@viralspin/mcp 0.1.0 → 0.3.1

package/dist/local-render/kit.js

@@ -0,0 +1,217 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BROWSER_HELP = exports.runBrowserInstall = exports.runNpm = exports.MIN_FREE_BYTES = void 0;
+exports.defaultKitDir = defaultKitDir;
+exports.assertSafeKitDir = assertSafeKitDir;
+exports.checkNode = checkNode;
+exports.freeBytes = freeBytes;
+exports.checkDisk = checkDisk;
+exports.sha256File = sha256File;
+exports.downloadVerified = downloadVerified;
+exports.npmInvocation = npmInvocation;
+exports.installKit = installKit;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+exports.MIN_FREE_BYTES = 8 * 2 ** 30;
+function defaultKitDir() {
+    return path_1.default.join(os_1.default.homedir(), ".viralspin", "kit");
+}
+/** The kit lives in the user's home, never at a drive root and never inside a git checkout (npm would write there). */
+function assertSafeKitDir(dir, home = os_1.default.homedir()) {
+    const abs = path_1.default.resolve(dir);
+    if (abs === path_1.default.parse(abs).root)
+        throw new Error(`Refusing to install the render kit at a drive root (${abs}).`);
+    let cur = abs;
+    for (;;) {
+        if (fs_1.default.existsSync(path_1.default.join(cur, ".git"))) {
+            throw new Error(`Refusing to install the render kit inside a git repository (${cur}). Use the default ${path_1.default.join(home, ".viralspin", "kit")}.`);
+        }
+        const up = path_1.default.dirname(cur);
+        if (up === cur)
+            break;
+        cur = up;
+    }
+    const rel = path_1.default.relative(path_1.default.resolve(home), abs);
+    if (rel.startsWith("..") || path_1.default.isAbsolute(rel)) {
+        throw new Error(`The render kit must live inside your home folder (${home}); got ${abs}.`);
+    }
+    return abs;
+}
+function checkNode(min, version = process.versions.node) {
+    const major = Number(version.split(".")[0]);
+    if (!(major >= min)) {
+        throw new Error(`Node ${version} is too old for local rendering (needs Node ${min} or newer). Install the current LTS from https://nodejs.org ` +
+            `(Windows: winget install OpenJS.NodeJS.LTS; macOS: brew install node), then restart Claude Desktop.`);
+    }
+}
+async function freeBytes(dir) {
+    let probe = path_1.default.resolve(dir);
+    while (!fs_1.default.existsSync(probe)) {
+        const up = path_1.default.dirname(probe);
+        if (up === probe)
+            break;
+        probe = up;
+    }
+    try {
+        const s = await fs_1.default.promises.statfs(probe);
+        return Number(s.bavail) * Number(s.bsize);
+    }
+    catch {
+        return null; // cannot tell: do not block on it
+    }
+}
+async function checkDisk(dir, need = exports.MIN_FREE_BYTES, free = freeBytes) {
+    const f = await free(dir);
+    if (f !== null && f < need) {
+        throw new Error(`Only ${(f / 2 ** 30).toFixed(1)} GB free on the drive holding ${dir}; local rendering needs at least ${(need / 2 ** 30).toFixed(0)} GB ` +
+            `(the render kit is ~0.5 GB, the media and the finished reel the rest). Free some space and try again.`);
+    }
+}
+function sha256File(file) {
+    return new Promise((resolve, reject) => {
+        const h = crypto_1.default.createHash("sha256");
+        fs_1.default.createReadStream(file).on("data", (d) => h.update(d)).on("error", reject).on("end", () => resolve(h.digest("hex")));
+    });
+}
+function safeRel(rel) {
+    if (!rel || rel.includes("\\") || path_1.default.isAbsolute(rel) || rel.split("/").some((p) => p === ".." || p === "")) {
+        throw new Error(`The toolkit manifest names an unsafe path (${rel}); refusing to install it.`);
+    }
+    return rel;
+}
+/** Download `url` to `dest` (via a .part file), verifying `sha256` when given. */
+async function downloadVerified(url, dest, sha256, fetchImpl = fetch) {
+    await fs_1.default.promises.mkdir(path_1.default.dirname(dest), { recursive: true });
+    const part = `${dest}.part`;
+    const resp = await fetchImpl(url);
+    if (!resp.ok || !resp.body)
+        throw new Error(`Download failed (${resp.status}) for ${url.slice(0, 120)}`);
+    const h = crypto_1.default.createHash("sha256");
+    const out = fs_1.default.createWriteStream(part);
+    let n = 0;
+    try {
+        for await (const chunk of resp.body) {
+            h.update(chunk);
+            n += chunk.length;
+            if (!out.write(chunk))
+                await new Promise((r) => out.once("drain", () => r()));
+        }
+        await new Promise((res, rej) => out.end((e) => (e ? rej(e) : res())));
+    }
+    catch (e) {
+        out.destroy();
+        await fs_1.default.promises.rm(part, { force: true });
+        throw e;
+    }
+    const got = h.digest("hex");
+    if (sha256 && got !== sha256) {
+        await fs_1.default.promises.rm(part, { force: true });
+        throw new Error(`Checksum mismatch for ${url.slice(0, 120)} (expected ${sha256.slice(0, 12)}…, got ${got.slice(0, 12)}…). Not using it.`);
+    }
+    await fs_1.default.promises.rename(part, dest);
+    return n;
+}
+/** npm without a shell where possible: `node <npm-cli.js>` sits next to the node binary on every platform. */
+function npmInvocation(execPath = process.execPath, platform = process.platform) {
+    const dir = path_1.default.dirname(execPath);
+    const candidates = [
+        path_1.default.join(dir, "node_modules", "npm", "bin", "npm-cli.js"), // Windows installer
+        path_1.default.join(dir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js"), // macOS / Linux
+    ];
+    for (const c of candidates)
+        if (fs_1.default.existsSync(c))
+            return { cmd: execPath, prefix: [c], shell: false };
+    // Last resort: fixed, argument-free-of-user-input commands, so a shell is safe.
+    return { cmd: platform === "win32" ? "npm.cmd" : "npm", prefix: [], shell: platform === "win32" };
+}
+const runNpm = (cwd, args, log) => new Promise((resolve, reject) => {
+    const inv = npmInvocation();
+    const p = (0, child_process_1.spawn)(inv.cmd, [...inv.prefix, ...args], { cwd, shell: inv.shell, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    const onData = (b) => String(b).split(/\r?\n/).filter(Boolean).forEach((l) => log(`[npm] ${l}`));
+    p.stdout.on("data", onData);
+    p.stderr.on("data", onData);
+    p.on("error", (e) => reject(new Error(`could not start npm: ${e.message}`)));
+    p.on("close", (c) => resolve(c ?? -1));
+});
+exports.runNpm = runNpm;
+/** ensureBrowser() once; the kit's own node_modules is the cwd so `@remotion/renderer` resolves. */
+const runBrowserInstall = (cwd, _args, log) => new Promise((resolve, reject) => {
+    const code = "import('@remotion/renderer').then(m=>m.ensureBrowser()).then(()=>{console.log('browser ready')}).catch(e=>{console.error(String(e&&e.message||e));process.exit(3)})";
+    const p = (0, child_process_1.spawn)(process.execPath, ["--input-type=module", "-e", code], { cwd, shell: false, windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    const onData = (b) => String(b).split(/\r?\n/).filter(Boolean).forEach((l) => log(`[browser] ${l}`));
+    p.stdout.on("data", onData);
+    p.stderr.on("data", onData);
+    p.on("error", (e) => reject(e));
+    p.on("close", (c) => resolve(c ?? -1));
+});
+exports.runBrowserInstall = runBrowserInstall;
+exports.BROWSER_HELP = "Could not download the Chrome Headless Shell that Remotion draws with. This is almost always antivirus, a corporate proxy or a firewall " +
+    "blocking the download. Manual step: allow the download host shown in the lines above (or set HTTPS_PROXY for this computer), then run " +
+    "render_locally again - or, in the kit folder, run:  node --input-type=module -e \"import('@remotion/renderer').then(m=>m.ensureBrowser())\"";
+async function installKit(o) {
+    const log = o.log ?? (() => undefined);
+    const kitDir = assertSafeKitDir(o.kitDir, o.home);
+    checkNode(o.manifest.min_node);
+    await fs_1.default.promises.mkdir(kitDir, { recursive: true });
+    const statePath = path_1.default.join(kitDir, ".installed.json");
+    let state = { bundle_version: "", remotion: "", files: {} };
+    try {
+        state = JSON.parse(await fs_1.default.promises.readFile(statePath, "utf8"));
+    }
+    catch { /* first install */ }
+    let updated = 0, skipped = 0, removed = 0;
+    const next = {};
+    for (const f of o.manifest.files) {
+        const rel = safeRel(f.path);
+        const dest = path_1.default.join(kitDir, ...rel.split("/"));
+        let ok = false;
+        if (state.files[rel] === f.sha256 && fs_1.default.existsSync(dest)) {
+            ok = (await fs_1.default.promises.stat(dest)).size === f.bytes;
+        }
+        if (ok) {
+            skipped++;
+            next[rel] = f.sha256;
+            continue;
+        }
+        await downloadVerified(f.url, dest, f.sha256, o.fetchImpl);
+        updated++;
+        next[rel] = f.sha256;
+    }
+    for (const rel of Object.keys(state.files)) {
+        if (!(rel in next)) {
+            await fs_1.default.promises.rm(path_1.default.join(kitDir, ...safeRel(rel).split("/")), { force: true });
+            removed++;
+        }
+    }
+    log(`[kit] ${updated} file(s) updated, ${skipped} already current, ${removed} removed (bundle ${o.manifest.bundle_version})`);
+    const pkgHash = next["package.json"] ?? "";
+    const haveModules = fs_1.default.existsSync(path_1.default.join(kitDir, "node_modules", "@remotion", "renderer", "package.json"));
+    let npmRan = false;
+    if (!haveModules || state.npm_hash !== pkgHash) {
+        log("[kit] installing Remotion (npm install, one time, a few minutes)...");
+        const code = await (o.npm ?? exports.runNpm)(kitDir, ["install", "--no-audit", "--no-fund", "--omit=dev", "--loglevel=error"], log);
+        if (code !== 0)
+            throw new Error(`npm install failed in ${kitDir} (exit ${code}). Check the [npm] lines above; a proxy or offline network is the usual cause.`);
+        npmRan = true;
+    }
+    let browserRan = false;
+    if (npmRan || state.browser !== o.manifest.remotion) {
+        log("[kit] checking the Chrome Headless Shell (downloads once, ~100-200 MB)...");
+        const code = await (o.browser ?? exports.runBrowserInstall)(kitDir, [], log);
+        if (code !== 0)
+            throw new Error(exports.BROWSER_HELP);
+        browserRan = true;
+    }
+    const newState = {
+        bundle_version: o.manifest.bundle_version, remotion: o.manifest.remotion, files: next,
+        npm_hash: pkgHash, browser: o.manifest.remotion,
+    };
+    await fs_1.default.promises.writeFile(statePath, JSON.stringify(newState, null, 1));
+    return { updated, skipped, removed, npmRan, browserRan, bundle_version: o.manifest.bundle_version };
+}

package/dist/local-render/login.js

@@ -0,0 +1,138 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.saveTokens = void 0;
+exports.pkcePair = pkcePair;
+exports.defaultOpenBrowser = defaultOpenBrowser;
+exports.login = login;
+exports.logout = logout;
+exports.whoami = whoami;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const http_1 = __importDefault(require("http"));
+const os_1 = __importDefault(require("os"));
+const child_process_1 = require("child_process");
+const tokens_js_1 = require("./tokens.js");
+Object.defineProperty(exports, "saveTokens", { enumerable: true, get: function () { return tokens_js_1.saveTokens; } });
+const b64url = (b) => b.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+function pkcePair() {
+    const verifier = b64url(crypto_1.default.randomBytes(48));
+    return { verifier, challenge: b64url(crypto_1.default.createHash("sha256").update(verifier).digest()) };
+}
+/** Open a URL in the default browser without a shell (an `&` in the URL must not be interpreted). */
+function defaultOpenBrowser(url) {
+    const [cmd, args] = process.platform === "darwin" ? ["open", [url]]
+        : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]]
+            : ["xdg-open", [url]];
+    const child = (0, child_process_1.spawn)(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => undefined); // no browser available: the printed link is the fallback
+    child.unref();
+}
+const PAGE = (title, body) => `<!doctype html><meta charset="utf-8"><title>ViralSpin</title><body style="font:16px system-ui;background:#0e1116;color:#f2f5f7;display:grid;place-items:center;height:100vh;margin:0"><div style="max-width:420px;text-align:center"><h1 style="font-size:22px">${title}</h1><p style="color:#b4bcc8">${body}</p></div>`;
+async function login(o) {
+    const log = o.log ?? (() => undefined);
+    const fetchImpl = o.fetchImpl ?? fetch;
+    const file = o.file ?? (0, tokens_js_1.defaultTokenFile)();
+    const { verifier, challenge } = pkcePair();
+    const state = b64url(crypto_1.default.randomBytes(16));
+    let settle;
+    const outcome = new Promise((r) => { settle = r; });
+    const server = http_1.default.createServer((req, res) => {
+        const u = new URL(req.url || "/", "http://127.0.0.1");
+        if (u.pathname !== "/callback") {
+            res.writeHead(404).end();
+            return;
+        }
+        const reply = (code, html) => { res.writeHead(code, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" }).end(html); };
+        if (u.searchParams.get("state") !== state) {
+            reply(400, PAGE("That did not match", "This sign-in link was not started by ViralSpin on this computer. Close this tab and try again."));
+            return; // a stray or forged request must not end the real attempt
+        }
+        const err = u.searchParams.get("error");
+        const code = u.searchParams.get("code");
+        if (err || !code) {
+            reply(200, PAGE("Not connected", "You chose not to connect ViralSpin. You can close this tab."));
+            settle({ error: err === "access_denied" || !code ? "You declined the sign-in in the browser." : `The sign-in failed (${err}).` });
+            return;
+        }
+        reply(200, PAGE("You are connected", "ViralSpin is connected to this computer. You can close this tab and go back to Claude."));
+        settle({ code });
+    });
+    await new Promise((resolve, reject) => { server.once("error", reject); server.listen(o.port ?? 0, "127.0.0.1", resolve); });
+    const port = server.address().port;
+    const redirectUri = `http://127.0.0.1:${port}/callback`;
+    let timer;
+    try {
+        const reg = await fetchImpl(`${o.apiBase}/v1/oauth/register`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ client_name: o.clientName ?? `ViralSpin on ${os_1.default.hostname()}`, redirect_uris: [redirectUri] }),
+        });
+        if (!reg.ok)
+            throw new Error(`ViralSpin would not register this computer for sign-in (${reg.status}).`);
+        const client_id = (await reg.json()).client_id;
+        if (!client_id)
+            throw new Error("ViralSpin answered the sign-in registration without a client id.");
+        const url = `${o.apiBase}/v1/oauth/authorize?` + new URLSearchParams({
+            client_id, redirect_uri: redirectUri, response_type: "code",
+            code_challenge: challenge, code_challenge_method: "S256", state,
+        }).toString();
+        log("[login] Opening your browser so you can approve ViralSpin on this computer...");
+        log(`[login] If it did not open, open this link yourself: ${url}`);
+        try {
+            await (o.openBrowser ?? defaultOpenBrowser)(url);
+        }
+        catch { /* the link above is the fallback */ }
+        const timeoutMs = o.timeoutMs ?? 5 * 60000;
+        const got = await Promise.race([
+            outcome,
+            new Promise((r) => { timer = setTimeout(() => r({ error: `Nobody approved the sign-in within ${Math.round(timeoutMs / 60000)} minutes.` }), timeoutMs); }),
+        ]);
+        if ("error" in got)
+            throw new Error(got.error);
+        const tok = await fetchImpl(`${o.apiBase}/v1/oauth/token`, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({ grant_type: "authorization_code", code: got.code, redirect_uri: redirectUri, client_id, code_verifier: verifier }).toString(),
+        });
+        if (!tok.ok)
+            throw new Error(`ViralSpin would not finish the sign-in (${tok.status}). Try again.`);
+        const j = (await tok.json());
+        if (!j.access_token)
+            throw new Error("The sign-in finished without an access token. Try again.");
+        (0, tokens_js_1.saveTokens)(file, { access_token: j.access_token, refresh_token: j.refresh_token, client_id });
+        log("[login] Connected. This computer stays signed in (renews itself for about 30 days of use).");
+        return { file, client_id, expires_at: (0, tokens_js_1.jwtExpiry)(j.access_token) };
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        server.close();
+        server.closeAllConnections?.();
+    }
+}
+function logout(file = (0, tokens_js_1.defaultTokenFile)()) {
+    try {
+        fs_1.default.unlinkSync(file);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Who is signed in, WITHOUT showing a token: the user id from the access token and when it lapses. */
+function whoami(file = (0, tokens_js_1.defaultTokenFile)()) {
+    try {
+        const j = JSON.parse(fs_1.default.readFileSync(file, "utf8"));
+        if (!j || typeof j.access_token !== "string")
+            return { signedIn: false };
+        const part = j.access_token.split(".")[1];
+        const sub = part ? JSON.parse(Buffer.from(part.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8")).sub : undefined;
+        return { signedIn: true, user: sub, accessExpiresAt: (0, tokens_js_1.jwtExpiry)(j.access_token), hasRefresh: Boolean(j.refresh_token) };
+    }
+    catch {
+        return { signedIn: false };
+    }
+}

package/dist/local-render/render.js

@@ -0,0 +1,252 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pickJob = pickJob;
+exports.listPendingJobs = listPendingJobs;
+exports.ago = ago;
+exports.defaultConcurrency = defaultConcurrency;
+exports.freePort = freePort;
+exports.rewritePlan = rewritePlan;
+exports.fetchToolkitManifest = fetchToolkitManifest;
+exports.planJob = planJob;
+exports.downloadMedia = downloadMedia;
+exports.uploadOutput = uploadOutput;
+exports.renderLocally = renderLocally;
+const fs_1 = __importDefault(require("fs"));
+const net_1 = __importDefault(require("net"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const url_1 = require("url");
+const kit_js_1 = require("./kit.js");
+/** Which of my pending jobs to render when nobody said: a reel that is READY and waiting, newest first; failing that one still being
+ *  prepared (we wait for it). One that a computer already took ("rendering") is never picked on its own. */
+function pickJob(jobs) {
+    const byNewest = [...jobs].sort((a, b) => String(b.created_at ?? "").localeCompare(String(a.created_at ?? "")));
+    const waiting = byNewest.filter((j) => j.phase === "waiting");
+    const planning = byNewest.filter((j) => j.phase === "planning");
+    const busy = byNewest.filter((j) => j.phase === "rendering");
+    const ordered = [...waiting, ...planning];
+    return { job: ordered[0] ?? null, others: ordered.slice(1), busy };
+}
+async function listPendingJobs(o) {
+    const r = await o.tokens.request("GET", `${o.apiBase}/v1/reel/local-jobs?status=pending`);
+    return r.jobs ?? [];
+}
+function ago(iso, now = Date.now()) {
+    const t = iso ? Date.parse(iso) : NaN;
+    if (!Number.isFinite(t))
+        return "a while ago";
+    const m = Math.max(0, Math.round((now - t) / 60000));
+    if (m < 1)
+        return "just now";
+    if (m < 60)
+        return `${m} min ago`;
+    const h = Math.round(m / 60);
+    return h < 48 ? `${h} h ago` : `${Math.round(h / 24)} days ago`;
+}
+function defaultConcurrency(cores = os_1.default.cpus().length) {
+    return Math.max(1, Math.min(4, Math.floor(cores / 2))); // measured: 6+ was slower than 4
+}
+function freePort() {
+    return new Promise((resolve, reject) => {
+        const s = net_1.default.createServer();
+        s.once("error", reject);
+        s.listen(0, "127.0.0.1", () => {
+            const p = s.address().port;
+            s.close(() => resolve(p));
+        });
+    });
+}
+/** Replace every media URL in the plan with the loopback address the kit's server will answer on. No public address remains. */
+function rewritePlan(plan, media, port) {
+    const map = new Map(media.map((m) => [m.url, `http://127.0.0.1:${port}/${m.name}`]));
+    const walk = (n) => {
+        if (typeof n === "string")
+            return map.get(n) ?? n;
+        if (Array.isArray(n))
+            return n.map(walk);
+        if (n && typeof n === "object")
+            return Object.fromEntries(Object.entries(n).map(([k, v]) => [k, walk(v)]));
+        return n;
+    };
+    return walk(plan);
+}
+const dynamicImport = new Function("u", "return import(u)");
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function fetchToolkitManifest(o) {
+    return o.tokens.request("GET", `${o.apiBase}/v1/toolkit/manifest`);
+}
+async function planJob(o, log) {
+    if (!o.job_id && !o.render_id && !o.request)
+        throw new Error("Pass a job_id, a render_id (a reel ViralSpin already planned) or a reel request {plan, aroll_url}.");
+    const body = o.render_id ? { render_id: o.render_id } : o.request;
+    let view = o.job_id
+        ? await o.tokens.request("GET", `${o.apiBase}/v1/reel/local-jobs/${encodeURIComponent(o.job_id)}`)
+        : await o.tokens.request("POST", `${o.apiBase}/v1/reel/local-jobs?wait=50`, body);
+    const t0 = Date.now();
+    const limit = o.planTimeoutMs ?? 20 * 60000;
+    let last = "";
+    while (view.status !== "local_ready") {
+        if (view.status === "failed" || view.status === "cancelled") {
+            throw new Error(`ViralSpin could not prepare this reel (${view.status}): ${view.error_message || "no reason given"}`);
+        }
+        if (Date.now() - t0 > limit)
+            throw new Error(`Preparing the reel took longer than ${Math.round(limit / 60000)} minutes; try again.`);
+        if (view.status !== last) {
+            log(`[plan] ${view.status}${view.progress ? ` ${Math.round(Number(view.progress) * 100)}%` : ""}`);
+            last = view.status;
+        }
+        await sleep(o.pollMs ?? 3000);
+        view = await o.tokens.request("GET", `${o.apiBase}/v1/reel/local-jobs/${view.job_id}`);
+    }
+    if (!view.manifest)
+        throw new Error("The server said the job is ready but sent no manifest.");
+    return view.manifest;
+}
+async function downloadMedia(media, dir, fetchImpl, log) {
+    await fs_1.default.promises.mkdir(dir, { recursive: true });
+    let downloaded = 0, cached = 0;
+    let i = 0;
+    const lane = async () => {
+        for (;;) {
+            const m = media[i++];
+            if (!m)
+                return;
+            const dest = path_1.default.join(dir, m.name);
+            if (fs_1.default.existsSync(dest) && m.sha256 && (await (0, kit_js_1.sha256File)(dest)) === m.sha256) {
+                cached++;
+                continue;
+            }
+            if (fs_1.default.existsSync(dest) && !m.sha256) {
+                cached++;
+                continue;
+            }
+            try {
+                await (0, kit_js_1.downloadVerified)(m.url, dest, m.sha256, fetchImpl);
+            }
+            catch {
+                await (0, kit_js_1.downloadVerified)(m.url, dest, m.sha256, fetchImpl); // one more try: a dropped connection is the usual cause
+            }
+            downloaded++;
+            if (downloaded % 10 === 0)
+                log(`[media] ${downloaded + cached}/${media.length}`);
+        }
+    };
+    await Promise.all([lane(), lane(), lane(), lane()]);
+    return { downloaded, cached };
+}
+/** Put the finished mp4 in ViralSpin storage through a signed slot (multipart PUT, the shape storage's own client uses). Retried: a home upload drops. */
+async function uploadOutput(o, jobId, file, fetchImpl = fetch, attempts = 3) {
+    const slot = await o.tokens.request("POST", `${o.apiBase}/v1/reel/local-jobs/${encodeURIComponent(jobId)}/upload-url`, {});
+    let lastErr = "";
+    for (let i = 1; i <= attempts; i++) {
+        try {
+            const blob = typeof fs_1.default.openAsBlob === "function"
+                ? await fs_1.default.openAsBlob(file, { type: "video/mp4" })
+                : new Blob([await fs_1.default.promises.readFile(file)], { type: "video/mp4" });
+            const form = new FormData();
+            form.append("cacheControl", "31536000");
+            form.append("", blob, path_1.default.basename(file));
+            const r = await fetchImpl(slot.upload_url, { method: "PUT", body: form, headers: { "x-upsert": "true" } });
+            if (r.ok)
+                return slot.public_url;
+            lastErr = `${r.status} ${(await r.text().catch(() => "")).slice(0, 120)}`;
+        }
+        catch (e) {
+            lastErr = String(e.message || e);
+        }
+        if (i < attempts)
+            await sleep(1500 * i);
+    }
+    throw new Error(`The reel was drawn but could not be sent to ViralSpin (${lastErr}). It is still on this computer: ${file}`);
+}
+async function renderLocally(o) {
+    const log = o.log ?? (() => undefined);
+    const home = o.homeDir ?? os_1.default.homedir();
+    const fetchImpl = o.fetchImpl ?? fetch;
+    const t0 = Date.now();
+    const secs = (a) => Math.round((Date.now() - a) / 100) / 10;
+    const kitDir = (0, kit_js_1.assertSafeKitDir)(o.kitDir ?? path_1.default.join(home, ".viralspin", "kit"), home);
+    const workRoot = path_1.default.resolve(o.workDir ?? path_1.default.join(home, ".viralspin"));
+    (0, kit_js_1.checkNode)(20);
+    const envGb = Number(process.env.VIRALSPIN_MIN_FREE_GB);
+    await (0, kit_js_1.checkDisk)(workRoot, o.minFreeBytes ?? (envGb > 0 ? envGb * 2 ** 30 : undefined));
+    // 1 - the toolkit
+    const tk = Date.now();
+    const manifest = await fetchToolkitManifest(o);
+    (0, kit_js_1.checkNode)(manifest.min_node);
+    const inst = await (0, kit_js_1.installKit)({ manifest, kitDir, fetchImpl, log, npm: o.npm, browser: o.browser, home });
+    const kitSecs = secs(tk);
+    // 2 - the plan passes, on the server
+    const tp = Date.now();
+    log("[plan] asking ViralSpin to prepare the reel (no cloud draw, no credits)...");
+    const job = await planJob(o, log);
+    const planSecs = secs(tp);
+    if (job.bundle_version !== manifest.bundle_version) {
+        throw new Error(`The server is serving render kit ${job.bundle_version} but the toolkit manifest said ${manifest.bundle_version} (a deploy landed between the two calls). Run render_locally again.`);
+    }
+    if (job.schema_version !== 1)
+        throw new Error(`This reel uses plan schema ${job.schema_version}, which this version of the ViralSpin MCP package does not draw. Update @viralspin/mcp.`);
+    log(`[plan] ready: ${job.frames} frames at ${job.fps} fps (${job.duration.toFixed(1)} s), ${job.media.length} media file(s), sfx: ${job.sfx.join(", ") || "none"}`);
+    // 3 - the media, content-addressed so a second render of the same take downloads nothing
+    const td = Date.now();
+    const mediaDir = path_1.default.join(workRoot, "cache", "media");
+    const dl = await downloadMedia(job.media, mediaDir, fetchImpl, log);
+    const dlSecs = secs(td);
+    log(`[media] ${job.media.length} file(s): ${dl.downloaded} downloaded, ${dl.cached} already cached`);
+    // the app shows "rendering on your computer" from here (best effort: a failed stamp never stops the draw)
+    if (!o.dryRun)
+        await o.tokens.request("POST", `${o.apiBase}/v1/reel/local-jobs/${encodeURIComponent(job.job_id)}/started`, {}).catch(() => undefined);
+    // 4 - the draw, by the installed kit's own run.mjs
+    const outDir = path_1.default.join(workRoot, "jobs", job.job_id);
+    await fs_1.default.promises.mkdir(outDir, { recursive: true });
+    const port = await freePort();
+    const propsPath = path_1.default.join(outDir, "props.json");
+    await fs_1.default.promises.writeFile(propsPath, JSON.stringify({ composition: "reel", plan: rewritePlan(job.plan, job.media, port) }));
+    const takeName = job.media.find((m) => m.url === job.audio_url)?.name;
+    if (!takeName)
+        throw new Error("The manifest lists no audio take among its media.");
+    const outPath = path_1.default.join(outDir, "reel.mp4");
+    const concurrency = o.concurrency && o.concurrency > 0 ? Math.floor(o.concurrency) : defaultConcurrency();
+    const runKit = o.runKit ?? (await dynamicImport((0, url_1.pathToFileURL)(path_1.default.join(kitDir, "run.mjs")).href)).runKit;
+    const dr = Date.now();
+    try {
+        const r = await runKit({
+            kitDir, propsPath, mediaDir, audioPath: path_1.default.join(mediaDir, takeName), outPath, port, concurrency,
+            dryRun: Boolean(o.dryRun), log, signal: o.signal,
+        });
+        const result = {
+            job_id: job.job_id, dry_run: Boolean(o.dryRun),
+            kit: { dir: kitDir, bundle_version: manifest.bundle_version, updated: inst.updated },
+            media: { files: job.media.length, ...dl },
+            seconds: { plan: planSecs, download: dlSecs, kit: kitSecs, draw: secs(dr), total: secs(t0) },
+        };
+        if (!o.dryRun) {
+            result.output_path = outPath;
+            result.timing = r.timing;
+            result.timing_path = path_1.default.join(outDir, "timing.json");
+            if (o.complete) {
+                let output_url;
+                if (o.upload ?? Boolean(o.job_id)) {
+                    log("[upload] sending the finished reel to ViralSpin so it shows up in the app...");
+                    output_url = await uploadOutput(o, job.job_id, outPath, fetchImpl);
+                    log("[upload] done");
+                }
+                await o.tokens.request("POST", `${o.apiBase}/v1/reel/local-jobs/${job.job_id}/complete`, { status: "done", output_url, timing: { ...r.timing, planSeconds: planSecs, downloadSeconds: dlSecs } });
+                result.completed = true;
+                result.output_url = output_url;
+            }
+        }
+        return result;
+    }
+    catch (e) {
+        if (o.complete && !o.dryRun) {
+            await o.tokens
+                .request("POST", `${o.apiBase}/v1/reel/local-jobs/${job.job_id}/complete`, { status: "failed", error: String(e.message).slice(0, 800) })
+                .catch(() => undefined);
+        }
+        throw e;
+    }
+}