@vibedev-si/dsh-vibedev 0.2.7 → 0.3.1

package/lib/index.js

@@ -53,12 +53,14 @@ var AccountService = class {
 		const credential = await this.options.chain.resolve().catch(() => void 0);
 		const source = credential === void 0 ? "none" : credential.kind === "account" ? "host" : credential.kind;
 		const pending = this.options.login.pendingSignIn();
+		const attempt = this.options.login.signInAttempt();
 		const base = {
 			source,
 			models: this.options.models(),
 			links: this.links(),
 			primary: this.options.primary === true,
-			...pending === void 0 ? {} : { pending }
+			...pending === void 0 ? {} : { pending },
+			...attempt === void 0 ? {} : { attempt }
 		};
 		if (credential === void 0) return base;
 		const grantUser = credential.kind === "plugin" ? await this.options.login.user().catch(() => void 0) : void 0;
@@ -82,7 +84,8 @@ var AccountService = class {
 						authorization: `Bearer ${token}`,
 						"user-agent": this.options.userAgent
 					},
-					signal: AbortSignal.timeout(15e3)
+					signal: AbortSignal.timeout(15e3),
+					redirect: "error"
 				});
 				if (!response.ok) return {};
 				const body = record$8(await response.json().catch(() => void 0));
@@ -166,9 +169,11 @@ function json(status, body) {
 	});
 }
 function failure(error) {
+	const candidate = record$8(error)?.code;
+	const code = candidate === "SIGN_IN_REFUSED" || candidate === "SIGN_IN_TIMEOUT" || candidate === "SIGN_IN_CANCELLED" ? candidate : "INTERNAL";
 	return json(500, { error: {
-		code: text$8(record$8(error)?.code) ?? "INTERNAL",
-		message: error instanceof Error ? error.message : String(error)
+		code,
+		message: code === "SIGN_IN_CANCELLED" ? "Sign-in was cancelled. 登录已取消。" : code === "SIGN_IN_TIMEOUT" ? "Sign-in expired. 登录已超时，请重新登录。" : "The account request could not be completed. 账号请求未完成，请查看登录诊断后重试。"
 	} });
 }
 /**
@@ -511,6 +516,32 @@ async function downloadTo(response, temporary, maxBytes, signal) {
 	}
 }
 //#endregion
+//#region src/gateway/origin.ts
+/** Origin boundaries for accounts and durable media state. No endpoint fallback is defined here. */
+/** Production API origin. Storage URLs are returned by the server, not derived from this address. */
+const DEFAULT_GATEWAY_ORIGIN = "https://api.vibedev.studio";
+/** Validate a bare HTTP(S) origin and canonicalize default ports, casing and trailing slash. */
+function normalizeGatewayOrigin(value) {
+	const url = new URL(value.trim());
+	if (!["https:", "http:"].includes(url.protocol) || url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "") throw new Error("gatewayOrigin must be a bare HTTP(S) origin, without credentials, path, query or fragment.");
+	return url.origin;
+}
+/** Stable, filesystem-safe identity; ports and schemes remain separate boundaries. */
+function gatewayId(origin) {
+	return createHash("sha256").update(normalizeGatewayOrigin(origin)).digest("hex");
+}
+/** Every gateway uses its own namespace; never read the unmarked historical root. */
+function gatewayStateDirectory(root, origin) {
+	return join(root, "gateways", gatewayId(origin));
+}
+/** Ignore the old shared key variable; development requires an explicitly named, gateway-specific variable. */
+function developmentKey(origin, name, env = process.env) {
+	normalizeGatewayOrigin(origin);
+	const key = name.trim();
+	if (key === "" || key === "VIBEDEV_GATEWAY_API_KEY") return void 0;
+	return env[key]?.trim() || void 0;
+}
+//#endregion
 //#region src/auth/credentials.ts
 /**
 * Which VibeDev credential a gateway request carries, in order: the host's
@@ -555,7 +586,10 @@ var CredentialChain = class {
 		else if (credential.kind === "plugin") await this.options.plugin?.reject(credential.token);
 	}
 };
-const GRANT_KEY = credentialKey("dsh-media", "vibedev-session");
+/** Credential identity for one gateway; never consult another gateway's record. */
+function gatewayGrantKey(origin) {
+	return credentialKey("dsh-vibedev", `gateway-${gatewayId(origin)}`);
+}
 function isGrant(value) {
 	const grant = value;
 	return typeof grant === "object" && grant !== null && typeof grant.accessToken === "string" && typeof grant.refreshToken === "string" && typeof grant.expiresAt === "number" && typeof grant.refreshExpiresAt === "number";
@@ -564,11 +598,23 @@ function isGrant(value) {
 * Grant storage: the host's credential store when one is loaded (a grant
 * record the store keeps verbatim), else a private file in the state
 * directory. The device id is not a secret and lives in the state directory.
-* @param stateDir - the plugin state directory.
+* @param root - the plugin state root; the storage selects an origin-specific directory itself.
 * @param credentials - the host's credential store, when loaded.
+* @param selectedOrigin - the issuing gateway; unmarked historical state is never adopted.
 * @returns the storage.
 */
-function grantStorage(stateDir, credentials) {
+function grantStorage(root, credentials, selectedOrigin = DEFAULT_GATEWAY_ORIGIN) {
+	const origin = normalizeGatewayOrigin(selectedOrigin);
+	const key = gatewayGrantKey(origin);
+	const stateDir = gatewayStateDirectory(root, origin);
+	const readGrant = (value) => isGrant(value) && value.gatewayOrigin === origin ? value : void 0;
+	const bind = (grant) => {
+		if (grant.gatewayOrigin !== void 0 && grant.gatewayOrigin !== origin) throw new Error("Cannot store a grant issued by another gateway.");
+		return {
+			...grant,
+			gatewayOrigin: origin
+		};
+	};
 	const sessionFile = join(stateDir, "session.json");
 	const deviceFile = join(stateDir, "device.json");
 	let device;
@@ -581,9 +627,9 @@ function grantStorage(stateDir, credentials) {
 			throw error;
 		}
 		const parsed = JSON.parse(text);
-		return isGrant(parsed) ? parsed : void 0;
+		return readGrant(parsed);
 	};
-	const writeFileGrant = (grant) => writeFileAtomic(sessionFile, new TextEncoder().encode(grant === void 0 ? "null" : JSON.stringify(grant)), { mode: 384 });
+	const writeFileGrant = (grant) => writeFileAtomic(sessionFile, new TextEncoder().encode(grant === void 0 ? "null" : JSON.stringify(bind(grant))), { mode: 384 });
 	const clearFileGrant = async () => {
 		try {
 			await stat(sessionFile);
@@ -599,9 +645,9 @@ function grantStorage(stateDir, credentials) {
 		} catch {}
 	};
 	const readHostGrant = async (store) => {
-		const stored = await store.readRecord(GRANT_KEY);
+		const stored = await store.readRecord(key);
 		if (stored !== void 0) {
-			const grant = stored.kind === "grant" && isGrant(stored.payload) ? stored.payload : void 0;
+			const grant = stored.kind === "grant" ? readGrant(stored.payload) : void 0;
 			if (grant !== void 0) await clearFileGrantQuietly();
 			return grant;
 		}
@@ -612,15 +658,15 @@ function grantStorage(stateDir, credentials) {
 			throw error;
 		}
 		let adopted;
-		await store.modifyRecord(GRANT_KEY, async (current) => {
+		await store.modifyRecord(key, async (current) => {
 			if (current !== void 0) {
-				adopted = current.kind === "grant" && isGrant(current.payload) ? current.payload : void 0;
+				adopted = current.kind === "grant" ? readGrant(current.payload) : void 0;
 				return;
 			}
 			adopted = await readFileGrant();
 			return adopted === void 0 ? void 0 : {
 				kind: "grant",
-				payload: adopted
+				payload: bind(adopted)
 			};
 		});
 		if (adopted !== void 0) await clearFileGrantQuietly();
@@ -636,11 +682,11 @@ function grantStorage(stateDir, credentials) {
 			if (store !== void 0) {
 				if (grant === void 0) {
 					await clearFileGrant();
-					await store.deleteRecord(GRANT_KEY);
+					await store.deleteRecord(key);
 				} else {
-					await store.modifyRecord(GRANT_KEY, () => Promise.resolve({
+					await store.modifyRecord(key, () => Promise.resolve({
 						kind: "grant",
-						payload: grant
+						payload: bind(grant)
 					}));
 					await clearFileGrantQuietly();
 				}
@@ -653,17 +699,17 @@ function grantStorage(stateDir, credentials) {
 			if (store !== void 0) {
 				await readHostGrant(store);
 				let remove = false;
-				await store.modifyRecord(GRANT_KEY, async (current) => {
-					const result = await change(current?.kind === "grant" && isGrant(current.payload) ? current.payload : void 0);
+				await store.modifyRecord(key, async (current) => {
+					const result = await change(current?.kind === "grant" ? readGrant(current.payload) : void 0);
 					if (result.kind === "set") return {
 						kind: "grant",
-						payload: result.grant
+						payload: bind(result.grant)
 					};
 					remove = result.kind === "delete";
 				});
 				if (remove) {
 					await clearFileGrant();
-					await store.deleteRecord(GRANT_KEY);
+					await store.deleteRecord(key);
 				}
 				return;
 			}
@@ -686,6 +732,100 @@ function grantStorage(stateDir, credentials) {
 	};
 }
 //#endregion
+//#region src/auth/sign-in-state.ts
+const REDEEM_PATH = "/api/v1/vibedev/link/redeem";
+const NETWORK_CODES = /* @__PURE__ */ new Set([
+	"ECONNREFUSED",
+	"ECONNRESET",
+	"ECONNABORTED",
+	"ENOTFOUND",
+	"EAI_AGAIN",
+	"ENETUNREACH",
+	"EHOSTUNREACH",
+	"EPIPE",
+	"ETIMEDOUT",
+	"UND_ERR_CONNECT_TIMEOUT",
+	"UND_ERR_HEADERS_TIMEOUT",
+	"UND_ERR_BODY_TIMEOUT",
+	"UND_ERR_SOCKET",
+	"CERT_HAS_EXPIRED",
+	"DEPTH_ZERO_SELF_SIGNED_CERT",
+	"UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+	"ERR_TLS_CERT_ALTNAME_INVALID"
+]);
+const TIMEOUT_CODES = /* @__PURE__ */ new Set([
+	"ETIMEDOUT",
+	"UND_ERR_CONNECT_TIMEOUT",
+	"UND_ERR_HEADERS_TIMEOUT",
+	"UND_ERR_BODY_TIMEOUT"
+]);
+/** Read only fixed transport codes, never error text, stack, body or arbitrary fields. */
+function transportFailure(error) {
+	let cause = error;
+	let timeout = false;
+	let networkCode;
+	for (let depth = 0; depth < 5 && typeof cause === "object" && cause !== null; depth++) {
+		const value = cause;
+		if (value.name === "TimeoutError") timeout = true;
+		if (typeof value.code === "string" && NETWORK_CODES.has(value.code)) {
+			networkCode ??= value.code;
+			if (TIMEOUT_CODES.has(value.code)) timeout = true;
+		}
+		cause = value.cause;
+	}
+	return {
+		errorCode: timeout ? "timeout" : "network",
+		...networkCode === void 0 ? {} : { networkCode }
+	};
+}
+const EXPLANATIONS = {
+	network: ["无法连接登录网关，请检查网络后重新登录。", "The sign-in gateway could not be reached. Check the connection and start sign-in again."],
+	timeout: ["登录等待或网关请求已超时，请重新登录。", "Sign-in or the gateway request timed out. Start sign-in again."],
+	"gateway-refused": ["登录网关拒绝了请求，请重新登录。", "The gateway refused the sign-in request. Start sign-in again."],
+	"gateway-unavailable": ["登录网关暂时不可用，请稍后重新登录。", "The sign-in gateway is temporarily unavailable. Start sign-in again later."],
+	protocol: ["登录网关返回了无效的凭据格式，请稍后重新登录。", "The gateway returned an invalid credential response. Start sign-in again later."],
+	storage: ["无法准备或保存本地登录凭据，请检查存储权限后重新登录。", "Local sign-in credentials could not be prepared or saved. Check storage permissions and start sign-in again."],
+	callback: ["无法启动或使用本地登录回调，请重新登录。", "The local sign-in callback could not be started or used. Start sign-in again."]
+};
+const STAGES = {
+	listen: ["本地回调监听", "Local callback listener"],
+	device: ["准备本地设备标识", "Preparing the local device identity"],
+	redeem: ["交换登录凭据", "Exchanging sign-in credentials"],
+	persist: ["保存本地凭据", "Saving local credentials"]
+};
+/** A fixed bilingual explanation suitable for exposed rejection messages. */
+function failureMessage(attempt) {
+	const [chinese, english] = EXPLANATIONS[attempt.errorCode ?? "callback"];
+	const stage = attempt.stage === void 0 ? "" : ` ${STAGES[attempt.stage].join(" / ")}; stage=${attempt.stage}.`;
+	const status = attempt.httpStatus === void 0 ? "" : ` HTTP ${attempt.httpStatus}.`;
+	return `${english} ${chinese} errorCode=${attempt.errorCode ?? "callback"}.${stage}${status}`;
+}
+const escapeHtml = (text) => text.replace(/[&<>"']/g, (character) => ({
+	"&": "&amp;",
+	"<": "&lt;",
+	">": "&gt;",
+	"\"": "&quot;",
+	"'": "&#39;"
+})[character]);
+/** Only our fixed explanation and escaped safe enum/status fields reach the browser. */
+function failurePage(attempt) {
+	return `<h1>Sign-in failed.</h1><p>${escapeHtml(failureMessage(attempt))}</p><p>请回到对话重新登录。</p>`;
+}
+/** Explicit log allowlist; adding fields to the public attempt never expands log output. */
+function attemptLog(event, attempt) {
+	return `dsh-vibedev sign-in ${JSON.stringify({
+		event,
+		id: attempt.id,
+		phase: attempt.phase,
+		gatewayOrigin: attempt.gatewayOrigin,
+		path: REDEEM_PATH,
+		...attempt.stage === void 0 ? {} : { stage: attempt.stage },
+		...attempt.errorCode === void 0 ? {} : { errorCode: attempt.errorCode },
+		...attempt.httpStatus === void 0 ? {} : { httpStatus: attempt.httpStatus },
+		...attempt.networkCode === void 0 ? {} : { networkCode: attempt.networkCode }
+	})}`;
+}
+//#endregion
 //#region src/auth/login.ts
 /**
 * The plugin's own VibeDev sign-in, for hosts whose account service does not
@@ -772,6 +912,7 @@ var PluginLogin = class {
 	readFailureReported = false;
 	refreshing;
 	pending;
+	attempt;
 	listeners = /* @__PURE__ */ new Set();
 	now;
 	origin;
@@ -781,7 +922,7 @@ var PluginLogin = class {
 	constructor(options) {
 		this.options = options;
 		this.now = options.now ?? Date.now;
-		this.origin = options.origin.trim().replace(/\/+$/, "");
+		this.origin = normalizeGatewayOrigin(options.origin);
 	}
 	readStored(notify) {
 		if (this.reading !== void 0) return this.reading;
@@ -816,10 +957,32 @@ var PluginLogin = class {
 		const changed = this.grant?.accessToken !== grant?.accessToken;
 		this.grant = grant;
 		if (!changed) return;
+		this.notify();
+	}
+	notify() {
 		for (const listener of this.listeners) try {
 			listener();
 		} catch {}
 	}
+	/** A copied safe snapshot, retained after completion until the next sign-in. */
+	signInAttempt() {
+		return this.attempt === void 0 ? void 0 : Object.freeze({ ...this.attempt });
+	}
+	logAttempt(event) {
+		if (this.attempt === void 0) return;
+		try {
+			this.options.log?.(attemptLog(event, this.attempt));
+		} catch {}
+	}
+	transition(id, change, event = "phase") {
+		if (this.attempt?.id !== id) return;
+		this.attempt = {
+			...this.attempt,
+			...change
+		};
+		this.logAttempt(event);
+		this.notify();
+	}
 	async save(grant) {
 		await this.options.storage.write(grant);
 		this.adopt(grant);
@@ -842,9 +1005,10 @@ var PluginLogin = class {
 	}
 	/** Whether a sign-in is waiting for the browser, and its link. */
 	pendingSignIn() {
-		return this.pending === void 0 ? void 0 : {
-			url: this.pending.url,
-			expiresAt: this.pending.expiresAt
+		const pending = this.pending;
+		return pending?.url === void 0 ? void 0 : {
+			url: pending.url,
+			expiresAt: pending.expiresAt
 		};
 	}
 	/**
@@ -900,7 +1064,7 @@ var PluginLogin = class {
 					});
 					const body = await response.json().catch(() => void 0);
 					if (response.status === 401 || response.status === 403) {
-						this.options.log?.(`dsh-vibedev: the VibeDev session ended (${text$6(record$6(body)?.reason) ?? response.status}); signed out`);
+						this.options.log?.(`dsh-vibedev: the VibeDev session ended (HTTP ${response.status}); signed out`);
 						outcome = void 0;
 						return { kind: "delete" };
 					}
@@ -927,7 +1091,7 @@ var PluginLogin = class {
 		})();
 		return this.refreshing;
 	}
-	post(path, json, token) {
+	post(path, json, token, signal = AbortSignal.timeout(3e4)) {
 		return (this.options.fetch ?? globalThis.fetch)(`${this.origin}${path}`, {
 			method: "POST",
 			headers: {
@@ -937,7 +1101,8 @@ var PluginLogin = class {
 				...token === void 0 ? {} : { authorization: `Bearer ${token}` }
 			},
 			body: JSON.stringify(json),
-			signal: AbortSignal.timeout(3e4)
+			redirect: "error",
+			signal
 		});
 	}
 	/**
@@ -948,19 +1113,22 @@ var PluginLogin = class {
 	* @returns the authorization link, whether a browser was opened, and the completion.
 	*/
 	async startSignIn(request = {}) {
-		const open = (url) => request.open === false ? Promise.resolve(false) : (this.options.openBrowser ?? openInBrowser)(url);
-		if (this.pending !== void 0 && this.pending.expiresAt > this.now()) {
-			const opened = await open(this.pending.url);
-			return {
-				url: this.pending.url,
-				expiresAt: this.pending.expiresAt,
-				done: this.pending.done,
-				opened
-			};
-		}
+		if (this.pending !== void 0 && !this.pending.committing && this.pending.expiresAt <= this.now()) this.pending.cancel("expired");
+		const active = this.pending ?? this.beginSignIn();
+		const started = await active.ready;
+		const opened = request.open === false || this.pending !== active ? false : await (this.options.openBrowser ?? openInBrowser)(started.url).catch(() => false);
+		return {
+			...started,
+			opened
+		};
+	}
+	beginSignIn() {
 		const verifier = base64url(randomBytes(32));
 		const challenge = base64url(createHash("sha256").update(verifier).digest());
 		const state = base64url(randomBytes(18));
+		const id = randomUUID();
+		const expiresAt = this.now() + (this.options.signInTimeoutMs ?? 3e5);
+		const controller = new AbortController();
 		let resolveDone;
 		let rejectDone;
 		const done = new Promise((resolve, reject) => {
@@ -968,8 +1136,73 @@ var PluginLogin = class {
 			rejectDone = reject;
 		});
 		done.catch(() => void 0);
-		let settled = false;
-		const server = createServer((request, response) => {
+		let resolveReady;
+		let rejectReady;
+		const ready = new Promise((resolve, reject) => {
+			resolveReady = resolve;
+			rejectReady = reject;
+		});
+		ready.catch(() => void 0);
+		let finished = false;
+		let claimed = false;
+		let server;
+		let timer;
+		const finish = () => {
+			finished = true;
+			clearTimeout(timer);
+			server?.close();
+			server?.closeAllConnections?.();
+			if (this.pending === active) this.pending = void 0;
+		};
+		const fail = (failure, phase = "failed") => {
+			const attempt = {
+				...this.attempt,
+				...failure,
+				phase
+			};
+			const error = new MediaError(phase === "cancelled" ? "The sign-in was cancelled." : failureMessage(attempt), phase === "expired" ? "SIGN_IN_TIMEOUT" : phase === "cancelled" ? "SIGN_IN_CANCELLED" : "SIGN_IN_REFUSED", attempt.httpStatus === void 0 ? {} : { status: attempt.httpStatus });
+			finish();
+			controller.abort();
+			this.transition(id, {
+				...failure,
+				phase
+			}, "terminal");
+			rejectReady(error);
+			rejectDone(error);
+			return error;
+		};
+		const active = {
+			id,
+			expiresAt,
+			ready,
+			done,
+			committing: false,
+			cancel: (phase) => {
+				if (!finished && !active.committing) fail(phase === "expired" ? { errorCode: "timeout" } : {}, phase);
+			}
+		};
+		this.pending = active;
+		this.attempt = {
+			id,
+			expiresAt,
+			gatewayOrigin: this.origin,
+			phase: "preparing",
+			stage: "listen"
+		};
+		this.logAttempt("request");
+		this.notify();
+		const live = () => {
+			if (finished || this.pending !== active) return false;
+			if (!active.committing && this.now() >= expiresAt) {
+				active.cancel("expired");
+				return false;
+			}
+			return true;
+		};
+		if (!live()) return active;
+		timer = setTimeout(() => active.cancel("expired"), Math.max(0, expiresAt - this.now()));
+		timer.unref();
+		const callback = (request, response) => {
 			const url = new URL(request.url ?? "/", "http://127.0.0.1");
 			if (url.pathname !== CALLBACK_PATH) {
 				response.writeHead(404).end();
@@ -981,107 +1214,170 @@ var PluginLogin = class {
 					"cache-control": "no-store"
 				}).end(PAGE(title, body));
 			};
-			if (settled) {
-				answer(410, "VibeDev", "<h1>This sign-in link has already been used.</h1><p>此登录链接已使用过。</p>");
+			if (request.method !== "GET") {
+				response.setHeader("allow", "GET");
+				answer(405, "VibeDev", "<h1>Use GET for sign-in.</h1><p>请使用浏览器登录回调。</p>");
+				return;
+			}
+			if (claimed || !live()) {
+				answer(410, "VibeDev", "<h1>This sign-in link has already been used.</h1><p>此登录链接已使用过或已失效。</p>");
 				return;
 			}
-			if (url.searchParams.get("state") !== state || url.searchParams.get("code") === null) {
+			const states = url.searchParams.getAll("state");
+			const codes = url.searchParams.getAll("code");
+			const code = codes[0];
+			if (states.length !== 1 || states[0] !== state || codes.length !== 1 || code === void 0 || code.trim() === "") {
 				answer(400, "VibeDev", "<h1>Sign-in could not be completed.</h1><p>登录未完成：链接无效，请回到对话重新登录。</p>");
 				return;
 			}
-			settled = true;
-			const code = url.searchParams.get("code");
-			this.redeem(code, verifier).then((grant) => {
-				const who = grant.user?.email ?? grant.user?.nickname;
-				answer(200, "VibeDev", `<h1>Signed in to VibeDev${who === void 0 ? "" : ` as ${who.replace(/[<>&"]/g, "")}`}.</h1><p>已登录 VibeDev，可以关闭此页面，回到对话继续。</p><p>You can close this tab and return to the conversation.</p>`);
+			claimed = true;
+			this.transition(id, {
+				phase: "exchanging",
+				stage: "device"
+			}, "request");
+			(async () => {
+				let grant;
+				try {
+					if (!live()) return;
+					const deviceId = await this.options.storage.deviceId();
+					if (!live()) return;
+					this.transition(id, { stage: "redeem" }, "request");
+					if (!live()) return;
+					const signal = AbortSignal.any([controller.signal, AbortSignal.timeout(3e4)]);
+					const response = await this.post(REDEEM_PATH, {
+						code,
+						code_verifier: verifier,
+						token_type: "app",
+						client: this.options.client ?? "vibedev-plugin",
+						device_id: deviceId,
+						device_model: `${platform()}-${arch()}`.slice(0, 128),
+						os_version: release().slice(0, 128)
+					}, void 0, signal);
+					if (!live()) {
+						response.body?.cancel().catch(() => void 0);
+						return;
+					}
+					this.transition(id, { httpStatus: response.status }, "response");
+					if (!live()) {
+						response.body?.cancel().catch(() => void 0);
+						return;
+					}
+					if (!response.ok) {
+						response.body?.cancel().catch(() => void 0);
+						const errorCode = response.status === 429 || response.status >= 500 ? "gateway-unavailable" : response.status >= 400 && response.status < 500 ? "gateway-refused" : "protocol";
+						answer(502, "VibeDev", failurePage({
+							...this.attempt,
+							errorCode
+						}));
+						fail({ errorCode });
+						return;
+					}
+					let body;
+					try {
+						body = await response.json();
+					} catch (error) {
+						if (!live()) return;
+						const transport = transportFailure(error);
+						const failure = transport.networkCode !== void 0 || transport.errorCode === "timeout" ? transport : { errorCode: "protocol" };
+						answer(502, "VibeDev", failurePage({
+							...this.attempt,
+							...failure
+						}));
+						fail(failure);
+						return;
+					}
+					if (!live()) return;
+					const envelope = record$6(body);
+					const parsed = envelope !== void 0 && (envelope.code === void 0 || envelope.code === 0) && (envelope.data === void 0 || record$6(envelope.data) !== void 0) ? parseGrant(body, this.now()) : void 0;
+					if (parsed === void 0) {
+						answer(502, "VibeDev", failurePage({
+							...this.attempt,
+							errorCode: "protocol"
+						}));
+						fail({ errorCode: "protocol" });
+						return;
+					}
+					grant = parsed;
+					active.committing = true;
+					clearTimeout(timer);
+					this.transition(id, {
+						phase: "committing",
+						stage: "persist"
+					});
+					await this.save(grant);
+				} catch (error) {
+					if (finished || this.pending !== active) return;
+					const failure = this.attempt?.stage === "device" || this.attempt?.stage === "persist" ? { errorCode: "storage" } : transportFailure(error);
+					answer(502, "VibeDev", failurePage({
+						...this.attempt,
+						...failure
+					}));
+					fail(failure);
+					return;
+				}
+				answer(200, "VibeDev", "<h1>Signed in to VibeDev.</h1><p>已登录 VibeDev，可以关闭此页面，回到对话继续。</p><p>You can close this tab and return to the conversation.</p>");
 				finish();
+				this.transition(id, { phase: "succeeded" }, "terminal");
 				resolveDone(grant);
-			}, (error) => {
-				answer(502, "VibeDev", "<h1>Sign-in failed.</h1><p>登录失败，请回到对话重新登录。</p>");
-				finish();
-				rejectDone(error instanceof Error ? error : new Error(String(error)));
+			})();
+		};
+		try {
+			server = createServer(callback);
+			server.on("error", () => {
+				if (finished || active.committing) return;
+				this.transition(id, { stage: "listen" });
+				if (!finished) fail({ errorCode: "callback" });
 			});
-		});
-		await new Promise((resolve, reject) => {
-			server.once("error", reject);
 			server.listen(0, "127.0.0.1", () => {
-				server.off("error", reject);
-				resolve();
-			});
-		});
-		const callback = `http://127.0.0.1:${server.address().port}${CALLBACK_PATH}`;
-		const url = `${this.origin}/vibedev-link?${new URLSearchParams({
-			callback,
-			state,
-			response_type: "code",
-			code_challenge: challenge,
-			code_challenge_method: "S256",
-			client: this.options.client ?? "vibedev-plugin"
-		}).toString()}`;
-		const timeoutMs = this.options.signInTimeoutMs ?? 3e5;
-		const timer = setTimeout(() => {
-			if (settled) return;
-			settled = true;
-			finish();
-			rejectDone(new MediaError("The VibeDev sign-in was not completed in time.", "SIGN_IN_TIMEOUT"));
-		}, timeoutMs);
-		timer.unref();
-		const finish = () => {
-			clearTimeout(timer);
-			server.close();
-			server.closeAllConnections?.();
-			if (this.pending?.server === server) this.pending = void 0;
-		};
-		this.pending = {
-			url,
-			expiresAt: this.now() + timeoutMs,
-			done,
-			server,
-			cancel: (reason) => {
-				if (!settled) {
-					settled = true;
-					finish();
-					rejectDone(reason);
+				if (!live()) {
+					server?.close();
+					server?.closeAllConnections?.();
+					return;
 				}
-			}
-		};
-		const opened = await open(url);
-		return {
-			url,
-			expiresAt: this.now() + timeoutMs,
-			done,
-			opened
-		};
-	}
-	async redeem(code, verifier) {
-		const response = await this.post("/api/v1/vibedev/link/redeem", {
-			code,
-			code_verifier: verifier,
-			token_type: "app",
-			client: this.options.client ?? "vibedev-plugin",
-			device_id: await this.options.storage.deviceId(),
-			device_model: `${platform()}-${arch()}`.slice(0, 128),
-			os_version: release().slice(0, 128)
-		});
-		const body = await response.json().catch(() => void 0);
-		if (!response.ok) throw new MediaError(`The VibeDev gateway refused the sign-in (HTTP ${response.status}${text$6(record$6(body)?.reason) === void 0 ? "" : `, ${text$6(record$6(body)?.reason)}`}).`, "SIGN_IN_REFUSED", { status: response.status });
-		const grant = parseGrant(body, this.now());
-		if (grant === void 0) throw new MediaError("The VibeDev gateway returned no tokens for the sign-in.", "SIGN_IN_REFUSED");
-		await this.save(grant);
-		return grant;
+				const port = (server?.address()).port;
+				const url = `${this.origin}/vibedev-link?${new URLSearchParams({
+					callback: `http://127.0.0.1:${port}${CALLBACK_PATH}`,
+					state,
+					response_type: "code",
+					code_challenge: challenge,
+					code_challenge_method: "S256",
+					client: this.options.client ?? "vibedev-plugin"
+				}).toString()}`;
+				active.url = url;
+				this.transition(id, {
+					phase: "waiting-browser",
+					stage: void 0
+				});
+				if (live()) resolveReady({
+					url,
+					expiresAt,
+					done
+				});
+			});
+		} catch {
+			if (!finished) fail({ errorCode: "callback" });
+		}
+		return active;
 	}
 	/** Sign out: revoke the session at the gateway (best effort) and forget it. */
 	async signOut() {
+		const attemptId = this.attempt?.id;
+		const pending = this.pending;
+		if (pending?.committing) await pending.done.catch(() => void 0);
+		else pending?.cancel("cancelled");
 		await this.load();
 		const grant = this.grant;
-		this.pending?.cancel(new MediaError("The sign-in was cancelled.", "SIGN_IN_CANCELLED"));
+		if (grant !== void 0) await this.save(void 0);
+		if (this.attempt?.id === attemptId && this.pending === void 0) {
+			this.attempt = void 0;
+			this.notify();
+		}
 		if (grant === void 0) return;
-		await this.save(void 0);
 		await this.post("/api/v1/vibedev/app-token/revoke", { refresh_token: grant.refreshToken }, grant.accessToken).then((response) => response.body?.cancel(), () => void 0);
 	}
 	/** Stop a waiting sign-in. */
 	dispose() {
-		this.pending?.cancel(new MediaError("The plugin stopped before the sign-in finished.", "SIGN_IN_CANCELLED"));
+		this.pending?.cancel("cancelled");
 	}
 };
 //#endregion
@@ -2495,7 +2791,12 @@ var GatewayAdapter = class extends LlmAdapter {
 					const token = credential.token;
 					let response;
 					const observingFetch = async (input, init) => {
-						const received = await fetch(input, init);
+						const url = input instanceof Request ? input.url : String(input);
+						if (new URL(url).origin !== snapshot.origin) throw new Error("Refusing a model request to another gateway origin.");
+						const received = await fetch(input, {
+							...init,
+							redirect: "error"
+						});
 						response = {
 							status: received.status,
 							headers: Object.fromEntries(received.headers.entries())
@@ -3141,7 +3442,7 @@ var GatewayHttp = class {
 				method: request.method ?? (body === void 0 ? "GET" : "POST"),
 				headers,
 				...body === void 0 ? {} : { body },
-				redirect: "follow",
+				redirect: "error",
 				signal
 			});
 		} catch (error) {
@@ -3213,6 +3514,13 @@ const VIDEO_INPUTS = [
 	"referenceVideos",
 	"referenceAudios"
 ];
+/** What an audio model does, as the catalog declares it (`audio.generation_kind`). */
+const AUDIO_GENERATION_KINDS = [
+	"music",
+	"podcast",
+	"speech",
+	"transcription"
+];
 const record$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 const text$4 = (value) => typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
 const strings = (value) => Array.isArray(value) && value.every((item) => typeof item === "string") ? value : void 0;
@@ -3446,10 +3754,144 @@ function effectiveVideoModes(video) {
 	}
 	return modes;
 }
-function parsePricing(value) {
+const PRICE_UNITS = [
+	"generation",
+	"second",
+	"original_second",
+	"minute"
+];
+/** The audio block: `entry.audio`, else `capabilities.audio`, else the fields flattened into `capabilities`. */
+function audioBlock(entry, capabilities) {
+	const own = record$3(entry.audio) ?? record$3(capabilities.audio);
+	if (own !== void 0) return own;
+	return field(capabilities, "generation_kind") !== void 0 ? capabilities : void 0;
+}
+function stringChoices(raw) {
+	const choices = record$3(raw);
+	if (choices === void 0) return void 0;
+	const out = {};
+	for (const [name, values] of Object.entries(choices)) {
+		const items = strings(values)?.map((item) => item.trim()).filter((item) => item !== "");
+		if (items !== void 0 && items.length > 0) out[name] = items;
+	}
+	return Object.keys(out).length === 0 ? void 0 : out;
+}
+function parseReferenceLimits(raw) {
+	if (raw === void 0) return void 0;
+	const max = count(field(raw, "max_count")) ?? count(raw.max);
+	if (max === void 0 || max === 0) return void 0;
+	const min = count(field(raw, "min_count")) ?? count(raw.min) ?? 0;
+	const limits = {
+		min: Math.min(min, max),
+		max
+	};
+	for (const [key, ...names] of [
+		[
+			"maxBytes",
+			"max_bytes",
+			"max_size_bytes"
+		],
+		[
+			"minSeconds",
+			"min_duration_seconds",
+			"min_seconds"
+		],
+		[
+			"maxSeconds",
+			"max_duration_seconds",
+			"max_seconds"
+		],
+		["maxTotalSeconds", "max_total_duration_seconds"]
+	]) {
+		const value = names.map((name) => positive(field(raw, name))).find((found) => found !== void 0);
+		if (value !== void 0) limits[key] = value;
+	}
+	const mimes = list(raw, "allowed_mimes") ?? list(raw, "mimes");
+	if (mimes !== void 0 && mimes.length > 0) limits.mimes = mimes;
+	const exclusive = list(raw, "mutually_exclusive_with") ?? list(raw, "exclusive_with");
+	if (exclusive !== void 0 && exclusive.length > 0) limits.exclusiveWith = exclusive;
+	const purpose = text$4(field(raw, "asset_purpose")) ?? text$4(raw.purpose);
+	if (purpose !== void 0) limits.purpose = purpose;
+	return limits;
+}
+/**
+* The output formats, in either declared shape: `output_formats: [{format, sample_rates}]`,
+* or `output_formats: ['wav','mp3']` with `sample_rates: {wav: [...], mp3: [...]}`.
+*/
+function parseOutputFormats(raw) {
+	const declared = field(raw, "output_formats");
+	if (!Array.isArray(declared)) return void 0;
+	const rates = record$3(field(raw, "sample_rates"));
+	const formats = [];
+	for (const item of declared) {
+		const entry = record$3(item);
+		const format = (entry === void 0 ? text$4(item) : text$4(entry.format))?.toLowerCase();
+		if (format === void 0 || formats.some((known) => known.format === format)) continue;
+		const sampleRates = (entry === void 0 ? void 0 : field(entry, "sample_rates")) ?? rates?.[format];
+		const valid = Array.isArray(sampleRates) ? sampleRates.filter((rate) => positive(rate) !== void 0 && Number.isInteger(rate)) : [];
+		const fallback = entry === void 0 ? void 0 : positive(field(entry, "default_sample_rate"));
+		formats.push({
+			format,
+			sampleRates: valid,
+			...fallback !== void 0 && valid.includes(fallback) ? { defaultSampleRate: fallback } : {}
+		});
+	}
+	return formats.length === 0 ? void 0 : formats;
+}
+/**
+* Parse an audio capability block.
+* @param raw - the block.
+* @returns the declared capabilities; `generationKind` is absent unless declared.
+*/
+function parseAudioCapabilities(raw) {
+	const kindRaw = text$4(field(raw, "generation_kind"))?.toLowerCase();
+	const generationKind = AUDIO_GENERATION_KINDS.includes(kindRaw ?? "") ? kindRaw : void 0;
+	const billingRaw = text$4(field(raw, "billing_unit"))?.toLowerCase();
+	const billingUnit = billingRaw === "generation" || billingRaw === "original_second" || billingRaw === "minute" ? billingRaw : void 0;
+	const promptField = text$4(field(raw, "prompt_field"));
+	const requestFields = list(raw, "request_fields") ?? [];
+	const references = parseReferenceLimits(record$3(field(raw, "references")) ?? record$3(field(raw, "reference_audio")));
+	const outputFormats = parseOutputFormats(raw);
+	const defaultFormat = text$4(field(raw, "default_format"))?.toLowerCase();
+	const choices = stringChoices(field(raw, "choices") ?? field(raw, "field_options"));
+	const result = { requestFields };
+	if (generationKind !== void 0) result.generationKind = generationKind;
+	if (promptField !== void 0) result.promptField = promptField;
+	if (billingUnit !== void 0) result.billingUnit = billingUnit;
+	if (references !== void 0) result.references = references;
+	if (outputFormats !== void 0) result.outputFormats = outputFormats;
+	if (defaultFormat !== void 0 && outputFormats?.some((format) => format.format === defaultFormat) === true) result.defaultFormat = defaultFormat;
+	if (choices !== void 0) result.choices = choices;
+	for (const [key, ...names] of [
+		[
+			"maxPromptChars",
+			"max_prompt_chars",
+			"max_text_chars"
+		],
+		[
+			"maxInputBytes",
+			"max_input_bytes",
+			"max_file_bytes"
+		],
+		[
+			"maxInputSeconds",
+			"max_input_seconds",
+			"max_duration_seconds"
+		]
+	]) {
+		const value = names.map((name) => positive(field(raw, name))).find((found) => found !== void 0);
+		if (value !== void 0) result[key] = value;
+	}
+	const inputMimes = list(raw, "input_mimes") ?? list(raw, "allowed_input_mimes");
+	if (inputMimes !== void 0 && inputMimes.length > 0) result.inputMimes = inputMimes;
+	const languages = list(raw, "languages");
+	if (languages !== void 0 && languages.length > 0) result.languages = languages;
+	return result;
+}
+function parsePricing(value, audioUnit) {
 	const raw = record$3(value);
 	if (raw === void 0) return void 0;
-	const unit = (item) => item === "generation" || item === "second" ? item : void 0;
+	const unit = (item) => PRICE_UNITS.includes(item) ? item : item === void 0 && audioUnit !== void 0 ? audioUnit : void 0;
 	const tiers = [];
 	if (Array.isArray(raw.tiers)) for (const entry of raw.tiers) {
 		const tier = record$3(entry);
@@ -3476,8 +3918,10 @@ function parsePricing(value) {
 	};
 }
 /** Which kind of media model a catalog entry is, or undefined for a chat or internal model. */
-function kindOf(entry, capabilities) {
+function kindOf(entry, capabilities, audio) {
 	if (text$4(entry.internal_role) !== void 0) return void 0;
+	if (audio?.generationKind === "transcription") return "transcription";
+	if (audio?.generationKind !== void 0) return "audio";
 	const mediaType = text$4(entry.media_type);
 	if (mediaType === "video" || mediaType === "image" || mediaType === "audio" || mediaType === "transcription") return mediaType;
 	if (capabilities.transcription === true || capabilities.realtime_transcription === true) return "transcription";
@@ -3506,29 +3950,35 @@ function parseMediaCatalog(body) {
 		const id = text$4(entry?.id);
 		if (entry === void 0 || id === void 0 || seen.has(id)) continue;
 		const capabilities = record$3(entry.capabilities) ?? {};
-		const kind = kindOf(entry, capabilities);
+		const audioRaw = audioBlock(entry, capabilities);
+		const audio = audioRaw === void 0 ? void 0 : parseAudioCapabilities(audioRaw);
+		const kind = kindOf(entry, capabilities, audio);
 		if (kind === void 0) continue;
 		seen.add(id);
 		const name = text$4(entry.display_name) ?? id;
 		const description = text$4(entry.description);
-		const pricing = parsePricing(entry.media_pricing);
+		const pricing = parsePricing(entry.media_pricing, audio?.billingUnit);
 		const inputModalities = strings(capabilities.input_modalities) ?? strings(entry.input_modalities) ?? [];
 		const endpoints = strings(capabilities.allowed_endpoints) ?? [];
+		const aliases = (strings(entry.aliases) ?? []).map((alias) => alias.trim()).filter((alias) => alias !== "" && alias !== id);
 		let video;
 		if (kind === "video") video = {
 			...parseVideoCapabilities(capabilities),
 			...parseVideoCapabilities(record$3(entry.video) ?? {})
 		};
+		const audioKind = audio?.generationKind === void 0 || audio.generationKind === "transcription" ? void 0 : audio.generationKind;
 		models.push({
 			id,
 			name,
 			kind,
 			endpoints,
 			inputModalities,
+			...aliases.length === 0 ? {} : { aliases },
 			...description === void 0 ? {} : { description },
 			...pricing === void 0 ? {} : { pricing },
 			...video === void 0 ? {} : { video },
-			...kind === "audio" ? { audioKind: /podcast/i.test(id) || /播客/.test(name) ? "podcast" : "music" } : {}
+			...audio === void 0 ? {} : { audio },
+			...audioKind === void 0 ? {} : { audioKind }
 		});
 	}
 	return models;
@@ -3820,6 +4270,27 @@ async function loadChatReference(reference, want, messages, store, maxBytes, sig
 * spending confirmation.
 * @module dsh-vibedev/runtime
 */
+/**
+* Whether a model serves a slot. Audio models serve the kind their catalog
+* entry declares, and only that: an undeclared kind serves none.
+* @param model - the model.
+* @param slot - the slot.
+* @returns whether the model can be chosen for it.
+*/
+function servesSlot(model, slot) {
+	if (slot === "music" || slot === "podcast" || slot === "speech") return model.kind === "audio" && model.audioKind === slot;
+	return model.kind === slot;
+}
+/**
+* The model a name refers to: its id, else one of its aliases (case-insensitive).
+* @param models - the catalog.
+* @param wanted - the id or alias.
+* @returns the model, or undefined.
+*/
+function modelNamed(models, wanted) {
+	const lower = wanted.toLowerCase();
+	return models.find((model) => model.id === wanted) ?? models.find((model) => model.id.toLowerCase() === lower) ?? models.find((model) => (model.aliases ?? []).some((alias) => alias.toLowerCase() === lower));
+}
 const CATALOG_TTL_MS = 12e4;
 /** Wait for a shared promise under one caller's signal without cancelling it for the others. */
 function abortable$1(promise, signal) {
@@ -3923,20 +4394,36 @@ var MediaRuntime = class {
 	*/
 	async pickModel(kind, slot, requested, accept, signal) {
 		const models = await this.models(signal);
-		const ofKind = models.filter((model) => model.kind === kind && (slot === "music" ? model.audioKind !== "podcast" : slot === "podcast" ? model.audioKind === "podcast" : true));
+		const ofKind = models.filter((model) => model.kind === kind && servesSlot(model, slot));
 		const wanted = requested?.trim();
 		if (wanted !== void 0 && wanted !== "") {
-			const found = models.find((model) => model.id === wanted) ?? models.find((model) => model.id.toLowerCase() === wanted.toLowerCase());
+			const found = modelNamed(models, wanted);
 			if (found === void 0) throw new MediaError(`There is no model "${wanted}" on this VibeDev account. ${slotLabel(slot)} models: ${ofKind.map((model) => model.id).join(", ") || "none"}.`, "MODEL_NOT_FOUND", { field: "model" });
-			if (!ofKind.includes(found)) throw new MediaError(`${found.id} is not a ${slotLabel(slot).toLowerCase()} model. ${slotLabel(slot)} models: ${ofKind.map((model) => model.id).join(", ") || "none"}.`, "MODEL_KIND_MISMATCH", { field: "model" });
+			if (!ofKind.includes(found)) {
+				if (found.kind === "audio" && found.audioKind === void 0) throw new MediaError(`${found.id} does not declare what kind of audio it makes, so it cannot be used for ${slotLabel(slot).toLowerCase()}.`, "AUDIO_KIND_UNDECLARED", { field: "model" });
+				throw new MediaError(`${found.id} is not a ${slotLabel(slot).toLowerCase()} model. ${slotLabel(slot)} models: ${ofKind.map((model) => model.id).join(", ") || "none"}.`, "MODEL_KIND_MISMATCH", { field: "model" });
+			}
 			return found;
 		}
 		if (ofKind.length === 0) throw new MediaError(`This VibeDev account has no ${slotLabel(slot).toLowerCase()} model available right now.`, "NO_MODEL_AVAILABLE");
-		const pinned = this.settings.defaultModel(slot).trim();
-		const ordered = pinned === "" ? ofKind : [...ofKind.filter((model) => model.id === pinned), ...ofKind.filter((model) => model.id !== pinned)];
+		const pinnedName = this.settings.defaultModel(slot).trim();
+		const pinned = pinnedName === "" ? void 0 : modelNamed(ofKind, pinnedName);
+		const ordered = pinned === void 0 ? ofKind : [pinned, ...ofKind.filter((model) => model !== pinned)];
 		return (accept === void 0 ? void 0 : ordered.find((model) => accept(model))) ?? ordered[0];
 	}
 	/**
+	* The model a name refers to, whatever its kind.
+	* @param requested - an id or alias.
+	* @param signal - cancels the catalog request.
+	* @returns the model.
+	* @throws {@link MediaError} when the account has no such model.
+	*/
+	async findModel(requested, signal) {
+		const found = modelNamed(await this.models(signal), requested.trim());
+		if (found === void 0) throw new MediaError(`There is no model "${requested}" on this VibeDev account.`, "MODEL_NOT_FOUND", { field: "model" });
+		return found;
+	}
+	/**
 	* The workspace of the calling session.
 	* @param call - the tool call or host call.
 	* @returns its absolute working directory, when it has one.
@@ -4073,6 +4560,7 @@ function slotLabel(slot) {
 		video: "Video",
 		music: "Music",
 		podcast: "Podcast",
+		speech: "Speech",
 		transcription: "Transcription"
 	}[slot];
 }
@@ -4316,14 +4804,23 @@ var GatewaySearchProvider = class {
 };
 //#endregion
 //#region src/pricing.ts
+/** Shown wherever the catalog gives no price. */
+const UNPRICED = {
+	en: "not priced",
+	zh: "未定价"
+};
 /** Seconds the gateway bills when a request names no duration. */
 const DEFAULT_BILLED_SECONDS = 8;
 /**
-* Format an amount in yuan.
+* Format an amount in yuan: two decimals, more when a small unit price needs them (`¥0.015`).
 * @param amount - the amount.
 * @returns `¥4.95`.
 */
 function yuan(amount) {
+	if (amount !== 0 && Math.abs(amount) < .1) {
+		const precise = amount.toFixed(4).replace(/0+$/, "");
+		if (precise.split(".")[1].length > 2) return `¥${precise}`;
+	}
 	return `¥${amount.toFixed(2)}`;
 }
 function tierFor(pricing, wanted) {
@@ -4335,17 +4832,47 @@ function tierFor(pricing, wanted) {
 	return pricing.tiers.length === 1 ? pricing.tiers[0] : void 0;
 }
 /**
-* A one-line price for listings: `¥0.10 per image`, `¥0.99/s (720p)`.
+* The unit after a price: `/s`, `/原始秒`, `/次`.
+* @param unit - the price unit.
+* @param kind - the kind of model, which names a generation (an image, a video, a request).
+* @returns the suffix in both languages.
+*/
+function unitSuffix(unit, kind) {
+	switch (unit) {
+		case "second": return {
+			en: "/s",
+			zh: "/秒"
+		};
+		case "original_second": return {
+			en: "/s of original audio",
+			zh: "/原始秒"
+		};
+		case "minute": return {
+			en: "/min",
+			zh: "/分钟"
+		};
+		default: return kind === "image" ? {
+			en: " per image",
+			zh: "/张"
+		} : {
+			en: " per generation",
+			zh: "/次"
+		};
+	}
+}
+/**
+* A one-line price for listings: `¥0.10 per image`, `¥0.99/s (720p)`; `not priced` without a price.
 * @param model - the model.
-* @returns the price, or undefined when the catalog gives none.
+* @param lang - the language.
+* @returns the price line.
 */
-function describePrice(model) {
+function describePrice(model, lang = "en") {
 	const pricing = model.pricing;
-	if (pricing === void 0) return void 0;
-	const per = (unit) => unit === "second" ? "/s" : model.kind === "image" ? " per image" : " per generation";
+	if (pricing === void 0) return UNPRICED[lang];
+	const per = (unit) => unitSuffix(unit, model.kind)[lang];
 	const parts = pricing.tiers.map((tier) => `${yuan(tier.amount)}${per(tier.unit)} (${tier.tier})`);
-	if (pricing.default !== void 0 && (pricing.tiers.length === 0 || !pricing.tiers.some((tier) => tier.amount === pricing.default?.amount && tier.unit === pricing.default.unit))) parts.push(`${yuan(pricing.default.amount)}${per(pricing.default.unit)}${pricing.tiers.length === 0 ? "" : " otherwise"}`);
-	return parts.length === 0 ? void 0 : parts.join(", ");
+	if (pricing.default !== void 0 && (pricing.tiers.length === 0 || !pricing.tiers.some((tier) => tier.amount === pricing.default?.amount && tier.unit === pricing.default.unit))) parts.push(`${yuan(pricing.default.amount)}${per(pricing.default.unit)}${pricing.tiers.length === 0 ? "" : lang === "zh" ? "（其他）" : " otherwise"}`);
+	return parts.length === 0 ? UNPRICED[lang] : parts.join(", ");
 }
 /**
 * Estimate an image request.
@@ -4355,7 +4882,7 @@ function describePrice(model) {
 */
 function estimateImages(model, count) {
 	const price = model.pricing === void 0 ? void 0 : tierFor(model.pricing, void 0);
-	if (price === void 0) return void 0;
+	if (price === void 0 || price.unit !== "generation") return void 0;
 	return {
 		amountCny: price.amount * count,
 		basis: count === 1 ? `${yuan(price.amount)} per image` : `${yuan(price.amount)} × ${count} images`
@@ -4378,6 +4905,7 @@ function estimateVideo(model, duration, resolution, referenceMs = 0) {
 		amountCny: price.amount,
 		basis: `${yuan(price.amount)} per video`
 	};
+	if (price.unit !== "second") return void 0;
 	const output = duration ?? DEFAULT_BILLED_SECONDS;
 	const reference = Math.ceil(referenceMs / 1e3);
 	const seconds = output + reference;
@@ -4387,16 +4915,429 @@ function estimateVideo(model, duration, resolution, referenceMs = 0) {
 	};
 }
 /**
-* Estimate a music or podcast request.
-* @param model - the audio model.
-* @returns the estimate, or undefined without a price.
+* Quote an audio request: music, podcast and speech generation, or a transcription.
+* @param model - the audio or transcription model.
+* @param inputSeconds - for a transcription, the measured length of the input, when known.
+* @returns the quote; `priced: false` (未定价) when the catalog gives no usable price.
 */
-function estimateAudio(model) {
+function quoteAudio(model, inputSeconds) {
 	const price = model.pricing === void 0 ? void 0 : tierFor(model.pricing, void 0);
-	if (price === void 0 || price.unit !== "generation") return void 0;
-	return {
+	const unit = price?.unit ?? model.audio?.billingUnit;
+	if (price === void 0 || unit === void 0 || unit === "second") return {
+		priced: false,
+		...unit === void 0 ? {} : { unit },
+		label: UNPRICED,
+		basis: {
+			en: "The catalog states no price for this model; the gateway receipt shows the charge.",
+			zh: "目录未给出价格，以网关结算为准。"
+		}
+	};
+	const suffix = unitSuffix(unit, model.kind);
+	const label = {
+		en: `${yuan(price.amount)}${suffix.en}`,
+		zh: `${yuan(price.amount)}${suffix.zh}`
+	};
+	const base = {
+		priced: true,
+		unit,
+		unitPriceCny: price.amount,
+		label
+	};
+	if (unit === "generation") return {
+		...base,
 		amountCny: price.amount,
-		basis: `${yuan(price.amount)} per request`
+		basis: {
+			en: `${label.en}, charged only if it succeeds`,
+			zh: `${label.zh}，成功才扣费`
+		}
+	};
+	if (unit === "original_second") return {
+		...base,
+		basis: {
+			en: `${label.en}: billed on the original length the provider reports, which can differ from the playback length`,
+			zh: `${label.zh}：按服务商返回的原始时长计费，可能与播放时长不同`
+		}
+	};
+	if (inputSeconds !== void 0 && inputSeconds > 0) {
+		const minutes = inputSeconds / 60;
+		return {
+			...base,
+			amountCny: price.amount * minutes,
+			basis: {
+				en: `${label.en} × ${minutes.toFixed(2)} min`,
+				zh: `${label.zh} × ${minutes.toFixed(2)} 分钟`
+			}
+		};
+	}
+	return {
+		...base,
+		basis: {
+			en: `${label.en} of input audio`,
+			zh: `${label.zh}，按音频时长计费`
+		}
+	};
+}
+//#endregion
+//#region src/audio/request.ts
+/**
+* Audio generation requests — music, podcasts and speech — checked against what
+* the chosen model declares in the catalog's `audio` block, and turned into the
+* body of `POST /v1/audio/generations`.
+*
+* Each kind sends only its own fields:
+*
+* | kind    | wire fields                                                     |
+* | ------- | --------------------------------------------------------------- |
+* | music   | model, prompt, lyrics, genre, mood, gender                      |
+* | podcast | model, prompt, source_url                                       |
+* | speech  | as declared; Seed: model, text_prompt, references, audio_config, watermark |
+*
+* The main text goes in the model's `prompt_field`. A field the model does not
+* declare in `request_fields` is refused before anything is uploaded or charged;
+* music and podcasts never take speech references, output formats, sample rates
+* or a duration. Speech references, formats and sample rates come from the
+* catalog only (count, size, length, mutual exclusions, the sample rates of
+* each format), never from a fixed list.
+* @module dsh-vibedev/audio/request
+*/
+const AUDIO_MAKE_KINDS = [
+	"music",
+	"podcast",
+	"speech"
+];
+/** The standard wire fields of a kind, for a model that declares none (speech declares its own). */
+const STANDARD_FIELDS = {
+	music: [
+		"model",
+		"prompt",
+		"lyrics",
+		"genre",
+		"mood",
+		"gender"
+	],
+	podcast: [
+		"model",
+		"prompt",
+		"source_url"
+	],
+	speech: []
+};
+/** Fields that belong to speech only: references, the output format and sample rate, a duration. */
+const SPEECH_ONLY = [
+	"references",
+	"format",
+	"sampleRate",
+	"duration"
+];
+/** Default limit on one reference file when the catalog states none. */
+const DEFAULT_REFERENCE_BYTES = 20971520;
+const OPERATION_ID = /^[\w-]{1,80}$/;
+const has = (value) => value !== void 0 && value.trim() !== "";
+/**
+* What an audio model makes, from its declaration only.
+* @param model - the model.
+* @returns the kind, or undefined when the catalog does not declare it.
+*/
+function audioKindOf(model) {
+	return model.kind === "audio" ? model.audioKind : void 0;
+}
+/** The wire fields a model takes. */
+function requestFieldsOf(model) {
+	const kind = audioKindOf(model);
+	const declared = model.audio?.requestFields ?? [];
+	if (declared.length > 0) return declared;
+	return kind === void 0 ? [] : STANDARD_FIELDS[kind];
+}
+/** The field the main text goes in. */
+function promptFieldOf(model) {
+	const declared = model.audio?.promptField;
+	if (declared !== void 0) return declared;
+	const fields = requestFieldsOf(model);
+	return [
+		"prompt",
+		"text_prompt",
+		"text",
+		"input"
+	].find((name) => fields.includes(name));
+}
+function refuse(message, field) {
+	throw new MediaError(message, "AUDIO_OPTION_INVALID", field === void 0 ? {} : { field });
+}
+/** Check one value against the model's declared choices for a field. */
+function checkChoice(audio, wire, value) {
+	const choices = audio?.choices?.[wire];
+	if (choices !== void 0 && !choices.some((choice) => choice.toLowerCase() === value.toLowerCase())) refuse(`${wire} "${value}" is not offered by this model; it takes ${choices.join(", ")}.`, wire);
+}
+/** The output format and sample rate a speech request uses, from the declared formats only. */
+function audioConfigOf(model, format, sampleRate) {
+	const formats = model.audio?.outputFormats ?? [];
+	if (formats.length === 0) {
+		if (format !== void 0 || sampleRate !== void 0) refuse(`${model.id} declares no output formats, so format and sample_rate cannot be chosen.`, "format");
+		return;
+	}
+	const wanted = format?.trim().toLowerCase();
+	const chosen = wanted === void 0 || wanted === "" ? formats.find((item) => item.format === model.audio?.defaultFormat) ?? formats[0] : formats.find((item) => item.format === wanted);
+	if (chosen === void 0) refuse(`${model.id} writes ${formats.map((item) => item.format).join(", ")}, not "${format}".`, "format");
+	if (sampleRate !== void 0) {
+		if (chosen.sampleRates.length > 0 && !chosen.sampleRates.includes(sampleRate)) refuse(`${chosen.format.toUpperCase()} from ${model.id} takes a sample rate of ${chosen.sampleRates.join(", ")} Hz, not ${sampleRate}.`, "sample_rate");
+		return {
+			format: chosen.format,
+			sample_rate: sampleRate
+		};
+	}
+	const fallback = chosen.defaultSampleRate;
+	return {
+		format: chosen.format,
+		...fallback === void 0 ? {} : { sample_rate: fallback }
+	};
+}
+/**
+* Check a request against the model and build the body, without references
+* (they are uploaded first; their URLs are added by {@link prepareAudioTask}).
+* @param model - the chosen model.
+* @param request - what to generate.
+* @returns the body without references, and the wire fields the request uses.
+* @throws {@link MediaError} for a field the model does not take, a missing text, or a value outside the declared choices.
+*/
+function audioRequestBody(model, request) {
+	const kind = audioKindOf(model);
+	if (kind === void 0) throw new MediaError(`${model.id} does not declare what kind of audio it makes, so it cannot be used for generation.`, "AUDIO_KIND_UNDECLARED", { field: "model" });
+	const audio = model.audio;
+	const fields = requestFieldsOf(model);
+	if (fields.length === 0) throw new MediaError(`${model.id} declares no request fields, so no request can be built for it.`, "AUDIO_FIELDS_UNDECLARED", { field: "model" });
+	if (kind !== "speech") for (const name of SPEECH_ONLY) {
+		const value = request[name];
+		if (value !== void 0 && !(Array.isArray(value) && value.length === 0)) refuse(`${name === "sampleRate" ? "sample_rate" : name} is for speech; ${kind === "music" ? "music" : "a podcast"} does not take it.`, name);
+	}
+	const takes = (wire) => fields.includes(wire);
+	const body = { model: model.id };
+	const promptField = promptFieldOf(model);
+	const prompt = request.prompt?.trim();
+	if (has(prompt)) {
+		if (promptField === void 0) refuse(`${model.id} takes no text prompt.`, "prompt");
+		if (audio?.maxPromptChars !== void 0 && [...prompt].length > audio.maxPromptChars) refuse(`The text is ${[...prompt].length} characters; ${model.id} takes at most ${audio.maxPromptChars}.`, promptField);
+		body[promptField] = prompt;
+	}
+	for (const [key, wire] of [
+		["lyrics", "lyrics"],
+		["genre", "genre"],
+		["mood", "mood"],
+		["gender", "gender"],
+		["sourceUrl", "source_url"]
+	]) {
+		const value = request[key]?.trim();
+		if (!has(value)) continue;
+		if (!takes(wire)) refuse(`${model.id} does not take ${wire}; it takes ${fields.filter((name) => name !== "model").join(", ")}.`, wire);
+		checkChoice(audio, wire, value);
+		if (wire === "source_url" && !/^https?:\/\//i.test(value)) refuse("source_url must be an http(s) link.", wire);
+		body[wire] = value;
+	}
+	if (request.duration !== void 0) {
+		if (!takes("duration")) refuse(`${model.id} does not take a duration.`, "duration");
+		body.duration = request.duration;
+	}
+	if (request.watermark !== void 0) {
+		if (!takes("watermark")) refuse(`${model.id} does not take watermark.`, "watermark");
+		body.watermark = request.watermark;
+	}
+	if (request.format !== void 0 || request.sampleRate !== void 0 || takes("audio_config")) {
+		if (!takes("audio_config")) refuse(`${model.id} does not take an output format or sample rate.`, "format");
+		const config = audioConfigOf(model, request.format, request.sampleRate);
+		if (config !== void 0) body.audio_config = config;
+	}
+	if ((request.references?.length ?? 0) > 0 && !takes("references")) refuse(`${model.id} does not take reference audio.`, "references");
+	if (kind === "music" && !has(prompt)) throw new MediaError("Music needs a prompt describing the song.", "AUDIO_PROMPT_REQUIRED", { field: "prompt" });
+	if (kind === "podcast" && !has(prompt) && body.source_url === void 0) throw new MediaError("A podcast needs a prompt (the topic), a source_url, or both.", "AUDIO_PROMPT_REQUIRED", { field: "prompt" });
+	if (kind === "speech" && !has(prompt)) throw new MediaError("Speech needs the text to speak.", "AUDIO_PROMPT_REQUIRED", { field: promptField ?? "prompt" });
+	return body;
+}
+/** Load, check and upload the reference audio of a speech request; their measured lengths are checked too. */
+async function uploadReferences(runtime, call, model, sources, body) {
+	const limits = model.audio?.references;
+	if (limits === void 0) refuse(`${model.id} does not take reference audio.`, "references");
+	if (sources.length < limits.min || sources.length > limits.max) refuse(limits.min === limits.max ? `${model.id} takes exactly ${limits.max} reference audio file(s); ${sources.length} were given.` : `${model.id} takes ${limits.min}–${limits.max} reference audio file(s); ${sources.length} were given.`, "references");
+	const clash = (limits.exclusiveWith ?? []).filter((name) => body[name] !== void 0);
+	if (clash.length > 0) refuse(`Reference audio cannot be combined with ${clash.join(", ")} on ${model.id}.`, "references");
+	const maxBytes = limits.maxBytes ?? DEFAULT_REFERENCE_BYTES;
+	const loaded = [];
+	for (const source of sources) {
+		const media = await runtime.load(call, source, "audio", maxBytes);
+		if (limits.mimes !== void 0 && !limits.mimes.includes(media.mime)) throw new MediaError(`"${media.source}" is ${media.mime}; ${model.id} takes reference audio as ${limits.mimes.join(", ")}.`, "REFERENCE_MEDIA_TYPE_UNSUPPORTED", { field: "references" });
+		loaded.push(media);
+	}
+	const checked = [];
+	let totalSeconds = 0;
+	for (const media of loaded) {
+		const asset = await runtime.library.upload(media, limits.purpose ?? "audio_reference", call.signal);
+		const seconds = asset.durationMs === void 0 ? void 0 : asset.durationMs / 1e3;
+		if (seconds === void 0 && (limits.minSeconds !== void 0 || limits.maxSeconds !== void 0 || limits.maxTotalSeconds !== void 0)) throw new MediaError(`The gateway could not measure the length of "${media.source}". Export it as a standard WAV or MP3 and try again.`, "REFERENCE_DURATION_UNKNOWN", { field: "references" });
+		if (seconds !== void 0) {
+			if (limits.minSeconds !== void 0 && seconds < limits.minSeconds) throw new MediaError(`"${media.source}" is ${seconds.toFixed(1)} s; ${model.id} needs reference audio of at least ${limits.minSeconds} s.`, "REFERENCE_AUDIO_TOO_SHORT", { field: "references" });
+			if (limits.maxSeconds !== void 0 && seconds > limits.maxSeconds) throw new MediaError(`"${media.source}" is ${seconds.toFixed(1)} s; ${model.id} takes reference audio of at most ${limits.maxSeconds} s.`, "REFERENCE_AUDIO_TOO_LONG", { field: "references" });
+			totalSeconds += seconds;
+		}
+		checked.push({
+			source: media.source,
+			asset
+		});
+	}
+	if (limits.maxTotalSeconds !== void 0 && totalSeconds > limits.maxTotalSeconds) throw new MediaError(`The reference audio adds up to ${totalSeconds.toFixed(1)} s; ${model.id} takes at most ${limits.maxTotalSeconds} s in total.`, "REFERENCE_TOTAL_TOO_LONG", { field: "references" });
+	return checked;
+}
+/**
+* Choose the model for a request: the one named (an id or an alias), else the
+* pinned or first model of the kind. A named model must make the kind asked for.
+*/
+async function chooseAudioModel(runtime, request, signal) {
+	if (request.kind === void 0 && !has(request.model)) throw new MediaError("Say what to make (music, podcast or speech), or name a model.", "AUDIO_KIND_REQUIRED", { field: "type" });
+	if (request.kind !== void 0) return runtime.pickModel("audio", request.kind, request.model, void 0, signal);
+	const model = await runtime.findModel(request.model, signal);
+	if (model.kind !== "audio") throw new MediaError(`${model.id} is not an audio generation model.`, "MODEL_KIND_MISMATCH", { field: "model" });
+	if (audioKindOf(model) === void 0) throw new MediaError(`${model.id} does not declare what kind of audio it makes, so it cannot be used for generation.`, "AUDIO_KIND_UNDECLARED", { field: "model" });
+	return model;
+}
+/**
+* Everything before an audio submission: choose the model, check every field
+* against its declaration, upload and measure speech references, price it,
+* confirm the spending, and build the task under the operation's key.
+* @param runtime - the media runtime.
+* @param call - the tool call or host call.
+* @param request - what to generate.
+* @param save - where the result goes.
+* @returns the prepared task.
+*/
+async function prepareAudioTask(runtime, call, request, save) {
+	if (request.operationId !== void 0 && !OPERATION_ID.test(request.operationId)) throw new MediaError("operationId may hold only letters, digits, \"-\" and \"_\" (at most 80).", "AUDIO_OPTION_INVALID", { field: "operationId" });
+	const model = await chooseAudioModel(runtime, request, call.signal);
+	const kind = audioKindOf(model);
+	const body = audioRequestBody(model, request);
+	const references = request.references ?? [];
+	if (references.length > 0) body.references = (await uploadReferences(runtime, call, model, references, body)).map((item) => item.asset.referenceUrl);
+	else if ((model.audio?.references?.min ?? 0) > 0) refuse(`${model.id} needs at least ${model.audio?.references?.min} reference audio file(s).`, "references");
+	const quote = quoteAudio(model);
+	const what = {
+		music: {
+			en: "a song",
+			zh: "一首音乐"
+		},
+		podcast: {
+			en: "a podcast episode",
+			zh: "一期播客"
+		},
+		speech: {
+			en: "speech",
+			zh: "一段语音"
+		}
+	}[kind];
+	await runtime.confirmSpending(call, "audio_generate", {
+		en: `Generate ${what.en} with ${model.id}: ${quote.basis.en}.`,
+		zh: `用 ${model.id} 生成${what.zh}：${quote.basis.zh}。`
+	});
+	const now = runtime.now();
+	const prompt = request.prompt?.trim();
+	return {
+		model,
+		kind,
+		quote,
+		draft: {
+			id: request.operationId ?? randomUUID(),
+			kind: "audio",
+			model: model.id,
+			label: excerptOf(prompt ?? request.sourceUrl ?? kind),
+			createdAt: now,
+			updatedAt: now,
+			...call.agent === void 0 ? {} : { owner: call.agent.id },
+			outputDir: save.folder,
+			stem: save.stem,
+			endpoint: "/v1/audio/generations",
+			body,
+			status: "submitting",
+			audioKind: kind,
+			...quote.amountCny === void 0 ? {} : { estimatedCny: quote.amountCny.toFixed(2) },
+			...quote.unit === void 0 ? {} : { billing: {
+				unit: quote.unit,
+				...quote.unitPriceCny === void 0 ? {} : { unitPriceCny: String(quote.unitPriceCny) }
+			} }
+		}
+	};
+}
+function excerptOf(text, max = 60) {
+	const flat = text.replace(/\s+/g, " ").trim();
+	const chars = [...flat];
+	return chars.length <= max ? flat : `${chars.slice(0, max - 1).join("")}…`;
+}
+/**
+* The form an interface shows for one model: only the fields the model
+* declares, with their declared choices and limits.
+* @param model - the model.
+* @returns the form, or undefined for a model that cannot generate audio.
+*/
+function audioFormOf(model) {
+	const kind = audioKindOf(model);
+	if (kind === void 0) return void 0;
+	const fields = requestFieldsOf(model);
+	if (fields.length === 0) return void 0;
+	const audio = model.audio;
+	const out = [];
+	const promptField = promptFieldOf(model);
+	if (promptField !== void 0) out.push({
+		key: "prompt",
+		wire: promptField,
+		required: kind !== "podcast",
+		...audio?.maxPromptChars === void 0 ? {} : { maxChars: audio.maxPromptChars }
+	});
+	for (const [key, wire] of [
+		["lyrics", "lyrics"],
+		["genre", "genre"],
+		["mood", "mood"],
+		["gender", "gender"],
+		["sourceUrl", "source_url"]
+	]) {
+		if (!fields.includes(wire)) continue;
+		const choices = audio?.choices?.[wire];
+		out.push({
+			key,
+			wire,
+			required: false,
+			...choices === void 0 ? {} : { choices }
+		});
+	}
+	if (kind === "speech") {
+		if (fields.includes("references") && audio?.references !== void 0) out.push({
+			key: "references",
+			wire: "references",
+			required: audio.references.min > 0,
+			limits: audio.references
+		});
+		const formats = audio?.outputFormats ?? [];
+		if (fields.includes("audio_config") && formats.length > 0) {
+			out.push({
+				key: "format",
+				wire: "audio_config.format",
+				required: false,
+				choices: formats.map((item) => item.format)
+			});
+			const rates = Object.fromEntries(formats.filter((item) => item.sampleRates.length > 0).map((item) => [item.format, item.sampleRates]));
+			if (Object.keys(rates).length > 0) out.push({
+				key: "sampleRate",
+				wire: "audio_config.sample_rate",
+				required: false,
+				sampleRates: rates
+			});
+		}
+		if (fields.includes("watermark")) out.push({
+			key: "watermark",
+			wire: "watermark",
+			required: false
+		});
+	}
+	return {
+		model: model.id,
+		name: model.name,
+		kind,
+		fields: out,
+		price: quoteAudio(model),
+		...audio?.defaultFormat === void 0 ? {} : { defaultFormat: audio.defaultFormat }
 	};
 }
 //#endregion
@@ -4420,10 +5361,12 @@ function excerpt(prompt, max = 60) {
 * @returns `Charged ¥4.95.`, an estimate, or the empty string.
 */
 function moneyLine(record) {
-	if (record.status !== "completed") return record.status === "failed" ? " Failed tasks are not charged." : "";
-	if (record.chargedCny !== void 0) return ` Charged ${yuan(Number(record.chargedCny))}.`;
-	if (record.estimatedCny !== void 0) return ` Estimated ${yuan(Number(record.estimatedCny))} (the gateway settles the charge shortly).`;
-	return "";
+	if (record.status !== "completed") return record.status === "failed" ? " Failed and cancelled tasks are not charged." : "";
+	const billed = record.billing?.originalSeconds === void 0 ? "" : ` Billed on ${record.billing.originalSeconds.toFixed(1)} s of original audio.`;
+	if (record.settlement === "pending") return ` The result is saved; the charge is still being settled (it is never generated again — media_tasks shows the charge once settled).${billed}`;
+	if (record.chargedCny !== void 0) return ` Charged ${yuan(Number(record.chargedCny))}.${billed}`;
+	if (record.estimatedCny !== void 0) return ` Estimated ${yuan(Number(record.estimatedCny))} (the gateway settles the charge shortly).${billed}`;
+	return billed;
 }
 /**
 * The model-facing account of a task's current state.
@@ -4591,7 +5534,7 @@ const text$2 = (value) => typeof value === "string" && value.trim() !== "" ? val
 const noPaths = { readPath: () => Promise.reject(new MediaError("The gateway returned an unexpected image reference.", "GATEWAY_BAD_RESPONSE")) };
 /**
 * Read the images of an `/v1/images/*` answer: `b64_json`, a `data:` URL, or a link.
-* @param runtime - for authenticated downloads of gateway links.
+* @param runtime - for downloading the gateway's full signed result URLs.
 * @param body - the parsed answer.
 * @param signal - cancels downloads.
 * @returns the images and the revised prompt, when the model returned one.
@@ -4611,7 +5554,7 @@ async function decodeImages(runtime, body, signal) {
 		else if (url?.startsWith("data:") === true) data = (await loadMedia(url, noPaths, MAX_OUTPUT_BYTES)).data;
 		else if (url !== void 0 && /^https?:\/\//i.test(url)) {
 			const response = await runtime.http.send(url, {
-				anonymous: !runtime.http.isGatewayUrl(url),
+				anonymous: true,
 				headers: { accept: "*/*" },
 				timeoutMs: 12e4,
 				signal
@@ -5495,19 +6438,44 @@ function videoGenerateTool(runtime) {
 }
 //#endregion
 //#region src/service.ts
+/**
+* The media service other plugins call, registered as `vibedevMedia`: the
+* film workbench's storyboard generates through it when someone presses a
+* generate button. It takes the same paths as the agent tools — model
+* choice, reference checks and uploads, idempotent submission, a background
+* follower that saves the result — with the caller naming the workspace and
+* where results go. The caller has already shown the price and the user chose
+* to go ahead, so the spending confirmation setting does not ask again.
+*
+* Every task, video or audio, is read the same way: {@link MediaHostService.task}
+* (what is recorded), {@link MediaHostService.refreshTask} (ask the gateway again:
+* fresh links, settlement — a query only, it never submits),
+* {@link MediaHostService.onTask} (each change) and
+* {@link MediaHostService.result} (the files to play or download).
+* @module dsh-vibedev/service
+*/
 const view = (record) => ({
 	id: record.id,
 	kind: record.kind,
+	...record.audioKind === void 0 ? {} : { audioKind: record.audioKind },
 	model: record.model,
 	status: record.status,
 	...record.progress === void 0 ? {} : { progress: record.progress },
-	...record.outputs === void 0 ? {} : { outputs: record.outputs.map((output) => ({ ...output })) },
+	...record.outputs === void 0 ? {} : { outputs: record.outputs.map(({ index: _index, bytes: _bytes, ...output }) => ({ ...output })) },
 	...record.error === void 0 ? {} : { error: { ...record.error } },
 	...record.estimatedCny === void 0 ? {} : { estimatedCny: record.estimatedCny },
 	...record.chargedCny === void 0 ? {} : { chargedCny: record.chargedCny },
+	...record.settlement === void 0 ? {} : { settlement: record.settlement },
+	...record.billing === void 0 ? {} : { billing: { ...record.billing } },
 	createdAt: record.createdAt,
 	updatedAt: record.updatedAt
 });
+/** The parts of a request that decide what is generated, to tell a repeated operation from a different one. */
+function sameRequest(record, draft) {
+	const { references: _a, ...left } = record.body;
+	const { references: _b, ...right } = draft.body;
+	return record.kind === draft.kind && record.model === draft.model && JSON.stringify(left) === JSON.stringify(right);
+}
 var MediaHostService = class {
 	runtime;
 	version;
@@ -5523,7 +6491,7 @@ var MediaHostService = class {
 		};
 	}
 	/**
-	* The media models this account can use (cached briefly).
+	* The media models this account can use (cached briefly; renewed after a sign-in, sign-out or account switch).
 	* @param signal - cancels the request.
 	* @returns the models in catalog order.
 	*/
@@ -5531,6 +6499,28 @@ var MediaHostService = class {
 		return this.runtime.models(signal);
 	}
 	/**
+	* The forms to show for the audio models this account can use: one per
+	* model that declares what it makes, with only the fields it takes, their
+	* declared choices and limits, and its price.
+	* @param signal - cancels the catalog request.
+	* @returns the forms, in catalog order.
+	*/
+	async audioForms(signal) {
+		return (await this.runtime.models(signal)).flatMap((model) => {
+			const form = audioFormOf(model);
+			return form === void 0 ? [] : [form];
+		});
+	}
+	/**
+	* The price of one audio or transcription model: `¥0.50/次`, `¥0.02/原始秒`, `¥0.30/分钟`, or 未定价.
+	* @param model - the model id or alias.
+	* @param signal - cancels the catalog request.
+	* @returns the quote.
+	*/
+	async audioPrice(model, signal) {
+		return quoteAudio(await this.runtime.findModel(model, signal));
+	}
+	/**
 	* Generate images now and save them.
 	* @param request - what to generate.
 	* @param target - the workspace and where the files go.
@@ -5563,18 +6553,53 @@ var MediaHostService = class {
 			folder: target.folder,
 			stem: target.stem
 		});
+		return this.submit(prepared.draft, signal);
+	}
+	/**
+	* Submit music, a podcast episode or speech. Fields are checked against
+	* what the model declares before anything is uploaded or charged; speech
+	* references are uploaded to the gateway media library first.
+	*
+	* One user operation, one task: pass the same `operationId` when the same
+	* click is retried and the task already recorded under it is returned —
+	* nothing is submitted twice. Without one, every call is a new operation.
+	* @param request - what to generate.
+	* @param target - the workspace and where the audio goes.
+	* @param signal - cancels the preparation and the submission.
+	* @returns the task.
+	*/
+	async startAudio(request, target, signal) {
+		if (request.operationId !== void 0) {
+			const earlier = await this.runtime.store.get(request.operationId).catch(() => void 0);
+			if (earlier !== void 0) {
+				if (earlier.kind !== "audio") throw new MediaError(`Operation ${request.operationId} already belongs to a ${earlier.kind} task.`, "OPERATION_CONFLICT", { field: "operationId" });
+				return view(earlier);
+			}
+		}
+		const prepared = await prepareAudioTask(this.runtime, this.call(target, signal), request, {
+			folder: target.folder,
+			stem: target.stem
+		});
+		const raced = await this.runtime.store.get(prepared.draft.id).catch(() => void 0);
+		if (raced !== void 0) {
+			if (!sameRequest(raced, prepared.draft)) throw new MediaError(`Operation ${prepared.draft.id} already belongs to a different request.`, "OPERATION_CONFLICT", { field: "operationId" });
+			return view(raced);
+		}
+		return this.submit(prepared.draft, signal);
+	}
+	async submit(draft, signal) {
 		try {
-			return view(await this.runtime.tracker.submit(prepared.draft, signal));
+			return view(await this.runtime.tracker.submit(draft, signal));
 		} catch (error) {
 			if (error instanceof MediaError && error.code === "SUBMISSION_UNCONFIRMED") {
-				const recorded = await this.runtime.store.get(prepared.draft.id);
+				const recorded = await this.runtime.store.get(draft.id);
 				if (recorded !== void 0) return view(recorded);
 			}
 			throw error;
 		}
 	}
 	/**
-	* A task's current state.
+	* A task's current state, as recorded (no request to the gateway).
 	* @param id - the task id.
 	* @returns the task, or `undefined` when there is none.
 	*/
@@ -5583,6 +6608,31 @@ var MediaHostService = class {
 		return record === void 0 ? void 0 : view(record);
 	}
 	/**
+	* Ask the gateway about a task again — a query, never a submission: a
+	* finished task gets fresh links and its missing files are downloaded
+	* again, and a pending settlement is read again. A running task is followed.
+	* @param id - the task id.
+	* @param signal - cancels the query.
+	* @returns the task after the query, or `undefined` when there is none.
+	*/
+	async refreshTask(id, signal) {
+		if (await this.runtime.store.get(id) === void 0) return void 0;
+		return view(await this.runtime.tracker.refresh(id, signal));
+	}
+	/**
+	* The files of a finished task, ready to play or download: saved files by
+	* path, and links renewed by a query when one is needed (a missing file, an
+	* expired link). Never generates again.
+	* @param id - the task id.
+	* @param signal - cancels the query.
+	* @returns the outputs, or `undefined` while the task has none.
+	*/
+	async result(id, signal) {
+		const record = await this.runtime.store.get(id);
+		if (record === void 0 || record.status !== "completed") return void 0;
+		return (((record.outputs ?? []).length > 0 && (record.outputs ?? []).every((output) => output.path !== void 0) ? record : await this.runtime.tracker.refresh(id, signal).catch(() => record)).outputs ?? []).map(({ index: _index, bytes: _bytes, ...output }) => ({ ...output }));
+	}
+	/**
 	* Hear about every change to one task.
 	* @param id - the task id.
 	* @param listener - called with the task after each change.
@@ -5794,7 +6844,8 @@ const COMPLETED = /* @__PURE__ */ new Set([
 	"succeeded",
 	"success",
 	"done",
-	"finished"
+	"finished",
+	"settlement_pending"
 ]);
 const FAILED = /* @__PURE__ */ new Set([
 	"failed",
@@ -5805,12 +6856,40 @@ const FAILED = /* @__PURE__ */ new Set([
 	"expired",
 	"rejected"
 ]);
+const CANCELLED = /* @__PURE__ */ new Set(["cancelled", "canceled"]);
+/** The result exists; only the charge is still being settled. */
+const SETTLEMENT_PENDING = "settlement_pending";
 function stateOf(status) {
 	const word = status.toLowerCase();
 	if (COMPLETED.has(word)) return "completed";
 	if (FAILED.has(word)) return "failed";
 	return "pending";
 }
+const seconds = (value) => {
+	const number = typeof value === "string" ? Number(value) : value;
+	return typeof number === "number" && Number.isFinite(number) && number > 0 ? number : void 0;
+};
+/** The billing facts of a task: whether the charge settled, and the billed length. */
+function billing(raw, status) {
+	const blocks = [
+		record$1(raw.billing),
+		record$1(raw.usage),
+		record$1(raw.effective),
+		raw
+	].filter((block) => block !== void 0);
+	const pick = (...names) => {
+		for (const block of blocks) for (const name of names) if (block[name] !== void 0) return block[name];
+	};
+	const originalSeconds = seconds(pick("original_seconds", "billed_original_seconds", "original_duration_seconds"));
+	const minutes = seconds(pick("billed_minutes", "minutes"));
+	const stateRaw = text$1(pick("settlement_state", "settlement_status"))?.toLowerCase();
+	const settlement = status.toLowerCase() === SETTLEMENT_PENDING || stateRaw === "pending" ? "pending" : stateRaw === "settled" || stateRaw === "completed" ? "settled" : void 0;
+	return {
+		...settlement === void 0 ? {} : { settlement },
+		...originalSeconds === void 0 ? {} : { billedOriginalSeconds: originalSeconds },
+		...minutes === void 0 ? {} : { billedMinutes: minutes }
+	};
+}
 function errorOf(raw) {
 	const nested = record$1(raw.error);
 	const message = text$1(nested?.message) ?? text$1(raw.error) ?? text$1(raw.failure_reason) ?? text$1(raw.error_message) ?? text$1(raw.fail_reason);
@@ -5890,19 +6969,25 @@ function parseAudioTask(body) {
 		const url = httpUrl(output.content_url) ?? httpUrl(output.url);
 		const contentType = text$1(output.content_type);
 		const title = text$1(output.title);
-		const duration = typeof output.duration_seconds === "number" && output.duration_seconds > 0 ? output.duration_seconds : void 0;
+		const duration = seconds(output.duration_seconds);
+		const original = seconds(output.original_duration_seconds) ?? seconds(output.original_seconds);
 		outputs.push({
 			index,
 			...url === void 0 ? {} : { url },
 			...contentType === void 0 ? {} : { contentType },
 			...title === void 0 ? {} : { title },
-			...duration === void 0 ? {} : { durationSeconds: duration }
+			...duration === void 0 ? {} : { durationSeconds: duration },
+			...original === void 0 ? {} : { originalSeconds: original }
 		});
 	}
-	const error = state === "failed" ? errorOf(raw) ?? {
+	const cancelled = CANCELLED.has(status.toLowerCase());
+	const error = state === "failed" ? errorOf(raw) ?? (cancelled ? {
+		code: "CANCELLED",
+		message: "The task was cancelled; cancelled tasks are not charged."
+	} : {
 		code: "GENERATION_FAILED",
 		message: `the task ended with status "${status}"`
-	} : void 0;
+	}) : void 0;
 	const progress = progressOf(raw.progress);
 	return {
 		id,
@@ -5911,6 +6996,7 @@ function parseAudioTask(body) {
 		...progress === void 0 ? {} : { progress },
 		...error === void 0 ? {} : { error },
 		...receipt(raw),
+		...billing(raw, status),
 		outputs: state === "completed" ? outputs : []
 	};
 }
@@ -6416,12 +7502,25 @@ var TaskTracker = class {
 		}
 		return Math.min(6e4, 5e3 * 2 ** Math.min(failures - 1, 4));
 	}
-	/** Record what the gateway says about a task; save the outputs of a finished one. */
-	async apply(record, task) {
-		const money = {
+	/** The money and billing facts of a gateway answer, merged into what the record already knows. */
+	moneyOf(record, task) {
+		const charged = task.settlement === "pending" ? void 0 : task.chargedCny;
+		const settlement = task.settlement ?? (charged !== void 0 ? "settled" : void 0);
+		const billing = task.billedOriginalSeconds !== void 0 || task.billedMinutes !== void 0 ? { billing: {
+			...record.billing,
+			...task.billedOriginalSeconds === void 0 ? {} : { originalSeconds: task.billedOriginalSeconds },
+			...task.billedMinutes === void 0 ? {} : { minutes: task.billedMinutes }
+		} } : {};
+		return {
 			...task.estimatedCny === void 0 ? {} : { estimatedCny: task.estimatedCny },
-			...task.chargedCny === void 0 ? {} : { chargedCny: task.chargedCny }
+			...charged === void 0 ? {} : { chargedCny: charged },
+			...settlement === void 0 ? {} : { settlement },
+			...billing
 		};
+	}
+	/** Record what the gateway says about a task; save the outputs of a finished one. */
+	async apply(record, task) {
+		const money = this.moneyOf(record, task);
 		if (task.state === "pending") return this.update(record.id, {
 			gatewayId: task.id,
 			status: "pending",
@@ -6447,14 +7546,14 @@ var TaskTracker = class {
 			if (attempts < (this.options.downloadAttempts ?? 5)) throw new MediaError(`${missing} result file(s) could not be downloaded yet.`, "DOWNLOAD_RETRY", { retryable: true });
 		}
 		let charged = money;
-		if (task.chargedCny === void 0) {
+		if (money.chargedCny === void 0 && task.settlement !== "pending") {
 			const settled = await this.options.http.json(SPECS[record.kind].poll(task.id), {
 				timeoutMs: 15e3,
 				signal: this.signal
 			}).then((body) => SPECS[record.kind].parse(body), () => void 0);
-			if (settled?.chargedCny !== void 0) charged = {
+			if (settled !== void 0) charged = {
 				...money,
-				chargedCny: settled.chargedCny
+				...this.moneyOf(current, settled)
 			};
 		}
 		return this.finish(record.id, {
@@ -6469,6 +7568,50 @@ var TaskTracker = class {
 		});
 	}
 	/**
+	* Ask the gateway about a task again, by query only: a finished task gets
+	* fresh links (signed links expire), files that are missing locally are
+	* downloaded again, and a pending settlement is read again. Nothing is ever
+	* submitted from here, so a failed query or download cannot create a task.
+	* A task still running is followed as usual.
+	* @param id - the local task id.
+	* @param signal - cancels the query.
+	* @returns the task after the query.
+	*/
+	async refresh(id, signal) {
+		const record = await this.options.store.get(id);
+		if (record === void 0) throw new MediaError(`dsh-vibedev has no task ${id}.`, "UNKNOWN_TASK");
+		if (!isFinished(record)) {
+			this.followQuietly(id);
+			return record;
+		}
+		if (record.gatewayId === void 0) return record;
+		const spec = SPECS[record.kind];
+		const task = spec.parse(await this.options.http.json(spec.poll(record.gatewayId), {
+			timeoutMs: 3e4,
+			...signal === void 0 ? {} : { signal }
+		}));
+		if (task === void 0) throw new MediaError("The VibeDev gateway returned an unreadable task.", "GATEWAY_BAD_RESPONSE");
+		const money = this.moneyOf(record, task);
+		if (task.state !== "completed") return this.update(id, money);
+		const fresh = new Map(task.outputs.map((output) => [output.index, output]));
+		const known = (record.outputs ?? []).filter((output) => output.path !== void 0 && output.index !== void 0).map((output) => ({
+			...output,
+			...fresh.get(output.index)?.url === void 0 ? {} : { url: fresh.get(output.index)?.url }
+		}));
+		const { outputs, missing } = await this.saveOutputs({
+			...record,
+			outputs: known
+		}, task);
+		return this.update(id, {
+			...money,
+			outputs,
+			error: missing === 0 ? void 0 : {
+				code: "DOWNLOAD_FAILED",
+				message: `${missing} of ${outputs.length} result file(s) could not be downloaded; the gateway links are listed instead.`
+			}
+		});
+	}
+	/**
 	* Save every output not saved yet, recording each one as it lands. A
 	* shutdown mid-download throws, so the task stays open and is resumed.
 	*/
@@ -6488,7 +7631,8 @@ var TaskTracker = class {
 				...output.url === void 0 ? {} : { url: output.url },
 				...output.contentType === void 0 ? {} : { contentType: output.contentType },
 				...output.title === void 0 ? {} : { title: output.title },
-				...output.durationSeconds === void 0 ? {} : { durationSeconds: output.durationSeconds }
+				...output.durationSeconds === void 0 ? {} : { durationSeconds: output.durationSeconds },
+				...output.originalSeconds === void 0 ? {} : { originalSeconds: output.originalSeconds }
 			};
 			const fromUrl = urlExtension(output.url);
 			const extension = output.contentType === void 0 ? fromUrl ?? extensionFor(spec.fallbackType) : extensionFor(output.contentType, fromUrl ?? extensionFor(spec.fallbackType));
@@ -6516,19 +7660,15 @@ var TaskTracker = class {
 			missing
 		};
 	}
-	/** Download one output: the authenticated `/content` route, then the gateway's no-login link. */
+	/** Use a returned signed URL verbatim and without the app token; old gateways without a URL use `/content`. */
 	async fetchOutput(record, task, output, temporary) {
 		const spec = SPECS[record.kind];
 		const sources = [];
-		if (record.kind === "video") sources.push({
-			url: spec.content(task.id, output.index),
-			anonymous: false
-		});
 		if (output.url !== void 0) sources.push({
 			url: output.url,
 			anonymous: true
 		});
-		if (record.kind === "audio") sources.push({
+		else sources.push({
 			url: spec.content(task.id, output.index),
 			anonymous: false
 		});
@@ -6561,8 +7701,6 @@ var TaskTracker = class {
 * Settings → VibeDev 账号; this is the agent's way to the same sign-in.
 * @module dsh-vibedev/tools/account
 */
-/** Where new users register. */
-const REGISTER_URL = "https://vibedev.jzsaas.com";
 /**
 * Build the tool.
 * @param runtime - the media runtime.
@@ -6643,7 +7781,7 @@ function mediaAccountTool(runtime, chain, login) {
 			return {
 				source,
 				signInUrl: started.url,
-				message: `${started.opened ? "Opened the VibeDev sign-in page in the user's browser." : "Could not open a browser."} If it did not appear, give the user this link: ${started.url} — new users can register on that page (or at ${REGISTER_URL}). The sign-in completes in the background within ${minutes} minutes; once the user says they are done, retry the request.`
+				message: `${started.opened ? "Opened the VibeDev sign-in page in the user's browser." : "Could not open a browser."} If it did not appear, give the user this link: ${started.url} — new users can register on that page (or at ${runtime.http.origin}). The sign-in completes in the background within ${minutes} minutes; once the user says they are done, retry the request.`
 			};
 		}
 	});
@@ -6651,8 +7789,9 @@ function mediaAccountTool(runtime, chain, login) {
 //#endregion
 //#region src/tools/audio.ts
 /**
-* `audio_generate`: a song or a podcast episode, as a background task whose
-* results are saved in the workspace.
+* `audio_generate`: music, a podcast episode or speech, as a background task
+* whose results are saved in the workspace. Every field is checked against
+* what the chosen model declares (see `audio/request`).
 * @module dsh-vibedev/tools/audio
 */
 /**
@@ -6663,17 +7802,17 @@ function mediaAccountTool(runtime, chain, login) {
 function audioGenerateTool(runtime) {
 	return defineTool({
 		name: "audio_generate",
-		description: "Generate music (a song with vocals or an instrumental) or a podcast episode (a spoken conversation about a topic or a web page) with a VibeDev audio model. It runs as a background job (usually 1-5 minutes): this call returns once the gateway accepts the task, you are notified when it finishes, and the files are saved in the workspace (media/audio/). Charged per request only when it succeeds (about ¥0.5 for music, ¥1 for a podcast; media_models lists prices). The length cannot be chosen.",
+		description: "Generate music (a song with vocals or an instrumental), a podcast episode (a spoken conversation about a topic or a web page) or speech (text read aloud, optionally in the voice of reference audio) with a VibeDev audio model. It runs as a background job: this call returns once the gateway accepts the task, you are notified when it finishes, and the files are saved in the workspace (media/audio/). Each model takes only the fields it declares; media_models lists them with prices (music and podcasts per request, speech per second of original audio). Charged only when it succeeds.",
 		parameters: {
 			type: {
 				type: "string",
-				enum: ["music", "podcast"],
+				enum: [...AUDIO_MAKE_KINDS],
 				required: true,
 				description: "What to make."
 			},
 			prompt: {
 				type: "string",
-				description: "Music: style, mood, instruments, tempo, theme. Podcast: the topic and angle to discuss. Required for music; for a podcast give a prompt, a source_url, or both."
+				description: "Music: style, mood, instruments, tempo, theme (required). Podcast: the topic and angle; give a prompt, a source_url, or both. Speech: the exact text to speak (required)."
 			},
 			lyrics: {
 				type: "string",
@@ -6689,16 +7828,32 @@ function audioGenerateTool(runtime) {
 			},
 			gender: {
 				type: "string",
-				enum: ["male", "female"],
-				description: "Music only: the singer's voice."
+				description: "Music only: the singer's voice, such as male or female."
 			},
 			source_url: {
 				type: "string",
 				description: "Podcast only: an http(s) page for the hosts to discuss."
 			},
+			references: {
+				type: "array",
+				items: { type: "string" },
+				description: `Speech only: reference audio whose voice to imitate, each ${SOURCE_HELP}. The model states how many, how large and how long.`
+			},
+			format: {
+				type: "string",
+				description: "Speech only: an output format the model offers (media_models lists them, such as wav or mp3)."
+			},
+			sample_rate: {
+				type: "integer",
+				description: "Speech only: a sample rate the model offers for that format (Hz)."
+			},
+			watermark: {
+				type: "boolean",
+				description: "Speech only, when the model takes it: add the provider's audio watermark."
+			},
 			model: {
 				type: "string",
-				description: "Audio model id from media_models. Omit to use the default for the type."
+				description: "Audio model id (or alias) from media_models. Omit to use the default for the type."
 			},
 			filename: {
 				type: "string",
@@ -6724,6 +7879,7 @@ function audioGenerateTool(runtime) {
 					},
 					jobId: { type: "string" },
 					estimatedCny: { type: "string" },
+					price: { type: "string" },
 					outputs: {
 						type: "array",
 						items: {
@@ -6733,7 +7889,8 @@ function audioGenerateTool(runtime) {
 								path: { type: "string" },
 								url: { type: "string" },
 								title: { type: "string" },
-								durationSeconds: { type: "number" }
+								durationSeconds: { type: "number" },
+								originalSeconds: { type: "number" }
 							}
 						}
 					},
@@ -6749,75 +7906,44 @@ function audioGenerateTool(runtime) {
 			}]
 		},
 		async execute(args, exec) {
+			const kind = args.type;
 			const prompt = args.prompt?.trim();
-			const sourceUrl = args.source_url?.trim();
-			let body;
-			if (args.type === "music") {
-				if (prompt === void 0 || prompt === "") throw new MediaError("Music needs a prompt describing the song.", "AUDIO_PROMPT_REQUIRED", { field: "prompt" });
-				if (sourceUrl !== void 0 && sourceUrl !== "") throw new MediaError("source_url is for podcasts; describe the song in the prompt instead.", "AUDIO_OPTION_INVALID", { field: "source_url" });
-				body = {
-					prompt,
-					...args.lyrics?.trim() ? { lyrics: args.lyrics.trim() } : {},
-					...args.genre?.trim() ? { genre: args.genre.trim() } : {},
-					...args.mood?.trim() ? { mood: args.mood.trim() } : {},
-					...args.gender === void 0 ? {} : { gender: args.gender }
-				};
-			} else {
-				if ((prompt === void 0 || prompt === "") && (sourceUrl === void 0 || sourceUrl === "")) throw new MediaError("A podcast needs a prompt (the topic), a source_url, or both.", "AUDIO_PROMPT_REQUIRED", { field: "prompt" });
-				if (sourceUrl !== void 0 && sourceUrl !== "" && !/^https?:\/\//i.test(sourceUrl)) throw new MediaError("source_url must be an http(s) link.", "AUDIO_OPTION_INVALID", { field: "source_url" });
-				if (args.lyrics !== void 0 || args.genre !== void 0 || args.mood !== void 0 || args.gender !== void 0) throw new MediaError("lyrics, genre, mood and gender are for music; describe the episode in the prompt instead.", "AUDIO_OPTION_INVALID");
-				body = {
-					...prompt ? { prompt } : {},
-					...sourceUrl ? { source_url: sourceUrl } : {}
-				};
-			}
-			const model = await runtime.pickModel("audio", args.type, args.model, void 0, exec.signal);
-			const estimate = estimateAudio(model);
-			const what = args.type === "music" ? {
-				en: "a song",
-				zh: "一首音乐"
-			} : {
-				en: "a podcast episode",
-				zh: "一期播客"
-			};
-			await runtime.confirmSpending(exec, "audio_generate", {
-				en: `Generate ${what.en} with ${model.id}${estimate === void 0 ? "" : `, about ${yuan(estimate.amountCny)}`}. Charged only if it succeeds.`,
-				zh: `用 ${model.id} 生成${what.zh}${estimate === void 0 ? "" : `，约 ${yuan(estimate.amountCny)}`}，成功才扣费。`
-			});
-			const now = runtime.now();
-			const label = excerpt(prompt ?? sourceUrl);
-			const { record: accepted, jobId, unconfirmed } = await submitTask(runtime, exec, {
-				id: randomUUID(),
-				kind: "audio",
-				model: model.id,
-				label,
-				createdAt: now,
-				updatedAt: now,
-				...exec.agent === void 0 ? {} : { owner: exec.agent.id },
-				outputDir: runtime.outputFolder(exec, "audio"),
-				stem: runtime.stem(args.filename, prompt ?? args.type),
-				endpoint: "/v1/audio/generations",
-				body: {
-					model: model.id,
-					...body
-				},
-				status: "submitting",
-				...estimate === void 0 ? {} : { estimatedCny: estimate.amountCny.toFixed(2) }
+			const prepared = await prepareAudioTask(runtime, exec, {
+				kind,
+				...args.model === void 0 ? {} : { model: args.model },
+				...prompt === void 0 || prompt === "" ? {} : { prompt },
+				...args.lyrics === void 0 ? {} : { lyrics: args.lyrics },
+				...args.genre === void 0 ? {} : { genre: args.genre },
+				...args.mood === void 0 ? {} : { mood: args.mood },
+				...args.gender === void 0 ? {} : { gender: args.gender },
+				...args.source_url === void 0 ? {} : { sourceUrl: args.source_url },
+				...args.references === void 0 ? {} : { references: args.references },
+				...args.format === void 0 ? {} : { format: args.format },
+				...args.sample_rate === void 0 ? {} : { sampleRate: args.sample_rate },
+				...args.watermark === void 0 ? {} : { watermark: args.watermark }
+			}, {
+				folder: runtime.outputFolder(exec, "audio"),
+				stem: runtime.stem(args.filename, prompt ?? args.source_url ?? kind)
 			});
+			const { model, quote } = prepared;
+			const { record: accepted, jobId, unconfirmed } = await submitTask(runtime, exec, prepared.draft);
 			const base = {
 				taskId: accepted.id,
 				model: model.id,
+				price: quote.label.en,
 				...accepted.estimatedCny === void 0 ? {} : { estimatedCny: accepted.estimatedCny }
 			};
-			if (jobId !== void 0) {
-				const kind = args.type === "music" ? "Music" : "Podcast";
-				return {
-					...base,
-					status: accepted.status,
-					jobId,
-					message: `${unconfirmed ? `${kind} task ${accepted.id} (${model.id}): ${UNCONFIRMED_NOTE}` : `${kind} task submitted to ${model.id}.`} Background job ${jobId} reports when it finishes; files are saved under ${runtime.display(exec, accepted.outputDir)}. ${accepted.estimatedCny === void 0 ? "" : `Estimated ${yuan(Number(accepted.estimatedCny))}, charged only if it succeeds. `}Carry on with other work meanwhile; there is no need to poll.`
-				};
-			}
+			const name = {
+				music: "Music",
+				podcast: "Podcast",
+				speech: "Speech"
+			}[kind];
+			if (jobId !== void 0) return {
+				...base,
+				status: accepted.status,
+				jobId,
+				message: `${unconfirmed ? `${name} task ${accepted.id} (${model.id}): ${UNCONFIRMED_NOTE}` : `${name} task submitted to ${model.id}.`} Background job ${jobId} reports when it finishes; files are saved under ${runtime.display(exec, accepted.outputDir)}. ${accepted.estimatedCny === void 0 ? `Price: ${quote.basis.en}. ` : `Estimated ${yuan(Number(accepted.estimatedCny))}, charged only if it succeeds. `}Carry on with other work meanwhile; there is no need to poll.`
+			};
 			const final = await waitForTask(runtime, exec, accepted);
 			return {
 				...base,
@@ -6826,7 +7952,8 @@ function audioGenerateTool(runtime) {
 					...output.path === void 0 ? {} : { path: runtime.display(exec, output.path) },
 					...output.url === void 0 ? {} : { url: output.url },
 					...output.title === void 0 ? {} : { title: output.title },
-					...output.durationSeconds === void 0 ? {} : { durationSeconds: output.durationSeconds }
+					...output.durationSeconds === void 0 ? {} : { durationSeconds: output.durationSeconds },
+					...output.originalSeconds === void 0 ? {} : { originalSeconds: output.originalSeconds }
 				})) },
 				message: describeTask(runtime, exec, final)
 			};
@@ -6843,14 +7970,47 @@ function audioGenerateTool(runtime) {
 const KIND_LABEL = {
 	image: "Image models (image_generate)",
 	video: "Video models (video_generate)",
-	audio: "Music and podcast models (audio_generate)",
+	audio: "Music, podcast and speech models (audio_generate)",
 	transcription: "Transcription models (audio_transcribe)"
 };
 function slotOf(model) {
-	if (model.kind === "audio") return model.audioKind === "podcast" ? "podcast" : "music";
+	if (model.kind === "audio") return model.audioKind;
 	return model.kind;
 }
 /**
+* What an audio model takes, from its declaration: the fields, speech references, output formats and sample rates.
+* @param model - an audio or transcription model.
+* @returns one line, or undefined when nothing is declared.
+*/
+function describeAudioModel(model) {
+	const audio = model.audio;
+	if (model.kind === "transcription") {
+		const facts = [
+			audio?.maxInputBytes === void 0 ? void 0 : `at most ${(audio.maxInputBytes / 1e6).toFixed(0)} MB`,
+			audio?.maxInputSeconds === void 0 ? void 0 : `at most ${Math.round(audio.maxInputSeconds / 60)} min`,
+			audio?.languages === void 0 ? void 0 : `languages ${audio.languages.join(", ")}`
+		].filter(Boolean);
+		return facts.length === 0 ? void 0 : facts.join("; ");
+	}
+	if (model.audioKind === void 0) return "does not declare what kind of audio it makes; it cannot be used for generation";
+	const fields = requestFieldsOf(model).filter((name) => name !== "model");
+	const parts = [`fields: ${fields.join(", ") || "none declared"}`];
+	const prompt = promptFieldOf(model);
+	if (prompt !== void 0 && prompt !== "prompt") parts.push(`the text goes in ${prompt}`);
+	const references = audio?.references;
+	if (references !== void 0 && fields.includes("references")) {
+		const count = references.min === references.max ? `${references.max}` : `${references.min}-${references.max}`;
+		parts.push([
+			`${count} reference audio`,
+			references.maxBytes === void 0 ? void 0 : `each at most ${(references.maxBytes / 1048576).toFixed(0)} MiB`,
+			references.minSeconds === void 0 && references.maxSeconds === void 0 ? void 0 : `each ${references.minSeconds ?? 0}-${references.maxSeconds ?? "∞"} s`,
+			references.exclusiveWith === void 0 ? void 0 : `not with ${references.exclusiveWith.join(", ")}`
+		].filter(Boolean).join(", "));
+	}
+	for (const format of audio?.outputFormats ?? []) parts.push(`format ${format.format}${format.sampleRates.length === 0 ? "" : ` at ${format.sampleRates.join("/")} Hz`}`);
+	return parts.join("; ");
+}
+/**
 * Build the tool.
 * @param runtime - the media runtime.
 * @returns the tool definition.
@@ -6858,7 +8018,7 @@ function slotOf(model) {
 function mediaModelsTool(runtime) {
 	return defineTool({
 		name: "media_models",
-		description: "List the image, video, music/podcast and transcription models this VibeDev account can use, with prices. For video models it lists each generation mode and the inputs it accepts (reference images, videos and audio, first and last frames), durations, aspect ratios and resolutions. Use it to choose a model when a request needs particular inputs or options; the generation tools pick a suitable model themselves when none is named.",
+		description: "List the image, video, music/podcast/speech and transcription models this VibeDev account can use, with prices (\"not priced\" when the catalog states none). For video models it lists each generation mode and the inputs it accepts (reference images, videos and audio, first and last frames), durations, aspect ratios and resolutions; for audio models the fields each takes, speech references, output formats and sample rates. Use it to choose a model when a request needs particular inputs or options; the generation tools pick a suitable model themselves when none is named.",
 		parameters: { kind: {
 			type: "string",
 			enum: [
@@ -6937,16 +8097,20 @@ function mediaModelsTool(runtime) {
 		isConcurrencySafe: () => true,
 		async execute(args, exec) {
 			return { models: (await runtime.models(exec.signal)).filter((model) => args.kind === void 0 || model.kind === args.kind).map((model) => {
-				const price = describePrice(model);
-				const pinned = runtime.settings.defaultModel(slotOf(model)).trim() === model.id;
+				const audioLike = model.kind === "audio" || model.kind === "transcription";
+				const price = audioLike ? quoteAudio(model).label.en : describePrice(model);
+				const slot = slotOf(model);
+				const pinned = slot !== void 0 && runtime.settings.defaultModel(slot).trim() === model.id;
+				const audioFacts = audioLike ? describeAudioModel(model) : void 0;
 				return {
 					id: model.id,
 					name: model.name,
 					kind: model.kind,
-					...model.audioKind === void 0 ? {} : { produces: model.audioKind },
+					...model.kind !== "audio" ? {} : { produces: model.audioKind ?? "undeclared" },
 					...model.description === void 0 ? {} : { description: model.description },
-					...price === void 0 ? {} : { price },
+					price,
 					...model.kind === "video" ? { capabilities: describeVideoModel(model) } : {},
+					...audioFacts === void 0 ? {} : { capabilities: audioFacts },
 					...pinned ? { pinned } : {}
 				};
 			}) };
@@ -7034,7 +8198,7 @@ function mediaTasksTool(runtime) {
 			const limit = Math.min(50, Math.max(1, Math.trunc(args.limit ?? 10)));
 			const shown = tasks.slice(0, limit);
 			for (const task of shown) if (!isFinished(task)) runtime.tracker.follow(task.id).catch(() => void 0);
-			return { tasks: shown.map((task) => ({
+			return { tasks: (await Promise.all(shown.map((task) => task.status === "completed" && task.settlement === "pending" ? runtime.tracker.refresh(task.id, exec.signal).catch(() => task) : task))).map((task) => ({
 				id: task.id,
 				kind: task.kind,
 				status: task.status,
@@ -7116,7 +8280,7 @@ function sleep(ms, signal) {
 function audioTranscribeTool(runtime) {
 	return defineTool({
 		name: "audio_transcribe",
-		description: "Transcribe speech in an audio file to text with a VibeDev transcription model. Mandarin Chinese (zh) only for now; at most 20 MB and 10 minutes; 16 kHz mono WAV works best. Charged per minute of audio.",
+		description: "Transcribe speech in an audio file to text with a VibeDev transcription model (uploaded as a multipart file). Each model states its languages and limits (media_models; commonly Mandarin Chinese, at most 20 MB and 10 minutes); 16 kHz mono WAV works best. Charged per minute of audio.",
 		parameters: {
 			file: {
 				type: "string",
@@ -7167,15 +8331,19 @@ function audioTranscribeTool(runtime) {
 		async execute(args, exec) {
 			const language = (args.language ?? "zh").trim().toLowerCase() || "zh";
 			const model = await runtime.pickModel("transcription", "transcription", args.model, void 0, exec.signal);
-			const media = await runtime.load(exec, args.file, "audio", MAX_BYTES);
-			if (!ACCEPTED.includes(media.mime)) throw new MediaError(`"${media.source}" is ${media.mime}, not an audio file the gateway transcribes; convert it to 16 kHz mono WAV first.`, "AUDIO_FORMAT_UNSUPPORTED", { field: "file" });
+			const declared = model.audio;
+			const maxBytes = declared?.maxInputBytes ?? MAX_BYTES;
+			const maxSeconds = declared?.maxInputSeconds ?? MAX_SECONDS;
+			const accepted = declared?.inputMimes ?? ACCEPTED;
+			if (declared?.languages !== void 0 && !declared.languages.includes(language)) throw new MediaError(`${model.id} transcribes ${declared.languages.join(", ")}, not "${language}".`, "AUDIO_OPTION_INVALID", { field: "language" });
+			const media = await runtime.load(exec, args.file, "audio", maxBytes);
+			if (!accepted.includes(media.mime)) throw new MediaError(`"${media.source}" is ${media.mime}, not an audio file the gateway transcribes; convert it to 16 kHz mono WAV first.`, "AUDIO_FORMAT_UNSUPPORTED", { field: "file" });
 			const seconds = media.mime === "audio/wav" ? wavSeconds(media.data) : void 0;
-			if (seconds !== void 0 && seconds > MAX_SECONDS) throw new MediaError(`"${media.source}" is ${(seconds / 60).toFixed(1)} minutes long; the limit is 10 minutes. Split it first.`, "AUDIO_TOO_LONG", { field: "file" });
-			const tier = model.pricing?.default ?? model.pricing?.tiers[0];
-			const estimate = tier?.unit === "second" && seconds !== void 0 ? tier.amount * seconds : void 0;
+			if (seconds !== void 0 && seconds > maxSeconds) throw new MediaError(`"${media.source}" is ${(seconds / 60).toFixed(1)} minutes long; the limit is ${(maxSeconds / 60).toFixed(0)} minutes. Split it first.`, "AUDIO_TOO_LONG", { field: "file" });
+			const quote = quoteAudio(model, seconds);
 			await runtime.confirmSpending(exec, "audio_transcribe", {
-				en: `Transcribe ${media.name} with ${model.id}${estimate === void 0 ? " (billed per minute)" : `, about ${yuan(estimate)}`}.`,
-				zh: `用 ${model.id} 转写 ${media.name}${estimate === void 0 ? "（按分钟计费）" : `，约 ${yuan(estimate)}`}。`
+				en: `Transcribe ${media.name} with ${model.id}: ${quote.amountCny === void 0 ? quote.basis.en : `about ${yuan(quote.amountCny)} (${quote.basis.en})`}.`,
+				zh: `用 ${model.id} 转写 ${media.name}：${quote.amountCny === void 0 ? quote.basis.zh : `约 ${yuan(quote.amountCny)}（${quote.basis.zh}）`}。`
 			});
 			const body = new FormData();
 			body.append("file", new Blob([media.data], { type: media.mime }), media.name);
@@ -7262,11 +8430,12 @@ const Config = Schema.object({
 	videoModel: Schema.string().default("").volatile(),
 	musicModel: Schema.string().default("").volatile(),
 	podcastModel: Schema.string().default("").volatile(),
+	speechModel: Schema.string().default("").volatile(),
 	transcriptionModel: Schema.string().default("").volatile(),
-	gatewayOrigin: Schema.string().default("https://vibedev.jzsaas.com"),
+	gatewayOrigin: Schema.string().default(DEFAULT_GATEWAY_ORIGIN),
 	client: Schema.string().default("vibedev-plugin"),
 	primary: Schema.boolean().default(false),
-	apiKeyEnv: Schema.string().default("VIBEDEV_GATEWAY_API_KEY"),
+	apiKeyEnv: Schema.string().default(""),
 	stateDir: Schema.string().default("")
 }).i18n({
 	"zh-CN": {
@@ -7280,6 +8449,7 @@ const Config = Schema.object({
 		videoModel: "默认视频模型（留空由 Agent 按目录选择）",
 		musicModel: "默认音乐模型（留空自动选择）",
 		podcastModel: "默认播客模型（留空自动选择）",
+		speechModel: "默认语音合成模型（留空自动选择）",
 		transcriptionModel: "默认语音转写模型（留空自动选择）",
 		gatewayOrigin: "VibeDev 网关地址",
 		client: "登录时报给网关的客户端名称（决定用量记在哪个密钥下）",
@@ -7298,6 +8468,7 @@ const Config = Schema.object({
 		videoModel: "Default video model (empty: the agent chooses from the catalog)",
 		musicModel: "Default music model (empty: chosen automatically)",
 		podcastModel: "Default podcast model (empty: chosen automatically)",
+		speechModel: "Default speech model (empty: chosen automatically)",
 		transcriptionModel: "Default transcription model (empty: chosen automatically)",
 		gatewayOrigin: "VibeDev gateway address",
 		client: "Client name reported to the gateway at sign-in (decides which key the usage is recorded under)",
@@ -7306,15 +8477,15 @@ const Config = Schema.object({
 		stateDir: "Plugin data folder (empty for the default)"
 	}
 });
-const GUIDANCE = "VibeDev media tools: image_generate, video_generate, audio_generate (music or a podcast) and audio_transcribe create and transcribe media with the user's VibeDev account; media_models lists models and prices. Use them on your own judgment whenever generated media serves the request (illustrations, product shots, storyboard frames, short clips, background music, a podcast episode), not only when a tool is named. They spend the user's balance, so make what the request needs rather than speculative variations. Results are saved in the workspace under media/. Pass files the user attached in this chat as chat:1 (the most recent), chat:2, and so on. Video and audio run as background jobs: carry on and let the job notification report the result.";
+const GUIDANCE = "VibeDev media tools: image_generate, video_generate, audio_generate (music, a podcast or speech) and audio_transcribe create and transcribe media with the user's VibeDev account; media_models lists models and prices. Use them on your own judgment whenever generated media serves the request (illustrations, product shots, storyboard frames, short clips, background music, a podcast episode, a voice-over), not only when a tool is named. They spend the user's balance, so make what the request needs rather than speculative variations. Results are saved in the workspace under media/. Pass files the user attached in this chat as chat:1 (the most recent), chat:2, and so on. Video and audio run as background jobs: carry on and let the job notification report the result.";
 function apply(ctx, config) {
-	const origin = config.gatewayOrigin.trim().replace(/\/+$/, "");
+	const origin = normalizeGatewayOrigin(config.gatewayOrigin);
 	const stateDir = stateDirectory(config.stateDir);
 	const userAgent = `vibedev-plugin/${version}`;
 	const warn = (message) => {
 		ctx.logger.warn(message);
 	};
-	const storage = grantStorage(stateDir, () => ctx.get("credentials"));
+	const storage = grantStorage(stateDir, () => ctx.get("credentials"), origin);
 	const login = new PluginLogin({
 		origin,
 		userAgent,
@@ -7325,7 +8496,7 @@ function apply(ctx, config) {
 	});
 	ctx.inject(["credentials"], (scoped) => {
 		scoped.on("credentials/record-updated", (key) => {
-			if (key === GRANT_KEY) login.restore();
+			if (key === gatewayGrantKey(origin)) login.restore();
 		});
 		scoped.effect(async () => {
 			await login.restore();
@@ -7336,7 +8507,7 @@ function apply(ctx, config) {
 		origin,
 		plugin: login,
 		account: () => ctx.get("deepseekAccount"),
-		apiKey: () => config.apiKeyEnv.trim() === "" ? void 0 : process.env[config.apiKeyEnv.trim()]?.trim()
+		apiKey: () => developmentKey(origin, config.apiKeyEnv)
 	});
 	const http = new GatewayHttp({
 		origin,
@@ -7344,7 +8515,7 @@ function apply(ctx, config) {
 		resolveCredential: () => chain.resolve(),
 		rejectToken: (credential) => chain.reject(credential)
 	});
-	const store = new TaskStore(stateDir);
+	const store = new TaskStore(gatewayStateDirectory(stateDir, origin));
 	const tracker = new TaskTracker({
 		http,
 		store,
@@ -7355,6 +8526,7 @@ function apply(ctx, config) {
 		video: config.videoModel,
 		music: config.musicModel,
 		podcast: config.podcastModel,
+		speech: config.speechModel,
 		transcription: config.transcriptionModel
 	};
 	const runtime = new MediaRuntime({