ai_co_discuss 0.3.46 → 0.3.49

package/runner/stt.mjs

@@ -78,7 +78,7 @@ export async function stt_part(home, input, request = fetch) {
   const { upload_id, index, data, final } = input || {};
   if (!/^[a-f0-9-]{36}$/i.test(upload_id || '') || !Number.isInteger(index) || index < 0 || typeof data !== 'string') throw new Error('录音片段无效');
   const settings = tts_settings(home);
-  if (!settings.api_key_ref) throw new Error('尚未配置语音：请在设置的“语音”中填写火山引擎 API Key');
+  if (!settings.stt_key_ref) throw new Error('语音输入使用火山引擎：请在设置的“语音”中填写火山引擎 API Key');
   const part = Buffer.from(data, 'base64');
   if (part.length > PART_MAX_BYTES || part.length % 2) throw new Error('录音片段无效');
   const root = join(home, 'stt');
@@ -98,7 +98,7 @@ export async function stt_part(home, input, request = fetch) {
     const pcm = Buffer.concat(parts);
     if (pcm.length > STT_MAX_BYTES) throw new Error('录音超过 5 分钟，请分段录制');
     if (!pcm.length) return { text: '' };
-    const key = read_saved_api_key(home, TTS_BASE_URL, settings.api_key_ref);
+    const key = read_saved_api_key(home, TTS_BASE_URL, settings.stt_key_ref);
     return { text: await recognize(key, pcm_to_wav(pcm), request) };
   } finally { rmSync(directory, { recursive: true, force: true }); }
 }

package/runner/tts.mjs

@@ -1,21 +1,24 @@
-/** Read-aloud: synthesize short text with Volcengine Doubao TTS 2.0; the key stays in the local private store. */
-import { createHash, randomUUID } from 'node:crypto';
+/**
+ * Read-aloud: synthesize short text with the speech service chosen in settings (Volcengine, Aliyun or Azure); keys stay
+ * in the local private store. Each service keeps its own key and voices, so switching back finds them as they were.
+ */
+import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 
 import { read_saved_api_key } from './discussion_api.mjs';
 import { atomic_json } from './files.mjs';
+import { provider_speak, TTS_PROVIDERS } from './tts_providers.mjs';
 
+// Volcengine's key root; its key also serves voice input.
 export const TTS_BASE_URL = 'https://openspeech.bytedance.com';
-const TTS_ENDPOINT = `${TTS_BASE_URL}/api/v3/tts/unidirectional`;
-const TTS_RESOURCE_ID = 'seed-tts-2.0';
-const TTS_DONE_CODE = 20000000;
-const TTS_TIMEOUT_MS = 45_000;
 // The page sends a paragraph of up to 200 characters; at about 8 KB of MP3 per second this keeps one relayed answer under 1 MiB.
 export const TTS_MAX_TEXT = 300;
 const MAX_CONTEXT = 200;
 const SETTINGS_FILE = 'tts-settings.json';
-const SPEAKER_PATTERN = /^[\w.-]{1,128}$/;
+const SPEAKER_PATTERN = /^[\w.:-]{1,128}$/;
+const REGION_PATTERN = /^[a-z0-9]{2,32}$/;
+const KEY_REF_PATTERN = /^[a-f0-9-]{36}$/i;
 // Trailing silence the page may ask for at a paragraph or message end; it is part of the audio, so it also plays in the background.
 const MAX_SILENCE_MS = 3000;
 // Synthesized paragraphs are kept on this computer, so hearing the same text again is instant and not billed again.
@@ -24,59 +27,44 @@ const CACHE_DIR = 'tts-cache';
 const CACHE_LIMIT_BYTES = 50 * 1024 * 1024;
 const CACHE_KEEP_BYTES = 40 * 1024 * 1024;
 const MAX_MEMBER_VOICES = 50;
-// A default tone instruction (context_texts) so reading sounds told rather than recited; users may change or clear it.
+// A default tone instruction (Volcengine's context_texts) so reading sounds told rather than recited; users may change or clear it.
 export const TTS_DEFAULT_CONTEXT = '请用自然放松的语气朗读，像给朋友讲故事一样，有轻重缓急，句子之间自然停顿。';
-export const TTS_DEFAULTS = { speaker: 'zh_female_vv_uranus_bigtts', speech_rate: 0, context: TTS_DEFAULT_CONTEXT };
-// Voices a user can pick without looking up IDs; any other 2.0 voice ID enabled in the console may be typed.
-export const TTS_VOICES = [
-  { id: 'zh_female_vv_uranus_bigtts', label: 'Vivi · 通用女声' },
-  { id: 'zh_female_xiaohe_uranus_bigtts', label: '小何 · 通用女声' },
-  { id: 'zh_male_m191_uranus_bigtts', label: '云舟 · 通用男声' },
-  { id: 'zh_male_taocheng_uranus_bigtts', label: '小天 · 通用男声' },
-  { id: 'zh_male_liufei_uranus_bigtts', label: '刘飞 · 通用男声' },
-  { id: 'zh_female_sophie_uranus_bigtts', label: '魅力苏菲 · 女声' },
-  { id: 'zh_female_qingxinnvsheng_uranus_bigtts', label: '清新女声' },
-  { id: 'zh_female_cancan_uranus_bigtts', label: '知性灿灿 · 女声' },
-  { id: 'zh_female_zhixingnv_uranus_bigtts', label: '知性女声' },
-  { id: 'zh_female_wenroushunv_uranus_bigtts', label: '温柔淑女 · 女声' },
-  { id: 'zh_female_linjianvhai_uranus_bigtts', label: '邻家女孩' },
-  { id: 'zh_female_shuangkuaisisi_uranus_bigtts', label: '爽快思思 · 女声' },
-  { id: 'zh_female_gaolengyujie_uranus_bigtts', label: '高冷御姐 · 女声' },
-  { id: 'zh_female_xiaoxue_uranus_bigtts', label: '儿童绘本 · 女声' },
-  { id: 'zh_male_ruyaqingnian_uranus_bigtts', label: '儒雅青年 · 男声' },
-  { id: 'zh_male_yangguangqingnian_uranus_bigtts', label: '阳光青年 · 男声' },
-  { id: 'zh_male_yuanboxiaoshu_uranus_bigtts', label: '渊博小叔 · 男声' },
-  { id: 'zh_male_cixingjieshuonan_uranus_bigtts', label: '磁性解说 · 男声' },
-  { id: 'zh_male_shenyeboke_uranus_bigtts', label: '深夜播客 · 男声' },
-  { id: 'zh_male_xuanyijieshuo_uranus_bigtts', label: '悬疑解说 · 男声' },
-  { id: 'zh_male_baqiqingshu_uranus_bigtts', label: '霸气青叔 · 有声书男声' },
-  { id: 'zh_male_yizhipiannan_uranus_bigtts', label: '译制片男声' },
-  { id: 'zh_male_jieshuoxiaoming_uranus_bigtts', label: '解说小明 · 男声' },
-  { id: 'zh_male_wennuanahu_uranus_bigtts', label: '温暖阿虎 · 男声' },
-];
-const STATUS_MESSAGES = {
-  40402003: '文本超出单次合成长度上限',
-  45000000: '音色不可用：请确认已在火山引擎控制台开通该豆包语音合成 2.0 音色，并核对音色 ID',
-  55000000: '火山引擎语音服务暂时出错，请稍后再试',
-};
+// A paragraph asked for again while its synthesis is still running (another device, a quick restart) waits for that call.
+const in_flight = new Map();
+const PROVIDER_IDS = TTS_PROVIDERS.map(provider => provider.id);
+const provider_of = (id) => TTS_PROVIDERS.find(provider => provider.id === id);
+
+/** One service's saved part with its defaults: key reference, voices and (Azure) region. */
+function provider_settings(provider, saved = {}) {
+  return { api_key_ref: '', speaker: provider.default_speaker, member_voices: {}, file_voice: '', ...(provider.region ? { region: '' } : {}), ...saved };
+}
 
-/** Read the saved read-aloud settings; only the key reference is kept, never the key. */
+/**
+ * Read the saved read-aloud settings; only key references are kept, never keys. Settings saved before services could be
+ * chosen held Volcengine's key and voices at the top level and are read as Volcengine's.
+ * The chosen service's key reference and voices are also given at the top level for readers that only play.
+ */
 export function tts_settings(home) {
   const path = join(home, SETTINGS_FILE);
   const saved = existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) : {};
-  return { ...TTS_DEFAULTS, member_voices: {}, file_voice: '', ...saved, voices: TTS_VOICES, key_base_url: TTS_BASE_URL };
+  const stored = saved.providers || { volcengine: { api_key_ref: saved.api_key_ref, speaker: saved.speaker, member_voices: saved.member_voices,
+    file_voice: saved.file_voice } };
+  const providers = Object.fromEntries(TTS_PROVIDERS.map(provider => [provider.id,
+    provider_settings(provider, Object.fromEntries(Object.entries(stored[provider.id] || {}).filter(([, value]) => value !== undefined)))]));
+  const provider = PROVIDER_IDS.includes(saved.provider) ? saved.provider : 'volcengine';
+  const active = providers[provider];
+  const ready = Boolean(active.api_key_ref && (!provider_of(provider).region || active.region));
+  return { provider, speech_rate: saved.speech_rate ?? 0, context: saved.context ?? TTS_DEFAULT_CONTEXT, providers, catalog: TTS_PROVIDERS,
+    api_key_ref: ready ? active.api_key_ref : '', speaker: active.speaker, member_voices: active.member_voices, file_voice: active.file_voice,
+    stt_key_ref: providers.volcengine.api_key_ref };
 }
 
-/** Validate and save the read-aloud settings the page edits. */
-export function save_tts_settings(home, input) {
-  const speaker = String(input.speaker ?? TTS_DEFAULTS.speaker).trim();
+/** Validate one service's part as the page sent it. */
+function check_provider(provider, input = {}) {
+  const speaker = String(input.speaker || provider.default_speaker).trim();
   if (!SPEAKER_PATTERN.test(speaker)) throw new Error('请填写有效的音色 ID');
-  const speech_rate = Number(input.speech_rate ?? 0);
-  if (!Number.isInteger(speech_rate) || speech_rate < -50 || speech_rate > 100) throw new Error('语速须为 -50 到 100 的整数');
-  const context = String(input.context ?? '').trim();
-  if (context.length > MAX_CONTEXT) throw new Error(`语气提示不超过 ${MAX_CONTEXT} 字`);
-  const api_key_ref = input.api_key_ref || undefined;
-  if (api_key_ref && !/^[a-f0-9-]{36}$/i.test(api_key_ref)) throw new Error('API Key 引用无效，请重新填写');
+  const api_key_ref = input.api_key_ref || '';
+  if (api_key_ref && !KEY_REF_PATTERN.test(api_key_ref)) throw new Error('API Key 引用无效，请重新填写');
   // Voices chosen per AI platform; members of other platforms, the user and program messages use the default voice.
   const member_voices = {};
   for (const [name, voice] of Object.entries(input.member_voices || {}).slice(0, MAX_MEMBER_VOICES)) {
@@ -87,37 +75,24 @@ export function save_tts_settings(home, input) {
   // The voice for reading project files; empty uses the default voice.
   const file_voice = String(input.file_voice ?? '').trim();
   if (file_voice && !SPEAKER_PATTERN.test(file_voice)) throw new Error('文件音色无效，请重新选择');
-  const settings = { speaker, speech_rate, context, member_voices, file_voice, ...(api_key_ref ? { api_key_ref } : {}) };
-  mkdirSync(home, { recursive: true, mode: 0o700 });
-  atomic_json(join(home, SETTINGS_FILE), settings);
-  return tts_settings(home);
+  const region = String(input.region ?? '').trim().toLowerCase();
+  if (region && !REGION_PATTERN.test(region)) throw new Error('Azure 区域应为如 eastasia 的小写英文与数字');
+  return { api_key_ref, speaker, member_voices, file_voice, ...(provider.region ? { region } : {}) };
 }
 
-/** Split a chunked answer made of concatenated JSON objects, newline-separated or not. */
-export function split_json_objects(text) {
-  const objects = [];
-  let depth = 0, start = -1, in_string = false, escaped = false;
-  for (let index = 0; index < text.length; index += 1) {
-    const character = text[index];
-    if (in_string) {
-      if (escaped) escaped = false;
-      else if (character === '\\') escaped = true;
-      else if (character === '"') in_string = false;
-    } else if (character === '"') in_string = true;
-    else if (character === '{') { if (depth++ === 0) start = index; }
-    else if (character === '}' && depth > 0 && --depth === 0) objects.push(JSON.parse(text.slice(start, index + 1)));
-  }
-  return objects;
-}
-
-/** Turn one service code into a message that says what to fix. */
-function tts_error(code, message) {
-  return new Error(`语音合成失败（${code}）：${STATUS_MESSAGES[code] || message || '请核对 API Key 与音色'}`);
-}
-
-/** Flatten the per-word timings the service returns with subtitles, as { w: word, t: start in ms }. */
-function word_marks(objects) {
-  return objects.flatMap(item => item.sentence?.words || []).map(word => ({ w: String(word.word || ''), t: Math.round(Number(word.startTime || 0) * 1000) }));
+/** Validate and save the read-aloud settings the page edits: the chosen service, each service's part, rate and tone. */
+export function save_tts_settings(home, input) {
+  const provider = String(input.provider || 'volcengine');
+  if (!PROVIDER_IDS.includes(provider)) throw new Error('请选择语音服务');
+  const speech_rate = Number(input.speech_rate ?? 0);
+  if (!Number.isInteger(speech_rate) || speech_rate < -50 || speech_rate > 100) throw new Error('语速须为 -50 到 100 的整数');
+  const context = String(input.context ?? '').trim();
+  if (context.length > MAX_CONTEXT) throw new Error(`语气提示不超过 ${MAX_CONTEXT} 字`);
+  const current = tts_settings(home).providers;
+  const providers = Object.fromEntries(TTS_PROVIDERS.map(item => [item.id, check_provider(item, input.providers?.[item.id] || current[item.id])]));
+  mkdirSync(home, { recursive: true, mode: 0o700 });
+  atomic_json(join(home, SETTINGS_FILE), { provider, speech_rate, context, providers });
+  return tts_settings(home);
 }
 
 /** Read a cached synthesis, refreshing its time so the most recently heard stay; null when absent or unreadable. */
@@ -143,47 +118,33 @@ function cache_write(directory, path, value) {
 }
 
 /**
- * Synthesize one paragraph and return it as base64 MP3 with word timings for highlighting.
+ * Synthesize one paragraph with the chosen service and return it as base64 MP3 with word timings for highlighting.
  * `speaker` may name another voice for this paragraph (a member's own voice); `silence_ms` appends trailing silence.
- * Requests of one reading pass share `section_id`, so the service keeps the earlier paragraphs as context.
+ * Requests of one reading pass share `section_id`, so Volcengine keeps the earlier paragraphs as context.
+ * @param {{ request?: Function, open?: Function }} [transport] `fetch` and WebSocket factory, replaceable in tests.
  */
-export async function tts_speak(home, input, request = fetch) {
+export async function tts_speak(home, input, transport) {
   const text = typeof input?.text === 'string' ? input.text.trim() : '';
   if (!text) throw new Error('朗读文本为空');
   if (text.length > TTS_MAX_TEXT) throw new Error(`单次朗读不超过 ${TTS_MAX_TEXT} 字`);
   const settings = tts_settings(home);
-  if (!settings.api_key_ref) throw new Error('尚未配置语音：请在设置的“语音”中填写火山引擎 API Key');
-  const speaker = SPEAKER_PATTERN.test(input.speaker || '') ? input.speaker : settings.speaker;
+  const provider = provider_of(settings.provider);
+  const own = settings.providers[provider.id];
+  if (!own.api_key_ref) throw new Error(`尚未配置语音：请在设置的“语音”中填写${provider.label} API Key`);
+  const speaker = SPEAKER_PATTERN.test(input.speaker || '') ? input.speaker : own.speaker;
   const silence = Math.max(0, Math.min(MAX_SILENCE_MS, Math.round(Number(input.silence_ms) || 0)));
+  const context = provider.context ? settings.context : '';
   const directory = join(home, CACHE_DIR);
-  const cache_path = join(directory, `${createHash('sha256').update(JSON.stringify([text, speaker, settings.speech_rate, settings.context, silence])).digest('hex')}.json`);
+  const cache_path = join(directory, `${createHash('sha256').update(JSON.stringify([text, speaker, settings.speech_rate, context, silence,
+    ...(provider.id === 'volcengine' ? [] : [provider.id])])).digest('hex')}.json`);
   const cached = existsSync(cache_path) && cache_read(cache_path);
   if (cached?.audio) return { ...cached, cached: true };
-  const key = read_saved_api_key(home, TTS_BASE_URL, settings.api_key_ref);
-  const section_id = /^[a-f0-9-]{36}$/i.test(input.section_id || '') ? input.section_id : undefined;
-  const additions = { ...(settings.context ? { context_texts: [settings.context] } : {}), ...(section_id ? { section_id } : {}),
-    ...(silence ? { silence_duration: silence } : {}) };
-  const body = { user: { uid: 'codiscuss' }, req_params: { text, speaker,
-    audio_params: { format: 'mp3', sample_rate: 24000, speech_rate: settings.speech_rate, enable_subtitle: true },
-    ...(Object.keys(additions).length ? { additions: JSON.stringify(additions) } : {}) } };
-  let response;
-  try {
-    response = await request(TTS_ENDPOINT, { method: 'POST', redirect: 'error', signal: AbortSignal.timeout(TTS_TIMEOUT_MS),
-      headers: { 'Content-Type': 'application/json', 'X-Api-Key': key, 'X-Api-Resource-Id': TTS_RESOURCE_ID, 'X-Api-Request-Id': randomUUID() },
-      body: JSON.stringify(body) });
-  } catch { throw new Error('语音合成请求超时或连接失败，请检查网络后重试'); }
-  if (response.status === 401 || response.status === 403) throw new Error('火山引擎拒绝了请求：API Key 无效或未开通豆包语音合成 2.0');
-  const objects = split_json_objects(await response.text());
-  const chunks = [];
-  for (const item of objects) {
-    if (item.code === TTS_DONE_CODE) {
-      const result = { audio: Buffer.concat(chunks).toString('base64'), format: 'mp3', marks: word_marks(objects) };
-      cache_write(directory, cache_path, result);
-      return result;
-    }
-    if (item.code !== 0) throw tts_error(item.code, item.message);
-    if (item.data) chunks.push(Buffer.from(item.data, 'base64'));
+  if (!in_flight.has(cache_path)) {
+    const key = read_saved_api_key(home, provider.key_base_url, own.api_key_ref);
+    const section_id = KEY_REF_PATTERN.test(input.section_id || '') ? input.section_id : undefined;
+    in_flight.set(cache_path, provider_speak(provider.id, { key, text, speaker, rate: settings.speech_rate, context, silence, section_id, region: own.region }, transport)
+      .then((result) => { cache_write(directory, cache_path, result); return result; })
+      .finally(() => in_flight.delete(cache_path)));
   }
-  if (!response.ok) throw new Error(`语音合成失败：火山引擎返回 HTTP ${response.status}`);
-  throw new Error('语音合成未完成：火山引擎没有返回结束标记');
+  return in_flight.get(cache_path);
 }

package/runner/tts_providers.mjs

@@ -0,0 +1,205 @@
+/**
+ * Read-aloud providers: what each speech service offers (voices, key root, console) and how one paragraph is
+ * synthesized there. Every provider answers the same shape, `{ audio: base64 MP3, format: "mp3", marks: [{ w, t }] }`;
+ * `marks` holds per-character start times in ms when the service gives them, otherwise it is empty and the page spreads
+ * the highlight by length.
+ */
+import { randomUUID } from 'node:crypto';
+
+const TTS_TIMEOUT_MS = 45_000;
+const VOLC_ENDPOINT = 'https://openspeech.bytedance.com/api/v3/tts/unidirectional';
+const VOLC_RESOURCE_ID = 'seed-tts-2.0';
+const VOLC_DONE_CODE = 20000000;
+const VOLC_MESSAGES = {
+  40402003: '文本超出单次合成长度上限',
+  45000000: '音色不可用：请确认已在火山引擎控制台开通该豆包语音合成 2.0 音色，并核对音色 ID',
+  55000000: '火山引擎语音服务暂时出错，请稍后再试',
+};
+const ALIYUN_SOCKET = 'wss://dashscope.aliyuncs.com/api-ws/v1/inference';
+const ALIYUN_MODEL = 'cosyvoice-v3-flash';
+// Aliyun and Azure answer 24 kHz mono MP3, so trailing silence is appended as silent frames of that format.
+const SAMPLE_RATE = 24000;
+// One silent MPEG-2 Layer III frame (24 kHz, 32 kbps, mono): a header and zeroed side info, 576 samples = 24 ms.
+const SILENT_FRAME = Buffer.concat([Buffer.from([0xff, 0xf3, 0x44, 0xc0]), Buffer.alloc(92)]);
+const SILENT_FRAME_MS = 24;
+const AZURE_FORMAT = 'audio-24khz-48kbitrate-mono-mp3';
+
+const VOLC_VOICES = [
+  ['zh_female_vv_uranus_bigtts', 'Vivi · 通用女声'], ['zh_female_xiaohe_uranus_bigtts', '小何 · 通用女声'],
+  ['zh_male_m191_uranus_bigtts', '云舟 · 通用男声'], ['zh_male_taocheng_uranus_bigtts', '小天 · 通用男声'],
+  ['zh_male_liufei_uranus_bigtts', '刘飞 · 通用男声'], ['zh_female_sophie_uranus_bigtts', '魅力苏菲 · 女声'],
+  ['zh_female_qingxinnvsheng_uranus_bigtts', '清新女声'], ['zh_female_cancan_uranus_bigtts', '知性灿灿 · 女声'],
+  ['zh_female_zhixingnv_uranus_bigtts', '知性女声'], ['zh_female_wenroushunv_uranus_bigtts', '温柔淑女 · 女声'],
+  ['zh_female_linjianvhai_uranus_bigtts', '邻家女孩'], ['zh_female_shuangkuaisisi_uranus_bigtts', '爽快思思 · 女声'],
+  ['zh_female_gaolengyujie_uranus_bigtts', '高冷御姐 · 女声'], ['zh_female_xiaoxue_uranus_bigtts', '儿童绘本 · 女声'],
+  ['zh_male_ruyaqingnian_uranus_bigtts', '儒雅青年 · 男声'], ['zh_male_yangguangqingnian_uranus_bigtts', '阳光青年 · 男声'],
+  ['zh_male_yuanboxiaoshu_uranus_bigtts', '渊博小叔 · 男声'], ['zh_male_cixingjieshuonan_uranus_bigtts', '磁性解说 · 男声'],
+  ['zh_male_shenyeboke_uranus_bigtts', '深夜播客 · 男声'], ['zh_male_xuanyijieshuo_uranus_bigtts', '悬疑解说 · 男声'],
+  ['zh_male_baqiqingshu_uranus_bigtts', '霸气青叔 · 有声书男声'], ['zh_male_yizhipiannan_uranus_bigtts', '译制片男声'],
+  ['zh_male_jieshuoxiaoming_uranus_bigtts', '解说小明 · 男声'], ['zh_male_wennuanahu_uranus_bigtts', '温暖阿虎 · 男声'],
+];
+// System voices of cosyvoice-v3-flash that read Mandarin and support per-character timings (voice list, 2026-11-04).
+const ALIYUN_VOICES = [
+  ['longxiaochun_v3', '龙小淳 · 知性女声'], ['longanwen_v3', '龙安温 · 优雅女声'], ['longanli_v3', '龙安莉 · 利落女声'],
+  ['longyingtao_v3', '龙应桃 · 温柔女声'], ['longyuan_v3', '龙媛 · 治愈女声'], ['longyue_v3', '龙悦 · 磁性女声'],
+  ['longxing_v3', '龙星 · 邻家女声'], ['longwan_v3', '龙婉 · 细腻女声'], ['longmiao_v3', '龙妙 · 抑扬顿挫女声'],
+  ['longxiaoxia_v3', '龙小夏 · 沉稳女声'], ['longanyang', '龙安洋 · 阳光男声'], ['longanyun_v3', '龙安昀 · 暖男'],
+  ['longanlang_v3', '龙安朗 · 清爽男声'], ['longanzhi_v3', '龙安智 · 睿智男声'], ['longcheng_v3', '龙橙 · 智慧青年'],
+  ['longtian_v3', '龙天 · 磁性男声'], ['longsanshu_v3', '龙三叔 · 沉稳男声'], ['longxiu_v3', '龙修 · 说书男声'],
+  ['longshu_v3', '龙书 · 沉稳青年'], ['longnan_v3', '龙楠 · 睿智青年'],
+];
+const AZURE_VOICES = [
+  ['zh-CN-XiaoxiaoNeural', '晓晓 · 女声'], ['zh-CN-XiaoxiaoMultilingualNeural', '晓晓（多语言）· 女声'],
+  ['zh-CN-XiaochenNeural', '晓辰 · 女声'], ['zh-CN-XiaoyiNeural', '晓伊 · 女声'], ['zh-CN-XiaohanNeural', '晓涵 · 女声'],
+  ['zh-CN-XiaomoNeural', '晓墨 · 女声'], ['zh-CN-YunxiNeural', '云希 · 男声'],
+  ['zh-CN-YunjianNeural', '云健 · 男声'], ['zh-CN-YunyangNeural', '云扬 · 新闻男声'], ['zh-CN-YunfengNeural', '云枫 · 男声'],
+  ['zh-CN-YunzeNeural', '云泽 · 男声'],
+];
+const voices = (list) => list.map(([id, label]) => ({ id, label }));
+
+/**
+ * The speech services the page can choose between. `key_base_url` is the root a saved key is bound to; `context` says
+ * whether the tone instruction applies; `region` says whether the service also needs a region; `voice_input` marks the
+ * one whose key also serves voice input.
+ */
+export const TTS_PROVIDERS = [
+  { id: 'volcengine', label: '火山引擎', key_base_url: 'https://openspeech.bytedance.com', console_url: 'https://console.volcengine.com/speech/new',
+    note: '豆包语音合成 2.0，约 3 元/万字（字数包更便宜）；语音输入也用这个 Key。', voices: voices(VOLC_VOICES),
+    default_speaker: 'zh_female_vv_uranus_bigtts', context: true, region: false, voice_input: true },
+  { id: 'aliyun', label: '阿里云百炼', key_base_url: 'https://dashscope.aliyuncs.com', console_url: 'https://bailian.console.aliyun.com/?tab=model#/api-key',
+    note: 'CosyVoice v3-flash，1 元/万字符（一个汉字计 2 字符，约 2 元/万字）。', voices: voices(ALIYUN_VOICES),
+    default_speaker: 'longxiaochun_v3', context: false, region: false, voice_input: false },
+  { id: 'azure', label: 'Azure', key_base_url: 'https://tts.speech.microsoft.com', console_url: 'https://portal.azure.com/#create/Microsoft.CognitiveServicesSpeechServices',
+    note: '神经语音，免费档 F0 每月 50 万字符（一个汉字计 2 字符，约 25 万字）；付费档约 2 元/万字；高亮按时长估算。', voices: voices(AZURE_VOICES),
+    default_speaker: 'zh-CN-XiaoxiaoNeural', context: false, region: true, voice_input: false },
+];
+
+/** Trailing silence as silent MP3 frames matching Aliyun's and Azure's output. */
+function silence_frames(silence_ms) {
+  return Buffer.concat(Array(Math.round(silence_ms / SILENT_FRAME_MS)).fill(SILENT_FRAME));
+}
+
+/** Split a chunked answer made of concatenated JSON objects, newline-separated or not. */
+export function split_json_objects(text) {
+  const objects = [];
+  let depth = 0, start = -1, in_string = false, escaped = false;
+  for (let index = 0; index < text.length; index += 1) {
+    const character = text[index];
+    if (in_string) {
+      if (escaped) escaped = false;
+      else if (character === '\\') escaped = true;
+      else if (character === '"') in_string = false;
+    } else if (character === '"') in_string = true;
+    else if (character === '{') { if (depth++ === 0) start = index; }
+    else if (character === '}' && depth > 0 && --depth === 0) objects.push(JSON.parse(text.slice(start, index + 1)));
+  }
+  return objects;
+}
+
+/** Volcengine Doubao TTS 2.0: one-way chunked JSON; silence, tone and the shared section are sent as `additions`. */
+async function volc_speak({ key, text, speaker, rate, context, silence, section_id }, request) {
+  const additions = { ...(context ? { context_texts: [context] } : {}), ...(section_id ? { section_id } : {}),
+    ...(silence ? { silence_duration: silence } : {}) };
+  const body = { user: { uid: 'codiscuss' }, req_params: { text, speaker,
+    audio_params: { format: 'mp3', sample_rate: SAMPLE_RATE, speech_rate: rate, enable_subtitle: true },
+    ...(Object.keys(additions).length ? { additions: JSON.stringify(additions) } : {}) } };
+  let response;
+  try {
+    response = await request(VOLC_ENDPOINT, { method: 'POST', redirect: 'error', signal: AbortSignal.timeout(TTS_TIMEOUT_MS),
+      headers: { 'Content-Type': 'application/json', 'X-Api-Key': key, 'X-Api-Resource-Id': VOLC_RESOURCE_ID, 'X-Api-Request-Id': randomUUID() },
+      body: JSON.stringify(body) });
+  } catch { throw new Error('语音合成请求超时或连接失败，请检查网络后重试'); }
+  if (response.status === 401 || response.status === 403) throw new Error('火山引擎拒绝了请求：API Key 无效或未开通豆包语音合成 2.0');
+  const objects = split_json_objects(await response.text());
+  const chunks = [];
+  for (const item of objects) {
+    if (item.code === VOLC_DONE_CODE) {
+      const marks = objects.flatMap(part => part.sentence?.words || [])
+        .map(word => ({ w: String(word.word || ''), t: Math.round(Number(word.startTime || 0) * 1000) }));
+      return { audio: Buffer.concat(chunks).toString('base64'), format: 'mp3', marks };
+    }
+    if (item.code !== 0) throw new Error(`语音合成失败（${item.code}）：${VOLC_MESSAGES[item.code] || item.message || '请核对 API Key 与音色'}`);
+    if (item.data) chunks.push(Buffer.from(item.data, 'base64'));
+  }
+  if (!response.ok) throw new Error(`语音合成失败：火山引擎返回 HTTP ${response.status}`);
+  throw new Error('语音合成未完成：火山引擎没有返回结束标记');
+}
+
+/** Per-character timings over all sentences; each sentence's timings may restart at zero, so they are laid end to end. */
+function aliyun_marks(sentences) {
+  const marks = [];
+  let base = 0, last = 0;
+  for (const [, words] of [...sentences].sort((a, b) => a[0] - b[0])) {
+    if (Number(words[0].begin_time) + base < last) base = last;
+    for (const word of words) marks.push({ w: String(word.text || ''), t: Number(word.begin_time) + base });
+    last = Number(words.at(-1).end_time) + base;
+  }
+  return marks;
+}
+
+/** Aliyun Bailian CosyVoice over its duplex WebSocket: run-task, the text, finish-task; audio arrives as binary frames. */
+function aliyun_speak({ key, text, speaker, rate, silence }, open) {
+  return new Promise((resolve, reject) => {
+    const task_id = randomUUID();
+    const chunks = [], sentences = new Map();
+    let settled = false;
+    const socket = open(ALIYUN_SOCKET, { headers: { Authorization: `Bearer ${key}` } });
+    const finish = (error, value) => {
+      if (settled) return;
+      settled = true; clearTimeout(timer);
+      try { socket.close(); } catch { /* Already closed. */ }
+      if (error) reject(error); else resolve(value);
+    };
+    const timer = setTimeout(() => finish(new Error('语音合成请求超时，请检查网络后重试')), TTS_TIMEOUT_MS);
+    const send = (action, payload) => socket.send(JSON.stringify({ header: { action, task_id, streaming: 'duplex' }, payload }));
+    socket.binaryType = 'arraybuffer';
+    socket.onopen = () => send('run-task', { task_group: 'audio', task: 'tts', function: 'SpeechSynthesizer', model: ALIYUN_MODEL, input: {},
+      parameters: { text_type: 'PlainText', voice: speaker, format: 'mp3', sample_rate: SAMPLE_RATE, rate: 1 + rate / 100, word_timestamp_enabled: true } });
+    socket.onmessage = ({ data }) => {
+      if (typeof data !== 'string') { chunks.push(Buffer.from(data)); return; }
+      const { header = {}, payload = {} } = JSON.parse(data);
+      const sentence = payload.output?.sentence;
+      if (sentence?.words?.length) sentences.set(sentence.index, sentence.words);
+      if (header.event === 'task-started') { send('continue-task', { input: { text } }); send('finish-task', { input: {} }); }
+      else if (header.event === 'task-finished') {
+        finish(null, { audio: Buffer.concat([...chunks, silence_frames(silence)]).toString('base64'), format: 'mp3', marks: aliyun_marks(sentences) });
+      } else if (header.event === 'task-failed') finish(new Error(`语音合成失败（${header.error_code}）：${header.error_message || '请核对 API Key 与音色'}`));
+    };
+    socket.onerror = () => finish(new Error('连接阿里云百炼失败：请核对 API Key，并确认已开通 CosyVoice 语音合成'));
+    socket.onclose = () => finish(new Error('阿里云百炼提前断开了连接，请稍后再试'));
+  });
+}
+
+/** Escape text for SSML. */
+const xml = (text) => text.replace(/[&<>"']/g, (character) => `&#${character.charCodeAt(0)};`);
+
+/** Azure neural voices over REST with SSML; the REST answer carries no word timings. */
+async function azure_speak({ key, region, text, speaker, rate, silence }, request) {
+  if (!region) throw new Error('尚未填写 Azure 区域：请在设置的“语音”中填写语音资源所在区域');
+  const ssml = `<speak version="1.0" xml:lang="zh-CN"><voice name="${xml(speaker)}"><prosody rate="${rate >= 0 ? '+' : ''}${rate}%">${xml(text)}</prosody></voice></speak>`;
+  let response;
+  try {
+    response = await request(`https://${region}.tts.speech.microsoft.com/cognitiveservices/v1`, { method: 'POST', redirect: 'error',
+      signal: AbortSignal.timeout(TTS_TIMEOUT_MS), headers: { 'Ocp-Apim-Subscription-Key': key, 'Content-Type': 'application/ssml+xml',
+        'X-Microsoft-OutputFormat': AZURE_FORMAT, 'User-Agent': 'codiscuss' }, body: ssml });
+  } catch { throw new Error('语音合成请求超时或连接失败，请检查网络与 Azure 区域后重试'); }
+  if (response.status === 401 || response.status === 403) throw new Error('Azure 拒绝了请求：请核对 API Key 与区域是否属于同一个语音资源');
+  if (response.status === 429) throw new Error('Azure 请求过于频繁（免费档每分钟 20 次），请稍后再试');
+  if (!response.ok) throw new Error(`语音合成失败：Azure 返回 HTTP ${response.status}，请核对音色名称`);
+  const audio = Buffer.from(await response.arrayBuffer());
+  return { audio: Buffer.concat([audio, silence_frames(silence)]).toString('base64'), format: 'mp3', marks: [] };
+}
+
+const SPEAKERS = { volcengine: volc_speak, aliyun: aliyun_speak, azure: azure_speak };
+
+/**
+ * Synthesize one paragraph with one provider.
+ * @param {string} provider One of TTS_PROVIDERS' ids.
+ * @param {{ key: string, text: string, speaker: string, rate: number, context?: string, silence: number, section_id?: string, region?: string }} input
+ *   `rate` is -50..100 (percent faster), `silence` the trailing silence in ms.
+ * @param {{ request?: Function, open?: Function }} [transport] `fetch` and WebSocket factory, replaceable in tests.
+ * @returns {Promise<{ audio: string, format: string, marks: { w: string, t: number }[] }>}
+ */
+export function provider_speak(provider, input, { request = fetch, open = (url, init) => new WebSocket(url, init) } = {}) {
+  return SPEAKERS[provider](input, provider === 'aliyun' ? open : request);
+}

package/runner/webauthn.mjs

@@ -0,0 +1,155 @@
+/**
+ * Passkey (WebAuthn) checks for this computer, with Node's built-in WebCrypto only: registration yields the credential's
+ * public key, and an assertion proves the user verified on the device. Only ES256 and RS256 keys are accepted, and
+ * attestation is not checked (attestation "none" is requested). backend/worker.mjs carries the same checks for login.
+ */
+import { createHash } from 'node:crypto';
+
+const FLAG_USER_PRESENT = 0x01;
+const FLAG_USER_VERIFIED = 0x04;
+const FLAG_ATTESTED_DATA = 0x40;
+const ES256 = -7;
+const RS256 = -257;
+
+export const b64url = bytes => Buffer.from(bytes).toString('base64url');
+export const from_b64url = text => new Uint8Array(Buffer.from(String(text || ''), 'base64url'));
+const sha256 = bytes => new Uint8Array(createHash('sha256').update(bytes).digest());
+
+/** Decode one CBOR item at `offset`; supports the subset WebAuthn uses (ints, bytes, text, arrays, maps, simple values). */
+function cbor_item(bytes, offset) {
+  const head = bytes[offset];
+  if (head === undefined) throw new Error('CBOR 数据不完整');
+  const major = head >> 5, info = head & 31;
+  let length, next = offset + 1;
+  if (info < 24) length = info;
+  else if (info === 24) { length = bytes[next]; next += 1; }
+  else if (info === 25) { length = (bytes[next] << 8) | bytes[next + 1]; next += 2; }
+  else if (info === 26) { length = ((bytes[next] << 24) >>> 0) + (bytes[next + 1] << 16) + (bytes[next + 2] << 8) + bytes[next + 3]; next += 4; }
+  else throw new Error('不支持的 CBOR 长度');
+  if (major === 0) return [length, next];
+  if (major === 1) return [-1 - length, next];
+  if (major === 2 || major === 3) {
+    if (next + length > bytes.length) throw new Error('CBOR 数据不完整');
+    const chunk = bytes.subarray(next, next + length);
+    return [major === 2 ? chunk : new TextDecoder().decode(chunk), next + length];
+  }
+  if (major === 4) {
+    const items = [];
+    for (let index = 0; index < length; index++) { const [item, after] = cbor_item(bytes, next); items.push(item); next = after; }
+    return [items, next];
+  }
+  if (major === 5) {
+    const map = new Map();
+    for (let index = 0; index < length; index++) {
+      const [key, after_key] = cbor_item(bytes, next);
+      const [value, after_value] = cbor_item(bytes, after_key);
+      map.set(key, value);
+      next = after_value;
+    }
+    return [map, next];
+  }
+  if (major === 7 && [20, 21, 22].includes(info)) return [info === 21 ? true : info === 20 ? false : null, next];
+  throw new Error('不支持的 CBOR 类型');
+}
+
+/** Decode a whole CBOR value; returns [value, bytes used]. */
+export function decode_cbor(bytes) {
+  return cbor_item(bytes, 0);
+}
+
+/** Turn a COSE public key into a JWK and its WebCrypto algorithm; anything but ES256 or RS256 is refused. */
+function cose_to_jwk(cose) {
+  const alg = cose.get(3);
+  if (alg === ES256 && cose.get(1) === 2 && cose.get(-1) === 1) {
+    return { alg, jwk: { kty: 'EC', crv: 'P-256', x: b64url(cose.get(-2)), y: b64url(cose.get(-3)) } };
+  }
+  if (alg === RS256 && cose.get(1) === 3) return { alg, jwk: { kty: 'RSA', n: b64url(cose.get(-1)), e: b64url(cose.get(-2)), alg: 'RS256' } };
+  throw new Error('通行密钥的算法不受支持，只接受 ES256 或 RS256');
+}
+
+/** Split authenticator data into its fields; the attested credential is present only on registration. */
+function parse_auth_data(bytes) {
+  if (bytes.length < 37) throw new Error('通行密钥数据不完整');
+  const result = { rp_id_hash: bytes.subarray(0, 32), flags: bytes[32], sign_count: new DataView(bytes.buffer, bytes.byteOffset + 33, 4).getUint32(0) };
+  if (result.flags & FLAG_ATTESTED_DATA) {
+    const id_length = (bytes[53] << 8) | bytes[54];
+    result.credential_id = bytes.subarray(55, 55 + id_length);
+    [result.cose] = decode_cbor(bytes.subarray(55 + id_length));
+  }
+  return result;
+}
+
+/** Check the browser's client data: ceremony type, exact challenge and exact origin. */
+function check_client_data(client_data_json, { type, challenge, origin }) {
+  let data;
+  try { data = JSON.parse(new TextDecoder().decode(client_data_json)); } catch { throw new Error('通行密钥数据无效'); }
+  if (data.type !== type) throw new Error('通行密钥操作类型不符');
+  if (data.challenge !== challenge) throw new Error('通行密钥挑战不符或已过期');
+  if (data.origin !== origin) throw new Error('通行密钥来自其他网站');
+}
+
+/** Check the relying party and that the user was present and verified (fingerprint, face or device PIN). */
+function check_auth_data(auth, rp_id) {
+  if (Buffer.compare(Buffer.from(auth.rp_id_hash), Buffer.from(sha256(new TextEncoder().encode(rp_id)))) !== 0) throw new Error('通行密钥不属于这个网站');
+  if (!(auth.flags & FLAG_USER_PRESENT) || !(auth.flags & FLAG_USER_VERIFIED)) throw new Error('需要在设备上验证身份（指纹、面容或设备密码）');
+}
+
+/**
+ * Verify a new passkey from navigator.credentials.create(); `challenge` is the base64url challenge the browser signed.
+ * Returns { id, public_key, alg, sign_count } to keep.
+ */
+export function verify_registration({ client_data_json, attestation_object }, { challenge, origin, rp_id }) {
+  const client_data = from_b64url(client_data_json);
+  check_client_data(client_data, { type: 'webauthn.create', challenge, origin });
+  const [attestation] = decode_cbor(from_b64url(attestation_object));
+  if (!(attestation instanceof Map) || !(attestation.get('authData') instanceof Uint8Array)) throw new Error('通行密钥数据无效');
+  const auth = parse_auth_data(attestation.get('authData'));
+  check_auth_data(auth, rp_id);
+  if (!auth.credential_id || !auth.cose) throw new Error('通行密钥数据缺少公钥');
+  const { alg, jwk } = cose_to_jwk(auth.cose);
+  return { id: b64url(auth.credential_id), public_key: jwk, alg, sign_count: auth.sign_count };
+}
+
+/** Convert a DER ECDSA signature into the raw r‖s form WebCrypto verifies. */
+function der_to_raw(der) {
+  if (der[0] !== 0x30) throw new Error('通行密钥签名格式无效');
+  let offset = 2;
+  const part = () => {
+    if (der[offset] !== 0x02) throw new Error('通行密钥签名格式无效');
+    const length = der[offset + 1];
+    let value = der.subarray(offset + 2, offset + 2 + length);
+    offset += 2 + length;
+    while (value.length > 32 && value[0] === 0) value = value.subarray(1);
+    if (value.length > 32) throw new Error('通行密钥签名格式无效');
+    const padded = new Uint8Array(32);
+    padded.set(value, 32 - value.length);
+    return padded;
+  };
+  const r = part(), s = part();
+  return Uint8Array.from([...r, ...s]);
+}
+
+/**
+ * Verify an assertion from navigator.credentials.get() against a kept passkey. Returns the new signature counter;
+ * a counter that did not grow (when either side is non-zero) suggests a cloned authenticator and is refused.
+ */
+export async function verify_assertion({ client_data_json, authenticator_data, signature }, passkey, { challenge, origin, rp_id }) {
+  const client_data = from_b64url(client_data_json), auth_bytes = from_b64url(authenticator_data);
+  check_client_data(client_data, { type: 'webauthn.get', challenge, origin });
+  const auth = parse_auth_data(auth_bytes);
+  check_auth_data(auth, rp_id);
+  const signed = Uint8Array.from([...auth_bytes, ...sha256(client_data)]);
+  const es256 = passkey.alg === ES256;
+  const algorithm = es256 ? { name: 'ECDSA', namedCurve: 'P-256' } : { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' };
+  const key = await crypto.subtle.importKey('jwk', passkey.public_key, algorithm, false, ['verify']);
+  const raw = from_b64url(signature);
+  const valid = await crypto.subtle.verify(es256 ? { name: 'ECDSA', hash: 'SHA-256' } : algorithm, key, es256 ? der_to_raw(raw) : raw, signed);
+  if (!valid) throw new Error('通行密钥签名无效');
+  if ((auth.sign_count || passkey.sign_count) && auth.sign_count <= passkey.sign_count) throw new Error('通行密钥计数异常，可能被复制，请撤销后重新配对');
+  return auth.sign_count;
+}
+
+/** The challenge a browser signs when one ceremony must satisfy two parties: SHA-256 of both random challenges. */
+export function joint_challenge(first, second) {
+  return b64url(sha256(Uint8Array.from([...from_b64url(first), ...from_b64url(second)])));
+}