@synthetic-ai/premiere-mcp 2.2.0 → 2.3.0-dev.0

package/scripts/package.mjs

@@ -1,254 +1,254 @@
-/**
- * Synthetic Premiere Pro MCP — Build & Package
- *
- * Produces a distributable, IP-protected release in ./release :
- *   release/
- *     server/index.mjs        bundled + minified (+ obfuscated) MCP server
- *     server/package.json     minimal ESM marker
- *     MCPBridgeCEP.zxp        signed CEP plugin (obfuscated main.js, verbatim premiere.jsx, no .debug)
- *     install/                install scripts
- *     README.md  LICENSE
- *   synthetic-premiere-mcp-v{VERSION}.zip
- *
- * Usage: node scripts/package.mjs
- * Env:   ZXP_SIGN_CMD (path to ZXPSignCmd.exe), ZXP_CERT_PASSWORD (default "synthetic")
- */
-import {
-  readFileSync, writeFileSync, mkdirSync, copyFileSync, existsSync,
-  rmSync, readdirSync, statSync,
-} from "fs";
-import { join, dirname } from "path";
-import { fileURLToPath } from "url";
-import { execSync, spawnSync } from "child_process";
-import { build as esbuild } from "esbuild";
-import JavaScriptObfuscator from "javascript-obfuscator";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const ROOT = join(__dirname, "..");
-const REL = join(ROOT, "release");
-const pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf-8"));
-const V = pkg.version;
-
-console.log(`\n🔨 Packaging Synthetic Premiere MCP v${V}\n`);
-
-// ─── 1. Clean ────────────────────────────────────────────────────────────────
-if (existsSync(REL)) rmSync(REL, { recursive: true, force: true });
-mkdirSync(join(REL, "server"), { recursive: true });
-console.log("✓ Cleaned release/");
-
-// ─── 2. Compile TS, then bundle with esbuild (single minified ESM file) ──────
-console.log("⚙  tsc build...");
-execSync("npm run build", { cwd: ROOT, stdio: "pipe" });
-const serverOut = join(REL, "server", "index.mjs");
-await esbuild({
-  entryPoints: [join(ROOT, "dist", "index.js")],
-  bundle: true,
-  platform: "node",
-  format: "esm",
-  target: "node18",
-  minify: true,
-  legalComments: "none",
-  outfile: serverOut,
-});
-const bundledSize = (statSync(serverOut).size / 1024).toFixed(1);
-console.log(`✓ Bundled server → release/server/index.mjs (${bundledSize} KB)`);
-
-// ─── 3. Obfuscate the bundle (conservative; falls back to minify-only) ───────
-function validateServer(file) {
-  // Start the server; it must print "Registered 437 tools" on stderr then be ready.
-  const r = spawnSync(process.execPath, [file], {
-    input: "",
-    timeout: 8000,
-    encoding: "utf-8",
-    env: { ...process.env },
-  });
-  const out = (r.stderr || "") + (r.stdout || "");
-  const m = out.match(/Registered (\d+) tools/);
-  return m ? parseInt(m[1], 10) : 0;
-}
-
-const minifiedCode = readFileSync(serverOut, "utf-8");
-let serverProtected = "minify-only";
-try {
-  console.log("🔒 Obfuscating server bundle...");
-  // Strip the shebang before obfuscating; re-add after.
-  const noShebang = minifiedCode.replace(/^#![^\n]*\n/, "");
-  const obf = JavaScriptObfuscator.obfuscate(noShebang, {
-    compact: true,
-    target: "node",
-    controlFlowFlattening: false,
-    deadCodeInjection: false,
-    debugProtection: false,
-    disableConsoleOutput: false,
-    identifierNamesGenerator: "hexadecimal",
-    numbersToExpressions: false,
-    renameGlobals: false,
-    selfDefending: false,
-    simplify: true,
-    splitStrings: false,
-    stringArray: true,
-    stringArrayEncoding: ["base64"],
-    stringArrayThreshold: 0.75,
-    unicodeEscapeSequence: false,
-  }).getObfuscatedCode();
-  writeFileSync(serverOut, "#!/usr/bin/env node\n" + obf);
-
-  const n = validateServer(serverOut);
-  if (n >= 400) {
-    serverProtected = "obfuscated";
-    console.log(`✓ Obfuscated server validated (registered ${n} tools)`);
-  } else {
-    throw new Error(`obfuscated server registered ${n} tools (expected 437)`);
-  }
-} catch (e) {
-  console.warn(`  ⚠ Obfuscation rejected (${e.message}). Falling back to minify-only.`);
-  writeFileSync(serverOut, minifiedCode);
-  const n = validateServer(serverOut);
-  if (n < 400) {
-    console.error(`✗ Minified server also failed to register tools (${n}). Aborting.`);
-    process.exit(1);
-  }
-  console.log(`✓ Minified server validated (registered ${n} tools)`);
-}
-writeFileSync(join(REL, "server", "package.json"),
-  JSON.stringify({ name: "synthetic-premiere-mcp", version: V, type: "module", private: true }, null, 2));
-
-// ─── 4. Stage the CEP plugin (obfuscate premiere.jsx + main.js, strip .debug) ─
-const CEP_SRC = join(ROOT, "cep-plugin");
-const CEP_STAGE = join(REL, "_cepstage");
-copyDirSync(CEP_SRC, CEP_STAGE);
-
-// 4a. Strip the dev debug file (opens a CEF debug port — must not ship).
-const dbg = join(CEP_STAGE, ".debug");
-if (existsSync(dbg)) { rmSync(dbg); console.log("✓ Stripped cep .debug"); }
-
-// 4b. Stamp version into the staged manifest.
-const mxPath = join(CEP_STAGE, "CSXS", "manifest.xml");
-let mx = readFileSync(mxPath, "utf-8")
-  .replace(/ExtensionBundleVersion="[^"]*"/, `ExtensionBundleVersion="${V}"`)
-  .replace(/(<Extension Id="[^"]*" Version=")[^"]*(")/, `$1${V}$2`);
-writeFileSync(mxPath, mx);
-
-// 4b2. Stamp version into main.js's own PANEL_VERSION constant. This is
-// what checkForUpdates() actually compares against the backend manifest —
-// the manifest.xml stamp above is cosmetic. Without this, the hand-
-// maintained literal silently drifts from package.json (found 2026-09-23
-// in the sibling AE MCP repo: main.js was stuck one release behind for a
-// while), which makes every future release re-offer the SAME update
-// forever, even after a customer successfully applies it. Must run before
-// 4c obfuscates main.js.
-const preObfMainJsPath = join(CEP_STAGE, "main.js");
-if (existsSync(preObfMainJsPath)) {
-  const mainSrc = readFileSync(preObfMainJsPath, "utf-8");
-  const versionRe = /var PANEL_VERSION = "[^"]*";/;
-  if (!versionRe.test(mainSrc)) {
-    console.error("✗ Could not find PANEL_VERSION literal in main.js to stamp — aborting so a stale version never ships silently.");
-    process.exit(1);
-  }
-  writeFileSync(preObfMainJsPath, mainSrc.replace(versionRe, `var PANEL_VERSION = "${V}";`));
-  console.log(`✓ Stamped version ${V} into main.js PANEL_VERSION`);
-}
-
-// 4c. Obfuscate the panel logic (main.js only). ExtendScript-safe settings:
-//     renameGlobals MUST stay false (helper fns are called by name), no control-flow
-//     flattening / selfDefending (incompatible with the ExtendScript engine).
-// stringArray is INTENTIONALLY OFF: it deadlocks the ExtendScript engine at
-// ~100% CPU on Premiere/AE 2026 26.3+ the moment the obfuscated code actually
-// runs in ExtendScript. Found 2026-09-22 auditing every Synthetic CEP product
-// after the identical bug (same obfuscation profile) shipped in AE Agent's
-// tools.jsx and hung a paying customer's After Effects -- see
-// synthetic-ae-agent CHANGELOG.md v1.9.10 and synthetic-autoedit-pro v1.0.1.
-//
-// premiere.jsx is shipped UNOBFUSCATED, same as host.jsx. Not a stylistic
-// choice: obfuscating it (even with stringArray off) made Premiere's
-// ExtendScript engine fail evalFile() outright with "EvalScript error." —
-// no hang, just a flat parse/load failure — on Premiere Pro 26.5.1, most
-// likely a size ceiling (this file is 25k+ lines / 437 tools, an order of
-// magnitude bigger than ae-bridge.jsx or AE Agent's tools.jsx, both of
-// which obfuscate fine). Verified live 2026-09-23: identical file loads
-// "OK" unobfuscated, fails obfuscated, nothing else changed. IP exposure
-// here is the accepted tradeoff for the panel actually working — same
-// precedent as ae-bridge.jsx above.
-const ES_SAFE = {
-  compact: true,
-  controlFlowFlattening: false,
-  deadCodeInjection: false,
-  debugProtection: false,
-  disableConsoleOutput: false,
-  identifierNamesGenerator: "hexadecimal",
-  numbersToExpressions: false,
-  renameGlobals: false,
-  selfDefending: false,
-  simplify: true,
-  splitStrings: false,
-  stringArray: false,             // DEADLOCKS ExtendScript on Premiere/AE 2026 26.3+ — do not re-enable
-  unicodeEscapeSequence: false,
-};
-for (const f of ["main.js"]) {
-  const p = join(CEP_STAGE, f);
-  if (!existsSync(p)) continue;
-  const src = readFileSync(p, "utf-8").replace(/^#!.*\n/, "");
-  const obf = JavaScriptObfuscator.obfuscate(src, ES_SAFE).getObfuscatedCode();
-  writeFileSync(p, obf);
-  console.log(`✓ Obfuscated cep/${f} (${(obf.length / 1024).toFixed(1)} KB)`);
-}
-console.log("✓ Shipped cep/premiere.jsx verbatim (no obfuscation — see comment above)");
-
-// ─── 5. Sign the staged plugin into a .zxp ───────────────────────────────────
-const ZXP = process.env.ZXP_SIGN_CMD ||
-  "C:\\Users\\Artear\\Documents\\CEP-Resources\\ZXPSignCMD\\4.1.3\\x64\\ZXPSignCmd.exe";
-const certPath = process.env.ZXP_CERT_PATH || join(ROOT, ".cert", "self-signed.p12");
-const certPass = process.env.ZXP_CERT_PASSWORD || "synthetic";
-const zxpOut = join(REL, "MCPBridgeCEP.zxp");
-
-if (!existsSync(certPath)) { console.error(`✗ Cert not found: ${certPath}`); process.exit(1); }
-function sign(withTsa) {
-  const tsa = withTsa ? ` -tsa "http://timestamp.digicert.com"` : "";
-  execSync(`"${ZXP}" -sign "${CEP_STAGE}" "${zxpOut}" "${certPath}" "${certPass}"${tsa}`,
-    { cwd: ROOT, stdio: "pipe" });
-}
-console.log("🖊  Signing MCPBridgeCEP.zxp...");
-try {
-  try { sign(true); } catch { if (existsSync(zxpOut)) rmSync(zxpOut); console.warn("  ⚠ TSA failed — signing offline."); sign(false); }
-  console.log(`✓ Signed → release/MCPBridgeCEP.zxp (${(statSync(zxpOut).size / 1024).toFixed(1)} KB)`);
-} catch (e) {
-  console.error("✗ Signing failed:", (e.stderr || e.message || "").toString());
-  process.exit(1);
-}
-rmSync(CEP_STAGE, { recursive: true, force: true });
-
-// ─── 6. Install scripts + docs ───────────────────────────────────────────────
-mkdirSync(join(REL, "install"), { recursive: true });
-for (const s of ["install-cep-windows.ps1", "install-windows.bat", "install-cep.sh"]) {
-  const p = join(ROOT, "scripts", s);
-  if (existsSync(p)) copyFileSync(p, join(REL, "install", s));
-}
-for (const f of ["LICENSE"]) {
-  if (existsSync(join(ROOT, f))) copyFileSync(join(ROOT, f), join(REL, f));
-}
-console.log("✓ Copied install scripts + LICENSE");
-
-// ─── 7. Zip ──────────────────────────────────────────────────────────────────
-const zipName = `synthetic-premiere-mcp-v${V}.zip`;
-const zipPath = join(ROOT, zipName);
-if (existsSync(zipPath)) rmSync(zipPath);
-try {
-  execSync(`powershell -NoProfile -Command "Compress-Archive -Path '${REL}\\*' -DestinationPath '${zipPath}' -Force"`,
-    { stdio: "pipe" });
-  console.log(`✓ Zipped → ${zipName} (${(statSync(zipPath).size / 1024).toFixed(1)} KB)`);
-} catch (e) {
-  console.warn("  ⚠ Zip step skipped:", (e.stderr || e.message || "").toString().slice(0, 120));
-}
-
-console.log(`\n✅ Done. Server protection: ${serverProtected}.`);
-console.log(`   release/  +  ${zipName}\n`);
-
-// ─── helper ──────────────────────────────────────────────────────────────────
-function copyDirSync(src, dest) {
-  mkdirSync(dest, { recursive: true });
-  for (const entry of readdirSync(src)) {
-    const s = join(src, entry), d = join(dest, entry);
-    if (statSync(s).isDirectory()) copyDirSync(s, d);
-    else copyFileSync(s, d);
-  }
-}
+/**
+ * Synthetic Premiere Pro MCP — Build & Package
+ *
+ * Produces a distributable, IP-protected release in ./release :
+ *   release/
+ *     server/index.mjs        bundled + minified (+ obfuscated) MCP server
+ *     server/package.json     minimal ESM marker
+ *     MCPBridgeCEP.zxp        signed CEP plugin (obfuscated main.js, verbatim premiere.jsx, no .debug)
+ *     install/                install scripts
+ *     README.md  LICENSE
+ *   synthetic-premiere-mcp-v{VERSION}.zip
+ *
+ * Usage: node scripts/package.mjs
+ * Env:   ZXP_SIGN_CMD (path to ZXPSignCmd.exe), ZXP_CERT_PASSWORD (default "synthetic")
+ */
+import {
+  readFileSync, writeFileSync, mkdirSync, copyFileSync, existsSync,
+  rmSync, readdirSync, statSync,
+} from "fs";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+import { execSync, spawnSync } from "child_process";
+import { build as esbuild } from "esbuild";
+import JavaScriptObfuscator from "javascript-obfuscator";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const ROOT = join(__dirname, "..");
+const REL = join(ROOT, "release");
+const pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf-8"));
+const V = pkg.version;
+
+console.log(`\n🔨 Packaging Synthetic Premiere MCP v${V}\n`);
+
+// ─── 1. Clean ────────────────────────────────────────────────────────────────
+if (existsSync(REL)) rmSync(REL, { recursive: true, force: true });
+mkdirSync(join(REL, "server"), { recursive: true });
+console.log("✓ Cleaned release/");
+
+// ─── 2. Compile TS, then bundle with esbuild (single minified ESM file) ──────
+console.log("⚙  tsc build...");
+execSync("npm run build", { cwd: ROOT, stdio: "pipe" });
+const serverOut = join(REL, "server", "index.mjs");
+await esbuild({
+  entryPoints: [join(ROOT, "dist", "index.js")],
+  bundle: true,
+  platform: "node",
+  format: "esm",
+  target: "node18",
+  minify: true,
+  legalComments: "none",
+  outfile: serverOut,
+});
+const bundledSize = (statSync(serverOut).size / 1024).toFixed(1);
+console.log(`✓ Bundled server → release/server/index.mjs (${bundledSize} KB)`);
+
+// ─── 3. Obfuscate the bundle (conservative; falls back to minify-only) ───────
+function validateServer(file) {
+  // Start the server; it must print "Registered 437 tools" on stderr then be ready.
+  const r = spawnSync(process.execPath, [file], {
+    input: "",
+    timeout: 8000,
+    encoding: "utf-8",
+    env: { ...process.env },
+  });
+  const out = (r.stderr || "") + (r.stdout || "");
+  const m = out.match(/Registered (\d+) tools/);
+  return m ? parseInt(m[1], 10) : 0;
+}
+
+const minifiedCode = readFileSync(serverOut, "utf-8");
+let serverProtected = "minify-only";
+try {
+  console.log("🔒 Obfuscating server bundle...");
+  // Strip the shebang before obfuscating; re-add after.
+  const noShebang = minifiedCode.replace(/^#![^\n]*\n/, "");
+  const obf = JavaScriptObfuscator.obfuscate(noShebang, {
+    compact: true,
+    target: "node",
+    controlFlowFlattening: false,
+    deadCodeInjection: false,
+    debugProtection: false,
+    disableConsoleOutput: false,
+    identifierNamesGenerator: "hexadecimal",
+    numbersToExpressions: false,
+    renameGlobals: false,
+    selfDefending: false,
+    simplify: true,
+    splitStrings: false,
+    stringArray: true,
+    stringArrayEncoding: ["base64"],
+    stringArrayThreshold: 0.75,
+    unicodeEscapeSequence: false,
+  }).getObfuscatedCode();
+  writeFileSync(serverOut, "#!/usr/bin/env node\n" + obf);
+
+  const n = validateServer(serverOut);
+  if (n >= 400) {
+    serverProtected = "obfuscated";
+    console.log(`✓ Obfuscated server validated (registered ${n} tools)`);
+  } else {
+    throw new Error(`obfuscated server registered ${n} tools (expected 437)`);
+  }
+} catch (e) {
+  console.warn(`  ⚠ Obfuscation rejected (${e.message}). Falling back to minify-only.`);
+  writeFileSync(serverOut, minifiedCode);
+  const n = validateServer(serverOut);
+  if (n < 400) {
+    console.error(`✗ Minified server also failed to register tools (${n}). Aborting.`);
+    process.exit(1);
+  }
+  console.log(`✓ Minified server validated (registered ${n} tools)`);
+}
+writeFileSync(join(REL, "server", "package.json"),
+  JSON.stringify({ name: "synthetic-premiere-mcp", version: V, type: "module", private: true }, null, 2));
+
+// ─── 4. Stage the CEP plugin (obfuscate premiere.jsx + main.js, strip .debug) ─
+const CEP_SRC = join(ROOT, "cep-plugin");
+const CEP_STAGE = join(REL, "_cepstage");
+copyDirSync(CEP_SRC, CEP_STAGE);
+
+// 4a. Strip the dev debug file (opens a CEF debug port — must not ship).
+const dbg = join(CEP_STAGE, ".debug");
+if (existsSync(dbg)) { rmSync(dbg); console.log("✓ Stripped cep .debug"); }
+
+// 4b. Stamp version into the staged manifest.
+const mxPath = join(CEP_STAGE, "CSXS", "manifest.xml");
+let mx = readFileSync(mxPath, "utf-8")
+  .replace(/ExtensionBundleVersion="[^"]*"/, `ExtensionBundleVersion="${V}"`)
+  .replace(/(<Extension Id="[^"]*" Version=")[^"]*(")/, `$1${V}$2`);
+writeFileSync(mxPath, mx);
+
+// 4b2. Stamp version into main.js's own PANEL_VERSION constant. This is
+// what checkForUpdates() actually compares against the backend manifest —
+// the manifest.xml stamp above is cosmetic. Without this, the hand-
+// maintained literal silently drifts from package.json (found 2026-09-23
+// in the sibling AE MCP repo: main.js was stuck one release behind for a
+// while), which makes every future release re-offer the SAME update
+// forever, even after a customer successfully applies it. Must run before
+// 4c obfuscates main.js.
+const preObfMainJsPath = join(CEP_STAGE, "main.js");
+if (existsSync(preObfMainJsPath)) {
+  const mainSrc = readFileSync(preObfMainJsPath, "utf-8");
+  const versionRe = /var PANEL_VERSION = "[^"]*";/;
+  if (!versionRe.test(mainSrc)) {
+    console.error("✗ Could not find PANEL_VERSION literal in main.js to stamp — aborting so a stale version never ships silently.");
+    process.exit(1);
+  }
+  writeFileSync(preObfMainJsPath, mainSrc.replace(versionRe, `var PANEL_VERSION = "${V}";`));
+  console.log(`✓ Stamped version ${V} into main.js PANEL_VERSION`);
+}
+
+// 4c. Obfuscate the panel logic (main.js only). ExtendScript-safe settings:
+//     renameGlobals MUST stay false (helper fns are called by name), no control-flow
+//     flattening / selfDefending (incompatible with the ExtendScript engine).
+// stringArray is INTENTIONALLY OFF: it deadlocks the ExtendScript engine at
+// ~100% CPU on Premiere/AE 2026 26.3+ the moment the obfuscated code actually
+// runs in ExtendScript. Found 2026-09-22 auditing every Synthetic CEP product
+// after the identical bug (same obfuscation profile) shipped in AE Agent's
+// tools.jsx and hung a paying customer's After Effects -- see
+// synthetic-ae-agent CHANGELOG.md v1.9.10 and synthetic-autoedit-pro v1.0.1.
+//
+// premiere.jsx is shipped UNOBFUSCATED, same as host.jsx. Not a stylistic
+// choice: obfuscating it (even with stringArray off) made Premiere's
+// ExtendScript engine fail evalFile() outright with "EvalScript error." —
+// no hang, just a flat parse/load failure — on Premiere Pro 26.5.1, most
+// likely a size ceiling (this file is 25k+ lines / 437 tools, an order of
+// magnitude bigger than ae-bridge.jsx or AE Agent's tools.jsx, both of
+// which obfuscate fine). Verified live 2026-09-23: identical file loads
+// "OK" unobfuscated, fails obfuscated, nothing else changed. IP exposure
+// here is the accepted tradeoff for the panel actually working — same
+// precedent as ae-bridge.jsx above.
+const ES_SAFE = {
+  compact: true,
+  controlFlowFlattening: false,
+  deadCodeInjection: false,
+  debugProtection: false,
+  disableConsoleOutput: false,
+  identifierNamesGenerator: "hexadecimal",
+  numbersToExpressions: false,
+  renameGlobals: false,
+  selfDefending: false,
+  simplify: true,
+  splitStrings: false,
+  stringArray: false,             // DEADLOCKS ExtendScript on Premiere/AE 2026 26.3+ — do not re-enable
+  unicodeEscapeSequence: false,
+};
+for (const f of ["main.js"]) {
+  const p = join(CEP_STAGE, f);
+  if (!existsSync(p)) continue;
+  const src = readFileSync(p, "utf-8").replace(/^#!.*\n/, "");
+  const obf = JavaScriptObfuscator.obfuscate(src, ES_SAFE).getObfuscatedCode();
+  writeFileSync(p, obf);
+  console.log(`✓ Obfuscated cep/${f} (${(obf.length / 1024).toFixed(1)} KB)`);
+}
+console.log("✓ Shipped cep/premiere.jsx verbatim (no obfuscation — see comment above)");
+
+// ─── 5. Sign the staged plugin into a .zxp ───────────────────────────────────
+const ZXP = process.env.ZXP_SIGN_CMD ||
+  "C:\\Users\\Artear\\Documents\\CEP-Resources\\ZXPSignCMD\\4.1.3\\x64\\ZXPSignCmd.exe";
+const certPath = process.env.ZXP_CERT_PATH || join(ROOT, ".cert", "self-signed.p12");
+const certPass = process.env.ZXP_CERT_PASSWORD || "synthetic";
+const zxpOut = join(REL, "MCPBridgeCEP.zxp");
+
+if (!existsSync(certPath)) { console.error(`✗ Cert not found: ${certPath}`); process.exit(1); }
+function sign(withTsa) {
+  const tsa = withTsa ? ` -tsa "http://timestamp.digicert.com"` : "";
+  execSync(`"${ZXP}" -sign "${CEP_STAGE}" "${zxpOut}" "${certPath}" "${certPass}"${tsa}`,
+    { cwd: ROOT, stdio: "pipe" });
+}
+console.log("🖊  Signing MCPBridgeCEP.zxp...");
+try {
+  try { sign(true); } catch { if (existsSync(zxpOut)) rmSync(zxpOut); console.warn("  ⚠ TSA failed — signing offline."); sign(false); }
+  console.log(`✓ Signed → release/MCPBridgeCEP.zxp (${(statSync(zxpOut).size / 1024).toFixed(1)} KB)`);
+} catch (e) {
+  console.error("✗ Signing failed:", (e.stderr || e.message || "").toString());
+  process.exit(1);
+}
+rmSync(CEP_STAGE, { recursive: true, force: true });
+
+// ─── 6. Install scripts + docs ───────────────────────────────────────────────
+mkdirSync(join(REL, "install"), { recursive: true });
+for (const s of ["install-cep-windows.ps1", "install-windows.bat", "install-cep.sh"]) {
+  const p = join(ROOT, "scripts", s);
+  if (existsSync(p)) copyFileSync(p, join(REL, "install", s));
+}
+for (const f of ["LICENSE"]) {
+  if (existsSync(join(ROOT, f))) copyFileSync(join(ROOT, f), join(REL, f));
+}
+console.log("✓ Copied install scripts + LICENSE");
+
+// ─── 7. Zip ──────────────────────────────────────────────────────────────────
+const zipName = `synthetic-premiere-mcp-v${V}.zip`;
+const zipPath = join(ROOT, zipName);
+if (existsSync(zipPath)) rmSync(zipPath);
+try {
+  execSync(`powershell -NoProfile -Command "Compress-Archive -Path '${REL}\\*' -DestinationPath '${zipPath}' -Force"`,
+    { stdio: "pipe" });
+  console.log(`✓ Zipped → ${zipName} (${(statSync(zipPath).size / 1024).toFixed(1)} KB)`);
+} catch (e) {
+  console.warn("  ⚠ Zip step skipped:", (e.stderr || e.message || "").toString().slice(0, 120));
+}
+
+console.log(`\n✅ Done. Server protection: ${serverProtected}.`);
+console.log(`   release/  +  ${zipName}\n`);
+
+// ─── helper ──────────────────────────────────────────────────────────────────
+function copyDirSync(src, dest) {
+  mkdirSync(dest, { recursive: true });
+  for (const entry of readdirSync(src)) {
+    const s = join(src, entry), d = join(dest, entry);
+    if (statSync(s).isDirectory()) copyDirSync(s, d);
+    else copyFileSync(s, d);
+  }
+}