io); the avatar runtime fetches its WebAssembly and data from the web app.
+  connectSrc: Object.freeze([api, voiceSocket, ALIA_WEB_ORIGIN]),
+  // The avatar runtime and the voice call's worklets are modules served by the web app; the
+  // runtime compiles WebAssembly (`'wasm-unsafe-eval'` allows that and nothing else: no eval).
+  scriptSrc: Object.freeze([ALIA_WEB_ORIGIN, "'wasm-unsafe-eval'"]),
+  // Stored attachments come from the API; an attachment's preview before upload is a blob.
+  imgSrc: Object.freeze([api, 'blob:']),
+  // Read-aloud clips are played from the API.
+  mediaSrc: Object.freeze([api]),
+} satisfies OxyCspExtensions);
+
+/**
+ * The host's own CSP extensions with the SDK's added: each directive is the union, the host's
+ * sources first. `@oxy.so/core` dedupes when it builds the policy.
+ */
+export function withAliaSdkCsp(host: OxyCspExtensions = {}): OxyCspExtensions {
+  const merged: Partial<Record<OxyCspDirective, readonly string[]>> = { ...host };
+  for (const [directive, sources] of Object.entries(ALIA_SDK_CSP) as [
+    OxyCspDirective,
+    readonly string[],
+  ][]) {
+    merged[directive] = [...(host[directive] ?? []), ...sources];
+  }
+  return merged;
+}

package/src/hooks/useAliaActivity.ts

@@ -3,7 +3,7 @@ import { useOxy } from '@oxy.so/services/ui/client';
 import type { AliaAvatarState } from '../components/AliaAvatar';
 import { selectAliaActivity, useAliaActivityStore } from '../lib/activity-store';
 import { acquireActivitySocket } from '../lib/activity-socket';
-import { ALIA_API_URL } from '../lib/api-url';
+import { ALIA_API_URL } from '../lib/origins';
 
 export interface UseAliaActivityOptions {
   /** The API the activity socket connects to. Defaults like `useAliaChat`'s `apiUrl`. */

package/src/hooks/useAliaChat.ts

@@ -7,7 +7,7 @@ import { agentMessageId, delegatedAgent } from '../lib/delegation';
 import { streamAliaChat } from '../lib/chat-transport';
 import type { AliaChatStreamEvent } from '../lib/chat-stream';
 
-import { ALIA_API_URL } from '../lib/api-url';
+import { ALIA_API_URL } from '../lib/origins';
 import { useAliaActivityStore } from '../lib/activity-store';
 import { turnActivityState } from '../lib/turn-state';
 

package/src/hooks/useDictation.ts

@@ -28,8 +28,7 @@ import {
 import { DictationRecorderError, useDictationRecorder } from '../lib/dictation-recorder';
 import { defaultSpeechLanguage } from '../lib/speech-language';
 import { VOICE_ERROR_MESSAGES, type VoiceErrorCode } from '../lib/speech-messages';
-
-const API_URL = process.env.EXPO_PUBLIC_ALIA_API_URL ?? 'https://api.alia.onl';
+import { ALIA_API_URL } from '../lib/origins';
 
 /** The remaining time is shown from here on. */
 const COUNTDOWN_FROM_MS = 30_000;
@@ -132,7 +131,7 @@ export function useDictation(options: UseDictationOptions = {}) {
       abortRef.current = controller;
       try {
         const result = await requestTranscription({
-          apiUrl: optionsRef.current.apiUrl || API_URL,
+          apiUrl: optionsRef.current.apiUrl || ALIA_API_URL,
           token,
           clip,
           language: optionsRef.current.lang ?? defaultSpeechLanguage(),

package/src/hooks/useTTS.ts

@@ -6,8 +6,7 @@ import { errorMessage } from '../lib/utils';
 import { create } from 'zustand';
 import { createAudioLevelMeter } from '../lib/audio-level';
 import { requestSpeechClip } from '../lib/speech-synthesis';
-
-const API_URL = process.env.EXPO_PUBLIC_ALIA_API_URL ?? 'https://api.alia.onl';
+import { ALIA_API_URL } from '../lib/origins';
 
 // ============== OPTIONS ==============
 
@@ -83,7 +82,7 @@ useTTSStore.subscribe((state, previous) => {
 // ============== HOOK ==============
 
 export function useTTS(options: UseTTSOptions = {}) {
-  const apiUrl = options.apiUrl || API_URL;
+  const apiUrl = options.apiUrl || ALIA_API_URL;
   const voicePref = options.voice ?? 'female';
   const voiceModel = options.model;
   const tonePref = options.tone ?? 'default';

package/src/hooks/useVoiceRoom.ts

@@ -24,8 +24,7 @@ import type { VoiceAudioEngine } from '../lib/voice-audio-engine-types';
 import { VoiceCall, type VoiceCallSnapshot, type VoiceSocketFactory } from '../lib/voice-call';
 import { VoiceLevelChannel, type VoiceLevelSource } from '../lib/voice-levels';
 import type { ProductVoice, VoiceCloseReason } from '../lib/voice-protocol';
-
-const API_URL = process.env.EXPO_PUBLIC_ALIA_API_URL ?? 'https://api.alia.onl';
+import { ALIA_API_URL } from '../lib/origins';
 
 export interface UseVoiceRoomOptions {
   apiUrl?: string;
@@ -120,7 +119,7 @@ export function useVoiceRoom(options: UseVoiceRoomOptions = {}) {
     if (live !== undefined && live !== 'ended' && live !== 'error') return;
     const current = optionsRef.current;
     const call = new VoiceCall({
-      apiUrl: current.apiUrl || API_URL,
+      apiUrl: current.apiUrl || ALIA_API_URL,
       getToken,
       conversationId: current.conversationId ?? newConversationId(),
       ...(current.agentId === undefined ? {} : { agentId: current.agentId }),

package/src/lib/character-runtime.ts

@@ -1,10 +1,12 @@
+import { ALIA_WEB_ORIGIN } from './origins';
+
 /**
  * Where the 3D character runtime (Alia's avatar) is served from when the host does not say.
  *
  * The runtime is ~214 MB of engine and data, so the chat loads it from Alia's own web origin
  * instead of asking every app to host a copy. That origin serves it with CORS open
- * (`packages/app/worker/index.js`), which a cross-origin module import needs; an app with a
- * strict CSP allows it in `script-src` and `connect-src`. A host that serves its own copy
- * passes `characterRuntimeUrl`.
+ * (`packages/app/worker/index.js`), which a cross-origin module import needs; a host with a
+ * CSP allows it with `@alia.onl/sdk/csp`. A host that serves its own copy passes
+ * `characterRuntimeUrl`.
  */
-export const ALIA_CHARACTER_RUNTIME_URL = 'https://alia.onl/bloom-character/runtime.mjs';
+export const ALIA_CHARACTER_RUNTIME_URL = `${ALIA_WEB_ORIGIN}/bloom-character/runtime.mjs`;

package/src/lib/origins.ts

@@ -0,0 +1,15 @@
+/**
+ * The two origins the SDK talks to, defined once. Every URL it builds starts from one of them,
+ * and `@alia.onl/sdk/csp` (`src/csp.ts`) derives the host's CSP from these same values, so an
+ * origin the SDK uses is an origin it declares.
+ */
+
+/** Alia's API: `EXPO_PUBLIC_ALIA_API_URL`, then production. Chat, dictation, speech, voice. */
+export const ALIA_API_URL = process.env.EXPO_PUBLIC_ALIA_API_URL ?? 'https://api.alia.onl';
+
+/**
+ * Alia's web app, which serves the files the SDK shares with every host: Bloom's character
+ * runtime (`/bloom-character/`) and the voice call's worklets (`/sdk/voice-worklets/`), both
+ * with CORS open (`packages/app/worker/index.js`).
+ */
+export const ALIA_WEB_ORIGIN = 'https://alia.onl';

package/src/lib/voice-audio-engine.ts

@@ -11,12 +11,14 @@
  * playback through a local `RTCPeerConnection` loopback) is not built until the
  * measurement says it is needed.
  *
- * The worklets are inline source turned into a Blob URL: the SDK ships raw
- * source and a host bundler would not emit a separate worklet file.
+ * The worklets are one module served by Alia's web app (`./voice-worklets.ts`),
+ * never a `blob:` URL a host's CSP would have to allow as script. Their numbers
+ * (stream rate, frame size, prebuffer) are passed as `processorOptions`.
  */
 
 import { levelOfPcm16, pcm16ToFloat } from './pcm';
 import { VOICE_FRAME_SAMPLES, VOICE_SAMPLE_RATE } from './voice-protocol';
+import { VOICE_WORKLETS_URL } from './voice-worklets';
 import {
   VoiceAudioEngineError,
   type VoiceAudioEngine,
@@ -30,155 +32,6 @@ const PREBUFFER_MS = 80;
 /** A burst shorter than the prebuffer still plays once nothing more arrives for this long. */
 const PREBUFFER_IDLE_MS = 100;
 
-const CAPTURE_PROCESSOR = `
-class AliaVoiceCapture extends AudioWorkletProcessor {
-  constructor() {
-    super();
-    this.ratio = sampleRate / ${VOICE_SAMPLE_RATE};
-    this.t = 0;
-    this.prev = 0;
-    this.frame = new Int16Array(${VOICE_FRAME_SAMPLES});
-    this.filled = 0;
-  }
-  process(inputs) {
-    const input = inputs[0] && inputs[0][0];
-    if (!input || input.length === 0) return true;
-    const n = input.length;
-    while (this.t < n - 1) {
-      const i = Math.floor(this.t);
-      const f = this.t - i;
-      const a = i < 0 ? this.prev : input[i];
-      const b = input[i + 1];
-      let s = a + (b - a) * f;
-      s = s < -1 ? -1 : s > 1 ? 1 : s;
-      this.frame[this.filled++] = s < 0 ? s * 0x8000 : s * 0x7fff;
-      if (this.filled === this.frame.length) {
-        const out = this.frame;
-        this.port.postMessage(out.buffer, [out.buffer]);
-        this.frame = new Int16Array(${VOICE_FRAME_SAMPLES});
-        this.filled = 0;
-      }
-      this.t += this.ratio;
-    }
-    this.t -= n;
-    this.prev = input[n - 1];
-    return true;
-  }
-}
-registerProcessor('alia-voice-capture', AliaVoiceCapture);
-`;
-
-const PLAYBACK_PROCESSOR = `
-class AliaVoicePlayback extends AudioWorkletProcessor {
-  constructor() {
-    super();
-    this.step = ${VOICE_SAMPLE_RATE} / sampleRate;
-    this.queue = [];
-    this.queued = 0;
-    this.pos = 0;
-    this.buffering = true;
-    this.lastChunkAt = 0;
-    this.item = null;
-    this.played = 0;
-    this.sinceReport = 0;
-    this.sumSquares = 0;
-    this.count = 0;
-    this.port.onmessage = (event) => {
-      const message = event.data;
-      if (message.type === 'chunk') {
-        this.queue.push({ itemId: message.itemId, samples: message.samples });
-        this.queued += message.samples.length;
-        this.lastChunkAt = currentTime;
-      } else if (message.type === 'flush') {
-        const playedMs = this.item === null ? null : (this.played / ${VOICE_SAMPLE_RATE}) * 1000;
-        this.port.postMessage({ type: 'flushed', itemId: this.item, playedMs });
-        this.queue = [];
-        this.queued = 0;
-        this.pos = 0;
-        this.buffering = true;
-        this.item = null;
-        this.played = 0;
-      }
-    };
-  }
-  report(force) {
-    if (!force && this.sinceReport < sampleRate / 20) return;
-    const rms = this.count === 0 ? 0 : Math.sqrt(this.sumSquares / this.count);
-    this.port.postMessage({
-      type: 'progress',
-      itemId: this.item,
-      playedMs: (this.played / ${VOICE_SAMPLE_RATE}) * 1000,
-      rms,
-    });
-    this.sinceReport = 0;
-    this.sumSquares = 0;
-    this.count = 0;
-  }
-  process(_inputs, outputs) {
-    const out = outputs[0][0];
-    if (this.buffering) {
-      const ready =
-        this.queued >= ${(VOICE_SAMPLE_RATE * PREBUFFER_MS) / 1000} ||
-        (this.queued > 0 && currentTime - this.lastChunkAt > ${PREBUFFER_IDLE_MS / 1000});
-      if (!ready) {
-        out.fill(0);
-        for (let c = 1; c < outputs[0].length; c++) outputs[0][c].fill(0);
-        return true;
-      }
-      this.buffering = false;
-    }
-    for (let k = 0; k < out.length; k++) {
-      const head = this.queue[0];
-      if (!head) {
-        out[k] = 0;
-        if (!this.buffering) {
-          this.buffering = true;
-          this.report(true);
-          this.port.postMessage({ type: 'idle' });
-        }
-        continue;
-      }
-      if (head.itemId !== this.item) {
-        this.item = head.itemId;
-        this.played = 0;
-        this.port.postMessage({ type: 'started', itemId: head.itemId });
-      }
-      const i = Math.floor(this.pos);
-      const f = this.pos - i;
-      const a = head.samples[i];
-      const b = i + 1 < head.samples.length ? head.samples[i + 1] : a;
-      const s = a + (b - a) * f;
-      out[k] = s;
-      this.sumSquares += s * s;
-      this.count++;
-      this.pos += this.step;
-      const consumed = Math.floor(this.pos);
-      if (consumed > 0) {
-        const taken = Math.min(consumed, head.samples.length);
-        this.played += taken;
-        this.queued -= taken;
-        if (consumed >= head.samples.length) {
-          this.queue.shift();
-          this.pos = 0;
-        } else {
-          head.samples = head.samples.subarray(consumed);
-          this.pos -= consumed;
-        }
-      }
-    }
-    for (let c = 1; c < outputs[0].length; c++) outputs[0][c].set(out);
-    this.sinceReport += out.length;
-    this.report(false);
-    return true;
-  }
-}
-registerProcessor('alia-voice-playback', AliaVoicePlayback);
-`;
-
-function moduleUrl(source: string): string {
-  return URL.createObjectURL(new Blob([source], { type: 'application/javascript' }));
-}
-
 function deviceError(caught: unknown): VoiceAudioEngineError {
   const name = (caught as { name?: unknown } | null)?.name;
   if (name === 'NotAllowedError' || name === 'SecurityError' || name === 'PermissionDeniedError')
@@ -229,16 +82,10 @@ export function createVoiceAudioEngine(): VoiceAudioEngine {
       }
 
       context = new AudioContextCtor({ latencyHint: 'interactive' });
-      const captureUrl = moduleUrl(CAPTURE_PROCESSOR);
-      const playbackUrl = moduleUrl(PLAYBACK_PROCESSOR);
       try {
-        await context.audioWorklet.addModule(captureUrl);
-        await context.audioWorklet.addModule(playbackUrl);
+        await context.audioWorklet.addModule(VOICE_WORKLETS_URL);
       } catch {
         throw new VoiceAudioEngineError('voice-unavailable');
-      } finally {
-        URL.revokeObjectURL(captureUrl);
-        URL.revokeObjectURL(playbackUrl);
       }
       await context.resume().catch(() => undefined);
 
@@ -247,6 +94,10 @@ export function createVoiceAudioEngine(): VoiceAudioEngine {
         numberOfInputs: 1,
         numberOfOutputs: 0,
         channelCount: 1,
+        processorOptions: {
+          streamSampleRate: VOICE_SAMPLE_RATE,
+          frameSamples: VOICE_FRAME_SAMPLES,
+        },
       });
       capture.port.onmessage = (event: MessageEvent<ArrayBuffer>) => {
         if (stopped) return;
@@ -260,6 +111,11 @@ export function createVoiceAudioEngine(): VoiceAudioEngine {
         numberOfInputs: 0,
         numberOfOutputs: 1,
         outputChannelCount: [context.destination.channelCount || 2],
+        processorOptions: {
+          streamSampleRate: VOICE_SAMPLE_RATE,
+          prebufferMs: PREBUFFER_MS,
+          prebufferIdleMs: PREBUFFER_IDLE_MS,
+        },
       });
       playback.port.onmessage = (event: MessageEvent) => {
         const message = event.data as

package/src/lib/voice-worklets.ts

@@ -0,0 +1,19 @@
+import { ALIA_WEB_ORIGIN } from './origins';
+
+/**
+ * The voice call's AudioWorklet processors (`worklets/voice-processors.js`), as the web engine
+ * loads them.
+ *
+ * Not a `blob:` URL: a worklet module is a script, so a blob would need `script-src blob:` in
+ * every host's CSP, which would let any blob the page makes run as script. Alia's web app serves
+ * the file instead, under `script-src https://alia.onl` that the avatar already needs
+ * (`@alia.onl/sdk/csp`), with CORS open for the cross-origin `addModule`.
+ *
+ * The name is the file's content hash, so an SDK embedded in another app (on its own release
+ * cycle) always loads the bytes it was written against: `packages/app/public/sdk/voice-worklets/`
+ * keeps every revision ever published, and a test fails if this revision is not the hash of the
+ * file or is not served.
+ */
+export const VOICE_WORKLETS_REVISION = '543d4a8e42937e99';
+
+export const VOICE_WORKLETS_URL = `${ALIA_WEB_ORIGIN}/sdk/voice-worklets/${VOICE_WORKLETS_REVISION}.js`;

package/worklets/voice-processors.js

@@ -0,0 +1,152 @@
+// The web voice call's two AudioWorklet processors (`src/lib/voice-audio-engine.ts`).
+//
+// Served from Alia's web origin, content-addressed (`/sdk/voice-worklets/<revision>.js`,
+// `src/lib/voice-worklets.ts`), so a host page loads it under `script-src https://alia.onl`
+// instead of a `blob:` URL its CSP would have to allow. Plain JavaScript with no imports: a
+// worklet module runs in the AudioWorkletGlobalScope. Every number it needs arrives in
+// `processorOptions`, so the bytes stay the same while the engine's settings change.
+
+class AliaVoiceCapture extends AudioWorkletProcessor {
+  constructor(options) {
+    super();
+    const { streamSampleRate, frameSamples } = options.processorOptions;
+    this.ratio = sampleRate / streamSampleRate;
+    this.frameSamples = frameSamples;
+    this.t = 0;
+    this.prev = 0;
+    this.frame = new Int16Array(frameSamples);
+    this.filled = 0;
+  }
+  process(inputs) {
+    const input = inputs[0]?.[0];
+    if (!input || input.length === 0) return true;
+    const n = input.length;
+    while (this.t < n - 1) {
+      const i = Math.floor(this.t);
+      const f = this.t - i;
+      const a = i < 0 ? this.prev : input[i];
+      const b = input[i + 1];
+      let s = a + (b - a) * f;
+      s = s < -1 ? -1 : s > 1 ? 1 : s;
+      this.frame[this.filled++] = s < 0 ? s * 0x8000 : s * 0x7fff;
+      if (this.filled === this.frame.length) {
+        const out = this.frame;
+        this.port.postMessage(out.buffer, [out.buffer]);
+        this.frame = new Int16Array(this.frameSamples);
+        this.filled = 0;
+      }
+      this.t += this.ratio;
+    }
+    this.t -= n;
+    this.prev = input[n - 1];
+    return true;
+  }
+}
+registerProcessor('alia-voice-capture', AliaVoiceCapture);
+
+class AliaVoicePlayback extends AudioWorkletProcessor {
+  constructor(options) {
+    super();
+    const { streamSampleRate, prebufferMs, prebufferIdleMs } = options.processorOptions;
+    this.streamSampleRate = streamSampleRate;
+    this.prebufferSamples = (streamSampleRate * prebufferMs) / 1000;
+    this.prebufferIdleSeconds = prebufferIdleMs / 1000;
+    this.step = streamSampleRate / sampleRate;
+    this.queue = [];
+    this.queued = 0;
+    this.pos = 0;
+    this.buffering = true;
+    this.lastChunkAt = 0;
+    this.item = null;
+    this.played = 0;
+    this.sinceReport = 0;
+    this.sumSquares = 0;
+    this.count = 0;
+    this.port.onmessage = (event) => {
+      const message = event.data;
+      if (message.type === 'chunk') {
+        this.queue.push({ itemId: message.itemId, samples: message.samples });
+        this.queued += message.samples.length;
+        this.lastChunkAt = currentTime;
+      } else if (message.type === 'flush') {
+        const playedMs = this.item === null ? null : this.playedMs();
+        this.port.postMessage({ type: 'flushed', itemId: this.item, playedMs });
+        this.queue = [];
+        this.queued = 0;
+        this.pos = 0;
+        this.buffering = true;
+        this.item = null;
+        this.played = 0;
+      }
+    };
+  }
+  playedMs() {
+    return (this.played / this.streamSampleRate) * 1000;
+  }
+  report(force) {
+    if (!force && this.sinceReport < sampleRate / 20) return;
+    const rms = this.count === 0 ? 0 : Math.sqrt(this.sumSquares / this.count);
+    this.port.postMessage({ type: 'progress', itemId: this.item, playedMs: this.playedMs(), rms });
+    this.sinceReport = 0;
+    this.sumSquares = 0;
+    this.count = 0;
+  }
+  process(_inputs, outputs) {
+    const out = outputs[0][0];
+    if (this.buffering) {
+      const ready =
+        this.queued >= this.prebufferSamples ||
+        (this.queued > 0 && currentTime - this.lastChunkAt > this.prebufferIdleSeconds);
+      if (!ready) {
+        out.fill(0);
+        for (let c = 1; c < outputs[0].length; c++) outputs[0][c].fill(0);
+        return true;
+      }
+      this.buffering = false;
+    }
+    for (let k = 0; k < out.length; k++) {
+      const head = this.queue[0];
+      if (!head) {
+        out[k] = 0;
+        if (!this.buffering) {
+          this.buffering = true;
+          this.report(true);
+          this.port.postMessage({ type: 'idle' });
+        }
+        continue;
+      }
+      if (head.itemId !== this.item) {
+        this.item = head.itemId;
+        this.played = 0;
+        this.port.postMessage({ type: 'started', itemId: head.itemId });
+      }
+      const i = Math.floor(this.pos);
+      const f = this.pos - i;
+      const a = head.samples[i];
+      const b = i + 1 < head.samples.length ? head.samples[i + 1] : a;
+      const s = a + (b - a) * f;
+      out[k] = s;
+      this.sumSquares += s * s;
+      this.count++;
+      this.pos += this.step;
+      const consumed = Math.floor(this.pos);
+      if (consumed > 0) {
+        const taken = Math.min(consumed, head.samples.length);
+        this.played += taken;
+        this.queued -= taken;
+        if (consumed >= head.samples.length) {
+          this.queue.shift();
+          this.pos = 0;
+        } else {
+          head.samples = head.samples.subarray(consumed);
+          this.pos -= consumed;
+        }
+      }
+    }
+    for (let c = 1; c < outputs[0].length; c++) outputs[0][c].set(out);
+    this.sinceReport += out.length;
+    this.report(false);
+    return true;
+  }
+}
+registerProcessor('alia-voice-playback', AliaVoicePlayback);

package/src/lib/api-url.ts

@@ -1,2 +0,0 @@
-/** Where Alia's API is: `EXPO_PUBLIC_ALIA_API_URL`, then `https://api.alia.onl`. */
-export const ALIA_API_URL = process.env.EXPO_PUBLIC_ALIA_API_URL ?? 'https://api.alia.onl';