Release 0.1.48 [auto-version-bump]

.dockerignore

@@ -5,3 +5,6 @@ scripts
 README.md
 AGENTS.md
 VERSION
+node_modules
+package-lock.json
+dist

.gitea/workflows/publish.yaml

@@ -25,9 +25,28 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
+          node --version
           python3 scripts/bump-version.py --check
           scripts/check-frontend.sh
 
+      - name: Build Piper WebAssembly assets
+        shell: bash
+        run: |
+          set -euo pipefail
+          npm install --no-audit --no-fund
+          npm run build:piper
+          test -s public/tts/piper-wasm-v1/piper/piper_phonemize.wasm
+          test -s public/tts/piper-wasm-v1/piper/piper_phonemize.data
+          test -s public/tts/piper-wasm-v1/piper-worker.js
+          test -s public/piper-runtime.js
+          test -s public/tts/piper-wasm-v1/voices/sv/sv_SE/alma/medium/sv_SE-alma-medium.onnx
+          test -s public/tts/piper-wasm-v1/voices/sv/sv_SE/alma/medium/sv_SE-alma-medium.onnx.json
+          test -s public/tts/piper-wasm-v1/voices/sv/sv_SE/lisa/medium/sv_SE-lisa-medium.onnx
+          test -s public/tts/piper-wasm-v1/voices/sv/sv_SE/lisa/medium/sv_SE-lisa-medium.onnx.json
+          test -s public/tts/piper-wasm-v1/voices/sv/sv_SE/nst/medium/sv_SE-nst-medium.onnx
+          test -s public/tts/piper-wasm-v1/voices/sv/sv_SE/nst/medium/sv_SE-nst-medium.onnx.json
+          test -s public/tts/piper-wasm-v1/voices/ATTRIBUTION.txt
+
       - name: Ensure Helm is available
         shell: bash
         env:
@@ -88,7 +107,7 @@ jobs:
           version="$(python3 scripts/bump-version.py)"
           git config user.name "Gitea Actions"
           git config user.email "actions@users.noreply.gitea"
-          git add VERSION deploy/helm/ai-spel-frontend/Chart.yaml
+          git add VERSION deploy/helm/ai-spel-frontend/Chart.yaml package-lock.json
           git commit -m "Release $version [auto-version-bump]"
           git tag -a "v$version" -m "v$version"
           git push origin HEAD:main "refs/tags/v$version"

AGENTS.md

@@ -7,3 +7,5 @@
 - Changes are written locally and built, checked, published, and exercised by Gitea Actions on the existing `large` runner and Kubernetes. Never run apps, tests, containers, images, or binaries locally. Do not create or register runners.
 - Never commit secrets, generated credentials, kubeconfigs, or environment files.
 - Helm charts are published to `harbor.k3s.k0.nu/ai-spel`; Argo CD uses the existing `ai-spel` project and namespace.
+- Player-facing speech uses the local Piper WebAssembly adapter when the player has activated audio. All supported Swedish Piper voice models are packaged into the frontend image and served from this origin; model downloads are redirected to same-origin paths and cached by the browser when supported. Game text is synthesized on-device and must never be sent to a TTS provider.
+- Build Piper/ONNX WebAssembly files and fetch/checksum pinned Swedish model files in the `large` runner; serve them from the frontend image under `/tts/piper-wasm-v1/`. Never build or run these assets locally.

Dockerfile

@@ -3,6 +3,9 @@ FROM nginxinc/nginx-unprivileged:1.27-alpine
 ARG FRONTEND_VERSION
 RUN test -n "$FRONTEND_VERSION"
 COPY index.html /usr/share/nginx/html/index.html
+COPY voice.js /usr/share/nginx/html/voice.js
+COPY public/piper-runtime.js /usr/share/nginx/html/piper-runtime.js
+COPY public/tts/piper-wasm-v1/ /usr/share/nginx/html/tts/piper-wasm-v1/
 COPY nginx/default.conf /etc/nginx/conf.d/default.conf
 USER root
 RUN sed -i "s/__FRONTEND_VERSION__/${FRONTEND_VERSION}/g" /usr/share/nginx/html/index.html

PIPER_VOICE_NOTICES.txt

@@ -0,0 +1,25 @@
+Swedish Piper voice models
+==========================
+
+This frontend distributes the Swedish medium Piper models Alma, Lisa, and NST
+from the rhasspy/piper-voices repository, pinned to revision
+c10ece1aade47bb51c153c893d14e5bf8e5b7117. Model weights are delivered by this
+site from /tts/piper-wasm-v1/voices/ after integrity verification in CI.
+
+Alma (sv_SE-alma-medium)
+Source: https://huggingface.co/rhasspy/piper-voices/tree/c10ece1aade47bb51c153c893d14e5bf8e5b7117/sv/sv_SE/alma/medium
+The model card states CC BY 4.0 and identifies the upstream voice project at
+https://huggingface.co/yeagersthlm/piper-voice-sv-alma.
+
+Lisa (sv_SE-lisa-medium)
+Source: https://huggingface.co/rhasspy/piper-voices/tree/c10ece1aade47bb51c153c893d14e5bf8e5b7117/sv/sv_SE/lisa/medium
+The upstream model card describes this as fine-tuned from the Norwegian
+talesyntese medium voice.
+
+NST (sv_SE-nst-medium)
+Source: https://huggingface.co/rhasspy/piper-voices/tree/c10ece1aade47bb51c153c893d14e5bf8e5b7117/sv/sv_SE/nst/medium
+The upstream model card identifies the NST Swedish TTS dataset as CC0 and
+credits KBLab at the National Library of Sweden for training the voice.
+
+The upstream model files and their model cards remain the source of truth for
+license terms. The complete source revision is pinned in scripts/build-piper.mjs.

README.md

@@ -6,8 +6,24 @@ After login, character creation and play use one dialogue history and one text i
 
 During play the UI has no persistent location, task, inventory, economy, status, or purchase panels. The player asks for information or writes an action in the same input. Rust validates state changes; the AI can only propose a typed intent. A direct request to travel may establish a new place and an encounter when Rust commits that movement.
 
+If the player asks to find or approach someone and no NPC is present, the direct dialogue scene may propose one person and an opening line. Rust creates that NPC only for the explicit request and commits the first exchange idempotently; a later turn continues the saved conversation. Clear requests about the current location are answered from its saved facts without asking the player to restate what they want to inspect.
+
+The separate `/admin` route provides an authenticated operations view for player search/profile/trace, YAML prompt assets, generated Luau rules with validation results, runtime debug logging, and the append-only audit log. All privileged data comes from the Rust `/api/admin/...` API; the browser never connects directly to PostgreSQL. Backend endpoints require `accounts.is_admin=true`. The Driftloggar view lets an administrator switch `debug=true` on or off without restarting pods; the setting is stored in PostgreSQL and propagated to running replicas. Verbose pod logs include request, AI-call, validation, and commit metadata but never raw player text, prompts, model responses, sessions, or secrets. Full protected prompt/provider exchanges remain in the audited player trace.
+
 The game is text- and dialogue-based and uses no images. Place descriptions include sound, smell, air/temperature, touch/surface, and spatial-orientation cues. Visible details may also be described in words, but are never required to understand the scene or play. The transcript is screen-reader announced, and Enter submits the input while Shift+Enter inserts a newline; no separate send button is required.
 
+Player-facing speech uses Piper TTS in WebAssembly in the browser after audio is activated by a user gesture. It reads game dialogue, onboarding, account responses, character and world creation, gameplay replies, in-game errors, and microphone disclosures; the `/admin` route is excluded. The audio is decoded and played through the Web Audio API, independently of `speechSynthesis`. The first unauthenticated visit keeps the introduction visible and it can be started with `Läs introduktionen`. New game replies are read automatically and the transcript remains available to screen readers and as text. Returning players hear the latest saved game reply when they reopen the game. The player can change speaking rate; narrator pitch is neutral and character pitch is varied consistently by voice identity. These preferences are stored in browser `localStorage`. If WebAssembly, model loading, or audio playback fails, the same content remains available as text and the dialogue offers a retry.
+
+The Piper engine, WebAssembly runtime, and all three Swedish medium voice models (Alma, Lisa, and NST) are served from this frontend's same-origin `/tts/piper-wasm-v1/` path. The Gitea pipeline downloads the pinned model files, verifies their sizes and cryptographic hashes, and packages them into the versioned frontend image. The browser's Piper adapter redirects the library's built-in model URLs to this same-origin server; it does not request voice files from Hugging Face. A voice model is fetched on first use and cached in browser storage when supported. The game currently uses the NST model. Dialogue text is synthesized on the device and is not sent to a TTS provider. Voice model attribution and license references are available in the voice settings and at `/tts/piper-wasm-v1/voices/ATTRIBUTION.txt`.
+
+The microphone button beside the text field uses Web Speech API when available and sends only its final Swedish transcript through the same submission path as typed text. Before its first use, the client explains that the browser may process audio through a provider-selected service; the game itself does not receive or store recordings, while the final transcript is saved as ordinary dialogue. Writing `röstinställningar` or saying `röstkommando alternativ` opens temporary voice controls in the dialogue. The player can adjust speaking rate and enable or disable short audio cues. Voice preferences are stored in browser `localStorage`.
+
+When a character or NPC is created, its saved voice identity is masculine, feminine, or neutral. The biography prompt only assigns masculine/feminine when the character is explicitly described that way; otherwise it uses neutral. Piper applies a stable, subtle pitch/rate profile per character, so a character keeps the same sound across visits. Narration always uses neutral pitch.
+
+System voice commands require the prefix `röstkommando`: `upprepa`, `avbryt`, `hjälp`, `alternativ`, or `paus`. Without the prefix, the same words remain ordinary dialogue. Speech recognition and synthesis are browser-dependent; release acceptance must record which real iPhone/Safari/VoiceOver and Android/Chrome/TalkBack combinations were actually checked.
+
+On iPhone and iPad, Safari requires a user gesture to unlock Web Audio. The frontend resumes the audio context during a trusted tap or key press and then reads generated replies automatically. Voice settings include **Testa ljudet**; if a game reply does not start, a **Läs senaste repliken** button appears in the dialogue. First use can take longer while the voice model downloads; progress and errors are announced in the dialogue. Actual iPhone/iPad playback remains a release acceptance check and must not be claimed until tested on a device.
+
 The browser and API stay on the same public origin, `https://ai-spel.k3s.k0.nu`. The ingress routes `/` to this frontend service and routes `/api`, `/version`, and `/health` to the Rust service. That keeps the current server-side session cookie same-origin and avoids browser CORS configuration.
 
 ## Release flow

VERSION

@@ -1 +1 @@
-0.1.23
+0.1.48

deploy/helm/ai-spel-frontend/Chart.yaml

@@ -2,5 +2,5 @@ apiVersion: v2
 name: ai-spel-frontend
 description: Static web frontend for the Swedish life simulator
 type: application
-version: 0.1.23
+version: 0.1.48
-appVersion: "0.1.23"
+appVersion: "0.1.48"

index.html

@@ -18,6 +18,15 @@
     #dialogue li[data-role="user"] { font-weight: 650; }
     #dialogue li[data-role="assistant"] { padding-inline-start: .75rem; border-inline-start: .2rem solid currentColor; }
     #message { width: 100%; min-height: 3.5rem; box-sizing: border-box; }
+    #message-tools { display: flex; flex-wrap: wrap; align-items: center; gap: .5rem; }
+    #voice-status { min-height: 1.5em; }
+    #dialogue li[data-role="voice-controls"] { border: 1px solid currentColor; border-radius: .35rem; padding: .75rem; }
+    #dialogue li[data-role="voice-controls"] fieldset { display: grid; gap: .5rem; margin-block: .5rem; }
+    #admin-content { display: grid; gap: 1rem; }
+    #admin-content section, #admin-content article { border: 1px solid currentColor; border-radius: .35rem; padding: .75rem; }
+    #admin-content pre { white-space: pre-wrap; overflow-wrap: anywhere; max-height: 32rem; overflow: auto; }
+    #admin-toolbar { display: flex; flex-wrap: wrap; gap: .5rem; margin-block: 1rem; }
+    #player-search { display: flex; flex-wrap: wrap; align-items: end; gap: .5rem; }
     .sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0,0,0,0); white-space: nowrap; border: 0; }
     [hidden] { display: none !important; }
     footer { margin-top: 2rem; border-top: 1px solid; padding-top: .5rem; color: GrayText; font-size: .875rem; }
@@ -27,7 +36,10 @@
   <main>
     <section id="auth" aria-labelledby="auth-heading">
       <h1 id="auth-heading">Svensk livssimulator</h1>
-      <p>Skapa en vuxen person och utforska en bestående värld genom dialog. Inga bilder används.</p>
+      <p id="auth-intro">Välkommen till en svensk, dialogbaserad livssimulator utan bilder. Världen beskrivs med ljud, dofter, temperatur, beröring och riktning. Skapa konto med ett användarnamn och ett lösenord på minst tolv tecken. Berätta sedan fritt om en vuxen person. Du får redigera och godkänna personens biografi och startplats. Spela genom att skriva eller tala vad du gör och frågar. Personer du möter kan minnas tidigare samtal. Spelets repliker läses automatiskt upp på svenska och finns kvar som text. Har du redan konto väljer du Logga in.</p>
+      <button type="button" id="auth-repeat-intro">Läs introduktionen</button>
+      <p id="auth-voice-status" role="status" aria-live="polite">På iPhone och iPad kan du behöva trycka på Läs introduktionen igen en gång för att aktivera uppläsningen.</p>
+      <p id="auth-status" role="status" aria-live="polite" hidden></p>
       <form id="auth-form">
         <label>Användarnamn <input name="username" required minlength="3" maxlength="40" autocomplete="username"></label>
         <label>Lösenord <input name="password" type="password" required minlength="12" maxlength="256" autocomplete="current-password"></label>
@@ -40,14 +52,33 @@
       <form id="message-form">
         <label for="message" id="message-label">Skriv ett meddelande</label>
         <textarea id="message" name="message" maxlength="4000" aria-describedby="message-help" autocomplete="off"></textarea>
+        <div id="message-tools"><button type="button" id="microphone" aria-pressed="false" aria-describedby="voice-status">Starta mikrofon</button></div>
         <span id="message-help" class="sr-only">Tryck Enter för att skicka. Tryck Skift och Enter för ny rad.</span>
       </form>
+      <p id="voice-status" role="status" aria-live="polite"></p>
+    </section>
+    <section id="admin-view" aria-labelledby="admin-heading" hidden>
+      <h1 id="admin-heading">Administration</h1>
+      <p>Privilegierad läsning loggas. Känsligt spelarinnehåll visas bara här för administratörer.</p>
+      <nav id="admin-toolbar" aria-label="Administrationsvyer">
+        <button type="button" data-admin-view="players">Spelare</button>
+        <button type="button" data-admin-view="prompts">Prompter</button>
+        <button type="button" data-admin-view="rules">Luau-regler</button>
+        <button type="button" data-admin-view="logging">Driftloggar</button>
+        <button type="button" data-admin-view="audit">Revisionslogg</button>
+        <button type="button" id="admin-logout">Logga ut</button>
+      </nav>
+      <div id="admin-content" aria-live="polite" aria-busy="false"></div>
     </section>
   </main>
   <footer id="version-footer">Frontend <span id="frontend-version">__FRONTEND_VERSION__</span> · API <span id="api-version">hämtar version…</span></footer>
+  <script src="/piper-runtime.js?v=__FRONTEND_VERSION__"></script>
+  <script src="/voice.js?v=__FRONTEND_VERSION__"></script>
   <script>
     const auth = document.querySelector('#auth');
     const play = document.querySelector('#play');
+    const adminView = document.querySelector('#admin-view');
+    const adminContent = document.querySelector('#admin-content');
     const transcript = document.querySelector('#dialogue');
     const messageField = document.querySelector('#message');
     const messageLabel = document.querySelector('#message-label');
@@ -57,6 +88,19 @@
     let gameState = null;
     let submitBusy = false;
     let pendingDialogue = null;
+    let latestAssistantText = '';
+    let latestAssistantVoice = {role: 'narrator', voiceIdentity: 'neutral'};
+    let speechRecoveryElement = null;
+    const voiceSettingsKey = 'ai-spel.voice-settings.v2';
+    let voiceSettings = window.GameVoice.loadSettings(localStorage, voiceSettingsKey, 'ai-spel.voice-settings.v1');
+    let voiceController;
+    let audioContext;
+    let voiceDisclosureAcknowledged = false;
+    let adminOffset = 0;
+    const adminPageSize = 50;
+    let presenceTimer = null;
+    let playerMessagesPrimed = false;
+    const seenPlayerMessageIds = new Set();
 
     async function request(path, options = {}) {
       const response = await fetch(path, {credentials: 'same-origin', ...options});
@@ -64,17 +108,227 @@
       if (!response.ok) throw new Error(body?.error || `HTTP ${response.status}`);
       return body;
     }
-    function appendLine(role, content) {
+    function appendLine(role, content, options = {}) {
       const line = document.createElement('li');
       line.dataset.role = role;
-      line.textContent = `${role === 'user' ? 'Du' : 'Berättelsen'}: ${content}`;
+      line.textContent = `${options.speaker || (role === 'user' ? 'Du' : 'Berättelsen')}: ${content}`;
       transcript.append(line);
       line.scrollIntoView({block: 'end'});
+      if (role === 'assistant') {
+        latestAssistantText = content;
+        latestAssistantVoice = options.voice || {role: 'narrator', voiceIdentity: 'neutral'};
+        if (options.speak !== false && location.pathname !== '/admin') {
+          voiceController?.speak(content, {...latestAssistantVoice, onStart: clearSpeechRecovery});
+        }
+      }
       return line;
     }
+    function biographyContextText(context) {
+      if (!context || typeof context !== 'object') return '';
+      const details = [];
+      if (typeof context.current_situation === 'string' && context.current_situation.trim()) {
+        details.push(`Nuvarande situation: ${context.current_situation.trim()}.`);
+      }
+      for (const [key, label] of [
+        ['skills', 'Färdigheter'],
+        ['possessions', 'Ägodelar som nämnts'],
+        ['obligations', 'Åtaganden'],
+        ['past_events', 'Tidigare händelser'],
+        ['known_people', 'Kända personer'],
+      ]) {
+        const values = context[key];
+        if (Array.isArray(values) && values.length) details.push(`${label}: ${values.join(', ')}.`);
+      }
+      return details.length ? `\n\nStartuppgifter att granska: ${details.join(' ')}` : '';
+    }
+    function explainDialogueError(error) {
+      const code = String(error?.message || '');
+      const known = {
+        dialogue_temporarily_unavailable: 'Berättartjänsten svarar inte just nu. Vänta en stund och försök igen.',
+        world_version_conflict: 'Världen hann ändras medan du skrev. Jag har uppdaterat läget; skicka meddelandet igen.',
+        world_not_available: 'Världen är inte tillgänglig just nu. Försök igen om en liten stund.',
+      };
+      return known[code] || (/^[a-z0-9_]+$/.test(code)
+        ? 'Jag kunde inte behandla det just nu. Försök igen om en liten stund.'
+        : code || 'Ett tillfälligt fel uppstod. Försök igen om en liten stund.');
+    }
+    function setVoiceStatus(message = '') {
+      document.querySelector('#voice-status').textContent = message;
+      const authVoiceStatus = document.querySelector('#auth-voice-status');
+      if (authVoiceStatus && !auth.hidden && message) authVoiceStatus.textContent = message;
+    }
+    function clearSpeechRecovery() {
+      speechRecoveryElement?.remove();
+      speechRecoveryElement = null;
+      const status = document.querySelector('#voice-status');
+      if (status?.textContent.startsWith('Uppläsningen startade inte')) setVoiceStatus('Läser upp dialog.');
+    }
+    function showSpeechRecovery(message) {
+      clearSpeechRecovery();
+      const item = document.createElement('li');
+      item.dataset.role = 'voice-controls';
+      item.setAttribute('aria-label', 'Uppläsning kunde inte starta');
+      const explanation = document.createElement('p');
+      explanation.textContent = message;
+      const retry = document.createElement('button');
+      retry.type = 'button';
+      retry.textContent = 'Läs senaste repliken';
+      retry.addEventListener('click', () => {
+        voiceController.activateFromUserGesture();
+        if (voiceController.speak(latestAssistantText, {...latestAssistantVoice, onStart: clearSpeechRecovery})) {
+          clearSpeechRecovery();
+        }
+      });
+      item.append(explanation, retry);
+      transcript.append(item);
+      item.scrollIntoView({block: 'end'});
+      speechRecoveryElement = item;
+    }
+    function refreshMicrophone() {
+      const button = document.querySelector('#microphone');
+      if (button) button.disabled = play.hidden || messageField.disabled || submitBusy;
+    }
+    function persistVoiceSettings() {
+      voiceSettings.mode = 'game-voice';
+      voiceSettings.autoSpeak = true;
+      if (!window.GameVoice.saveSettings(localStorage, voiceSettingsKey, voiceSettings)) {
+        setVoiceStatus('Röstinställningen kunde inte sparas i den här webbläsaren.');
+      }
+      voiceController?.update(voiceSettings);
+      transcript.setAttribute('aria-live', 'polite');
+    }
+    function playVoiceSignal(state) {
+      if (!voiceSettings.soundSignals || !['LISTENING', 'PROCESSING', 'ERROR', 'STOPPED'].includes(state)) return;
+      try {
+        const Audio = window.AudioContext || window.webkitAudioContext;
+        if (!Audio) return;
+        audioContext ||= new Audio();
+        if (audioContext.state === 'suspended') audioContext.resume();
+        const oscillator = audioContext.createOscillator(); const gain = audioContext.createGain();
+        oscillator.frequency.value = state === 'ERROR' ? 260 : state === 'PROCESSING' ? 820 : state === 'STOPPED' ? 420 : 560;
+        gain.gain.value = 0.025; oscillator.connect(gain); gain.connect(audioContext.destination);
+        oscillator.start(); oscillator.stop(audioContext.currentTime + 0.055);
+      } catch (_) { /* Audio cues are optional and never block the game. */ }
+    }
+    voiceController = window.GameVoice.createVoiceController({
+      settings: voiceSettings,
+      onState(state, message) {
+        const microphone = document.querySelector('#microphone');
+        const listening = state === 'LISTENING';
+        microphone.setAttribute('aria-pressed', String(listening));
+        microphone.textContent = listening ? 'Avsluta mikrofon' : 'Starta mikrofon';
+        refreshMicrophone();
+        if (message) setVoiceStatus(message);
+        else if (state === 'IDLE') setVoiceStatus('');
+        if (/Läs senaste repliken/.test(message)) showSpeechRecovery(message);
+        playVoiceSignal(state === 'IDLE' && /Mikrofonen är avstängd/.test(message) ? 'STOPPED' : state);
+      },
+      onTranscript(text) {
+        return submitMessage(text, 'voice');
+      },
+    });
+    function primeSpeechFromGesture(event) {
+      if (!event.isTrusted) return;
+      voiceController.activateFromUserGesture();
+    }
+    document.addEventListener('pointerdown', primeSpeechFromGesture, true);
+    document.addEventListener('keydown', primeSpeechFromGesture, true);
+    persistVoiceSettings();
+
+    function addVoiceButton(parent, label, handler) {
+      const button = document.createElement('button'); button.type = 'button'; button.textContent = label;
+      button.addEventListener('click', handler); parent.append(button); return button;
+    }
+    function appendVoiceSettings() {
+      const item = document.createElement('li'); item.dataset.role = 'voice-controls';
+      item.setAttribute('aria-label', 'Röstinställningar och uppläsning');
+      const heading = document.createElement('strong'); heading.textContent = 'Röstinställningar'; item.append(heading);
+      const fieldset = document.createElement('fieldset');
+      const legend = document.createElement('legend'); legend.textContent = 'Spelets repliker läses alltid upp. Anpassa rösten här.'; fieldset.append(legend);
+      const speedLabel = document.createElement('label'); speedLabel.textContent = `Talhastighet: ${Number(voiceSettings.rate).toFixed(1)}`;
+      const speed = document.createElement('input'); speed.type = 'range'; speed.min = '0.5'; speed.max = '2'; speed.step = '0.1'; speed.value = String(voiceSettings.rate);
+      speed.setAttribute('aria-label', 'Talhastighet'); speed.addEventListener('input', () => { speedLabel.firstChild.textContent = `Talhastighet: ${Number(speed.value).toFixed(1)}`; });
+      speedLabel.append(speed); fieldset.append(speedLabel);
+      const voiceLabel = document.createElement('label'); voiceLabel.textContent = 'Svensk röst';
+      const voice = document.createElement('select'); voice.setAttribute('aria-label', 'Svensk röst');
+      const defaultVoice = document.createElement('option'); defaultVoice.value = ''; defaultVoice.textContent = 'Systemets standardröst'; voice.append(defaultVoice);
+      const piperVoice = document.createElement('option');
+      piperVoice.value = 'piper-sv-nst';
+      piperVoice.textContent = 'Piper – svensk röst på enheten';
+      voice.append(piperVoice);
+      voice.value = piperVoice.value;
+      voiceSettings.voiceName = piperVoice.value;
+      voiceLabel.append(voice); fieldset.append(voiceLabel);
+      const modelCredits = document.createElement('a');
+      modelCredits.href = '/tts/piper-wasm-v1/voices/ATTRIBUTION.txt';
+      modelCredits.textContent = 'Svenska rösters upphov och licenser';
+      fieldset.append(modelCredits);
+      const signalLabel = document.createElement('label'); const signals = document.createElement('input');
+      signals.type = 'checkbox'; signals.checked = voiceSettings.soundSignals;
+      signalLabel.append(signals, document.createTextNode(' Ljudsignal vid röstinmatning')); fieldset.append(signalLabel);
+      item.append(fieldset);
+      const speakLatest = () => {
+        voiceController.activateFromUserGesture();
+        if (!voiceController.speak(latestAssistantText, {...latestAssistantVoice, onStart: clearSpeechRecovery})) setVoiceStatus('Talsyntes stöds inte i den här webbläsaren. Dialogen finns kvar som text.');
+      };
+      const testSpeech = () => {
+        voiceController.activateFromUserGesture();
+        if (!voiceController.speak('Det här är ett test av uppläsningen.', {role: 'narrator', voiceIdentity: 'neutral', onStart: clearSpeechRecovery})) {
+          setVoiceStatus('Talsyntes stöds inte i den här webbläsaren. Dialogen finns kvar som text.');
+        }
+      };
+      addVoiceButton(item, 'Testa ljudet', testSpeech);
+      addVoiceButton(item, 'Läs senaste repliken', speakLatest);
+      addVoiceButton(item, 'Upprepa', speakLatest);
+      addVoiceButton(item, 'Avbryt uppläsning', () => voiceController.cancelSpeech());
+      speed.addEventListener('change', () => { voiceSettings.rate = Number(speed.value); persistVoiceSettings(); });
+      voice.addEventListener('change', () => { voiceSettings.voiceName = voice.value; persistVoiceSettings(); });
+      signals.addEventListener('change', () => { voiceSettings.soundSignals = signals.checked; persistVoiceSettings(); });
+      addVoiceButton(item, 'Stäng röstinställningar', () => item.remove());
+      transcript.append(item); item.scrollIntoView({block: 'end'}); speed.focus();
+    }
+    function requestVoiceDisclosure() {
+      const item = document.createElement('li'); item.dataset.role = 'voice-controls';
+      item.setAttribute('aria-label', 'Information om mikrofonen');
+      const message = document.createElement('p');
+      message.textContent = 'Innan du startar: webbläsarens taligenkänning kan behandla ljud genom en tjänst som webbläsaren väljer. Spelet tar inte emot eller sparar ljudinspelningen. Den färdiga transkriberingen skickas och sparas som din vanliga dialog. Fortsätt bara om du godkänner webbläsarens hantering av tal.';
+      item.append(message);
+      voiceController.speak(message.textContent, {role: 'narrator', voiceIdentity: 'neutral'});
+      addVoiceButton(item, 'Jag förstår – starta mikrofonen', () => {
+        voiceDisclosureAcknowledged = true;
+        item.remove();
+        voiceController.startListening();
+      });
+      transcript.append(item); item.scrollIntoView({block: 'end'});
+      item.querySelector('button').focus();
+    }
+    function handleVoiceCommand(message, source) {
+      const parsed = window.GameVoice.parseVoiceCommand(message, {requirePrefix: source === 'voice'});
+      if (!parsed) return false;
+      if (parsed.command === 'settings') {
+        appendLine('assistant', 'Här kan du välja en svensk röst och justera talhastigheten. Alla repliker i spelet läses upp automatiskt.');
+        appendVoiceSettings();
+      }
+      else if (parsed.command === 'repeat') {
+        if (!voiceController.speak(latestAssistantText, latestAssistantVoice)) setVoiceStatus('Talsyntes stöds inte i den här webbläsaren. Dialogen finns kvar som text.');
+      } else if (parsed.command === 'stop') {
+        voiceController.cancelSpeech(); voiceController.stopListening(); setVoiceStatus('Röstinteraktionen är avbruten.');
+      } else if (parsed.command === 'help') {
+        appendLine('assistant', 'Skriv röstinställningar för att välja svensk röst och talhastighet. Spelets repliker läses alltid upp. Du kan tala i mikrofonen när den finns, eller skriva. Använd “röstkommando upprepa” för att höra senaste repliken igen.');
+      } else setVoiceStatus('Okänt röstkommando. Skriv röstinställningar för alternativen.');
+      return true;
+    }
+    document.querySelector('#microphone').addEventListener('click', () => {
+      if (voiceController.getState() === 'LISTENING') voiceController.stopListening();
+      else if (!voiceDisclosureAcknowledged && voiceController.supportsRecognition()) requestVoiceDisclosure();
+      else voiceController.startListening();
+    });
+    document.addEventListener('visibilitychange', () => { if (document.hidden) voiceController.stopAll(); });
+    window.addEventListener('pagehide', () => voiceController.stopAll());
     function setStage(next) {
       stage = next;
       messageField.disabled = false;
+      refreshMicrophone();
       messageField.value = '';
       messageLabel.textContent = next === 'biography'
         ? 'Berätta fritt om personen du vill spela'
@@ -88,15 +342,177 @@
     function showAuth() {
       stage = 'auth';
       play.hidden = true;
+      adminView.hidden = true;
       auth.hidden = false;
+      document.querySelector('#auth-heading').textContent = location.pathname === '/admin' ? 'Administratörsinloggning' : 'Svensk livssimulator';
       document.querySelector('#version-footer').hidden = false;
+      const adminRoute = location.pathname === '/admin';
+      document.querySelector('#auth-intro').hidden = adminRoute;
+      document.querySelector('#auth-repeat-intro').hidden = adminRoute;
+      document.querySelector('[name="intent"][value="register"]').hidden = adminRoute;
+      if (!adminRoute) playFirstVisitIntroduction();
     }
     function showPlay() {
       auth.hidden = true;
+      adminView.hidden = true;
       play.hidden = false;
-      document.querySelector('#version-footer').hidden = true;
+      refreshMicrophone();
       messageField.focus();
     }
+    function showAdmin() {
+      if (presenceTimer) clearInterval(presenceTimer);
+      presenceTimer = null;
+      voiceController.stopAll();
+      auth.hidden = true;
+      play.hidden = true;
+      adminView.hidden = false;
+      document.querySelector('#version-footer').hidden = true;
+    }
+    const introductionKey = 'ai-spel.introduction-heard.v2';
+    function playFirstVisitIntroduction() {
+      let alreadyHeard = false;
+      try { alreadyHeard = localStorage.getItem(introductionKey) === 'true'; } catch (_) { /* Keep the intro available for this visit. */ }
+      if (alreadyHeard) return;
+      const isAppleMobile = /iPad|iPhone|iPod/i.test(navigator.userAgent)
+        || (navigator.platform === 'MacIntel' && navigator.maxTouchPoints > 1);
+      if (isAppleMobile) {
+        document.querySelector('#auth-repeat-intro').textContent = 'Läs introduktionen';
+        return;
+      }
+      const introduction = document.querySelector('#auth-intro').textContent;
+      voiceController.speak(introduction, {
+        role: 'narrator', voiceIdentity: 'neutral',
+        onStart() { try { localStorage.setItem(introductionKey, 'true'); } catch (_) { /* The page text remains available. */ } },
+      });
+    }
+    document.querySelector('#auth-repeat-intro').addEventListener('click', () => {
+      if (location.pathname !== '/admin') {
+        voiceController.activateFromUserGesture();
+        const introduction = document.querySelector('#auth-intro').textContent;
+        voiceController.speak(introduction, {
+          role: 'narrator', voiceIdentity: 'neutral',
+          onStart() { try { localStorage.setItem(introductionKey, 'true'); } catch (_) { /* The page text remains available. */ } },
+        });
+      }
+    });
+    function explainAuthError(error, intent) {
+      if (intent === 'register' && error?.message === 'username_unavailable') return 'Det användarnamnet används redan. Välj ett annat och försök igen.';
+      if (intent === 'register' && ['invalid_username', 'password_length_must_be_12_to_256'].includes(error?.message)) return 'Kontot kunde inte skapas. Användarnamnet ska ha 3 till 40 bokstäver, siffror eller tecknen punkt, bindestreck och understreck. Lösenordet ska ha minst tolv tecken.';
+      if (intent === 'login' && ['unauthorized', 'invalid_credentials'].includes(error?.message)) return 'Användarnamnet eller lösenordet stämmer inte. Försök igen.';
+      return 'Begäran kunde inte genomföras just nu. Kontrollera uppgifterna och försök igen.';
+    }
+    function adminElement(tag, text, parent = adminContent) {
+      const element = document.createElement(tag);
+      if (text !== undefined) element.textContent = text;
+      parent.append(element);
+      return element;
+    }
+    function adminJson(title, value, parent = adminContent) {
+      const details = adminElement('details', undefined, parent);
+      adminElement('summary', title, details);
+      adminElement('pre', JSON.stringify(value, null, 2), details);
+      return details;
+    }
+    async function loadAdminPlayers(query = '', offset = 0) {
+      adminOffset = offset;
+      adminContent.replaceChildren();
+      const search = adminElement('form');
+      search.id = 'player-search';
+      const label = adminElement('label', 'Sök efter användarnamn eller karaktär', search);
+      const field = document.createElement('input');
+      field.type = 'search'; field.name = 'q'; field.value = query; field.maxLength = 100;
+      label.append(field);
+      const submit = adminElement('button', 'Sök', search); submit.type = 'submit';
+      search.addEventListener('submit', event => { event.preventDefault(); loadAdminPlayers(field.value, 0); });
+      const result = await request(`/api/admin/players?q=${encodeURIComponent(query)}&limit=${adminPageSize}&offset=${offset}`);
+      adminElement('p', `${result.total} spelare. Visar ${result.offset + 1}–${Math.min(result.total, result.offset + result.players.length)}.`, adminContent);
+      const list = adminElement('ul');
+      for (const player of result.players) {
+        const item = adminElement('li', undefined, list);
+        const button = adminElement('button', `${player.username} · ${player.character_name || 'ingen karaktär'} · världsversion ${player.world_version ?? 'saknas'}`, item);
+        button.type = 'button'; button.addEventListener('click', () => openAdminPlayer(player.account_id));
+      }
+      const paging = adminElement('div');
+      const previous = adminElement('button', 'Föregående sida', paging);
+      previous.type = 'button'; previous.disabled = offset <= 0; previous.addEventListener('click', () => loadAdminPlayers(query, Math.max(0, offset - adminPageSize)));
+      const next = adminElement('button', 'Nästa sida', paging);
+      next.type = 'button'; next.disabled = offset + result.players.length >= result.total; next.addEventListener('click', () => loadAdminPlayers(query, offset + adminPageSize));
+    }
+    async function openAdminPlayer(accountId) {
+      adminContent.replaceChildren();
+      const back = adminElement('button', 'Tillbaka till spelare'); back.type = 'button'; back.addEventListener('click', () => loadAdminPlayers('', adminOffset));
+      adminElement('h2', 'Spelarprofil');
+      const profile = await request(`/api/admin/players/${encodeURIComponent(accountId)}`);
+      adminJson(`${profile.username} · profil och biografi`, profile);
+      const trace = await request(`/api/admin/players/${encodeURIComponent(accountId)}/trace?limit=200`);
+      const entries = [
+        ...trace.events.map(event => ({kind: 'Världshändelse', at: event.recorded_at, order: event.commit_sequence, data: event})),
+        ...trace.player_messages.map(message => ({kind: 'Privat spelarmeddelande', at: message.recorded_at, order: message.sequence, data: message})),
+        ...trace.ai_interactions.map(interaction => ({kind: `AI ${interaction.prompt_id} · ${interaction.outcome}`, at: interaction.requested_at, order: interaction.correlation_id, data: interaction}))
+      ].sort((a, b) => String(a.at).localeCompare(String(b.at)));
+      adminElement('h2', 'Kronologiskt spelarspår');
+      adminElement('p', 'Registreringstid visas separat från världstid och commitordning. AI-frågor, svar och världshändelser är korrelerade där korrelations-ID finns.');
+      for (const [index, entry] of entries.entries()) {
+        const status = entry.data.execution_mode || entry.data.metadata?.decision || entry.data.outcome || 'status okänd';
+        adminJson(`${index + 1}. ${entry.kind} · ${status} · ${entry.at} · ${entry.order}`, entry.data);
+        if (entry.data.external_call && Object.keys(entry.data.external_call).length > 0) {
+          const call = entry.data.external_call;
+          const outcome = call.error || `HTTP ${call.response_status ?? 'okänt'}`;
+          adminJson(`Externt tjänsteanrop · ${call.service || 'okänd tjänst'} · ${outcome} · ${call.duration_ms ?? '?'} ms`, call);
+        }
+      }
+    }
+    async function loadAdminPrompts() {
+      adminContent.replaceChildren();
+      const result = await request('/api/admin/prompts');
+      adminElement('h2', 'Prompttillgångar');
+      for (const prompt of result.prompts) adminJson(`${prompt.id} · version ${prompt.version}`, prompt.yaml);
+    }
+    async function loadAdminRules() {
+      adminContent.replaceChildren();
+      const result = await request('/api/admin/rules');
+      adminElement('h2', 'Luau-regler');
+      for (const rule of result.rules) adminJson(`${rule.rule_key} · v${rule.version} · ${rule.active ? 'aktiv' : 'inaktiv'} · ${rule.source_hash}`, {source: rule.source, validation_results: rule.validation_results, created_at: rule.created_at});
+    }
+    async function loadAdminAudit() {
+      adminContent.replaceChildren();
+      const result = await request('/api/admin/audit?limit=200');
+      adminElement('h2', 'Revisionslogg');
+      for (const entry of result.entries) adminJson(`${entry.created_at} · ${entry.action} · ${entry.admin_account_id || entry.operator_identity}`, entry);
+    }
+    async function loadAdminLogging() {
+      adminContent.replaceChildren();
+      const result = await request('/api/admin/settings/logging');
+      adminElement('h2', 'Driftloggar');
+      adminElement('p', 'debug=true skriver detaljerade tekniska händelser för HTTP, AI-anrop, validering och commit. debug=false behåller korta tekniska åtkomstloggar och fel. Ändringen sparas i databasen och börjar gälla utan omstart. Spelartext, promptinnehåll, AI-svar, sessionsuppgifter och hemligheter skrivs aldrig till poddloggarna.');
+      const form = adminElement('form');
+      const label = adminElement('label', undefined, form);
+      const checkbox = document.createElement('input');
+      checkbox.type = 'checkbox'; checkbox.name = 'debug'; checkbox.checked = result.debug;
+      label.append(checkbox, document.createTextNode(' Aktivera verbose felsökningsloggar (debug=true)'));
+      const save = adminElement('button', 'Spara loggnivå', form); save.type = 'submit';
+      const status = adminElement('p', `Aktuell nivå: debug=${result.debug}`);
+      status.setAttribute('role', 'status');
+      form.addEventListener('submit', async event => {
+        event.preventDefault(); save.disabled = true;
+        try {
+          const updated = await request('/api/admin/settings/logging', {
+            method: 'PUT', headers: {'content-type': 'application/json'},
+            body: JSON.stringify({debug: checkbox.checked}),
+          });
+          status.textContent = `Aktuell nivå: debug=${updated.debug}. Ändringen gäller utan omstart.`;
+        } catch (error) {
+          status.textContent = `Loggnivån kunde inte ändras: ${error.message}`;
+        } finally { save.disabled = false; }
+      });
+    }
+    async function openAdmin() {
+      showAdmin();
+      adminContent.setAttribute('aria-busy', 'true');
+      try { await loadAdminPlayers(); }
+      catch (error) { adminContent.replaceChildren(); adminElement('p', `Administrationsvyn kunde inte öppnas: ${error.message}`); }
+      finally { adminContent.setAttribute('aria-busy', 'false'); }
+    }
     function appendInitialPrompt() {
       appendLine('assistant', 'Välkommen. Skriv fritt om personen du vill spela. Jag föreslår en vuxen biografi som du kan ändra innan du godkänner den.');
       setStage('biography');
@@ -145,8 +561,11 @@
     async function loadSavedDialogue() {
       const lines = await request('/api/dialogue');
       transcript.replaceChildren();
-      for (const line of lines) appendLine(line.role === 'user' ? 'user' : 'assistant', line.content);
+      latestAssistantText = '';
-      if (lines.length === 0 && gameState?.world) {
+      for (const line of lines) appendLine(line.role === 'user' ? 'user' : 'assistant', line.content, {speak: false});
+      if (lines.length > 0 && latestAssistantText && location.pathname !== '/admin') {
+        voiceController?.speak(latestAssistantText, {role: 'narrator', voiceIdentity: 'neutral'});
+      } else if (lines.length === 0 && gameState?.world) {
         const place = gameState.world.location;
         const senses = place.senses || {};
         appendLine('assistant', `Du börjar på ${place.name}. ${place.description} Ljud: ${senses.sound || 'Inget särskilt ljud beskrivet.'} Doft: ${senses.smell || 'Ingen särskild doft beskriven.'} Luft och temperatur: ${senses.air_and_temperature || 'Inte beskrivet.'} Beröring och ytor: ${senses.touch_and_surfaces || 'Inte beskrivet.'} Orientering: ${senses.spatial_orientation || 'Inte beskrivet.'}`);
@@ -169,9 +588,24 @@
       }
       await loadSavedDialogue();
       setStage('game');
+      startPlayerPresence();
+      announcePlayerChatHelp();
+    }
+    function announcePlayerChatHelp() {
+      const key = 'ai-spel.player-chat-help.v1';
+      try {
+        if (localStorage.getItem(key) === 'true') return;
+        localStorage.setItem(key, 'true');
+      } catch (_) { /* The help remains available through dialogue questions. */ }
+      appendLine('assistant', 'Du kan fråga vilka andra spelare som är här, säga “Säg till Robin: hej” för att skriva direkt till en spelare eller be mig visa meddelanden från spelare.');
     }
     async function handleLogout() {
+      if (presenceTimer) clearInterval(presenceTimer);
+      presenceTimer = null;
+      playerMessagesPrimed = false;
+      seenPlayerMessageIds.clear();
       await request('/api/logout', {method: 'POST'});
+      if (location.pathname !== '/admin') appendLine('assistant', 'Du har loggat ut. Logga in igen för att fortsätta spela.');
       characterDraft = null;
       gameState = null;
       transcript.replaceChildren();
@@ -209,7 +643,7 @@
           body: JSON.stringify({input: message, current_draft: characterDraft}),
         });
         characterDraft = proposal.draft;
-        appendLine('assistant', `${proposal.message}\n\nFörslag: ${characterDraft.name}, ${characterDraft.age} år.\n${characterDraft.biography}\n\nSkriv ändringar eller “godkänn”.`);
+        appendLine('assistant', `${proposal.message}\n\nFörslag: ${characterDraft.name}, ${characterDraft.age} år.\n${characterDraft.biography}${biographyContextText(characterDraft.life_context)}\n\nSkriv ändringar eller “godkänn”.`);
       } catch (error) {
         appendLine('assistant', `Jag kunde inte ta fram ett biografiförslag: ${error.message}. Försök igen när tjänsten svarar.`);
       }
@@ -236,6 +670,7 @@
         else await proposeWorld(message);
         return;
       }
+      if (await handlePlayerMessageCommand(message)) return;
       const idempotencyKey = pendingDialogue?.message === message
         ? pendingDialogue.idempotencyKey
         : crypto.randomUUID();
@@ -261,10 +696,19 @@
         gameState.world.version = result.world_version;
         gameState.world.world_time = result.world_time;
         pendingDialogue = null;
-        appendLine('assistant', result.reply);
+        if (result.intent === 'move' || result.intent === 'meet') {
+          try {
+            const refreshed = await request('/api/world');
+            if (refreshed.world) gameState = refreshed;
+          } catch (_) { /* The committed dialogue stays successful if this optional view refresh fails. */ }
+        }
+        const speakingNpc = ['speak', 'meet'].includes(result.intent) ? gameState.world.npc : null;
+        appendLine('assistant', result.reply, speakingNpc
+          ? {speaker: speakingNpc.name, voice: {characterId: speakingNpc.id, voiceIdentity: speakingNpc.voice_identity}}
+          : {speaker: 'Berättelsen', voice: {role: 'narrator', voiceIdentity: 'neutral'}});
       } catch (error) {
         messageField.value = message;
-        appendLine('assistant', `Meddelandet kunde inte behandlas: ${error.message}. Texten ligger kvar i inmatningen; skicka igen för att försöka på nytt.`);
+        appendLine('assistant', `${explainDialogueError(error)} Ditt meddelande ligger kvar i inmatningen.`);
       }
       messageField.disabled = false;
       messageField.focus();
@@ -278,17 +722,27 @@
       try {
         await request(`/api/${intent}`, {method: 'POST', headers: {'content-type': 'application/json'}, body: JSON.stringify({username: data.get('username'), password: data.get('password')})});
         form.reset();
-        await openGame();
+        if (location.pathname === '/admin') await openAdmin(); else await openGame();
       } catch (error) {
-        window.alert(`Kunde inte logga in: ${error.message}`);
+        const status = document.querySelector('#auth-status');
+        status.textContent = explainAuthError(error, intent);
+        status.hidden = false;
+        if (location.pathname !== '/admin') voiceController.speak(status.textContent, {role: 'narrator', voiceIdentity: 'neutral'});
       }
     });
-    document.querySelector('#message-form').addEventListener('submit', async (event) => {
+    async function submitMessage(input, source = 'text') {
-      event.preventDefault();
       if (submitBusy || messageField.disabled) return;
-      const message = messageField.value.trim();
+      const message = String(input || '').trim();
       if (!message) return;
+      if (handleVoiceCommand(message, source)) { messageField.value = ''; return; }
       submitBusy = true;
+      refreshMicrophone();
+      voiceController.stopListening();
+      voiceController.cancelSpeech();
+      // cancel() above may also have discarded Safari's silent speech-channel
+      // primer. Restore it synchronously inside the submit gesture, before
+      // waiting for the API response that will be read aloud.
+      voiceController.activateFromUserGesture();
       messageField.value = '';
       try {
         if (stage === 'biography') await handleBiography(message);
@@ -297,9 +751,107 @@
         appendLine('assistant', `Det gick inte att genomföra begäran: ${error.message}`);
       } finally {
         submitBusy = false;
+        refreshMicrophone();
         if (!play.hidden && !messageField.disabled) messageField.focus();
       }
+    }
+    async function handlePlayerMessageCommand(message) {
+      const listPlayers = /^(?:vilka (?:andra )?spelare är här|finns det andra spelare här)\??$/i.test(message.trim());
+      const sendMatch = /^(?:säg|skriv|skicka) till ([^:]{1,80}):\s*(.{1,4000})$/is.exec(message.trim());
+      const readMessages = /^(?:visa|läs upp) (?:de senaste )?meddelanden från spelare\.?$/i.test(message.trim());
+      if (!listPlayers && !sendMatch && !readMessages) return false;
+      appendLine('user', message);
+      try {
+        if (listPlayers) {
+          const players = await request('/api/players/nearby');
+          appendLine('assistant', players.length
+            ? `Här finns ${players.map(player => player.name).join(', ')} att prata med.`
+            : 'Just nu finns inga andra inloggade spelare på platsen.');
+          return true;
+        }
+        if (readMessages) {
+          const messages = await request('/api/player/messages');
+          const recent = messages.slice(-10);
+          if (recent.length === 0) appendLine('assistant', 'Du har inga sparade meddelanden från andra spelare.');
+          else for (const entry of recent) {
+            seenPlayerMessageIds.add(entry.id);
+            const isIncoming = entry.direction === 'incoming';
+            appendLine(isIncoming ? 'assistant' : 'user', entry.message, isIncoming
+              ? {speaker: entry.sender_name, voice: {characterId: entry.sender_character_id, voiceIdentity: entry.sender_voice_identity}}
+              : {speaker: 'Du', speak: false});
+          }
+          return true;
+        }
+        const players = await request('/api/players/nearby');
+        const targetName = sendMatch[1].trim();
+        const matches = players.filter(player => player.name.localeCompare(targetName, 'sv', {sensitivity: 'base'}) === 0);
+        if (matches.length === 0) {
+          appendLine('assistant', `Jag hittar ingen inloggad spelare som heter ${targetName} på platsen. Fråga vilka andra spelare som är här.`);
+          return true;
+        }
+        if (matches.length > 1) {
+          appendLine('assistant', `Flera spelare heter ${targetName}. Säg vilket namn de använder i spelet.`);
+          return true;
+        }
+        const key = pendingPlayerMessage?.text === sendMatch[2] && pendingPlayerMessage?.target === matches[0].character_id
+          ? pendingPlayerMessage.key
+          : crypto.randomUUID();
+        pendingPlayerMessage = {text: sendMatch[2], target: matches[0].character_id, key};
+        const result = await request(`/api/players/${encodeURIComponent(matches[0].character_id)}/messages`, {
+          method: 'POST', headers: {'content-type': 'application/json'},
+          body: JSON.stringify({message: sendMatch[2], idempotency_key: key}),
         });
+        pendingPlayerMessage = null;
+        appendLine('assistant', `Ditt meddelande skickades till ${matches[0].name}.`);
+        return Boolean(result.message_id);
+      } catch (error) {
+        messageField.value = message;
+        appendLine('assistant', `Spelarmeddelandet kunde inte hanteras: ${explainDialogueError(error)}`);
+        return true;
+      }
+    }
+    let pendingPlayerMessage = null;
+    async function startPlayerPresence() {
+      if (presenceTimer) clearInterval(presenceTimer);
+      const refresh = async (announceNewMessages) => {
+        if (play.hidden || stage !== 'game') return;
+        try {
+          await request('/api/presence/heartbeat', {method: 'POST'});
+          const messages = await request('/api/player/messages');
+          for (const entry of messages) {
+            if (seenPlayerMessageIds.has(entry.id)) continue;
+            if (announceNewMessages && entry.direction === 'incoming'
+                && (submitBusy || ['LISTENING', 'PROCESSING', 'SPEAKING'].includes(voiceController.getState()))) continue;
+            seenPlayerMessageIds.add(entry.id);
+            if (announceNewMessages && entry.direction === 'incoming') {
+              appendLine('assistant', entry.message, {
+                speaker: entry.sender_name,
+                voice: {characterId: entry.sender_character_id, voiceIdentity: entry.sender_voice_identity},
+              });
+            }
+          }
+          playerMessagesPrimed = true;
+        } catch (_) { /* Presence is a hint; the text game remains usable if it is unavailable. */ }
+      };
+      await refresh(playerMessagesPrimed);
+      presenceTimer = setInterval(() => refresh(true), 30_000);
+    }
+    document.querySelector('#message-form').addEventListener('submit', async (event) => {
+      event.preventDefault();
+      await submitMessage(messageField.value);
+    });
+    document.querySelectorAll('[data-admin-view]').forEach(button => button.addEventListener('click', async () => {
+      adminContent.setAttribute('aria-busy', 'true');
+      try {
+        if (button.dataset.adminView === 'players') await loadAdminPlayers();
+        else if (button.dataset.adminView === 'prompts') await loadAdminPrompts();
+        else if (button.dataset.adminView === 'rules') await loadAdminRules();
+        else if (button.dataset.adminView === 'logging') await loadAdminLogging();
+        else await loadAdminAudit();
+      } catch (error) { adminContent.replaceChildren(); adminElement('p', `Vyn kunde inte läsas: ${error.message}`); }
+      finally { adminContent.setAttribute('aria-busy', 'false'); }
+    }));
+    document.querySelector('#admin-logout').addEventListener('click', handleLogout);
     messageField.addEventListener('keydown', (event) => {
       if (event.key === 'Enter' && !event.shiftKey && !event.isComposing) {
         event.preventDefault();
@@ -311,7 +863,7 @@
     }).catch(() => {
       document.querySelector('#api-version').textContent = 'otillgänglig';
     });
-    request('/api/me').then(openGame).catch(showAuth);
+    request('/api/me').then(() => location.pathname === '/admin' ? openAdmin() : openGame()).catch(showAuth);
   </script>
 </body>
 </html>

nginx/default.conf

@@ -9,8 +9,27 @@ server {
         return 204;
     }
 
+    location ^~ /tts/piper-wasm-v1/ {
+        types {
+            application/wasm wasm;
+            application/javascript js;
+            application/json json;
+            application/octet-stream onnx;
+            text/plain txt;
+        }
+        add_header Cache-Control "public, max-age=31536000, immutable" always;
+        add_header Cross-Origin-Opener-Policy "same-origin" always;
+        add_header Cross-Origin-Embedder-Policy "require-corp" always;
+        add_header Cross-Origin-Resource-Policy "same-origin" always;
+        try_files $uri =404;
+    }
+
     location / {
-        add_header Cache-Control "no-cache" always;
+        add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
+        add_header Pragma "no-cache" always;
+        add_header Expires "0" always;
+        add_header Cross-Origin-Opener-Policy "same-origin" always;
+        add_header Cross-Origin-Embedder-Policy "require-corp" always;
         try_files $uri $uri/ /index.html;
     }
 }

package-lock.json

@@ -0,0 +1,610 @@
+{
+  "name": "ai-spel-frontend-assets",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "ai-spel-frontend-assets",
+      "dependencies": {
+        "@diffusionstudio/piper-wasm": "1.0.0",
+        "@mintplex-labs/piper-tts-web": "1.0.3",
+        "esbuild": "0.25.5",
+        "onnxruntime-web": "1.20.1"
+      }
+    },
+    "node_modules/@diffusionstudio/piper-wasm": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/@diffusionstudio/piper-wasm/-/piper-wasm-1.0.0.tgz",
+      "integrity": "sha512-4Hgh7wJ1PuGEVgVi1CpducESnyXwjFRJN4zXjYRpxgquM+Zh6Eqq8ZaiGpCKm4yXvT1Y2SPQXbv0dEckFD9NaQ==",
+      "license": "MIT"
+    },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.5.tgz",
+      "integrity": "sha512-9o3TMmpmftaCMepOdA5k/yDw8SfInyzWWTjYTFCX3kPSDJMROQTb8jg+h9Cnwnmm1vOzvxN7gIfB5V2ewpjtGA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.5.tgz",
+      "integrity": "sha512-AdJKSPeEHgi7/ZhuIPtcQKr5RQdo6OO2IL87JkianiMYMPbCtot9fxPbrMiBADOWWm3T2si9stAiVsGbTQFkbA==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.5.tgz",
+      "integrity": "sha512-VGzGhj4lJO+TVGV1v8ntCZWJktV7SGCs3Pn1GRWI1SBFtRALoomm8k5E9Pmwg3HOAal2VDc2F9+PM/rEY6oIDg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.5.tgz",
+      "integrity": "sha512-D2GyJT1kjvO//drbRT3Hib9XPwQeWd9vZoBJn+bu/lVsOZ13cqNdDeqIF/xQ5/VmWvMduP6AmXvylO/PIc2isw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.5.tgz",
+      "integrity": "sha512-GtaBgammVvdF7aPIgH2jxMDdivezgFu6iKpmT+48+F8Hhg5J/sfnDieg0aeG/jfSvkYQU2/pceFPDKlqZzwnfQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.5.tgz",
+      "integrity": "sha512-1iT4FVL0dJ76/q1wd7XDsXrSW+oLoquptvh4CLR4kITDtqi2e/xwXwdCVH8hVHU43wgJdsq7Gxuzcs6Iq/7bxQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.5.tgz",
+      "integrity": "sha512-nk4tGP3JThz4La38Uy/gzyXtpkPW8zSAmoUhK9xKKXdBCzKODMc2adkB2+8om9BDYugz+uGV7sLmpTYzvmz6Sw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.5.tgz",
+      "integrity": "sha512-PrikaNjiXdR2laW6OIjlbeuCPrPaAl0IwPIaRv+SMV8CiM8i2LqVUHFC1+8eORgWyY7yhQY+2U2fA55mBzReaw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.5.tgz",
+      "integrity": "sha512-cPzojwW2okgh7ZlRpcBEtsX7WBuqbLrNXqLU89GxWbNt6uIg78ET82qifUy3W6OVww6ZWobWub5oqZOVtwolfw==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.5.tgz",
+      "integrity": "sha512-Z9kfb1v6ZlGbWj8EJk9T6czVEjjq2ntSYLY2cw6pAZl4oKtfgQuS4HOq41M/BcoLPzrUbNd+R4BXFyH//nHxVg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.5.tgz",
+      "integrity": "sha512-sQ7l00M8bSv36GLV95BVAdhJ2QsIbCuCjh/uYrWiMQSUuV+LpXwIqhgJDcvMTj+VsQmqAHL2yYaasENvJ7CDKA==",
+      "cpu": [
+        "ia32"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.5.tgz",
+      "integrity": "sha512-0ur7ae16hDUC4OL5iEnDb0tZHDxYmuQyhKhsPBV8f99f6Z9KQM02g33f93rNH5A30agMS46u2HP6qTdEt6Q1kg==",
+      "cpu": [
+        "loong64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.5.tgz",
+      "integrity": "sha512-kB/66P1OsHO5zLz0i6X0RxlQ+3cu0mkxS3TKFvkb5lin6uwZ/ttOkP3Z8lfR9mJOBk14ZwZ9182SIIWFGNmqmg==",
+      "cpu": [
+        "mips64el"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.5.tgz",
+      "integrity": "sha512-UZCmJ7r9X2fe2D6jBmkLBMQetXPXIsZjQJCjgwpVDz+YMcS6oFR27alkgGv3Oqkv07bxdvw7fyB71/olceJhkQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.5.tgz",
+      "integrity": "sha512-kTxwu4mLyeOlsVIFPfQo+fQJAV9mh24xL+y+Bm6ej067sYANjyEw1dNHmvoqxJUCMnkBdKpvOn0Ahql6+4VyeA==",
+      "cpu": [
+        "riscv64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.5.tgz",
+      "integrity": "sha512-K2dSKTKfmdh78uJ3NcWFiqyRrimfdinS5ErLSn3vluHNeHVnBAFWC8a4X5N+7FgVE1EjXS1QDZbpqZBjfrqMTQ==",
+      "cpu": [
+        "s390x"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.5.tgz",
+      "integrity": "sha512-uhj8N2obKTE6pSZ+aMUbqq+1nXxNjZIIjCjGLfsWvVpy7gKCOL6rsY1MhRh9zLtUtAI7vpgLMK6DxjO8Qm9lJw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.5.tgz",
+      "integrity": "sha512-pwHtMP9viAy1oHPvgxtOv+OkduK5ugofNTVDilIzBLpoWAM16r7b/mxBvfpuQDpRQFMfuVr5aLcn4yveGvBZvw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.5.tgz",
+      "integrity": "sha512-WOb5fKrvVTRMfWFNCroYWWklbnXH0Q5rZppjq0vQIdlsQKuw6mdSihwSo4RV/YdQ5UCKKvBy7/0ZZYLBZKIbwQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.5.tgz",
+      "integrity": "sha512-7A208+uQKgTxHd0G0uqZO8UjK2R0DDb4fDmERtARjSHWxqMTye4Erz4zZafx7Di9Cv+lNHYuncAkiGFySoD+Mw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.5.tgz",
+      "integrity": "sha512-G4hE405ErTWraiZ8UiSoesH8DaCsMm0Cay4fsFWOOUcz8b8rC6uCvnagr+gnioEjWn0wC+o1/TAHt+It+MpIMg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.5.tgz",
+      "integrity": "sha512-l+azKShMy7FxzY0Rj4RCt5VD/q8mG/e+mDivgspo+yL8zW7qEwctQ6YqKX34DTEleFAvCIUviCFX1SDZRSyMQA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.5.tgz",
+      "integrity": "sha512-O2S7SNZzdcFG7eFKgvwUEZ2VG9D/sn/eIiz8XRZ1Q/DO5a3s76Xv0mdBzVM5j5R639lXQmPmSo0iRpHqUUrsxw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.5.tgz",
+      "integrity": "sha512-onOJ02pqs9h1iMJ1PQphR+VZv8qBMQ77Klcsqv9CNW2w6yLqoURLcgERAIurY6QE63bbLuqgP9ATqajFLK5AMQ==",
+      "cpu": [
+        "ia32"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.5.tgz",
+      "integrity": "sha512-TXv6YnJ8ZMVdX+SXWVBo/0p8LTcrUYngpWjvm91TMjjBQii7Oz11Lw5lbDV5Y0TzuhSJHwiH4hEtC1I42mMS0g==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@mintplex-labs/piper-tts-web": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@mintplex-labs/piper-tts-web/-/piper-tts-web-1.0.3.tgz",
+      "integrity": "sha512-vjYiEgigm0JHt9yKxj0euQd2eHIhtbGgWyeySLTPG+CdCH9RMf10WtczpeslboUYAvX5Eaxh6RMK+IuHU2rNhw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "onnxruntime-web": "^1.18.0"
+      }
+    },
+    "node_modules/@protobufjs/aspromise": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/aspromise/-/aspromise-1.1.2.tgz",
+      "integrity": "sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/base64": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/base64/-/base64-1.1.2.tgz",
+      "integrity": "sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/codegen": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.5.tgz",
+      "integrity": "sha512-zgXFLzW3Ap33e6d0Wlj4MGIm6Ce8O89n/apUaGNB/jx+hw+ruWEp7EwGUshdLKVRCxZW12fp9r40E1mQrf/34g==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/eventemitter": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.1.tgz",
+      "integrity": "sha512-vW1GmwMZNnL+gMRaovlh9yZX74kc+TTU3FObkkurpMaRtBfLP3ldjS9KQWlwZgraRE0+dheEEoAxdzcJQ8eXZg==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/fetch": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.1.tgz",
+      "integrity": "sha512-GpptLrs57adMSuHi3VNj0mAF8dwh36LMaYF6XyJ6JMWlVsc+t42tm1HSEDmOs3A8fC9yyeisgLhsTVQokOZ0zw==",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@protobufjs/aspromise": "^1.1.1"
+      }
+    },
+    "node_modules/@protobufjs/float": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/float/-/float-1.0.2.tgz",
+      "integrity": "sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/path": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/path/-/path-1.1.2.tgz",
+      "integrity": "sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/pool": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@protobufjs/pool/-/pool-1.1.0.tgz",
+      "integrity": "sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/utf8": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/utf8/-/utf8-1.1.2.tgz",
+      "integrity": "sha512-b1UQwcEZ4yCnMCD8DAL1VlbvBJE9/IX4FTIp7BG1xYpf29SLazLSrqUkj4w7Y5y7cCVP6E5tcqqcI0xemPkHug==",
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@types/node": {
+      "version": "26.6.5",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.5.tgz",
+      "integrity": "sha512-uMzsv9stDdofIZBx4UGh4Z9ZgXnGC9seRDscilBcTHAeOFk67MZg/k9bWVfO+bk4qZmG+l52hRnLwUiH2LnJTg==",
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~8.9.0"
+      }
+    },
+    "node_modules/esbuild": {
+      "version": "0.25.5",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.5.tgz",
+      "integrity": "sha512-P8OtKZRv/5J5hhz0cUAdu/cLuPIKXpQl1R9pZtvmHWQvrAUVd0UNIPT4IB4W3rNOqVO0rlqHmCIbSwxh/c9yUQ==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.25.5",
+        "@esbuild/android-arm": "0.25.5",
+        "@esbuild/android-arm64": "0.25.5",
+        "@esbuild/android-x64": "0.25.5",
+        "@esbuild/darwin-arm64": "0.25.5",
+        "@esbuild/darwin-x64": "0.25.5",
+        "@esbuild/freebsd-arm64": "0.25.5",
+        "@esbuild/freebsd-x64": "0.25.5",
+        "@esbuild/linux-arm": "0.25.5",
+        "@esbuild/linux-arm64": "0.25.5",
+        "@esbuild/linux-ia32": "0.25.5",
+        "@esbuild/linux-loong64": "0.25.5",
+        "@esbuild/linux-mips64el": "0.25.5",
+        "@esbuild/linux-ppc64": "0.25.5",
+        "@esbuild/linux-riscv64": "0.25.5",
+        "@esbuild/linux-s390x": "0.25.5",
+        "@esbuild/linux-x64": "0.25.5",
+        "@esbuild/netbsd-arm64": "0.25.5",
+        "@esbuild/netbsd-x64": "0.25.5",
+        "@esbuild/openbsd-arm64": "0.25.5",
+        "@esbuild/openbsd-x64": "0.25.5",
+        "@esbuild/sunos-x64": "0.25.5",
+        "@esbuild/win32-arm64": "0.25.5",
+        "@esbuild/win32-ia32": "0.25.5",
+        "@esbuild/win32-x64": "0.25.5"
+      }
+    },
+    "node_modules/flatbuffers": {
+      "version": "1.12.0",
+      "resolved": "https://registry.npmjs.org/flatbuffers/-/flatbuffers-1.12.0.tgz",
+      "integrity": "sha512-c7CZADjRcl6j0PlvFy0ZqXQ67qSEZfrVPynmnL+2zPc+NtMvrF8Y0QceMo7QqnSPc7+uWjUIAbvCQ5WIKlMVdQ==",
+      "license": "SEE LICENSE IN LICENSE.txt"
+    },
+    "node_modules/guid-typescript": {
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/guid-typescript/-/guid-typescript-1.0.9.tgz",
+      "integrity": "sha512-Y8T4vYhEfwJOTbouREvG+3XDsjr8E3kIr7uf+JZ0BYloFsttiHU0WfvANVsR7TxNUJa/WpCnw/Ino/p+DeBhBQ==",
+      "license": "ISC"
+    },
+    "node_modules/long": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/long/-/long-5.3.2.tgz",
+      "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
+      "license": "Apache-2.0"
+    },
+    "node_modules/onnxruntime-common": {
+      "version": "1.20.1",
+      "resolved": "https://registry.npmjs.org/onnxruntime-common/-/onnxruntime-common-1.20.1.tgz",
+      "integrity": "sha512-YiU0s0IzYYC+gWvqD1HzLc46Du1sXpSiwzKb63PACIJr6LfL27VsXSXQvt68EzD3V0D5Bc0vyJTjmMxp0ylQiw==",
+      "license": "MIT"
+    },
+    "node_modules/onnxruntime-web": {
+      "version": "1.20.1",
+      "resolved": "https://registry.npmjs.org/onnxruntime-web/-/onnxruntime-web-1.20.1.tgz",
+      "integrity": "sha512-TePF6XVpLL1rWVMIl5Y9ACBQcyCNFThZON/jgElNd9Txb73CIEGlklhYR3UEr1cp5r0rbGI6nDwwrs79g7WjoA==",
+      "license": "MIT",
+      "dependencies": {
+        "flatbuffers": "^1.12.0",
+        "guid-typescript": "^1.0.9",
+        "long": "^5.2.3",
+        "onnxruntime-common": "1.20.1",
+        "platform": "^1.3.6",
+        "protobufjs": "^7.2.4"
+      }
+    },
+    "node_modules/platform": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/platform/-/platform-1.3.6.tgz",
+      "integrity": "sha512-fnWVljUchTro6RiCFvCXBbNhJc2NijN7oIQxbwsyL0buWJPG85v81ehlHI9fXrJsMNgTofEoWIQeClKpgxFLrg==",
+      "license": "MIT"
+    },
+    "node_modules/protobufjs": {
+      "version": "7.6.6",
+      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.6.tgz",
+      "integrity": "sha512-dYDWdjSl5RNb7SgPxGQcRU+GtvP7s2fpkrY0r432PcOIaZ0/rBcxEZnQN67iJhFuQiVw754JDoPruPCNdGsbjg==",
+      "hasInstallScript": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@protobufjs/aspromise": "^1.1.2",
+        "@protobufjs/base64": "^1.1.2",
+        "@protobufjs/codegen": "^2.0.5",
+        "@protobufjs/eventemitter": "^1.1.1",
+        "@protobufjs/fetch": "^1.1.1",
+        "@protobufjs/float": "^1.0.2",
+        "@protobufjs/path": "^1.1.2",
+        "@protobufjs/pool": "^1.1.0",
+        "@protobufjs/utf8": "^1.1.1",
+        "@types/node": ">=13.7.0",
+        "long": "^5.3.2"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "8.9.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
+      "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
+      "license": "MIT"
+    }
+  }
+}

package.json

@@ -0,0 +1,14 @@
+{
+  "name": "ai-spel-frontend-assets",
+  "private": true,
+  "description": "Build-only Piper WebAssembly assets for the static game client.",
+  "scripts": {
+    "build:piper": "node scripts/build-piper.mjs"
+  },
+  "dependencies": {
+    "@diffusionstudio/piper-wasm": "1.0.0",
+    "@mintplex-labs/piper-tts-web": "1.0.3",
+    "esbuild": "0.25.5",
+    "onnxruntime-web": "1.20.1"
+  }
+}

piper-model-routing.mjs

@@ -0,0 +1,9 @@
+const PIPER_MODEL_ORIGIN = 'https://huggingface.co/diffusionstudio/piper-voices/resolve/main/';
+const localPathPrefix = '/tts/piper-wasm-v1/voices/';
+
+export function localPiperModelUrl(requestedUrl, origin) {
+  if (!requestedUrl.startsWith(PIPER_MODEL_ORIGIN)) return null;
+  const relativePath = requestedUrl.slice(PIPER_MODEL_ORIGIN.length);
+  if (!/^[\w./-]+$/.test(relativePath) || relativePath.split('/').includes('..')) return null;
+  return new URL(`${localPathPrefix}${relativePath}`, origin).href;
+}

piper-runtime.js

@@ -0,0 +1,54 @@
+const version = document.querySelector('#frontend-version')?.textContent || 'dev';
+const workerUrl = `/tts/piper-wasm-v1/piper-worker.js?v=${encodeURIComponent(version)}`;
+let worker;
+let requestId = 0;
+const pending = new Map();
+
+function getWorker() {
+  if (worker) return worker;
+  worker = new Worker(workerUrl);
+  worker.onmessage = event => {
+    const message = event.data || {};
+    const request = pending.get(message.id);
+    if (!request) return;
+    if (message.type === 'progress') {
+      request.onProgress?.(message.progress);
+    } else {
+      pending.delete(message.id);
+      if (message.type === 'audio') request.resolve(new Blob([message.audio], {type: 'audio/x-wav'}));
+      else request.reject(new Error(message.error || 'Piper-arbetaren misslyckades.'));
+    }
+  };
+  worker.onerror = event => {
+    const details = [event.message, event.filename && `${event.filename}:${event.lineno || 0}:${event.colno || 0}`]
+      .filter(Boolean)
+      .join(' — ');
+    const error = new Error(details
+      ? `Piper-arbetaren kunde inte startas: ${details}`
+      : 'Piper-arbetaren kunde inte startas.');
+    for (const request of pending.values()) request.reject(error);
+    pending.clear();
+    worker?.terminate();
+    worker = null;
+  };
+  worker.onmessageerror = () => {
+    const error = new Error('Piper-arbetaren skickade ett oläsbart svar.');
+    for (const request of pending.values()) request.reject(error);
+    pending.clear();
+    worker?.terminate();
+    worker = null;
+  };
+  return worker;
+}
+
+window.GamePiper = {
+  voiceId: 'sv_SE-nst-medium',
+  synthesize(text, onProgress) {
+    return new Promise((resolve, reject) => {
+      const id = ++requestId;
+      pending.set(id, {resolve, reject, onProgress});
+      try { getWorker().postMessage({id, text: String(text)}); }
+      catch (error) { pending.delete(id); reject(error); }
+    });
+  },
+};

piper-worker.js

@@ -0,0 +1,54 @@
+import {TtsSession} from '@mintplex-labs/piper-tts-web';
+import {localPiperModelUrl} from './piper-model-routing.mjs';
+
+const VOICE_ID = 'sv_SE-nst-medium';
+const ASSET_ROOT = '/tts/piper-wasm-v1';
+const localFetch = self.fetch.bind(self);
+
+// The pinned TTS library uses a fixed Hugging Face URL. Keep its OPFS cache logic,
+// but serve every model/config request from this frontend origin instead.
+self.fetch = (resource, options) => {
+  const requestedUrl = resource instanceof Request ? resource.url : String(resource);
+  const localModelUrl = localPiperModelUrl(requestedUrl, self.location.origin);
+  if (!localModelUrl) return localFetch(resource, options);
+  const redirected = resource instanceof Request ? new Request(localModelUrl, resource) : localModelUrl;
+  return localFetch(redirected, options);
+};
+
+let sessionPromise;
+let inferenceQueue = Promise.resolve();
+
+async function getSession(onProgress) {
+  if (!sessionPromise) {
+    sessionPromise = TtsSession.create({
+      voiceId: VOICE_ID,
+      progress: onProgress,
+      wasmPaths: {
+        onnxWasm: `${ASSET_ROOT}/onnx/`,
+        piperData: `${ASSET_ROOT}/piper/piper_phonemize.data`,
+        piperWasm: `${ASSET_ROOT}/piper/piper_phonemize.wasm`,
+      },
+    }).catch(error => {
+      sessionPromise = null;
+      throw error;
+    });
+  }
+  return sessionPromise;
+}
+
+async function synthesizeMessage(event) {
+  const {id, text} = event.data || {};
+  if (!Number.isSafeInteger(id) || typeof text !== 'string') return;
+  try {
+    const session = await getSession(progress => self.postMessage({id, type: 'progress', progress}));
+    const blob = await session.predict(text);
+    const audio = await blob.arrayBuffer();
+    self.postMessage({id, type: 'audio', audio}, [audio]);
+  } catch (error) {
+    self.postMessage({id, type: 'error', error: String(error?.message || error)});
+  }
+}
+
+self.addEventListener('message', event => {
+  inferenceQueue = inferenceQueue.then(() => synthesizeMessage(event));
+});

scripts/build-piper.mjs

@@ -0,0 +1,113 @@
+import {build} from 'esbuild';
+import {createHash} from 'node:crypto';
+import {createWriteStream} from 'node:fs';
+import {cp, mkdir, readdir, rm, stat, rename, unlink} from 'node:fs/promises';
+import {join, resolve} from 'node:path';
+import {Readable, Transform} from 'node:stream';
+import {pipeline} from 'node:stream/promises';
+
+const root = process.cwd();
+const publicRoot = join(root, 'public');
+const assetRoot = join(publicRoot, 'tts', 'piper-wasm-v1');
+const onnxSource = join(root, 'node_modules', 'onnxruntime-web', 'dist');
+const piperSource = join(root, 'node_modules', '@diffusionstudio', 'piper-wasm', 'build');
+const piperWasm = join(piperSource, 'piper_phonemize.wasm');
+const piperData = join(piperSource, 'piper_phonemize.data');
+
+const voiceRevision = 'c10ece1aade47bb51c153c893d14e5bf8e5b7117';
+const voiceRepository = 'https://huggingface.co/rhasspy/piper-voices/resolve';
+const voiceFiles = [
+  {path: 'sv/sv_SE/alma/medium/sv_SE-alma-medium.onnx', size: 63434611, sha256: 'f75455eb6afeb1db9e2905d5bd7e4115afcd3710e0d399b6a40981766d32fedc'},
+  {path: 'sv/sv_SE/alma/medium/sv_SE-alma-medium.onnx.json', size: 6059, gitBlobSha1: '7eaf3ef20af4a74e9cee9d29b98de3d9fcec0bdc'},
+  {path: 'sv/sv_SE/lisa/medium/sv_SE-lisa-medium.onnx', size: 63511038, sha256: '94cae912b31d6e9140d3f5160f1815951588600c7a9e43d539ba1e81a110d131'},
+  {path: 'sv/sv_SE/lisa/medium/sv_SE-lisa-medium.onnx.json', size: 7239, gitBlobSha1: 'b2b5fb0f8af2aae4ddfb81eaa7709c6b8faa412b'},
+  {path: 'sv/sv_SE/nst/medium/sv_SE-nst-medium.onnx', size: 63104526, sha256: 'df011f56825a59dd1efc080c38a65a1ef70407e60f63050e9246f43a3d7e471e'},
+  {path: 'sv/sv_SE/nst/medium/sv_SE-nst-medium.onnx.json', size: 4157, gitBlobSha1: '9766b9769436046a610a505fda925032e12a66b3'},
+];
+
+async function downloadVoiceFile(file) {
+  const destination = join(assetRoot, 'voices', file.path);
+  const temporary = `${destination}.part`;
+  await mkdir(join(destination, '..'), {recursive: true});
+  const response = await fetch(`${voiceRepository}/${voiceRevision}/${file.path}`);
+  if (!response.ok || !response.body) {
+    throw new Error(`Unable to download Piper voice asset ${file.path}: HTTP ${response.status}`);
+  }
+  const sha256 = createHash('sha256');
+  const sha1 = createHash('sha1').update(Buffer.from(`blob ${file.size}\0`));
+  let size = 0;
+  const verifyAndPassThrough = new Transform({
+    transform(chunk, _encoding, callback) {
+      size += chunk.length;
+      sha256.update(chunk);
+      sha1.update(chunk);
+      callback(null, chunk);
+    },
+  });
+  try {
+    await pipeline(Readable.fromWeb(response.body), verifyAndPassThrough, createWriteStream(temporary));
+    const actualSha1 = sha1.digest('hex');
+    if (size !== file.size || (file.sha256 && sha256.digest('hex') !== file.sha256) ||
+        (file.gitBlobSha1 && actualSha1 !== file.gitBlobSha1)) {
+      throw new Error(`Piper voice asset integrity check failed for ${file.path} (${size} bytes)`);
+    }
+    await rename(temporary, destination);
+  } catch (error) {
+    await unlink(temporary).catch(() => {});
+    throw error;
+  }
+}
+
+await rm(assetRoot, {recursive: true, force: true});
+await mkdir(join(assetRoot, 'onnx'), {recursive: true});
+await mkdir(join(assetRoot, 'piper'), {recursive: true});
+for (const file of voiceFiles) await downloadVoiceFile(file);
+await cp(join(root, 'PIPER_VOICE_NOTICES.txt'), join(assetRoot, 'voices', 'ATTRIBUTION.txt'));
+
+const wasmFiles = (await readdir(onnxSource))
+  .filter(name => name.endsWith('.wasm'));
+if (wasmFiles.length === 0) throw new Error('ONNX Runtime WebAssembly files are missing');
+for (const file of wasmFiles) {
+  await cp(join(onnxSource, file), join(assetRoot, 'onnx', file));
+}
+for (const file of [piperWasm, piperData]) {
+  const fileStat = await stat(file).catch(() => null);
+  if (!fileStat?.isFile() || fileStat.size === 0) throw new Error(`Missing Piper WebAssembly asset: ${file}`);
+  await cp(file, join(assetRoot, 'piper', file.split('/').at(-1)));
+}
+
+await build({
+  entryPoints: [resolve(root, 'piper-runtime.js')],
+  outfile: join(publicRoot, 'piper-runtime.js'),
+  bundle: true,
+  format: 'iife',
+  platform: 'browser',
+  target: ['es2022'],
+  external: ['fs', 'path'],
+  sourcemap: false,
+  legalComments: 'none',
+});
+
+await build({
+  entryPoints: [resolve(root, 'piper-worker.js')],
+  outfile: join(assetRoot, 'piper-worker.js'),
+  bundle: true,
+  format: 'iife',
+  platform: 'browser',
+  target: ['es2022'],
+  external: ['fs', 'path'],
+  sourcemap: false,
+  legalComments: 'none',
+});
+
+for (const file of voiceFiles) {
+  const downloaded = join(assetRoot, 'voices', file.path);
+  if ((await stat(downloaded)).size !== file.size) throw new Error(`Missing Piper voice asset: ${downloaded}`);
+}
+const workerBundle = await (await import('node:fs/promises')).readFile(join(assetRoot, 'piper-worker.js'), 'utf8');
+if (!workerBundle.includes('https://huggingface.co/diffusionstudio/piper-voices/resolve/main/') ||
+    !workerBundle.includes('/tts/piper-wasm-v1/voices/')) {
+  throw new Error('The Piper worker is missing its same-origin model download route.');
+}
+
+console.log(`Piper browser assets prepared at ${assetRoot}`);

scripts/check-frontend.sh

@@ -4,14 +4,75 @@ set -euo pipefail
 test -s index.html
 grep -q '<html lang="sv">' index.html
 grep -q 'id="frontend-version">__FRONTEND_VERSION__' index.html
+grep -q '<script src="/voice.js?v=__FRONTEND_VERSION__"></script>' index.html
+grep -q '<script src="/piper-runtime.js?v=__FRONTEND_VERSION__"></script>' index.html
+grep -q 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0' nginx/default.conf
+grep -q 'Cross-Origin-Embedder-Policy "require-corp"' nginx/default.conf
+grep -q 'add_header Cross-Origin-Embedder-Policy "require-corp" always;' nginx/default.conf
+grep -q 'add_header Cross-Origin-Resource-Policy "same-origin" always;' nginx/default.conf
+grep -q 'application/javascript js;' nginx/default.conf
 grep -q "request('/version')" index.html
 grep -Fq "credentials: 'same-origin'" index.html
 grep -q 'id="dialogue" aria-label="Dialoghistorik" role="log" aria-live="polite"' index.html
 grep -q 'id="message" name="message"' index.html
+grep -q 'id="auth-intro"' index.html
+grep -q 'Skapa konto med ett användarnamn och ett lösenord på minst tolv tecken' index.html
+grep -q 'id="auth-repeat-intro"' index.html
+grep -q 'function playFirstVisitIntroduction' index.html
+grep -q 'id="auth-voice-status" role="status" aria-live="polite"' index.html
+grep -q 'activateFromUserGesture' index.html
+grep -q 'function showSpeechRecovery' index.html
+grep -q "retry.textContent = 'Läs senaste repliken'" index.html
+grep -q "location.pathname !== '/admin'" index.html
+grep -q "if (options.speak !== false && location.pathname !== '/admin')" index.html
+grep -q 'id="microphone" aria-pressed="false"' index.html
+grep -q 'id="voice-status" role="status" aria-live="polite"' index.html
+grep -q "window.GameVoice.createVoiceController" index.html
+grep -q "addVoiceButton(item, 'Testa ljudet'" index.html
+grep -q 'Jag förstår – starta mikrofonen' index.html
+grep -q 'supportsRecognition' voice.js
+grep -q 'characterVoiceProfile' voice.js
+grep -q 'utterance.volume = 1' voice.js
+grep -q 'Webbläsaren har startat talsyntesen' voice.js
+grep -q 'WebKit versions before Safari 27' voice.js
+grep -q "voiceIdentity: speakingNpc.voice_identity" index.html
+grep -q "role: 'narrator', voiceIdentity: 'neutral'" index.html
+grep -q 'COPY voice.js /usr/share/nginx/html/voice.js' Dockerfile
+grep -q 'COPY public/piper-runtime.js /usr/share/nginx/html/piper-runtime.js' Dockerfile
+grep -q 'COPY public/tts/piper-wasm-v1/' Dockerfile
+grep -q 'build:piper' .gitea/workflows/publish.yaml
+grep -q 'Piper' piper-runtime.js
+grep -q 'sv_SE-nst-medium' piper-worker.js
+grep -q 'new Worker(workerUrl)' piper-runtime.js
+grep -q 'worker.js?v=' piper-runtime.js
+grep -q 'worker.onmessageerror' piper-runtime.js
+grep -q 'localPiperModelUrl' piper-worker.js
+grep -q 'PIPER_MODEL_ORIGIN' piper-model-routing.mjs
+grep -q '/tts/piper-wasm-v1/voices/' piper-model-routing.mjs
+grep -q 'same-origin.*voice' README.md
+grep -q 'ATTRIBUTION.txt' index.html
+grep -q "SpeechRecognition || win.webkitSpeechRecognition" voice.js
+grep -q "submitMessage(text, 'voice')" index.html
+grep -q 'Spelets repliker läses alltid upp' index.html
 grep -q "event.key === 'Enter' && !event.shiftKey" index.html
 grep -q "request('/api/character/draft'" index.html
 grep -q "request('/api/world/draft'" index.html
 grep -q "request('/api/dialogue'" index.html
+grep -q "request('/api/presence/heartbeat'" index.html
+grep -q "request('/api/players/nearby'" index.html
+grep -q "request('/api/player/messages'" index.html
+grep -q "Säg till Robin" index.html
+grep -q "result.intent === 'move' || result.intent === 'meet'" index.html
+grep -q 'dialogue_temporarily_unavailable:' index.html
+grep -q 'id="admin-view"' index.html
+grep -q '/api/admin/players?' index.html
+grep -q "request('/api/admin/prompts'" index.html
+grep -q "request('/api/admin/rules'" index.html
+grep -q "request('/api/admin/settings/logging'" index.html
+grep -q 'data-admin-view="logging"' index.html
+grep -q '/api/admin/audit?limit=200' index.html
+grep -q 'entry.data.external_call' index.html
+grep -q 'Externt tjänsteanrop' index.html
 grep -q "request('/api/world/start'" index.html
 grep -q "request('/api/character'" index.html
 grep -q 'location = /healthz' nginx/default.conf
@@ -19,9 +80,11 @@ if grep -Eq 'id="(new-character|world-setup|shop|buy-offer|balance|inventory|pla
   echo 'The active player UI must not contain permanent data panels, forms, or action buttons.' >&2
   exit 1
 fi
-if sed -n '/<section id="play"/,/^    <\/section>/p' index.html | grep -q '<button'; then
+if sed -n '/<section id="play"/,/^    <\/section>/p' index.html | grep '<button' | grep -v 'id="microphone"' >/dev/null; then
-  echo 'The game input must not require a separate send or action button.' >&2
+  echo 'Only the microphone control may appear beside the game text input.' >&2
   exit 1
 fi
 
+node --test tests/*.test.cjs
+
 echo 'Frontend source checks passed.'

tests/piper-model-routing.test.cjs

@@ -0,0 +1,23 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+test('Piper model and config requests use the same-origin voice mirror', async () => {
+  const {localPiperModelUrl} = await import('../piper-model-routing.mjs');
+  const origin = 'https://ai-spel.k3s.k0.nu';
+  assert.equal(
+    localPiperModelUrl('https://huggingface.co/diffusionstudio/piper-voices/resolve/main/sv/sv_SE/nst/medium/sv_SE-nst-medium.onnx', origin),
+    'https://ai-spel.k3s.k0.nu/tts/piper-wasm-v1/voices/sv/sv_SE/nst/medium/sv_SE-nst-medium.onnx',
+  );
+  assert.equal(
+    localPiperModelUrl('https://huggingface.co/diffusionstudio/piper-voices/resolve/main/sv/sv_SE/lisa/medium/sv_SE-lisa-medium.onnx.json', origin),
+    'https://ai-spel.k3s.k0.nu/tts/piper-wasm-v1/voices/sv/sv_SE/lisa/medium/sv_SE-lisa-medium.onnx.json',
+  );
+});
+
+test('Piper model routing leaves unrelated URLs alone and rejects traversal paths', async () => {
+  const {localPiperModelUrl} = await import('../piper-model-routing.mjs');
+  const origin = 'https://ai-spel.k3s.k0.nu';
+  assert.equal(localPiperModelUrl('https://example.com/model.onnx', origin), null);
+  assert.equal(localPiperModelUrl('https://huggingface.co.evil.test/diffusionstudio/piper-voices/resolve/main/model.onnx', origin), null);
+  assert.equal(localPiperModelUrl('https://huggingface.co/diffusionstudio/piper-voices/resolve/main/../secret', origin), null);
+});

tests/voice.test.cjs

@@ -0,0 +1,321 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const test = require('node:test');
+const vm = require('node:vm');
+
+const source = fs.readFileSync(path.join(__dirname, '..', 'voice.js'), 'utf8');
+const apiWindow = {};
+vm.runInNewContext(source, {window: apiWindow, globalThis: apiWindow, Promise, String, Math, Object});
+const GameVoice = apiWindow.GameVoice;
+
+function makeHarness({supported = true, tts = true, piper = false, onTranscript = () => Promise.resolve()} = {}) {
+  const recognitions = [];
+  const utterances = [];
+  const states = [];
+  const timers = new Map();
+  const timerDelays = new Map();
+  let timerId = 0;
+  class Recognition {
+    constructor() { recognitions.push(this); }
+    start() { this.started = true; }
+    stop() { this.stopped = true; }
+    abort() { this.aborted = true; }
+  }
+  class Utterance {
+    constructor(text) { this.text = text; utterances.push(this); }
+  }
+  const audioSources = [];
+  class AudioContext {
+    constructor() { this.state = 'running'; this.destination = {}; }
+    resume() { this.state = 'running'; return Promise.resolve(); }
+    decodeAudioData() { return Promise.resolve({duration: 1}); }
+    createBufferSource() {
+      const source = {playbackRate: {value: 1}, detune: {value: 0}, connect() {}, start() { this.started = true; }, stop() { this.stopped = true; }};
+      audioSources.push(source);
+      return source;
+    }
+  }
+  const synthesis = tts ? {
+    spoken: [], cancelled: 0,
+    getVoices: () => [{name: 'Svensk', lang: 'sv-SE'}],
+    speak(utterance) { this.spoken.push(utterance); },
+    cancel() { this.cancelled += 1; },
+  } : undefined;
+  const window = {
+    setTimeout(callback, delay = 0) { const id = ++timerId; timers.set(id, callback); timerDelays.set(id, delay); return id; },
+    clearTimeout(id) { timers.delete(id); timerDelays.delete(id); },
+    speechSynthesis: synthesis,
+    SpeechSynthesisUtterance: tts ? Utterance : undefined,
+    SpeechRecognition: supported ? Recognition : undefined,
+    AudioContext,
+    GamePiper: piper ? {synthesize: () => Promise.resolve({arrayBuffer: () => Promise.resolve(new ArrayBuffer(8))})} : undefined,
+  };
+  vm.runInNewContext(source, {window, globalThis: window, Promise, String, Math, Object});
+  const controller = window.GameVoice.createVoiceController({
+    window,
+    onState: (state, message) => states.push({state, message}),
+    onTranscript,
+  });
+  return {
+    controller, recognitions, utterances, synthesis, states, timers, audioSources,
+    runTimer(delay) {
+      const match = [...timerDelays.entries()].find(([, value]) => value === delay);
+      if (!match) throw new Error(`No timer found with delay ${delay}`);
+      timers.get(match[0])();
+    },
+  };
+}
+
+test('recognition is single-shot Swedish and sends only final transcript once', async () => {
+  const received = [];
+  const h = makeHarness({onTranscript: text => { received.push(text); }});
+  assert.equal(h.controller.startListening(), true);
+  const recognition = h.recognitions[0];
+  assert.equal(recognition.lang, 'sv-SE');
+  assert.equal(recognition.continuous, false);
+  assert.equal(recognition.interimResults, false);
+  recognition.onresult({resultIndex: 0, results: [{isFinal: false, 0: {transcript: 'delvis'}}]});
+  recognition.onresult({resultIndex: 0, results: [{isFinal: true, 0: {transcript: '  Hej världen  '}}]});
+  recognition.onresult({resultIndex: 0, results: [{isFinal: true, 0: {transcript: 'dubblett'}}]});
+  await Promise.resolve(); await Promise.resolve();
+  assert.deepEqual(received, ['Hej världen']);
+  assert.equal(h.controller.getState(), 'IDLE');
+});
+
+test('second microphone activation stops the active recognition session', () => {
+  const h = makeHarness();
+  h.controller.startListening();
+  h.controller.startListening();
+  assert.equal(h.recognitions.length, 1);
+  assert.equal(h.recognitions[0].aborted, true);
+  assert.equal(h.controller.getState(), 'IDLE');
+});
+
+test('unsupported recognition stays recoverable and leaves text input available', () => {
+  const h = makeHarness({supported: false});
+  assert.equal(h.controller.startListening(), false);
+  assert.equal(h.controller.getState(), 'IDLE');
+  assert.match(h.states.at(-1).message, /skriva/);
+});
+
+test('permission errors reset state and a later session can start', () => {
+  const h = makeHarness();
+  h.controller.startListening();
+  h.recognitions[0].onerror({error: 'not-allowed'});
+  assert.equal(h.controller.getState(), 'IDLE');
+  assert.match(h.states.at(-1).message, /behörighet nekades/);
+  assert.equal(h.controller.startListening(), true);
+  assert.equal(h.recognitions.length, 2);
+});
+
+test('late recognition results after cancellation are ignored', () => {
+  let delivered = 0;
+  const h = makeHarness({onTranscript: () => { delivered += 1; }});
+  h.controller.startListening();
+  const old = h.recognitions[0];
+  h.controller.stopListening();
+  old.onresult({resultIndex: 0, results: [{isFinal: true, 0: {transcript: 'för sent'}}]});
+  assert.equal(delivered, 0);
+});
+
+test('recognition watchdog closes a session that never ends and permits retry', () => {
+  const h = makeHarness();
+  h.controller.startListening();
+  const watchdog = [...h.timers.values()][0];
+  watchdog();
+  assert.equal(h.controller.getState(), 'IDLE');
+  assert.match(h.states.at(-1).message, /en minut/);
+  assert.equal(h.controller.startListening(), true);
+  assert.equal(h.recognitions.length, 2);
+});
+
+test('TTS uses the system default voice unless a named Swedish voice is selected', () => {
+  const h = makeHarness();
+  h.controller.update({mode: 'game-voice', rate: 1.4});
+  assert.equal(h.controller.speak('Hej.'), true);
+  const first = h.utterances[0];
+  assert.equal(first.lang, 'sv-SE');
+  assert.equal(first.rate, 1.4);
+  assert.equal(first.voice, null);
+  h.controller.cancelSpeech();
+  first.onend();
+  assert.equal(h.controller.getState(), 'IDLE');
+  assert.equal(h.controller.speak('Namngiven röst.', {voiceName: 'Svensk'}), true);
+  assert.equal(h.utterances.at(-1).voice.name, 'Svensk');
+});
+
+test('a player gesture restores the iOS speech primer after cancelling a queued reply', () => {
+  const h = makeHarness();
+  assert.equal(h.controller.activateFromUserGesture(), true);
+  assert.equal(h.synthesis.spoken[0].text, ' ');
+  h.controller.speak('Tidigare replik');
+  h.controller.cancelSpeech();
+  const countAfterCancel = h.synthesis.spoken.length;
+  assert.equal(h.controller.activateFromUserGesture(), true);
+  assert.equal(h.synthesis.spoken.length, countAfterCancel + 1);
+  assert.equal(h.synthesis.spoken.at(-1).text, ' ');
+  h.controller.speak('Nytt svar');
+  assert.equal(h.synthesis.spoken.at(-1).text, 'Nytt svar');
+});
+
+test('speech is reported as in progress only after the native onstart event', () => {
+  const h = makeHarness();
+  h.controller.speak('Hej.');
+  assert.equal(h.controller.getState(), 'QUEUED');
+  assert.match(h.states.at(-1).message, /Startar uppläsningen/);
+  h.utterances[0].onstart();
+  assert.equal(h.controller.getState(), 'SPEAKING');
+  assert.match(h.states.at(-1).message, /Webbläsaren har startat talsyntesen/);
+  assert.match(h.states.at(-1).message, /Läs senaste repliken/);
+});
+
+test('iOS user gesture primes speech silently and idle speech is not cancelled before speak', () => {
+  const h = makeHarness();
+  assert.equal(h.controller.activateFromUserGesture(), true);
+  assert.equal(h.synthesis.spoken[0].text, ' ');
+  assert.equal(h.synthesis.spoken[0].volume, 0);
+  const cancelledBeforeReply = h.synthesis.cancelled;
+  assert.equal(h.controller.speak('Ett svar efter nätverksanropet'), true);
+  assert.equal(h.synthesis.spoken.at(-1).text, 'Ett svar efter nätverksanropet');
+  assert.equal(h.synthesis.cancelled, cancelledBeforeReply);
+});
+
+test('replacing active speech waits one event-loop turn after WebKit cancel', () => {
+  const h = makeHarness();
+  h.controller.speak('Första repliken');
+  const cancelledBeforeReplace = h.synthesis.cancelled;
+  h.controller.speak('Nästa replik');
+  assert.equal(h.synthesis.cancelled, cancelledBeforeReplace + 1);
+  assert.notEqual(h.synthesis.spoken.at(-1).text, 'Nästa replik');
+  h.runTimer(100);
+  assert.equal(h.synthesis.spoken.at(-1).text, 'Nästa replik');
+});
+
+test('speech start timeout tells the player how to recover when mobile playback is blocked', () => {
+  const h = makeHarness();
+  h.controller.speak('En replik');
+  const cancelledBeforeTimeout = h.synthesis.cancelled;
+  h.runTimer(4000);
+  assert.match(h.states.at(-1).message, /Tryck på Läs senaste repliken/);
+  assert.equal(h.synthesis.cancelled, cancelledBeforeTimeout + 1);
+  const cancelledBeforeRetry = h.synthesis.cancelled;
+  h.controller.speak('Manuell återläsning');
+  assert.equal(h.synthesis.spoken.at(-1).text, 'Manuell återläsning');
+  assert.equal(h.synthesis.cancelled, cancelledBeforeRetry);
+});
+
+test('iOS not-allowed speech error offers an immediate gesture-based retry', () => {
+  const h = makeHarness();
+  h.controller.speak('En replik');
+  h.utterances[0].onerror({error: 'not-allowed'});
+  assert.match(h.states.at(-1).message, /Safari blockerade uppläsningen/);
+  assert.match(h.states.at(-1).message, /Läs senaste repliken/);
+  assert.equal(h.controller.speak('Försök igen'), true);
+  assert.equal(h.synthesis.spoken.at(-1).text, 'Försök igen');
+});
+
+test('character voice identity gives stable distinct masculine, feminine, and neutral timbres', () => {
+  const profile = GameVoice.characterVoiceProfile;
+  const masculine = profile('masculine', 'character-1');
+  const feminine = profile('feminine', 'character-1');
+  const neutral = profile('neutral', 'character-1');
+  assert.equal(profile('masculine', 'character-1').pitch, masculine.pitch);
+  assert.ok(masculine.pitch < neutral.pitch);
+  assert.ok(neutral.pitch < feminine.pitch);
+  assert.notEqual(profile('masculine', 'character-2').pitch, masculine.pitch);
+});
+
+test('narrator uses neutral pitch while character replies use their saved voice identity', () => {
+  const h = makeHarness();
+  h.controller.update({mode: 'game-voice'});
+  h.controller.speak('Berättarröst', {role: 'narrator', voiceIdentity: 'feminine', characterId: 'narrator'});
+  h.controller.speak('NPC-replik', {voiceIdentity: 'masculine', characterId: 'npc-1'});
+  h.runTimer(100);
+  assert.equal(h.utterances[0].pitch, 1);
+  assert.ok(h.utterances[1].pitch < 1);
+});
+
+test('Piper WASM output uses the unlocked audio context and starts only after local synthesis', async () => {
+  const h = makeHarness({piper: true});
+  assert.equal(h.controller.activateFromUserGesture(), true);
+  assert.equal(h.controller.speak('Ett svar från Piper.', {role: 'narrator', voiceIdentity: 'neutral'}), true);
+  assert.equal(h.controller.getState(), 'QUEUED');
+  await new Promise(resolve => setImmediate(resolve));
+  assert.equal(h.audioSources.length, 1);
+  assert.equal(h.audioSources[0].started, true);
+  assert.equal(h.audioSources[0].detune.value, 0);
+  assert.equal(h.controller.getState(), 'SPEAKING');
+  h.audioSources[0].onended();
+  assert.equal(h.controller.getState(), 'IDLE');
+});
+
+test('Piper output keeps per-character pitch and rate stable', async () => {
+  const h = makeHarness({piper: true});
+  h.controller.activateFromUserGesture();
+  h.controller.speak('NPC-svar.', {voiceIdentity: 'masculine', characterId: 'npc-1'});
+  await new Promise(resolve => setImmediate(resolve));
+  assert.ok(h.audioSources[0].detune.value < 0);
+  assert.ok(h.audioSources[0].playbackRate.value < 1);
+});
+
+test('TTS and microphone are mutually exclusive', () => {
+  const h = makeHarness();
+  h.controller.update({mode: 'game-voice'});
+  h.controller.startListening();
+  h.controller.speak('Svar');
+  assert.equal(h.recognitions[0].aborted, true);
+  assert.equal(h.controller.getState(), 'QUEUED');
+  h.utterances.at(-1).onstart();
+  assert.equal(h.controller.getState(), 'SPEAKING');
+});
+
+test('game speech stays automatic even with legacy text-only settings and gracefully degrades without synthesis', () => {
+  const screenReader = makeHarness();
+  screenReader.controller.update({mode: 'text-only', autoSpeak: false});
+  assert.equal(screenReader.controller.speak('dialog'), true);
+  assert.equal(screenReader.synthesis.spoken[0].text, 'dialog');
+  const noTts = makeHarness({tts: false});
+  noTts.controller.update({mode: 'game-voice'});
+  assert.equal(noTts.controller.speak('dialog'), false);
+});
+
+test('system commands require an explicit prefix; ordinary dialogue words are untouched', () => {
+  const global = {};
+  vm.runInNewContext(source, {window: global, globalThis: global, Promise, String, Math, Object});
+  assert.equal(GameVoice.parseVoiceCommand('upprepa'), null);
+  assert.equal(GameVoice.parseVoiceCommand('hjälp'), null);
+  assert.equal(GameVoice.parseVoiceCommand('röstkommando upprepa.' ).command, 'repeat');
+  assert.equal(GameVoice.parseVoiceCommand('röstkommando alternativ').command, 'settings');
+  assert.equal(GameVoice.parseVoiceCommand('röstinställningar').command, 'settings');
+  assert.equal(GameVoice.parseVoiceCommand('röstinställningar', {requirePrefix: true}), null);
+  assert.equal(GameVoice.parseVoiceCommand('röstkommando alternativ', {requirePrefix: true}).command, 'settings');
+});
+
+test('settings survive reload and invalid storage falls back to accessible defaults', () => {
+  const global = {};
+  vm.runInNewContext(source, {window: global, globalThis: global, Promise, String, Math, Object});
+  const values = new Map();
+  const storage = {getItem: key => values.get(key) || null, setItem: (key, value) => values.set(key, value)};
+  const defaults = GameVoice.loadSettings(storage, 'new-player');
+  assert.equal(defaults.mode, 'game-voice');
+  assert.equal(defaults.autoSpeak, true);
+  values.set('voice-v1', JSON.stringify({mode: 'text-only', autoSpeak: false, rate: 1.4, voiceName: 'Svensk', soundSignals: false}));
+  const migrated = GameVoice.loadSettings(storage, 'voice-v2', 'voice-v1');
+  assert.equal(migrated.mode, 'game-voice');
+  assert.equal(migrated.autoSpeak, true);
+  assert.equal(migrated.rate, 1.4);
+  assert.equal(migrated.voiceName, 'Svensk');
+  assert.equal(migrated.soundSignals, false);
+  const requested = {...GameVoice.DEFAULT_SETTINGS, mode: 'game-voice', autoSpeak: true, rate: 1.5, voiceName: 'Svensk'};
+  assert.equal(GameVoice.saveSettings(storage, 'voice', requested), true);
+  const loaded = GameVoice.loadSettings(storage, 'voice');
+  assert.equal(loaded.mode, 'game-voice');
+  assert.equal(loaded.autoSpeak, true);
+  assert.equal(loaded.rate, 1.5);
+  assert.equal(loaded.voiceName, 'Svensk');
+  values.set('voice', '{trasig');
+  assert.equal(GameVoice.loadSettings(storage, 'voice').mode, 'game-voice');
+  assert.equal(GameVoice.loadSettings(storage, 'voice').autoSpeak, true);
+  assert.equal(GameVoice.saveSettings({setItem() { throw new Error('blocked'); }}, 'voice', requested), false);
+});

voice.js

@@ -0,0 +1,422 @@
+/* Browser voice adapters. Kept independent of the game submission and API layer. */
+(function exposeVoice(root) {
+  const DEFAULT_SETTINGS = Object.freeze({
+    mode: 'game-voice',
+    autoSpeak: true,
+    language: 'sv-SE',
+    rate: 1,
+    voiceName: '',
+    speakerProfiles: {},
+    autoStop: true,
+    soundSignals: true,
+  });
+
+  function parseVoiceCommand(text, options = {}) {
+    const value = String(text || '').trim();
+    if (/^röstinställningar[.!]?$/i.test(value)) return options.requirePrefix ? null : {command: 'settings'};
+    const match = value.match(/^röstkommando\s+(.+?)[.!]?$/i);
+    if (!match) return null;
+    const command = match[1].trim().replace(/[.!?]+$/, '').toLocaleLowerCase('sv-SE');
+    const aliases = {
+      upprepa: 'repeat', 'läs igen': 'repeat',
+      avbryt: 'stop', stopp: 'stop', paus: 'stop',
+      hjälp: 'help', alternativ: 'settings', inställningar: 'settings', röstinställningar: 'settings',
+    };
+    return {command: aliases[command] || 'unknown'};
+  }
+
+  function loadSettings(storage, key, legacyKey) {
+    try {
+      const current = storage.getItem(key);
+      if (!current && legacyKey) {
+        const legacy = JSON.parse(storage.getItem(legacyKey) || '{}');
+        const migrated = {
+          ...DEFAULT_SETTINGS,
+          rate: legacy.rate,
+          voiceName: legacy.voiceName,
+          speakerProfiles: legacy.speakerProfiles,
+          soundSignals: legacy.soundSignals,
+        };
+        saveSettings(storage, key, migrated);
+        return migrated;
+      }
+      const stored = JSON.parse(current || '{}');
+      const settings = {...DEFAULT_SETTINGS, ...stored};
+      // Game dialogue is always spoken. These assignments also migrate older
+      // local settings that allowed text-only or screen-reader-only playback.
+      settings.mode = 'game-voice';
+      settings.autoSpeak = true;
+      settings.rate = Math.min(2, Math.max(0.5, Number(settings.rate) || 1));
+      settings.voiceName = typeof settings.voiceName === 'string' ? settings.voiceName : '';
+      settings.speakerProfiles = settings.speakerProfiles && typeof settings.speakerProfiles === 'object' ? settings.speakerProfiles : {};
+      settings.soundSignals = settings.soundSignals !== false;
+      return settings;
+    } catch (_) { return {...DEFAULT_SETTINGS}; }
+  }
+
+  function saveSettings(storage, key, settings) {
+    try { storage.setItem(key, JSON.stringify(settings)); return true; }
+    catch (_) { return false; }
+  }
+
+  function characterVoiceProfile(voiceIdentity, characterId = '') {
+    const identity = ['masculine', 'feminine', 'neutral'].includes(voiceIdentity) ? voiceIdentity : 'neutral';
+    let hash = 2166136261;
+    for (const char of String(characterId)) hash = Math.imul(hash ^ char.charCodeAt(0), 16777619) >>> 0;
+    const variation = (hash % 1000) / 1000;
+    if (identity === 'masculine') return {pitch: 0.88 + variation * 0.08, rate: 0.96 + variation * 0.04};
+    if (identity === 'feminine') return {pitch: 1.06 + variation * 0.08, rate: 0.98 + variation * 0.04};
+    return {pitch: 0.98 + variation * 0.04, rate: 1};
+  }
+
+  function createVoiceController(options = {}) {
+    const win = options.window || root;
+    const onState = options.onState || (() => {});
+    const onTranscript = options.onTranscript || (() => {});
+    const settings = {...DEFAULT_SETTINGS, ...(options.settings || {})};
+    let state = 'IDLE';
+    let generation = 0;
+    let recognition = null;
+    let speechTimer = null;
+    let speechStartTimer = null;
+    let listeningTimer = null;
+    let currentUtterance = null;
+    let speechPrimed = false;
+    let piperAudioContext = null;
+    let piperSource = null;
+    let piperAudioUnlocked = false;
+
+    function setState(next, message = '') {
+      state = next;
+      onState(next, message);
+    }
+
+    function cancelSpeech() {
+      generation += 1;
+      if (speechTimer !== null) win.clearTimeout(speechTimer);
+      if (speechStartTimer !== null) win.clearTimeout(speechStartTimer);
+      speechTimer = null;
+      speechStartTimer = null;
+      const wasQueued = currentUtterance !== null;
+      const wasPiper = currentUtterance?.kind === 'piper';
+      currentUtterance = null;
+      // WebKit versions before Safari 27 can discard a speak() queued in the
+      // same turn as cancel(). Do not clear an already-empty native queue.
+      if (wasQueued) {
+        if (wasPiper) {
+          try { piperSource?.stop(); } catch (_) { /* Already stopped. */ }
+          piperSource = null;
+        } else {
+          try { win.speechSynthesis?.cancel(); } catch (_) { /* Best effort. */ }
+          // cancel() also removes the silent user-gesture primer from the native
+          // queue. A later reply must prime again from the next player gesture.
+          speechPrimed = false;
+        }
+      }
+      if (!recognition) setState('IDLE');
+    }
+
+    function activateFromUserGesture() {
+      const AudioContext = win.AudioContext || win.webkitAudioContext;
+      if (win.GamePiper && AudioContext) {
+        try {
+          piperAudioContext ||= new AudioContext();
+          if (piperAudioContext.state === 'suspended') piperAudioContext.resume().catch(() => {});
+          piperAudioUnlocked = true;
+          return true;
+        } catch (_) { /* Fall through to the browser speech adapter. */ }
+      }
+      if (!win.speechSynthesis || !win.SpeechSynthesisUtterance) return false;
+      if (speechPrimed) return true;
+      // iOS Safari requires speech output to be initiated by a user gesture.
+      // Prime its speech channel silently on the first trusted tap/key press so
+      // later game replies can be spoken after the API response arrives.
+      try {
+        const primer = new win.SpeechSynthesisUtterance(' ');
+        primer.volume = 0;
+        win.speechSynthesis.speak(primer);
+        speechPrimed = true;
+        return true;
+      } catch (_) { return false; }
+    }
+
+    function finishRecognition(token, message = '') {
+      if (token !== generation) return;
+      if (listeningTimer !== null) win.clearTimeout(listeningTimer);
+      listeningTimer = null;
+      recognition = null;
+      generation += 1;
+      if (message) setState('ERROR', message);
+      setState('IDLE', message);
+    }
+
+    function stopListening() {
+      if (!recognition) return;
+      const old = recognition;
+      recognition = null;
+      generation += 1;
+      if (listeningTimer !== null) win.clearTimeout(listeningTimer);
+      listeningTimer = null;
+      try { old.abort(); } catch (_) { try { old.stop(); } catch (_) { /* Already stopped. */ } }
+      setState('IDLE', 'Mikrofonen är avstängd.');
+    }
+
+    function startListening() {
+      if (recognition) { stopListening(); return true; }
+      const Recognition = win.SpeechRecognition || win.webkitSpeechRecognition;
+      if (!Recognition) {
+        setState('ERROR', 'Taligenkänning stöds inte här. Du kan fortfarande skriva.');
+        setState('IDLE', 'Taligenkänning stöds inte här. Du kan fortfarande skriva.');
+        return false;
+      }
+      cancelSpeech();
+      // This runs synchronously from the microphone button gesture. If
+      // cancelSpeech() removed the earlier primer, restore it before starting
+      // recognition so a spoken reply can follow the transcript.
+      activateFromUserGesture();
+      const token = ++generation;
+      let instance;
+      try { instance = new Recognition(); }
+      catch (_) { setState('IDLE', 'Mikrofonen kunde inte startas. Kontrollera behörigheten och försök igen.'); return false; }
+      recognition = instance;
+      instance.lang = settings.language || 'sv-SE';
+      instance.continuous = false;
+      instance.interimResults = false;
+      let delivered = false;
+      instance.onresult = event => {
+        if (token !== generation || delivered) return;
+        const result = event.results?.[event.resultIndex ?? 0];
+        if (!result?.isFinal) return;
+        const text = String(result[0]?.transcript || '').trim();
+        if (!text) { finishRecognition(token, 'Inget tal kunde identifieras. Försök igen eller skriv.'); return; }
+        delivered = true;
+        if (listeningTimer !== null) win.clearTimeout(listeningTimer);
+        listeningTimer = null;
+        setState('PROCESSING', 'Tal identifierat.');
+        Promise.resolve().then(() => onTranscript(text)).then(
+          () => finishRecognition(token),
+          () => finishRecognition(token, 'Meddelandet kunde inte skickas. Du kan försöka igen eller skriva.')
+        );
+      };
+      instance.onerror = event => {
+        if (token !== generation) return;
+        const messages = {
+          'not-allowed': 'Mikrofonbehörighet nekades. Tillåt mikrofonen i webbläsaren eller skriv i stället.',
+          'service-not-allowed': 'Taligenkänning är inte tillgänglig. Du kan skriva i stället.',
+          'audio-capture': 'Ingen mikrofon hittades. Anslut en mikrofon eller skriv i stället.',
+          'no-speech': 'Inget tal hördes. Tryck på mikrofonen och försök igen.',
+          network: 'Taligenkänningens nätverkstjänst svarar inte. Försök igen eller skriv.',
+          aborted: 'Taligenkänningen avbröts. Du kan starta den igen.',
+        };
+        finishRecognition(token, messages[event.error] || 'Taligenkänningen avslutades oväntat. Försök igen eller skriv.');
+      };
+      instance.onend = () => {
+        if (token !== generation || delivered || state === 'PROCESSING') return;
+        finishRecognition(token, 'Mikrofonen avslutades. Tryck för att försöka igen eller skriv.');
+      };
+      setState('LISTENING', 'Lyssnar. Tryck på mikrofonen igen för att avsluta.');
+      listeningTimer = win.setTimeout(() => {
+        if (token !== generation) return;
+        try { instance.abort(); } catch (_) { /* Recognition may already have stopped. */ }
+        finishRecognition(token, 'Mikrofonen stängdes efter en minut. Tryck för att försöka igen eller skriv.');
+      }, 60000);
+      try { instance.start(); }
+      catch (_) { finishRecognition(token, 'Mikrofonen kunde inte startas. Kontrollera behörigheten och försök igen.'); return false; }
+      return true;
+    }
+
+    function availableVoices() {
+      try { return win.speechSynthesis?.getVoices?.() || []; } catch (_) { return []; }
+    }
+
+    function speakWithPiper(text, voiceOptions) {
+      const AudioContext = win.AudioContext || win.webkitAudioContext;
+      if (!AudioContext || !piperAudioUnlocked) return false;
+      stopListening();
+      if (currentUtterance) cancelSpeech();
+      const token = ++generation;
+      const playback = {kind: 'piper', token};
+      currentUtterance = playback;
+      setState('QUEUED', 'Förbereder svensk uppläsning. Första gången kan en röstmodell på cirka 63 MB behöva hämtas till enheten.');
+
+      if (speechTimer !== null) win.clearTimeout(speechTimer);
+      speechTimer = win.setTimeout(() => {
+        if (token !== generation) return;
+        generation += 1;
+        currentUtterance = null;
+        try { piperSource?.stop(); } catch (_) { /* Best effort. */ }
+        piperSource = null;
+        speechTimer = null;
+        setState('IDLE', 'Piper tog för lång tid på sig. Dialogen finns kvar som text. Tryck på Läs senaste repliken för att försöka igen.');
+      }, 180000);
+
+      let lastProgress = -1;
+      const progress = event => {
+        if (token !== generation || !event?.total) return;
+        const percent = Math.min(100, Math.floor((event.loaded / event.total) * 100));
+        if (percent === lastProgress) return;
+        lastProgress = percent;
+        setState('PROCESSING', `Hämtar svensk röstmodell till enheten: ${percent} procent.`);
+      };
+
+      Promise.resolve()
+        .then(() => win.GamePiper.synthesize(String(text), progress))
+        .then(async blob => {
+          if (token !== generation) return;
+          piperAudioContext ||= new AudioContext();
+          if (piperAudioContext.state === 'suspended') await piperAudioContext.resume();
+          const buffer = await piperAudioContext.decodeAudioData(await blob.arrayBuffer());
+          if (token !== generation) return;
+          const source = piperAudioContext.createBufferSource();
+          const profile = voiceOptions.characterId ? settings.speakerProfiles?.[voiceOptions.characterId] || {} : {};
+          const identity = characterVoiceProfile(voiceOptions.voiceIdentity, voiceOptions.characterId);
+          const narrator = voiceOptions.role === 'narrator';
+          const requestedRate = Number(voiceOptions.rate ?? profile.rate ?? settings.rate) || 1;
+          source.buffer = buffer;
+          source.playbackRate.value = Math.min(2, Math.max(0.5, requestedRate * (narrator || voiceOptions.rate != null || profile.rate != null ? 1 : identity.rate)));
+          const pitch = narrator ? 1 : Number(voiceOptions.pitch ?? profile.pitch ?? identity.pitch) || 1;
+          if (source.detune) source.detune.value = Math.min(600, Math.max(-600, (pitch - 1) * 1200));
+          source.connect(piperAudioContext.destination);
+          source.onended = () => {
+            if (token !== generation) return;
+            if (speechTimer !== null) win.clearTimeout(speechTimer);
+            speechTimer = null;
+            currentUtterance = null;
+            piperSource = null;
+            setState('IDLE');
+          };
+          piperSource = source;
+          source.start();
+          if (typeof voiceOptions.onStart === 'function') voiceOptions.onStart();
+          setState('SPEAKING', 'Läser upp dialogen med svensk röst.');
+        })
+        .catch(error => {
+          if (token !== generation) return;
+          if (speechTimer !== null) win.clearTimeout(speechTimer);
+          speechTimer = null;
+          currentUtterance = null;
+          piperSource = null;
+          generation += 1;
+          setState('IDLE', `Piper kunde inte skapa eller spela upp ljudet${error?.message ? `: ${error.message}` : '.'} Dialogen finns kvar som text. Tryck på Läs senaste repliken för att försöka igen.`);
+        });
+      return true;
+    }
+
+    function speak(text, voiceOptions = {}) {
+      if (text && win.GamePiper?.synthesize && speakWithPiper(text, voiceOptions)) return true;
+      if (!text || !win.speechSynthesis || !win.SpeechSynthesisUtterance) {
+        setState('IDLE', 'Talsyntes stöds inte i den här webbläsaren. Dialogen finns kvar som text.');
+        return false;
+      }
+      stopListening();
+      const hadQueuedUtterance = currentUtterance !== null;
+      if (hadQueuedUtterance) cancelSpeech();
+      const token = ++generation;
+      let utterance;
+      try { utterance = new win.SpeechSynthesisUtterance(text); }
+      catch (_) { setState('IDLE', 'Talsyntesen kunde inte startas. Dialogen finns kvar som text.'); return false; }
+      utterance.lang = settings.language || 'sv-SE';
+      utterance.volume = 1;
+      const profile = voiceOptions.characterId ? settings.speakerProfiles?.[voiceOptions.characterId] || {} : {};
+      const identityProfile = characterVoiceProfile(voiceOptions.voiceIdentity, voiceOptions.characterId);
+      const isNarrator = voiceOptions.role === 'narrator';
+      const configuredRate = Number(voiceOptions.rate ?? profile.rate ?? settings.rate) || 1;
+      utterance.rate = Math.min(2, Math.max(0.5, configuredRate * (isNarrator || voiceOptions.rate != null || profile.rate != null ? 1 : identityProfile.rate)));
+      utterance.pitch = isNarrator ? 1 : Math.min(2, Math.max(0, Number(voiceOptions.pitch ?? profile.pitch ?? identityProfile.pitch) || 1));
+      const requestedName = voiceOptions.voiceName || profile.voiceName || settings.voiceName;
+      const voices = availableVoices();
+      // An empty selection means the operating system should choose its
+      // default voice for the requested language. Forcing the first voice
+      // returned by WebKit can select a voice that is listed but cannot speak.
+      utterance.voice = requestedName
+        ? voices.find(voice => voice.name === requestedName)
+          || voices.find(voice => /^sv(-|$)/i.test(voice.lang))
+          || null
+        : null;
+      utterance.onstart = () => {
+        if (token !== generation) return;
+        if (speechStartTimer !== null) win.clearTimeout(speechStartTimer);
+        speechStartTimer = null;
+        if (typeof voiceOptions.onStart === 'function') voiceOptions.onStart();
+        // onstart confirms the browser speech engine accepted the utterance;
+        // it cannot confirm that sound reached the device's speakers.
+        setState('SPEAKING', 'Webbläsaren har startat talsyntesen. Om du inte hör ljud, tryck på Läs senaste repliken.');
+      };
+      utterance.onend = () => {
+        if (token !== generation) return;
+        if (speechTimer !== null) win.clearTimeout(speechTimer);
+        if (speechStartTimer !== null) win.clearTimeout(speechStartTimer);
+        speechTimer = null;
+        speechStartTimer = null;
+        currentUtterance = null;
+        setState('IDLE');
+      };
+      utterance.onerror = event => {
+        if (token !== generation) return;
+        if (speechTimer !== null) win.clearTimeout(speechTimer);
+        if (speechStartTimer !== null) win.clearTimeout(speechStartTimer);
+        speechTimer = null;
+        speechStartTimer = null;
+        currentUtterance = null;
+        generation += 1;
+        const blocked = event?.error === 'not-allowed' || event?.error === 'service-not-allowed';
+        const message = blocked
+          ? 'Safari blockerade uppläsningen. Tryck på Läs senaste repliken för att starta ljudet.'
+          : 'Uppläsningen avbröts. Tryck på Läs senaste repliken för att försöka igen. Dialogen finns kvar som text.';
+        setState('IDLE', message);
+      };
+      setState('QUEUED', 'Startar uppläsningen.');
+      currentUtterance = utterance;
+      speechStartTimer = win.setTimeout(() => {
+        if (token !== generation || currentUtterance !== utterance) return;
+        speechStartTimer = null;
+        generation += 1;
+        currentUtterance = null;
+        if (speechTimer !== null) win.clearTimeout(speechTimer);
+        speechTimer = null;
+        // Drop a blocked native utterance now. A player retry can then call
+        // speak() directly from its button gesture instead of following a
+        // same-turn cancel() that older WebKit versions may discard.
+        try { win.speechSynthesis.cancel(); } catch (_) { /* Best effort. */ }
+        setState('IDLE', 'Uppläsningen startade inte. Tryck på Läs senaste repliken för att starta ljudet.');
+      }, 4000);
+      speechTimer = win.setTimeout(() => {
+        if (token !== generation) return;
+        generation += 1;
+        try { win.speechSynthesis.cancel(); } catch (_) { /* Best effort. */ }
+        currentUtterance = null;
+        if (speechStartTimer !== null) win.clearTimeout(speechStartTimer);
+        speechStartTimer = null;
+        speechTimer = null;
+        setState('IDLE', 'Uppläsningen avslutades. Dialogen finns kvar som text.');
+      }, Math.max(30000, Math.min(180000, String(text).length * 180)));
+      const enqueue = () => {
+        if (token !== generation) return;
+        try { win.speechSynthesis.speak(utterance); }
+        catch (_) {
+          currentUtterance = null;
+          cancelSpeech();
+          setState('IDLE', 'Talsyntesen kunde inte startas. Dialogen finns kvar som text.');
+        }
+      };
+      try {
+        // Give WebKit one event-loop turn to finish cancel() before replacing
+        // speech that was actively playing. Normal replies enqueue immediately.
+        if (hadQueuedUtterance) win.setTimeout(enqueue, 100);
+        else enqueue();
+      }
+      catch (_) { cancelSpeech(); setState('IDLE', 'Talsyntesen kunde inte startas. Dialogen finns kvar som text.'); return false; }
+      return true;
+    }
+
+    function update(patch) { Object.assign(settings, patch); return {...settings}; }
+    function stopAll() { stopListening(); cancelSpeech(); }
+    function getState() { return state; }
+    function getSettings() { return {...settings}; }
+    function getVoices() { return availableVoices(); }
+    function supportsRecognition() { return Boolean(win.SpeechRecognition || win.webkitSpeechRecognition); }
+    return {startListening, stopListening, speak, cancelSpeech, stopAll, activateFromUserGesture, update, getState, getSettings, getVoices, supportsRecognition};
+  }
+
+  root.GameVoice = {createVoiceController, DEFAULT_SETTINGS, parseVoiceCommand, loadSettings, saveSettings, characterVoiceProfile};
+})(typeof window !== 'undefined' ? window : globalThis);