ssml-builder-js 2.12.0 → 2.14.0

package/README.md

@@ -240,6 +240,8 @@ const diagnostics = validateAzureSsml(ssml, {
 });
 ```
 
+`audio`、`mstts:backgroundaudio`、`lexicon`、`mstts:voiceconversion` の URL は `urlValidator`（または `customUrlValidator`）へ渡せます。Promise を返す検証関数で DNS 解決後のプライベート IP 遮断などを実装できます。
+
 `maxXmlDepth` は `<speak>` を深さ 1 として XML の過剰なネストを検出します。長文は `splitSsmlDocument` で `<p>`／`<s>` と親の `voice`、`prosody` コンテキストを保ったまま分割できます。
 
 ```ts
@@ -248,10 +250,12 @@ import { splitSsmlDocument } from "ssml-builder-js/core";
 const blocks = splitSsmlDocument(longSsml, 10_000);
 for (const block of blocks) {
   // 各 block は独立した <speak> 文書として Azure へ送信できます。
-  await client.synthesize(block);
+  await client.synthesize(block.ssml);
 }
 ```
 
+各ブロックは `SsmlChunk`（`chunkIndex`、`originalTextRange`、継承した音声/言語/韻律、内包マーク、背景音声の有無）です。`<mstts:backgroundaudio>` はデフォルトで先頭チャンクだけに含まれ、全チャンクへ複製する場合は `splitSsmlDocument(longSsml, 10_000, { replicateBackgroundAudio: true })` を指定します。
+
 Azure Speech は `<audio>` の URL を取得するため、任意の URL をそのまま受け付けるサーバーは SSRF の踏み台になり得ます。ユーザー入力の SSML を合成する場合は、HTTPS、許可オリジン、リダイレクト先、応答サイズをサーバー側でも制限し、`allowExternalAudio` だけで無制限に許可しないでください。
 
 ## `ssml-editor-react` の利用方法
@@ -336,6 +340,8 @@ export function App() {
 - `insertionGroups`: 挿入メニューを縦線で区切るグループ設定。`toolbarGroups` を省略した場合は、この設定からツールバーの既定グループも作成されます。省略時は間・無音、声の調整、表現、読み上げに分けて表示されます
 - `emotionStyles`: `emotion` メニューに表示する音声スタイル候補
 - `customInsertions` / `additionalInsertions`: カスタム SSML 挿入定義。`customInsertions` は同じ ID の標準定義を置き換え、`additionalInsertions` は標準定義へ追加します
+- `customInspectors`: Visual Editor のタグ名ごとに Inspector を差し替えるレンダラー
+- `renderVoiceSelector`: 音声セレクターのカスタムレンダラー。`voiceCatalog` と `voiceLocale`、`voiceRegion`、`voiceStyle` で候補を絞り込めます。プレビュー音声にはバッジ情報も渡されます
 - `className` / `style`: エディター全体のクラス名とインラインスタイル
 - `toolbarClassName` / `toolbarStyle`: ツールバーのクラス名とインラインスタイル
 - `displayClassName` / `displayStyle`: 本文表示エリアのクラス名とインラインスタイル
@@ -702,6 +708,8 @@ const diagnostics = validateAzureSsml(ssml, {
 });
 ```
 
+URLs in `audio`, `mstts:backgroundaudio`, `lexicon`, and `mstts:voiceconversion` can be passed to `urlValidator` (or `customUrlValidator`). The callback may be asynchronous, making it suitable for host-side DNS/private-IP and SSRF policy checks.
+
 The catalog is represented by `AzureVoiceDefinition` with `name`, `locale`, optional `secondaryLocales`, `styles`, `supportedTags`, `unsupportedTags`, `models`, `regions`, and `status`. Pass `voiceDefinitions` (or `voiceCatalog`) to supplement or override the built-in catalog with an external definition. A tag that violates `supportedTags` or `unsupportedTags` produces `azure-unsupported-tag-for-voice` with error severity. `customVoiceStyleMap` remains supported for backward compatibility and overrides styles for the named voice. Diagnostics distinguish an unregistered voice (`azure-unknown-voice`, controlled by `unknownVoicePolicy`), an unsupported style on a registered voice (`azure-unsupported-style`), and a locale mismatch (`azure-locale-mismatch`). The `<mstts:audioduration value="10s"/>` element accepts positive `ms` or `s` values and `hh:mm:ss[.fff]` clock values.
 
 `npm run sync:voices -- --regions eastus,japaneast` fetches Azure's List Voices API for each region, deduplicates the results, and updates the generated TypeScript definitions plus `azureVoiceCatalog.json` with generation time, API version, regions, and voice count. Provide credentials through `AZURE_SPEECH_KEY` and `AZURE_SPEECH_REGION(S)`, or CLI options.
@@ -735,6 +743,17 @@ const diagnostics = validateAzureSsml(ssml, {
 
 Azure Speech fetches `<audio>` URLs, so a server that accepts arbitrary user-provided SSML can become an SSRF proxy. For untrusted SSML, enforce HTTPS, an origin allowlist, redirect policy, and response-size limits on the server; do not treat `allowExternalAudio` as a substitute for those controls.
 
+Long documents can be split into independently synthesizable `SsmlChunk` values:
+
+```ts
+import { splitSsmlDocument } from "ssml-builder-js/core";
+
+const chunks = splitSsmlDocument(longSsml, 10_000);
+for (const chunk of chunks) await client.synthesize(chunk.ssml);
+```
+
+Each chunk includes `chunkIndex`, `originalTextRange`, inherited voice/language/prosody context, contained markers, and background-audio state. Background audio is placed in the first chunk by default; pass `{ replicateBackgroundAudio: true }` as the third argument to include it in every chunk.
+
 ## Using `ssml-editor-react`
 
 `SsmlEditor` accepts an `SsmlDocument` and renders only a toolbar and text display area. The toolbar applies rate, volume, and pitch settings to the selection and provides undo and redo actions. The application is responsible for selecting and displaying the voice. Monaco Editor is used for text editing, and SSML syntax is validated whenever the text changes. Syntax errors are shown with editor markers and an error message. Hovering over XML tag names or parameters shows SSML descriptions. Selecting text displays a floating action bar with the character count and preview action. When `enableCodeLens` is enabled (the default), CodeLens quick controls for editing and unwrapping `prosody` tags and editing or deleting `break` tags are shown above those tags. When `showDecorations` is enabled, inline badges for pause and pitch changes are rendered next to `break` and `prosody` tags, and Monaco inline decorations are enabled. Generated SSML is provided through `onSsmlChange` so the application can display it wherever it needs. Pass an `SsmlEditorRef` through `ref` to retrieve full, selected, or current-line SSML, and use `onSelectionChange` to observe selection text and state. The UI supports Japanese (the default) and English.
@@ -813,6 +832,8 @@ export function App() {
 - `insertionGroups`: Groups insertion menus with vertical separators; when `toolbarGroups` is omitted, these groups also define the default toolbar groups. Menus are grouped into pauses, voice, expression, and pronunciation by default
 - `emotionStyles`: Candidate voice styles shown by the `emotion` menu
 - `customInsertions` / `additionalInsertions`: Custom SSML insertion definitions. `customInsertions` replaces a built-in definition with the same ID, while `additionalInsertions` adds definitions to the built-ins
+- `customInspectors`: Custom renderers keyed by element type or serialized tag name for the Visual Editor
+- `renderVoiceSelector`: Custom voice selector renderer. Supply `voiceCatalog` and optional `voiceLocale`, `voiceRegion`, or `voiceStyle` filters; preview status is included in each voice entry
 - `className` / `style`: A class name and inline styles for the editor container
 - `toolbarClassName` / `toolbarStyle`: A class name and inline styles for the toolbar
 - `displayClassName` / `displayStyle`: A class name and inline styles for the text display area
@@ -888,6 +909,18 @@ result.visemes; // { visemeId, audioOffsetMs }[]
 result.bookmarks; // { name, audioOffsetMs }[]
 ```
 
+長文を分割して合成する場合は `synthesizeSsmlChunks` または `AzureTtsClient.synthesizeChunks` を使います。音声バイナリを連結し、`boundaries`、`visemes`、`bookmarks` のオフセットを累積 `durationMs` 分だけ補正します。`synthesizeSsmlSafe(client, ssml, { validation })` は検証エラー時に Azure API を呼び出さず、`status: "validation-error"` / `"azure-api-error"` / `"success"` の結果を返します。
+
+v2.14.0 では `synthesizeSsmlChunksSafe(client, chunks, options)` が全チャンクを事前検証し、エラー時に `ChunkValidationError.chunkIndex` を返します。`onProgress` には `chunkIndex`、`originalTextRange`、`status`、`durationMs`、`error` が含まれます。`mergeAudioBuffers(buffers, format)` は PCM WAV のヘッダーを再構築し、MP3 の ID3 タグを除去して結合します。Ogg/WebM など安全に連結できない形式は `UnsupportedMergeFormatError` になります。同期イベントには `chunkIndex`、`sourceNodePath`、`originalTextRange`、`chunkAudioOffsetMs` が付与されます。
+
+`validateAzureSsml` の `urlValidation` オプションは URL の重複排除、キャッシュ、`concurrency`、`signal`、`timeoutMs` を制御します。
+
+For long documents, use `synthesizeSsmlChunks` or `AzureTtsClient.synthesizeChunks`; `onProgress` reports completed chunks while audio and synchronization offsets are merged. `synthesizeSsmlSafe(client, ssml, { validation })` validates before synthesis and returns a discriminated result without calling Azure when static validation fails.
+
+In v2.14.0, `synthesizeSsmlChunksSafe(client, chunks, options)` validates every chunk before contacting Azure and returns a `ChunkValidationError` with its `chunkIndex` when validation fails. `onProgress` events include `chunkIndex`, `originalTextRange`, `status`, `durationMs`, and `error`. `mergeAudioBuffers(buffers, format)` rebuilds PCM WAV headers and strips ID3 tags from MP3 streams; formats such as Ogg and WebM throw `UnsupportedMergeFormatError` because they require re-multiplexing. Synchronization events retain `chunkIndex`, `sourceNodePath`, `originalTextRange`, and `chunkAudioOffsetMs`.
+
+The `urlValidation` option of `validateAzureSsml` provides URL deduplication, in-memory caching, bounded `concurrency`, `signal`, and `timeoutMs` controls.
+
 The public updater CLI is `npx ssml-builder sync-voices --region eastus --output ./azure-voices.json`. It reads the key from `AZURE_SPEECH_KEY` (or `--key`) and regions from `AZURE_SPEECH_REGION(S)` (or `--region(s)`).
 
 ```ts

package/dist/{chunk-4BVNAUVR.mjs → chunk-AQ55MOPU.mjs}

@@ -1003,30 +1003,138 @@ function splitNode(document, node, maxLength, context = []) {
   flush();
   return parts;
 }
-function splitSsmlDocument(ssml, maxLength = DEFAULT_MAX_LENGTH) {
-  if (!Number.isInteger(maxLength) || maxLength <= 0) {
+function textFromNode(node) {
+  if (typeof node === "string") return node;
+  if (node.type === "text") return node.value;
+  return (node.children ?? []).map(textFromNode).join("");
+}
+function collectMarks(node, marks) {
+  if (typeof node === "string" || node.type === "text") return;
+  if (node.type === "mark" && node.name) marks.push(node.name);
+  if (node.type === "bookmark" && node.mark) marks.push(node.mark);
+  for (const child of node.children ?? []) collectMarks(child, marks);
+}
+function collectInheritedContext(nodes) {
+  const context = {};
+  const visit = (node) => {
+    if (typeof node === "string" || node.type === "text") return;
+    if (context.voice === void 0 && node.type === "voice" && node.name) context.voice = node.name;
+    if (context.lang === void 0 && node.type === "lang" && node.lang) context.lang = node.lang;
+    if (context.prosody === void 0 && node.type === "prosody") {
+      const prosody = {};
+      for (const [key, value] of Object.entries(node.attributes ?? {})) prosody[key] = String(value);
+      for (const key of ["rate", "pitch", "volume", "contour", "range"]) {
+        const value = node[key];
+        if (value !== void 0) prosody[key] = String(value);
+      }
+      if (Object.keys(prosody).length > 0) context.prosody = prosody;
+    }
+    for (const child of node.children ?? []) visit(child);
+  };
+  nodes.forEach(visit);
+  return context;
+}
+function elementName(node) {
+  return node.type === "custom" || node.type === "element" ? node.name : node.type;
+}
+function findSourceNodePath(nodes, targetOffset) {
+  let textOffset = 0;
+  let firstPath;
+  let foundPath;
+  const visit = (node, path) => {
+    if (typeof node === "string" || node.type === "text") {
+      const text = typeof node === "string" ? node : node.value;
+      if (text && firstPath === void 0) firstPath = [...path];
+      if (text && foundPath === void 0 && targetOffset < textOffset + text.length) foundPath = [...path];
+      textOffset += text.length;
+      return;
+    }
+    node.children?.forEach((child, index) => {
+      const childPath = typeof child === "string" || child.type === "text" ? path : [...path, `${elementName(child)}[${index}]`];
+      visit(child, childPath);
+    });
+  };
+  nodes.forEach((node, index) => {
+    if (!foundPath) {
+      if (typeof node === "string" || node.type === "text") visit(node, ["speak"]);
+      else visit(node, ["speak", `${elementName(node)}[${index}]`]);
+    }
+  });
+  return foundPath ?? firstPath;
+}
+function createChunk(document, nodes, chunkIndex, textStart, backgroundAudio, replicateBackgroundAudio) {
+  const chunkNodes = backgroundAudio && (replicateBackgroundAudio || chunkIndex === 0) ? [backgroundAudio, ...nodes] : nodes;
+  const text = nodes.map(textFromNode).join("");
+  const marks = [];
+  for (const node of nodes) collectMarks(node, marks);
+  const inheritedContext = collectInheritedContext(nodes);
+  if (inheritedContext.lang === void 0 && document.lang) inheritedContext.lang = document.lang;
+  return {
+    chunkIndex,
+    ssml: documentWithChildren(document, chunkNodes),
+    originalTextRange: { start: textStart, end: textStart + text.length },
+    inheritedContext,
+    containedMarks: marks,
+    hasBackgroundAudio: chunkNodes.some(
+      (node) => typeof node !== "string" && node.type !== "text" && node.type === "mstts:backgroundaudio"
+    ),
+    sourceNodePath: findSourceNodePath(document.children ?? [], textStart)
+  };
+}
+function splitSsmlDocument(ssml, maxLength = DEFAULT_MAX_LENGTH, options = {}) {
+  const resolvedMaxLength = typeof maxLength === "number" ? maxLength : maxLength.maxLength ?? DEFAULT_MAX_LENGTH;
+  const resolvedOptions = typeof maxLength === "number" ? options : maxLength;
+  if (!Number.isInteger(resolvedMaxLength) || resolvedMaxLength <= 0) {
     throw new RangeError("maxLength must be a positive integer");
   }
   const document = parseSsml(ssml);
-  if (ssml.length <= maxLength) return [ssml];
-  const children = document.children ?? [];
-  const splitChildren = children.flatMap((child) => splitNode(document, child, maxLength));
+  const backgroundAudio = (document.children ?? []).find(
+    (node) => typeof node !== "string" && node.type !== "text" && node.type === "mstts:backgroundaudio"
+  );
+  if (ssml.length <= resolvedMaxLength) {
+    return [createChunk(document, document.children ?? [], 0, 0, backgroundAudio, true)];
+  }
+  const contentChildren = (document.children ?? []).filter((node) => node !== backgroundAudio);
+  const plainDocumentLength = documentWithChildren(document, []).length;
+  const backgroundDocumentLength = backgroundAudio ? documentWithChildren(document, [backgroundAudio]).length : plainDocumentLength;
+  const backgroundOverhead = Math.max(0, backgroundDocumentLength - plainDocumentLength);
+  const contentMaxLength = Math.max(1, resolvedMaxLength - backgroundOverhead);
+  const splitChildren = contentChildren.flatMap((child) => splitNode(document, child, contentMaxLength));
   const chunks = [];
   let group = [];
   for (const child of splitChildren) {
     const candidate = [...group, child];
-    if (documentWithChildren(document, candidate).length <= maxLength) {
+    if (documentWithChildren(document, candidate).length <= contentMaxLength) {
       group = candidate;
       continue;
     }
     if (group.length > 0) chunks.push(group);
     group = [child];
-    if (documentWithChildren(document, group).length > maxLength) {
+    if (documentWithChildren(document, group).length > contentMaxLength) {
       throw new RangeError("maxLength is too small to contain the SSML document wrapper");
     }
   }
   if (group.length > 0) chunks.push(group);
-  return chunks.map((chunk) => documentWithChildren(document, chunk));
+  if (chunks.length === 0) {
+    const result = createChunk(document, [], 0, 0, backgroundAudio, resolvedOptions.replicateBackgroundAudio ?? false);
+    if (result.ssml.length > resolvedMaxLength) {
+      throw new RangeError("maxLength is too small to contain the SSML document wrapper");
+    }
+    return [result];
+  }
+  let textStart = 0;
+  return chunks.map((chunk, chunkIndex) => {
+    const result = createChunk(
+      document,
+      chunk,
+      chunkIndex,
+      textStart,
+      backgroundAudio,
+      resolvedOptions.replicateBackgroundAudio ?? false
+    );
+    textStart = result.originalTextRange.end;
+    return result;
+  });
 }
 
 // packages/ssml-core/src/validation.ts
@@ -1196,7 +1304,7 @@ async function mapSsmlTextNodes(ssml, transform, options = {}) {
 
 // packages/ssml-core/src/migration.ts
 var DEFAULT_TRANSLATION_SKIP_TAGS = ["phoneme", "say-as", "sayAs", "sub"];
-function elementName(element) {
+function elementName2(element) {
   switch (element.type) {
     case "custom":
     case "element":
@@ -1349,7 +1457,7 @@ function extractSsmlTranslatableText(ssml, options = {}) {
         }
         return;
       }
-      const tag = elementName(node);
+      const tag = elementName2(node);
       if (skipTags.has(tag.toLowerCase())) return;
       visit(childrenOf(node), [...ancestors, tag], [...path, String(index)]);
     });
@@ -1395,7 +1503,7 @@ function serializeDocument2(document) {
   const serialize = (node) => {
     if (typeof node === "string") return node.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
     if (node.type === "text") return serialize(node.value);
-    const tag = elementName(node);
+    const tag = elementName2(node);
     const nodeAttributes = elementAttributes(node);
     const serializedAttributes = Object.entries(nodeAttributes).map(([name, value]) => ` ${name}="${serialize(value).replace(/"/g, "&quot;")}"`).join("");
     const children = childrenOf(node).map(serialize).join("");
@@ -1409,7 +1517,7 @@ function flatten(document) {
     nodes.forEach((node, index) => {
       if (typeof node === "string" || node.type === "text") return;
       const currentPath = `${path}/${index}`;
-      result.push({ name: elementName(node), attributes: elementAttributes(node), path: currentPath });
+      result.push({ name: elementName2(node), attributes: elementAttributes(node), path: currentPath });
       visit(childrenOf(node), currentPath);
     });
   };
@@ -1607,6 +1715,69 @@ var AZURE_VOICE_DEFINITIONS = [
 ];
 
 // packages/ssml-core/src/azureValidation.ts
+function createAzureUrlValidatorRunner(validator, options = {}) {
+  if (typeof validator !== "function") throw new TypeError("A URL validator function is required.");
+  const concurrency = options.concurrency === void 0 ? Infinity : Number.isFinite(options.concurrency) ? Math.max(1, Math.floor(options.concurrency)) : Infinity;
+  const cache = options.cache ?? /* @__PURE__ */ new Map();
+  const inFlight = /* @__PURE__ */ new Map();
+  const waiters = [];
+  let active = 0;
+  const acquire = async () => {
+    if (active < concurrency) {
+      active += 1;
+      return;
+    }
+    await new Promise((resolve) => waiters.push(resolve));
+    active += 1;
+  };
+  const release = () => {
+    active -= 1;
+    waiters.shift()?.();
+  };
+  const check = async (url, context) => {
+    if (options.signal?.aborted) throw new Error("URL validation was aborted.");
+    const cached = cache.get(url);
+    if (cached !== void 0) return cached;
+    const existing = inFlight.get(url);
+    if (existing) return existing;
+    const promise = (async () => {
+      await acquire();
+      try {
+        if (options.signal?.aborted) throw new Error("URL validation was aborted.");
+        const validation = Promise.resolve(validator(url, context));
+        let timer;
+        let abortHandler;
+        const cancellation = new Promise((_resolve, reject) => {
+          abortHandler = () => reject(new Error("URL validation was aborted."));
+          options.signal?.addEventListener("abort", abortHandler, { once: true });
+          if (options.timeoutMs !== void 0 && options.timeoutMs > 0) {
+            timer = setTimeout(
+              () => reject(new Error(`URL validation timed out after ${options.timeoutMs} ms.`)),
+              options.timeoutMs
+            );
+          }
+        });
+        try {
+          const result = await (timer || abortHandler ? Promise.race([validation, cancellation]) : validation);
+          cache.set(url, result);
+          return result;
+        } finally {
+          if (timer) clearTimeout(timer);
+          if (abortHandler) options.signal?.removeEventListener("abort", abortHandler);
+        }
+      } finally {
+        release();
+      }
+    })();
+    inFlight.set(url, promise);
+    try {
+      return await promise;
+    } finally {
+      inFlight.delete(url);
+    }
+  };
+  return (url, context) => check(url, context);
+}
 var ALLOWED_BREAK_STRENGTHS = /* @__PURE__ */ new Set(["none", "x-weak", "weak", "medium", "strong", "x-strong"]);
 var ALLOWED_SAY_AS = /* @__PURE__ */ new Set([
   "characters",
@@ -1901,23 +2072,23 @@ function validateVoiceFeatureMatrix(token, source, diagnostics, voiceName, defin
     );
   }
 }
-function validateAudioSource(token, source, diagnostics, options, elementName2) {
+function validateAudioSource(token, source, diagnostics, options, elementName3) {
   const src = attr(token, "src");
   if (!src) {
-    addDiagnostic(diagnostics, source, token.start, `<${elementName2}> requires a "src" attribute.`);
+    addDiagnostic(diagnostics, source, token.start, `<${elementName3}> requires a "src" attribute.`);
     return;
   }
   let parsed;
   try {
     parsed = new URL(src);
   } catch {
-    addDiagnostic(diagnostics, source, token.start, `<${elementName2} src> must be an absolute HTTP(S) URL.`);
+    addDiagnostic(diagnostics, source, token.start, `<${elementName3} src> must be an absolute HTTP(S) URL.`);
     return;
   }
   if (parsed.username || parsed.password)
-    addDiagnostic(diagnostics, source, token.start, `<${elementName2} src> must not contain URL credentials.`);
+    addDiagnostic(diagnostics, source, token.start, `<${elementName3} src> must not contain URL credentials.`);
   if (parsed.protocol !== "https:" && !(options.allowHttpAudio && parsed.protocol === "http:"))
-    addDiagnostic(diagnostics, source, token.start, `<${elementName2} src> must use HTTPS.`);
+    addDiagnostic(diagnostics, source, token.start, `<${elementName3} src> must use HTTPS.`);
   const isAllowedOrigin = options.allowedAudioOrigins?.some((allowedOrigin) => {
     try {
       const configured = new URL(allowedOrigin);
@@ -1929,13 +2100,13 @@ function validateAudioSource(token, source, diagnostics, options, elementName2)
     }
   }) ?? false;
   if (options.allowedAudioOrigins && !isAllowedOrigin)
-    addDiagnostic(diagnostics, source, token.start, `<${elementName2} src> origin "${parsed.origin}" is not allowed.`);
+    addDiagnostic(diagnostics, source, token.start, `<${elementName3} src> origin "${parsed.origin}" is not allowed.`);
   else if (!isAllowedOrigin && !options.allowExternalAudio)
     addDiagnostic(
       diagnostics,
       source,
       token.start,
-      `<${elementName2} src> external origin "${parsed.origin}" is blocked by default; set allowExternalAudio to true or provide allowedAudioOrigins.`
+      `<${elementName3} src> external origin "${parsed.origin}" is blocked by default; set allowExternalAudio to true or provide allowedAudioOrigins.`
     );
 }
 function validateElement(token, source, diagnostics, voiceName, options, voiceCatalog) {
@@ -2117,7 +2288,7 @@ function validateElement(token, source, diagnostics, voiceName, options, voiceCa
       addDiagnostic(diagnostics, source, token.start, "<mstts:backgroundaudio> must be self-closing.");
   }
 }
-function validateAzureSsml(ssml, options = {}) {
+function validateAzureSsmlStatic(ssml, options = {}) {
   const diagnostics = [];
   if (typeof ssml !== "string") {
     return [
@@ -2241,6 +2412,59 @@ function validateAzureSsml(ssml, options = {}) {
   }
   return diagnostics;
 }
+function urlAttributes(token) {
+  const tag = canonicalTagName(token.name);
+  const attributes = tag === "audio" || tag === "mstts:backgroundaudio" ? ["src"] : tag === "lexicon" ? ["uri"] : tag === "mstts:voiceconversion" ? ["url"] : [];
+  return attributes.flatMap((attribute) => {
+    const value = attr(token, attribute);
+    return value === void 0 ? [] : [{ attribute, value }];
+  });
+}
+function validateAzureSsml(ssml, options = {}) {
+  const diagnostics = validateAzureSsmlStatic(ssml, options);
+  const validator = options.urlValidator ?? options.customUrlValidator;
+  if (!validator || typeof ssml !== "string") return diagnostics;
+  const runnerOptions = options.urlValidation ?? {};
+  const boundedValidator = createAzureUrlValidatorRunner(validator, {
+    ...runnerOptions,
+    ...options.urlValidatorConcurrency !== void 0 ? { concurrency: options.urlValidatorConcurrency } : {},
+    ...options.urlValidatorTimeoutMs !== void 0 ? { timeoutMs: options.urlValidatorTimeoutMs } : {},
+    ...options.urlValidatorSignal ? { signal: options.urlValidatorSignal } : {},
+    ...options.urlValidatorCache ? { cache: options.urlValidatorCache } : {}
+  });
+  let tokens;
+  try {
+    tokens = tokenizeElements(ssml);
+  } catch {
+    return diagnostics;
+  }
+  const checks = tokens.flatMap(
+    (token) => urlAttributes(token).map(async ({ attribute, value }) => {
+      try {
+        const result = await boundedValidator(value, { tag: token.name, attribute });
+        const valid = typeof result === "boolean" ? result : result.valid;
+        if (!valid) {
+          const reason = typeof result === "boolean" ? void 0 : result.reason;
+          addDiagnostic(
+            diagnostics,
+            ssml,
+            token.start,
+            `<${token.name} ${attribute}> was rejected by the custom URL validator${reason ? `: ${reason}` : "."}`
+          );
+        }
+      } catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        addDiagnostic(
+          diagnostics,
+          ssml,
+          token.start,
+          `<${token.name} ${attribute}> could not be validated by the custom URL validator: ${reason}`
+        );
+      }
+    })
+  );
+  return Promise.all(checks).then(() => diagnostics);
+}
 
 // packages/ssml-core/src/generated/azureVoiceCatalog.ts
 var AZURE_VOICE_CATALOG_METADATA = {
@@ -2270,6 +2494,7 @@ export {
   extractSsmlTranslatableText,
   fromPlainTextToSsml,
   validateSsmlStructureIntegrity,
+  createAzureUrlValidatorRunner,
   isValidAzureAudioDuration,
   normalizeAzureLanguage,
   areAzureLanguagesEquivalent,
@@ -2277,4 +2502,4 @@ export {
   getAzureVoiceCatalogMetadata,
   getBuiltInVoiceCatalogMetadata
 };
-//# sourceMappingURL=chunk-4BVNAUVR.mjs.map
+//# sourceMappingURL=chunk-AQ55MOPU.mjs.map