dsh-voice 0.4.3 → 0.5.1

package/CHANGELOG.md

@@ -4,6 +4,19 @@
 
 [历史英文记录](docs/CHANGELOG.en.md)
 
+## 0.5.1 (2026-10-29)
+
+- 同步仓库与 npm 的简明介绍、中英文 README 和反馈入口；本次为文档与包元数据更新。
+- Sync npm descriptions and both README guides with the repository, including issue and pull-request links.
+
+## 0.5.0 (2026-10-28)
+
+- 跟进 edge-tts 7.3.1 的 v2 令牌与 Cookie 协议，恢复真实 Edge 在线语音；独立模块保留上游 LGPLv3 许可与源码，主体仍为 MIT。
+
+- ASR 不再跟随重定向上传音频；请将 asrBaseUrl 直接设为可信的最终接口。直连和插件代理均适用。
+- 修复同名音频并发生成时的覆盖问题，转写和试听也返回实际保存的独立文件名。
+- 显式覆盖只允许没有硬链接的普通文件，保留工作区和链接边界检查。
+
 ## 0.4.3 (2026-10-27)
 
 - 修复分批更新时的新旧更新控件混用：保留原页面、草稿与安装保护，空闲后接管旧控制器，兼容旧入口。

package/LICENSES/edge-tts-LGPLv3.txt

@@ -0,0 +1,195 @@
+The MIT license is used for 'src/edge_tts/srt_composer.py' only. All
+remaining files are licensed under the LGPLv3.
+
+-----------------------------------------------------------------------
+
+The MIT License
+
+Copyright (c) 2014-2023 Christopher Down
+Copyright (c) 2025- rany <rany@riseup.net>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+-----------------------------------------------------------------------
+
+                   GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+
+  This version of the GNU Lesser General Public License incorporates
+the terms and conditions of version 3 of the GNU General Public
+License, supplemented by the additional permissions listed below.
+
+  0. Additional Definitions.
+
+  As used herein, "this License" refers to version 3 of the GNU Lesser
+General Public License, and the "GNU GPL" refers to version 3 of the GNU
+General Public License.
+
+  "The Library" refers to a covered work governed by this License,
+other than an Application or a Combined Work as defined below.
+
+  An "Application" is any work that makes use of an interface provided
+by the Library, but which is not otherwise based on the Library.
+Defining a subclass of a class defined by the Library is deemed a mode
+of using an interface provided by the Library.
+
+  A "Combined Work" is a work produced by combining or linking an
+Application with the Library.  The particular version of the Library
+with which the Combined Work was made is also called the "Linked
+Version".
+
+  The "Minimal Corresponding Source" for a Combined Work means the
+Corresponding Source for the Combined Work, excluding any source code
+for portions of the Combined Work that, considered in isolation, are
+based on the Application, and not on the Linked Version.
+
+  The "Corresponding Application Code" for a Combined Work means the
+object code and/or source code for the Application, including any data
+and utility programs needed for reproducing the Combined Work from the
+Application, but excluding the System Libraries of the Combined Work.
+
+  1. Exception to Section 3 of the GNU GPL.
+
+  You may convey a covered work under sections 3 and 4 of this License
+without being bound by section 3 of the GNU GPL.
+
+  2. Conveying Modified Versions.
+
+  If you modify a copy of the Library, and, in your modifications, a
+facility refers to a function or data to be supplied by an Application
+that uses the facility (other than as an argument passed when the
+facility is invoked), then you may convey a copy of the modified
+version:
+
+   a) under this License, provided that you make a good faith effort to
+   ensure that, in the event an Application does not supply the
+   function or data, the facility still operates, and performs
+   whatever part of its purpose remains meaningful, or
+
+   b) under the GNU GPL, with none of the additional permissions of
+   this License applicable to that copy.
+
+  3. Object Code Incorporating Material from Library Header Files.
+
+  The object code form of an Application may incorporate material from
+a header file that is part of the Library.  You may convey such object
+code under terms of your choice, provided that, if the incorporated
+material is not limited to numerical parameters, data structure
+layouts and accessors, or small macros, inline functions and templates
+(ten or fewer lines in length), you do both of the following:
+
+   a) Give prominent notice with each copy of the object code that the
+   Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the object code with a copy of the GNU GPL and this license
+   document.
+
+  4. Combined Works.
+
+  You may convey a Combined Work under terms of your choice that,
+taken together, effectively do not restrict modification of the
+portions of the Library contained in the Combined Work and reverse
+engineering for debugging such modifications, if you also do each of
+the following:
+
+   a) Give prominent notice with each copy of the Combined Work that
+   the Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the Combined Work with a copy of the GNU GPL and this license
+   document.
+
+   c) For a Combined Work that displays copyright notices during
+   execution, include the copyright notice for the Library among
+   these notices, as well as a reference directing the user to the
+   copies of the GNU GPL and this license document.
+
+   d) Do one of the following:
+
+       0) Convey the Minimal Corresponding Source under the terms of this
+       License, and the Corresponding Application Code in a form
+       suitable for, and under terms that permit, the user to
+       recombine or relink the Application with a modified version of
+       the Linked Version to produce a modified Combined Work, in the
+       manner specified by section 6 of the GNU GPL for conveying
+       Corresponding Source.
+
+       1) Use a suitable shared library mechanism for linking with the
+       Library.  A suitable mechanism is one that (a) uses at run time
+       a copy of the Library already present on the user's computer
+       system, and (b) will operate properly with a modified version
+       of the Library that is interface-compatible with the Linked
+       Version.
+
+   e) Provide Installation Information, but only if you would otherwise
+   be required to provide such information under section 6 of the
+   GNU GPL, and only to the extent that such information is
+   necessary to install and execute a modified version of the
+   Combined Work produced by recombining or relinking the
+   Application with a modified version of the Linked Version. (If
+   you use option 4d0, the Installation Information must accompany
+   the Minimal Corresponding Source and Corresponding Application
+   Code. If you use option 4d1, you must provide the Installation
+   Information in the manner specified by section 6 of the GNU GPL
+   for conveying Corresponding Source.)
+
+  5. Combined Libraries.
+
+  You may place library facilities that are a work based on the
+Library side by side in a single library together with other library
+facilities that are not Applications and are not covered by this
+License, and convey such a combined library under terms of your
+choice, if you do both of the following:
+
+   a) Accompany the combined library with a copy of the same work based
+   on the Library, uncombined with any other library facilities,
+   conveyed under the terms of this License.
+
+   b) Give prominent notice with the combined library that part of it
+   is a work based on the Library, and explaining where to find the
+   accompanying uncombined form of the same work.
+
+  6. Revised Versions of the GNU Lesser General Public License.
+
+  The Free Software Foundation may publish revised and/or new versions
+of the GNU Lesser General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+  Each version is given a distinguishing version number. If the
+Library as you received it specifies that a certain numbered version
+of the GNU Lesser General Public License "or any later version"
+applies to it, you have the option of following the terms and
+conditions either of that published version or of any later version
+published by the Free Software Foundation. If the Library as you
+received it does not specify a version number of the GNU Lesser
+General Public License, you may choose any version of the GNU Lesser
+General Public License ever published by the Free Software Foundation.
+
+  If the Library as you received it specifies that a proxy can decide
+whether future versions of the GNU Lesser General Public License shall
+apply, that proxy's public statement of acceptance of any version is
+permanent authorization for you to choose that version for the
+Library.

package/README.en.md

@@ -4,7 +4,7 @@
 
 ![dsh-voice whale girl plugin cover](https://raw.githubusercontent.com/STARDUSTLC666/dsh-voice/master/assets/cover-whale-girl.png)
 
-Generate speech from text or transcribe audio through a compatible API.
+Generate speech or transcribe workspace recordings from DSH. Supports Edge TTS and OpenAI, Groq or custom compatible ASR; transcription uses your configured endpoint and output files avoid overwriting by default.
 
 [![npm](https://img.shields.io/npm/v/dsh-voice)](https://www.npmjs.com/package/dsh-voice) [![downloads](https://raw.githubusercontent.com/STARDUSTLC666/dsh-suite/npm-downloads/assets/dsh-voice-downloads.svg)](https://www.npmjs.com/package/dsh-voice)
 
@@ -51,4 +51,4 @@ Older releases need one manual update in native plugin management to acquire the
 
 ## License
 
-[MIT](LICENSE)
+Original code: [MIT](LICENSE). The separate Edge v2 token module is LGPLv3; its source and license are included. See [third-party notices](THIRD_PARTY_NOTICES.md).

package/README.md

@@ -4,7 +4,7 @@
 
 ![dsh-voice 鲸鱼娘插件封面](https://raw.githubusercontent.com/STARDUSTLC666/dsh-voice/master/assets/cover-whale-girl.png)
 
-把文字生成语音，或通过兼容接口把音频转为文字。
+在 DSH 中把文字合成为语音，或将工作区录音转为文字。支持 Edge TTS 和 OpenAI / Groq / 自建兼容 ASR；转写使用你配置的地址，输出文件默认避免覆盖。
 
 [![npm](https://img.shields.io/npm/v/dsh-voice)](https://www.npmjs.com/package/dsh-voice) [![downloads](https://raw.githubusercontent.com/STARDUSTLC666/dsh-suite/npm-downloads/assets/dsh-voice-downloads.svg)](https://www.npmjs.com/package/dsh-voice)
 
@@ -51,4 +51,4 @@ dsh plugin --profile desktop add dsh-voice
 
 ## License
 
-[MIT](LICENSE)
+主体采用 [MIT](LICENSE)；独立的 Edge v2 令牌模块采用上游 LGPLv3，源码与许可随包提供，见[第三方声明](THIRD_PARTY_NOTICES.md)。

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,12 @@
+# Third-party notices
+
+`src/edge-drm-v2.ts` and its compiled module are adapted from
+[rany2/edge-tts 7.3.1](https://github.com/rany2/edge-tts/tree/7.3.1),
+`src/edge_tts/drm.py` (blob `707dc7724b63242624b9b62175556fa1fdcb7fad`),
+copyright rany and contributors, licensed under LGPLv3.
+The adaptation replaces the Python digest implementation with a separate
+TypeScript module, retaining the protocol constants and calculations.
+Its source and the upstream license are included in the npm package, under
+`src/edge-drm-v2.ts` and `LICENSES/edge-tts-LGPLv3.txt`.
+You may modify and replace this module under LGPLv3; no replacement lock is used.
+The remaining original dsh-voice code remains under the repository's MIT license.

package/docs/USAGE.en.md

@@ -4,6 +4,8 @@
 
 ## Current improvements
 
+ASR stops on redirects instead of forwarding audio to another endpoint, including through the plugin proxy. Set `asrBaseUrl` to the trusted final API address. With `overwrite=false`, concurrent outputs are saved separately and tools return the actual saved path. Explicit overwrite requires a regular file with no hard links.
+
 Check the ASR endpoint, key and response format after a failure. Blank results are not saved as successful transcripts. Verify TTS and ASR service availability separately.
 
 ## Installation
@@ -58,7 +60,7 @@ voice_health {}                                              # self-check TTS /
 
 ## Implementation and file limits
 
-- **Direct edge-tts protocol**: the Sec-MS-GEC token is **generated locally** with the official DRM algorithm (SHA256 of Windows file time + trusted client token, 5-minute windows); transport uses the `ws` library with permessage-deflate and an optional HTTP CONNECT proxy tunnel
+- **Direct edge-tts protocol**: follows open-source edge-tts 7.3.1 Sec-MS-GEC v2, generating tokens locally in five-minute windows. Uses `ws` and optional HTTP CONNECT. This is not a Microsoft SDK, and the service protocol may change.
 - **API configuration**: TTS needs no separate API key. STT uses your configured ASR service, whose pricing and limits apply.
 - Up-front validation: text ≤ 5000 chars, audio ≤ 25MB (re-checked against the bytes actually read); same-name outputs auto-suffixed
 - **Reads and writes stay inside the session workspace**: `audio`, `output` and `outputDir` must resolve (symlinks included) under `session.header.cwd`; anything outside is rejected. Copy the file in first.
@@ -77,4 +79,4 @@ pnpm test:integration  # opt-in real edge-tts request; network and assertion err
 
 ## License
 
-MIT
+Original code MIT; separate Edge v2 token module LGPLv3. See [third-party notices](../THIRD_PARTY_NOTICES.md).

package/docs/USAGE.md

@@ -58,13 +58,15 @@ voice_health {}                                          # 自检 TTS / ASR /
 
 ## 实现与文件限制
 
-- **edge-tts 协议直连**：Sec-MS-GEC 令牌按官方 DRM 算法**本地生成**（SHA256(Windows 文件时间 + TrustedClientToken)，5 分钟窗口），WS 传输用 `ws` 库 + permessage-deflate 压缩 + 可选 HTTP CONNECT 代理隧道
+- **edge-tts 协议直连**：对齐开源 edge-tts 7.3.1 的 Sec-MS-GEC v2 协议，令牌在本地按 5 分钟窗口生成；WS 使用 `ws` 库与可选 HTTP CONNECT 代理。不是微软官方 SDK，服务协议仍可能变更。
 - **接口配置**：TTS 无需另填 API Key；STT 使用你配置的 ASR 服务，其计费与额度由该服务决定。
 - 文本 ≤5000 字符、音频 ≤25MB 前置校验（读入后再按实际字节数复查一次）；输出同名自动加序号
 - **读写都在会话工作区内**：`audio` 与 `output` / `outputDir` 解析后（含符号链接）必须落在 `session.header.cwd` 之下，越界直接报错。想转写工作区外的录音，先复制进来；输出同理
 - **不跟随符号链接写文件**：目标是符号链接（含悬空链接）时拒绝写入，新建文件用 `O_EXCL`，避免检查完再被换成链接
 - **转写文本 0600**：`voice_stt` 写出的 `.txt` 只给当前用户读写（Windows 不检查权限位）
 - **密钥只发给配置的地址**：ASR 请求地址一律取配置 `asrBaseUrl`（groq/openai 的预设只是缺省值），模型传的 `engine` 与配置不一致会直接报错，避免把密钥发到另一家的主机
+- **重定向需要用户确认地址**：接口返回 3xx 时停止，不向跳转地址发送音频。请检查服务文档，把 `asrBaseUrl` 设为可信的最终接口；这也适用于配置了插件代理的请求。
+- **并发生成不覆盖**：`overwrite=false` 时即使两个任务同时写同名文件，或合成期间出现用户同名文件，也会另存并返回实际文件名。显式覆盖只接受没有硬链接的普通文件。
 - Edge TTS 协议适配保留在插件实现中，不使用旧令牌端点。
 
 ## 开发
@@ -77,4 +79,4 @@ pnpm test:integration  # 显式联网，调用真实 edge-tts；网络或断言
 
 ## License
 
-MIT
+主体 MIT；独立的 Edge v2 令牌模块 LGPLv3，见[第三方声明](../THIRD_PARTY_NOTICES.md)。

package/docs/VALIDATION.md

@@ -1,5 +1,9 @@
 # dsh-voice 验证记录
 
+## 2026-10-28：0.5.0
+
+[本次修复与验收边界](validation-0.5.0.md)。
+
 本页整理原 README 的历史验证说明，保留当时的版本、日期与范围。自动测试、启动检查、浏览器操作和真实服务验收分别记录，不能相互替代。更详细的版本验收文件仍保留在仓库中。
 
 ## 原中文记录

package/docs/validation-0.5.0.md

@@ -0,0 +1,11 @@
+# 0.5.0 验证记录（2026-10-28）
+
+Windows 回归 74 项：72 通过、2 跳过（文件符号链接权限、POSIX 0600 位）。硬链接、目录 junction、并发合成/转写/试听均另有真实 Windows 文件系统用例。
+
+官方 DSH 0.2.1-rc.4 隔离 profile 实际注册工具并生成两段在线 Edge MP3，同名输出各自保留；旧 v1 协议连接失败，更新后真实合成通过。v2 计算同时匹配固定的 upstream Python 7.3.1 参考向量 44 组。不是仅用模拟音频验收。
+
+ASR 使用本机 HTTP 服务与真实 multipart 请求验证：引擎错配在联网前拒绝、工作区外文件拒绝、307 不转发音频；301/302/303/307/308 同时覆盖直连与真实 HTTP 代理。模拟 ASR 返回不代表真实商业转写服务通过。
+
+官方 Web 浏览器实际选择工作区、打开会话轨迹并查看转写结果与插件列表；窄屏无水平溢出。未操作用户桌面窗口，未验证 Electron 原生窗口或真实 ASR 账号。
+
+Edge v2 模块单独保留上游 LGPLv3 许可与可替换源码，其他原代码仍为 MIT，见 THIRD_PARTY_NOTICES.md。在线服务后续仍可能变更。

package/lib/edge-drm-v2.d.ts

@@ -0,0 +1,8 @@
+/**
+ * SPDX-License-Identifier: LGPL-3.0-only
+ * Adapted from rany2/edge-tts 7.3.1 src/edge_tts/drm.py (rany and contributors).
+ * https://github.com/rany2/edge-tts/blob/7.3.1/src/edge_tts/drm.py
+ * TypeScript adaptation, 2026 STARDUSTLC666. See LICENSES/edge-tts-LGPLv3.txt.
+ * Kept as a separate, replaceable module; the rest of dsh-voice remains MIT.
+ */
+export declare function edgeTokenV2(data: string): string;

package/lib/edge-drm-v2.js

@@ -0,0 +1,122 @@
+/**
+ * SPDX-License-Identifier: LGPL-3.0-only
+ * Adapted from rany2/edge-tts 7.3.1 src/edge_tts/drm.py (rany and contributors).
+ * https://github.com/rany2/edge-tts/blob/7.3.1/src/edge_tts/drm.py
+ * TypeScript adaptation, 2026 STARDUSTLC666. See LICENSES/edge-tts-LGPLv3.txt.
+ * Kept as a separate, replaceable module; the rest of dsh-voice remains MIT.
+ */
+const INITIAL = [0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A, 0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19];
+const STATE = [0xFD9FBEA2, 0x91243CE7, 0xBE499094, 0xCD2E1E0A, 0x6C006F49, 0x04BD35AB, 0xFEB0A7E4, 0x03EFFBD2];
+const SCHEDULE = [0xEB24BF9E, 0x1558691F, 0xA0C09EE2, 0x0CFA32BA, 0xA622EE8C, 0xD1DD9491, 0xC0DD25A0, 0xF9E70AB6, 0xF0C31573, 0x7058CE4E, 0x7188E606, 0x00E5AB33, 0xD258B060, 0x72766564];
+const K = [
+    0x428A2F98, 0x71374491, 0xB5C0FBCF, 0xE9B5DBA5, 0x3956C25B, 0x59F111F1, 0x923F82A4, 0xAB1C5ED5,
+    0xD807AA98, 0x12835B01, 0x243185BE, 0x550C7DC3, 0x72BE5D74, 0x80DEB1FE, 0x9BDC06A7, 0xC19BF174,
+    0xE49B69C1, 0xEFBE4786, 0x0FC19DC6, 0x240CA1CC, 0x2DE92C6F, 0x4A7484AA, 0x5CB0A9DC, 0x76F988DA,
+    0x983E5152, 0xA831C66D, 0xB00327C8, 0xBF597FC7, 0xC6E00BF3, 0xD5A79147, 0x06CA6351, 0x14292967,
+    0x27B70A85, 0x2E1B2138, 0x4D2C6DFC, 0x53380D13, 0x650A7354, 0x766A0ABB, 0x81C2C92E, 0x92722C85,
+    0xA2BFE8A1, 0xA81A664B, 0xC24B8B70, 0xC76C51A3, 0xD192E819, 0xD6990624, 0xF40E3585, 0x106AA070,
+    0x19A4C116, 0x1E376C08, 0x2748774C, 0x34B0BCB5, 0x391C0CB3, 0x4ED8AA4A, 0x5B9CCA4F, 0x682E6FF3,
+    0x748F82EE, 0x78A5636F, 0x84C87814, 0x8CC70208, 0x90BEFFFA, 0xA4506CEB, 0xBEF9A3F7, 0xC67178F2,
+];
+const COEFFICIENTS = [
+    [0xE82E91B1, 0xB32700D0], [0x44DE24C6, 0x88DFF51D], [0x3BEB65BC, 0x29514038], [0xC89C5933, 0xB328CBDF],
+    [0x8D1EC211, 0xD405B4D5], [0x314EF5D5, 0x26E55F3C], [0xE92491B1, 0x607801C6], [0xF0A5B9D5, 0x82B2C1FB],
+    [0x06064CF3, 0xFA51A3DA], [0xDA79FA60, 0x207CC464], [0xBED20560, 0x3C3C74F3], [0x89F9C9F8, 0xD2D14B61],
+    [0x35FA38C6, 0xBB04A2C1], [0xCB49E3C6, 0xC5626167],
+];
+const rol16 = (x) => ((x << 16) | (x >>> 16)) >>> 0;
+const rotr = (x, n) => (x >>> n) | (x << (32 - n));
+const sigma0 = (x) => (rotr(x, 7) ^ rotr(x, 18) ^ (x >>> 3)) >>> 0;
+const sigma1 = (x) => (rotr(x, 17) ^ rotr(x, 19) ^ (x >>> 10)) >>> 0;
+const mul = (x, y) => Math.imul(x, y) >>> 0;
+function expand(words, first = 16) {
+    for (let i = first; i < 64; i++)
+        words.push((sigma1(words[i - 2]) + words[i - 7] + sigma0(words[i - 15]) + words[i - 16]) >>> 0);
+}
+function rounds(state, words, first = 0) {
+    let [a, b, c, d, e, f, g, h] = state;
+    for (let i = first; i < 64; i++) {
+        const constant = first === 14 && i === 14 ? 0xC9DC06A7 : K[i];
+        const t1 = (h + ((rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) >>> 0) + ((g ^ (e & (f ^ g))) >>> 0) + constant + words[i]) >>> 0;
+        const t2 = (((rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) >>> 0) + (((a & b) | (c & (a | b))) >>> 0)) >>> 0;
+        [a, b, c, d, e, f, g, h] = [(t1 + t2) >>> 0, a, b, c, (d + t1) >>> 0, e, f, g];
+    }
+    return [a, b, c, d, e, f, g, h];
+}
+function tokenDigest(data) {
+    const words = new Array(14).fill(0);
+    words.push(data.readUIntBE(0, 3), data.readUInt32BE(3));
+    for (let i = 16; i < 30; i++) {
+        let value = SCHEDULE[i - 16];
+        if (i - 2 >= 14)
+            value += (sigma1(words[i - 2]) ^ (i === 16 ? 0x000B92C0 : 0)) >>> 0;
+        if (i - 7 >= 14)
+            value += words[i - 7];
+        if (i - 15 >= 14)
+            value += (sigma0(words[i - 15]) ^ (i === 29 ? 0x059C0B80 : 0)) >>> 0;
+        words.push(value >>> 0);
+    }
+    words.push((sigma1(words[28]) + words[23] + sigma0(words[15]) + words[14] + 0xC9DC06A7 - K[14]) >>> 0);
+    expand(words, 31);
+    let state = rounds(STATE, words, 14).map((x, i) => (x + INITIAL[i]) >>> 0);
+    const length = 57 + data.length, padding = ((55 - length) % 64 + 64) % 64;
+    const tail = Buffer.concat([data.subarray(7), Buffer.from([0x80]), Buffer.alloc(padding + 8)]);
+    tail.writeBigUInt64BE(BigInt(length) * 8n, tail.length - 8);
+    for (let offset = 0; offset < tail.length; offset += 64) {
+        const block = Array.from({ length: 16 }, (_, i) => tail.readUInt32BE(offset + 4 * i));
+        expand(block);
+        state = rounds(state, block).map((x, i) => (x + state[i]) >>> 0);
+    }
+    const out = Buffer.alloc(32);
+    state.forEach((x, i) => out.writeUInt32BE(x, 4 * i));
+    return out;
+}
+function cs64(data, digest) {
+    const keyA = (digest.readUInt32LE(0) | 1) >>> 0, keyB = (digest.readUInt32LE(4) | 1) >>> 0;
+    const factors = [mul(keyA, 0x82893933), mul(keyB, 0x82893933)];
+    const terms = COEFFICIENTS.map(([coefficient], i) => mul(coefficient, factors[i % 2])), offsets = COEFFICIENTS.map(([, offset]) => offset);
+    const padded = Buffer.alloc(Math.ceil((data.length + 1) / 8) * 8);
+    data.copy(padded, 1);
+    for (let i = 0; i < padded.length / 4; i++) {
+        const word = padded.readUInt32LE(4 * i);
+        let term = mul(word, i % 2 === 0 ? keyA : keyB), offset = mul(rol16(word), i % 2 === 0 ? 0xEF0569FB : 0xC31713DB);
+        if (i === 0) {
+            term = (term + mul(0xF2F90B1A, factors[0])) >>> 0;
+            offset = (offset + 0x0B1A0000) >>> 0;
+        }
+        terms.push(term);
+        offsets.push(offset);
+    }
+    let swapAcc = 0, swapLast = 0, state = 0, acc = 0;
+    for (let i = 0; i < terms.length; i += 2) {
+        const x = terms[i], y = terms[i + 1];
+        let t = rol16((offsets[i] + x) >>> 0), q = mul(t, 0x76F50F34);
+        swapAcc += (mul(rol16(q), 0xC3EFEA97) + q) >>> 0;
+        t = rol16((offsets[i + 1] + y) >>> 0);
+        q = mul(t, 0x1881CE3C);
+        swapLast = (mul(rol16(q), 0x35BD1EC9) + q) >>> 0;
+        swapAcc = (swapAcc + swapLast) >>> 0;
+        state = (mul(state, keyA) + x) >>> 0;
+        for (const factor of [0xCF98B111, 0x87085B9F, 0x12CEB96D, 0x257E1D83])
+            state = mul(rol16(state), factor);
+        acc += state;
+        t = (mul(state, keyB) + y) >>> 0;
+        for (const factor of [0xA27416F5, 0xD38396FF])
+            t = mul(rol16(t), factor);
+        state = mul(rol16(mul(rol16(t), 0x7C932B89)), 0xBFA49F69);
+        acc = (acc + state) >>> 0;
+    }
+    const out = Buffer.alloc(8);
+    out.writeUInt32LE((swapLast ^ state) >>> 0);
+    out.writeUInt32LE((swapAcc ^ acc) >>> 0, 4);
+    return out;
+}
+let lastData = '', lastToken = '';
+export function edgeTokenV2(data) {
+    if (data === lastData)
+        return lastToken;
+    const bytes = Buffer.from(data, 'ascii'), digest = tokenDigest(bytes);
+    lastToken = cs64(bytes, digest).toString('hex').toUpperCase() + '-' + digest.toString('hex').toUpperCase();
+    lastData = data;
+    return lastToken;
+}

package/lib/edge-tts.d.ts

@@ -26,7 +26,7 @@ export type WebSocketFactory = (url: string, options: {
     headers: Record<string, string>;
 }) => WebSocketLike;
 /**
- * 本地生成 Sec-MS-GEC 令牌（对齐 edge-tts DRM 算法）。
+ * 本地生成 Sec-MS-GEC v2 令牌（对齐 edge-tts 7.3.1）。
  */
 export declare function generateSecMsGec(nowSeconds?: number): string;
 /** 生成 SSML。 */

package/lib/edge-tts.js

@@ -5,13 +5,14 @@
  *
  * @module dsh-voice/edge-tts
  */
-import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { randomBytes, randomUUID } from 'node:crypto';
+import { edgeTokenV2 } from './edge-drm-v2.js';
 import { HttpsProxyAgent } from 'https-proxy-agent';
 import WebSocket from 'ws';
 const TRUSTED_CLIENT_TOKEN = '6A5AA1D4EAFF4E9FB37E23D68491D6F4';
 const WS_BASE = 'wss://speech.platform.bing.com/consumer/speech/synthesize/readaloud/edge/v1';
 const OUTPUT_FORMAT = 'audio-24khz-48kbitrate-mono-mp3';
-const SEC_MS_GEC_VERSION = '1-143.0.3650.75';
+const SEC_MS_GEC_VERSION = '2-143.0.3650.75';
 const WIN_EPOCH_SECONDS = 11644473600;
 const WSS_HEADERS = {
     Pragma: 'no-cache',
@@ -32,14 +33,14 @@ function proxyWebSocket(proxyUrl) {
     return (url, options) => new WebSocket(url, { headers: options.headers, agent });
 }
 /**
- * 本地生成 Sec-MS-GEC 令牌（对齐 edge-tts DRM 算法）。
+ * 本地生成 Sec-MS-GEC v2 令牌（对齐 edge-tts 7.3.1）。
  */
 export function generateSecMsGec(nowSeconds = Date.now() / 1000) {
     let ticks = Math.floor(nowSeconds) + WIN_EPOCH_SECONDS;
     ticks -= ticks % 300;
     const windowsTicks = ticks * 10000000;
     const raw = String(windowsTicks) + TRUSTED_CLIENT_TOKEN;
-    return createHash('sha256').update(raw, 'ascii').digest('hex').toUpperCase();
+    return edgeTokenV2(raw);
 }
 /** XML 转义。 */
 function escapeXml(text) {
@@ -75,7 +76,7 @@ export async function synthesizeSpeech(options, deps = {}, timeoutMs = 30000, si
     // 对齐 edge-tts 当前协议：Sec-MS-GEC 走 URL 查询参数，MUID 走 header
     const url = WS_BASE + '?TrustedClientToken=' + TRUSTED_CLIENT_TOKEN + '&ConnectionId=' + randomUUID().replace(/-/g, '') + '&Sec-MS-GEC=' + token + '&Sec-MS-GEC-Version=' + SEC_MS_GEC_VERSION;
     const socket = factory(url, {
-        headers: { ...WSS_HEADERS, MUID: randomBytes(16).toString('hex').toUpperCase() },
+        headers: { ...WSS_HEADERS, Cookie: 'muid=' + randomBytes(16).toString('hex').toUpperCase() + ';' },
     });
     const chunks = [];
     let done = false;

package/lib/paths.d.ts

@@ -16,8 +16,8 @@ export declare function resolveOutputPath(explicit: string | undefined, defaultN
 /** 确保输出目录存在且落在工作区内：不存在则创建，越界或符号链接报错。 */
 export declare function ensureWorkspaceDirectory(input: string, cwd?: string): string;
 /**
- * 写工作区内的文件：先建父目录，再按「新建用 wx / 覆盖用 w」落盘。
+ * 写工作区内的文件，返回实际写入的路径。同名竞争通过 wx 排他创建解决。
  *
  * 新建时用 O_EXCL，避免检查完成到写入之间被人塞进一个符号链接。
  */
-export declare function writeWorkspaceFile(target: string, data: string | Buffer, cwd?: string, mode?: number): void;
+export declare function writeWorkspaceFile(target: string, data: string | Buffer, cwd?: string, mode?: number, overwrite?: boolean): string;

package/lib/paths.js

@@ -3,7 +3,7 @@
  *
  * @module dsh-voice/paths
  */
-import { lstatSync, mkdirSync, openSync, closeSync, realpathSync, statSync, writeFileSync } from 'node:fs';
+import { lstatSync, mkdirSync, openSync, closeSync, realpathSync, statSync, writeFileSync, fstatSync, ftruncateSync, fchmodSync, constants } from 'node:fs';
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 /** 会话工作区的真实路径（解析符号链接）；取不到就退回解析后的绝对路径。 */
 function workspaceRoot(cwd) {
@@ -24,10 +24,17 @@ function pathState(target) {
     try {
         return lstatSync(target).isSymbolicLink() ? 'symlink' : 'present';
     }
-    catch {
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
         return 'missing';
     }
 }
+function assertOverwriteFile(target, stat = lstatSync(target)) {
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1) {
+        throw new Error('覆盖目标必须是没有硬链接的普通文件：' + target + '。请改用新的输出文件名。');
+    }
+}
 /**
  * 沿着最近的已存在祖先解析真实路径，再接回尚不存在的后缀。
  *
@@ -96,6 +103,8 @@ export function resolveOutputPath(explicit, defaultName, overwrite, cwd = proces
     const requested = explicit !== undefined && explicit.trim() !== '' ? explicit.trim() : defaultName;
     const target = resolve(root, requested);
     assertWritableTarget(target, root, '输出路径');
+    if (overwrite && pathState(target) === 'present')
+        assertOverwriteFile(target);
     if (overwrite || pathState(target) === 'missing')
         return target;
     const directory = dirname(target);
@@ -129,24 +138,58 @@ export function ensureWorkspaceDirectory(input, cwd = process.cwd()) {
     return target;
 }
 /**
- * 写工作区内的文件：先建父目录，再按「新建用 wx / 覆盖用 w」落盘。
+ * 写工作区内的文件，返回实际写入的路径。同名竞争通过 wx 排他创建解决。
  *
  * 新建时用 O_EXCL，避免检查完成到写入之间被人塞进一个符号链接。
  */
-export function writeWorkspaceFile(target, data, cwd = process.cwd(), mode) {
+export function writeWorkspaceFile(target, data, cwd = process.cwd(), mode, overwrite = false) {
     const root = workspaceRoot(cwd);
     assertWritableTarget(target, root, '输出路径');
     mkdirSync(dirname(target), { recursive: true });
-    assertWritableTarget(target, root, '输出路径');
-    if (pathState(target) === 'missing') {
-        const fd = openSync(target, 'wx', mode);
+    const extension = extname(target), base = basename(target, extension);
+    for (let index = 0; index < 1000; index++) {
+        const candidate = index === 0 ? target : join(dirname(target), base + '_' + index + extension);
+        if (index > 0 && pathState(candidate) !== 'missing')
+            continue;
+        assertWritableTarget(candidate, root, '输出路径');
+        let fd;
+        try {
+            fd = openSync(candidate, 'wx', mode);
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            if (!overwrite)
+                continue;
+            // 不在校验前截断文件。打开后还需检查真实句柄，防止静态硬链接和替换。
+            const before = lstatSync(candidate);
+            assertOverwriteFile(candidate, before);
+            fd = openSync(candidate, constants.O_WRONLY | (constants.O_NOFOLLOW ?? 0));
+            try {
+                const opened = fstatSync(fd), current = lstatSync(candidate);
+                assertOverwriteFile(candidate, opened);
+                assertOverwriteFile(candidate, current);
+                assertWritableTarget(candidate, root, '输出路径');
+                if (opened.dev !== before.dev || opened.ino !== before.ino || opened.dev !== current.dev || opened.ino !== current.ino) {
+                    throw new Error('输出文件在写入前发生变化，请重试：' + candidate);
+                }
+                if (mode !== undefined && process.platform !== 'win32')
+                    fchmodSync(fd, mode);
+                ftruncateSync(fd, 0);
+                writeFileSync(fd, data);
+            }
+            finally {
+                closeSync(fd);
+            }
+            return candidate;
+        }
         try {
             writeFileSync(fd, data);
         }
         finally {
             closeSync(fd);
         }
-        return;
+        return candidate;
     }
-    writeFileSync(target, data, mode === undefined ? undefined : { mode });
+    throw new Error('找不到可用的输出文件名（同名文件超过 999 个），请显式指定 output。');
 }

package/lib/stt.js

@@ -56,6 +56,8 @@ export async function transcribe(baseUrl, apiKey, options, fetchImpl = globalThi
     try {
         response = await raceAbort(fetchImpl(baseUrl + '/audio/transcriptions', {
             method: 'POST',
+            // 音频只交给配置的端点；307/308 也不能把 multipart 转发到另一站。
+            redirect: 'manual',
             headers: { authorization: 'Bearer ' + apiKey },
             body: form,
             signal: requestSignal,
@@ -67,6 +69,14 @@ export async function transcribe(baseUrl, apiKey, options, fetchImpl = globalThi
             throw new Error('ASR 请求超时，请重试或缩短音频。');
         throw new Error('ASR 请求失败：' + (error instanceof Error ? error.message : String(error)) + '。若接口需要特殊代理（梯子），请在 cordis.patch.yml 配置 proxyUrl 后重启。');
     }
+    if (response.status >= 300 && response.status < 400) {
+        try {
+            await raceAbort(response.body?.cancel(), requestSignal);
+        }
+        catch { /* 尽力释放响应，仍受请求超时限制。 */ }
+        throwIfAborted(abortSignal);
+        throw new Error('ASR 接口返回重定向（HTTP ' + response.status + '），未向跳转地址发送音频。请确认服务地址，并在 asrBaseUrl 中直接填写可信的最终接口地址。');
+    }
     if (!response.ok) {
         let body;
         try {

package/lib/tools.js

@@ -197,10 +197,11 @@ export function buildVoiceTools(config, deps = {}) {
                 if (!/^[+-]?\d+(\.\d+)?(%|Hz|st)$/.test(value))
                     throw new Error(label + ' 不合法：' + value + '。合法格式如 +10%、-2Hz、+1st。');
             }
-            const output = resolveOutputPath(optionalString(args, 'output'), 'voice_output.mp3', cfg.overwrite, sessionCwd(exec));
+            const requested = optionalString(args, 'output'), cwd = sessionCwd(exec);
+            resolveOutputPath(requested, 'voice_output.mp3', cfg.overwrite, cwd);
             const audio = await raceAbort((deps.tts ?? synthesizeSpeech)({ text, voice, rate, pitch }, { proxyUrl: cfg.proxyUrl }, timeout, signal), signal);
             throwIfAborted(signal);
-            writeWorkspaceFile(output, audio, sessionCwd(exec));
+            const output = writeWorkspaceFile(resolveOutputPath(requested, 'voice_output.mp3', cfg.overwrite, cwd), audio, cwd, undefined, cfg.overwrite);
             return { output, bytes: audio.length, voice, rate, pitch, textLength: text.length };
         },
         timeoutMs: timeout + 10000,
@@ -258,8 +259,7 @@ export function buildVoiceTools(config, deps = {}) {
             if (output !== undefined) {
                 const target = resolveOutputPath(output, '', cfg.overwrite, cwd);
                 // 转写文本可能含隐私内容，只用 0600 写入。
-                writeWorkspaceFile(target, text, cwd, 0o600);
-                transcriptFile = target;
+                transcriptFile = writeWorkspaceFile(target, text, cwd, 0o600, cfg.overwrite);
             }
             // The output schema declares these as strings — never return null, or
             // dsh rejects the whole tool result (issue #1).
@@ -319,8 +319,8 @@ export function buildVoiceTools(config, deps = {}) {
                     const name = 'voice-preview-' + voice.replace(/[^a-zA-Z0-9-]/g, '_') + '.mp3';
                     // 复用 resolveOutputPath：overwrite=false 时改名加序号，不再直接覆盖同名样例。
                     const file = resolveOutputPath(join(outDir, name), '', cfg.overwrite, cwd);
-                    writeWorkspaceFile(file, audio, cwd);
-                    return { voice, output: file, bytes: audio.length };
+                    const output = writeWorkspaceFile(file, audio, cwd, undefined, cfg.overwrite);
+                    return { voice, output, bytes: audio.length };
                 }
                 catch (error) {
                     throwIfAborted(signal);

package/lib/update-client.js

@@ -437,7 +437,7 @@ function __stardustUpdatesClient(ctx, React, require, shared) {
 }
 
 /* STARDUSTLC_UPDATE_CLIENT_BODY_START */
-window.__ModuleLoader__.load(__stardustUpdatesWrap({id:"dsh-voice",factory:require=>({apply(){}})},{"name":"dsh-voice","version":"0.1.0","hasWorkbench":false,"packageVersion":"0.4.3","label":"语音","labelEn":"Voice","suiteComponent":true}));
+window.__ModuleLoader__.load(__stardustUpdatesWrap({id:"dsh-voice",factory:require=>({apply(){}})},{"name":"dsh-voice","version":"0.1.0","hasWorkbench":false,"packageVersion":"0.5.1","label":"语音","labelEn":"Voice","suiteComponent":true}));
 
 /* STARDUSTLC_UPDATE_CLIENT_BODY_END */
 })();

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-voice",
-  "version": "0.4.3",
-  "description": "把文字生成语音，或通过兼容接口把音频转为文字。",
+  "version": "0.5.1",
+  "description": "DSH 语音工具：Edge TTS 朗读、兼容 ASR 转写、工作区文件保护与并发输出。欢迎提交 issues 和 PR。",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -20,7 +20,10 @@
     "README.md",
     "README.en.md",
     "docs",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "src/edge-drm-v2.ts",
+    "LICENSES",
+    "THIRD_PARTY_NOTICES.md"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.json && node scripts/build-updates.mjs",
@@ -52,7 +55,7 @@
     "voice",
     "dsh-plugin"
   ],
-  "license": "MIT",
+  "license": "MIT AND LGPL-3.0-only",
   "engines": {
     "node": "^22.19.0 || >=24.0.0",
     "dsh": ">=0.2.1-rc.3"

package/src/edge-drm-v2.ts

@@ -0,0 +1,105 @@
+/**
+ * SPDX-License-Identifier: LGPL-3.0-only
+ * Adapted from rany2/edge-tts 7.3.1 src/edge_tts/drm.py (rany and contributors).
+ * https://github.com/rany2/edge-tts/blob/7.3.1/src/edge_tts/drm.py
+ * TypeScript adaptation, 2026 STARDUSTLC666. See LICENSES/edge-tts-LGPLv3.txt.
+ * Kept as a separate, replaceable module; the rest of dsh-voice remains MIT.
+ */
+
+const INITIAL = [0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A, 0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19]
+const STATE = [0xFD9FBEA2, 0x91243CE7, 0xBE499094, 0xCD2E1E0A, 0x6C006F49, 0x04BD35AB, 0xFEB0A7E4, 0x03EFFBD2]
+const SCHEDULE = [0xEB24BF9E, 0x1558691F, 0xA0C09EE2, 0x0CFA32BA, 0xA622EE8C, 0xD1DD9491, 0xC0DD25A0, 0xF9E70AB6, 0xF0C31573, 0x7058CE4E, 0x7188E606, 0x00E5AB33, 0xD258B060, 0x72766564]
+const K = [
+  0x428A2F98, 0x71374491, 0xB5C0FBCF, 0xE9B5DBA5, 0x3956C25B, 0x59F111F1, 0x923F82A4, 0xAB1C5ED5,
+  0xD807AA98, 0x12835B01, 0x243185BE, 0x550C7DC3, 0x72BE5D74, 0x80DEB1FE, 0x9BDC06A7, 0xC19BF174,
+  0xE49B69C1, 0xEFBE4786, 0x0FC19DC6, 0x240CA1CC, 0x2DE92C6F, 0x4A7484AA, 0x5CB0A9DC, 0x76F988DA,
+  0x983E5152, 0xA831C66D, 0xB00327C8, 0xBF597FC7, 0xC6E00BF3, 0xD5A79147, 0x06CA6351, 0x14292967,
+  0x27B70A85, 0x2E1B2138, 0x4D2C6DFC, 0x53380D13, 0x650A7354, 0x766A0ABB, 0x81C2C92E, 0x92722C85,
+  0xA2BFE8A1, 0xA81A664B, 0xC24B8B70, 0xC76C51A3, 0xD192E819, 0xD6990624, 0xF40E3585, 0x106AA070,
+  0x19A4C116, 0x1E376C08, 0x2748774C, 0x34B0BCB5, 0x391C0CB3, 0x4ED8AA4A, 0x5B9CCA4F, 0x682E6FF3,
+  0x748F82EE, 0x78A5636F, 0x84C87814, 0x8CC70208, 0x90BEFFFA, 0xA4506CEB, 0xBEF9A3F7, 0xC67178F2,
+]
+const COEFFICIENTS = [
+  [0xE82E91B1, 0xB32700D0], [0x44DE24C6, 0x88DFF51D], [0x3BEB65BC, 0x29514038], [0xC89C5933, 0xB328CBDF],
+  [0x8D1EC211, 0xD405B4D5], [0x314EF5D5, 0x26E55F3C], [0xE92491B1, 0x607801C6], [0xF0A5B9D5, 0x82B2C1FB],
+  [0x06064CF3, 0xFA51A3DA], [0xDA79FA60, 0x207CC464], [0xBED20560, 0x3C3C74F3], [0x89F9C9F8, 0xD2D14B61],
+  [0x35FA38C6, 0xBB04A2C1], [0xCB49E3C6, 0xC5626167],
+]
+const rol16 = (x: number) => ((x << 16) | (x >>> 16)) >>> 0
+const rotr = (x: number, n: number) => (x >>> n) | (x << (32 - n))
+const sigma0 = (x: number) => (rotr(x, 7) ^ rotr(x, 18) ^ (x >>> 3)) >>> 0
+const sigma1 = (x: number) => (rotr(x, 17) ^ rotr(x, 19) ^ (x >>> 10)) >>> 0
+const mul = (x: number, y: number) => Math.imul(x, y) >>> 0
+
+function expand(words: number[], first = 16): void {
+  for (let i = first; i < 64; i++) words.push((sigma1(words[i - 2]) + words[i - 7] + sigma0(words[i - 15]) + words[i - 16]) >>> 0)
+}
+function rounds(state: number[], words: number[], first = 0): number[] {
+  let [a, b, c, d, e, f, g, h] = state
+  for (let i = first; i < 64; i++) {
+    const constant = first === 14 && i === 14 ? 0xC9DC06A7 : K[i]
+    const t1 = (h + ((rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) >>> 0) + ((g ^ (e & (f ^ g))) >>> 0) + constant + words[i]) >>> 0
+    const t2 = (((rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) >>> 0) + (((a & b) | (c & (a | b))) >>> 0)) >>> 0
+    ;[a, b, c, d, e, f, g, h] = [(t1 + t2) >>> 0, a, b, c, (d + t1) >>> 0, e, f, g]
+  }
+  return [a, b, c, d, e, f, g, h]
+}
+function tokenDigest(data: Buffer): Buffer {
+  const words = new Array<number>(14).fill(0)
+  words.push(data.readUIntBE(0, 3), data.readUInt32BE(3))
+  for (let i = 16; i < 30; i++) {
+    let value = SCHEDULE[i - 16]
+    if (i - 2 >= 14) value += (sigma1(words[i - 2]) ^ (i === 16 ? 0x000B92C0 : 0)) >>> 0
+    if (i - 7 >= 14) value += words[i - 7]
+    if (i - 15 >= 14) value += (sigma0(words[i - 15]) ^ (i === 29 ? 0x059C0B80 : 0)) >>> 0
+    words.push(value >>> 0)
+  }
+  words.push((sigma1(words[28]) + words[23] + sigma0(words[15]) + words[14] + 0xC9DC06A7 - K[14]) >>> 0)
+  expand(words, 31)
+  let state = rounds(STATE, words, 14).map((x, i) => (x + INITIAL[i]) >>> 0)
+  const length = 57 + data.length, padding = ((55 - length) % 64 + 64) % 64
+  const tail = Buffer.concat([data.subarray(7), Buffer.from([0x80]), Buffer.alloc(padding + 8)])
+  tail.writeBigUInt64BE(BigInt(length) * 8n, tail.length - 8)
+  for (let offset = 0; offset < tail.length; offset += 64) {
+    const block = Array.from({ length: 16 }, (_, i) => tail.readUInt32BE(offset + 4 * i))
+    expand(block)
+    state = rounds(state, block).map((x, i) => (x + state[i]) >>> 0)
+  }
+  const out = Buffer.alloc(32); state.forEach((x, i) => out.writeUInt32BE(x, 4 * i)); return out
+}
+function cs64(data: Buffer, digest: Buffer): Buffer {
+  const keyA = (digest.readUInt32LE(0) | 1) >>> 0, keyB = (digest.readUInt32LE(4) | 1) >>> 0
+  const factors = [mul(keyA, 0x82893933), mul(keyB, 0x82893933)]
+  const terms = COEFFICIENTS.map(([coefficient], i) => mul(coefficient, factors[i % 2])), offsets = COEFFICIENTS.map(([, offset]) => offset)
+  const padded = Buffer.alloc(Math.ceil((data.length + 1) / 8) * 8); data.copy(padded, 1)
+  for (let i = 0; i < padded.length / 4; i++) {
+    const word = padded.readUInt32LE(4 * i)
+    let term = mul(word, i % 2 === 0 ? keyA : keyB), offset = mul(rol16(word), i % 2 === 0 ? 0xEF0569FB : 0xC31713DB)
+    if (i === 0) { term = (term + mul(0xF2F90B1A, factors[0])) >>> 0; offset = (offset + 0x0B1A0000) >>> 0 }
+    terms.push(term); offsets.push(offset)
+  }
+  let swapAcc = 0, swapLast = 0, state = 0, acc = 0
+  for (let i = 0; i < terms.length; i += 2) {
+    const x = terms[i], y = terms[i + 1]
+    let t = rol16((offsets[i] + x) >>> 0), q = mul(t, 0x76F50F34)
+    swapAcc += (mul(rol16(q), 0xC3EFEA97) + q) >>> 0
+    t = rol16((offsets[i + 1] + y) >>> 0); q = mul(t, 0x1881CE3C)
+    swapLast = (mul(rol16(q), 0x35BD1EC9) + q) >>> 0; swapAcc = (swapAcc + swapLast) >>> 0
+    state = (mul(state, keyA) + x) >>> 0
+    for (const factor of [0xCF98B111, 0x87085B9F, 0x12CEB96D, 0x257E1D83]) state = mul(rol16(state), factor)
+    acc += state
+    t = (mul(state, keyB) + y) >>> 0
+    for (const factor of [0xA27416F5, 0xD38396FF]) t = mul(rol16(t), factor)
+    state = mul(rol16(mul(rol16(t), 0x7C932B89)), 0xBFA49F69); acc = (acc + state) >>> 0
+  }
+  const out = Buffer.alloc(8); out.writeUInt32LE((swapLast ^ state) >>> 0); out.writeUInt32LE((swapAcc ^ acc) >>> 0, 4); return out
+}
+
+let lastData = '', lastToken = ''
+export function edgeTokenV2(data: string): string {
+  if (data === lastData) return lastToken
+  const bytes = Buffer.from(data, 'ascii'), digest = tokenDigest(bytes)
+  lastToken = cs64(bytes, digest).toString('hex').toUpperCase() + '-' + digest.toString('hex').toUpperCase()
+  lastData = data
+  return lastToken
+}