aimakeall-mcp 0.14.2 → 0.14.4

package/lib/durable-channel-request.mjs

@@ -0,0 +1,375 @@
+import { captureDurableChannelInput, captureDurableChannelOutput, DURABLE_CHANNEL_CONTRACT_VERSION,
+  DURABLE_CHANNEL_MODEL, DURABLE_CHANNEL_LIMITS, DURABLE_CHANNEL_TYPES, DURABLE_CHANNEL_OUTPUT_FIELDS, DURABLE_CHANNEL_PATHS } from './durable-channel-contract.mjs';
+
+export const durableChannelPath = operation => DURABLE_CHANNEL_PATHS[operation];
+export const durableChannelCapabilityPath = operation => `${durableChannelPath(operation)}/execution-capability`;
+export const DURABLE_CHANNEL_REQUEST_LIMITS = Object.freeze({ maxResponseBytes: DURABLE_CHANNEL_LIMITS.maxOutputBytes + 65536, maxReadChunks: 65536 });
+const JOB = /^epoch-v2-[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u;
+const COST = /^bg-durable-channel-v1:[a-f0-9]{64}:(?:[1-9]|1[0-9]|2[0-4])$/u;
+const encoder = new TextEncoder(), failures = new WeakMap();
+const messages = Object.freeze({
+  INVALID: '채널 분석 요청을 안전하게 확인하지 못했습니다.',
+  AUTHORITY_CHANGED: '계정·프로젝트·입력이 변경되어 이전 채널 분석 작업을 중단했습니다.',
+  SESSION_REQUIRED: '로그인 후 채널 분석를 생성해 주세요.',
+  UNAVAILABLE: '현재 서버에서는 안전한 채널 분석 생성을 사용할 수 없습니다.',
+  RESPONSE_INVALID: '채널 분석 응답을 안전하게 확인하지 못했습니다. 자동 재생성하지 않습니다.',
+  JOURNAL_UNAVAILABLE: '제출 기록을 확인하지 못했습니다. 자동 재생성하지 않습니다.',
+  JOURNAL_FULL: '안전한 제출 기록 한도(계정당 32건)에 도달했습니다. 기존 작업 조회는 가능하지만 새 생성은 차단됩니다. 기록을 삭제하지 말고 고객지원에 문의해 주세요.',
+  UNRESOLVED: '이전 제출 결과가 확정되지 않았습니다. 자동 재생성하지 않습니다.',
+  MISSING: '이전 작업을 찾을 수 없습니다. 새 생성 요청을 보내지 않았습니다.',
+  WAIT_ABORTED: '기다리기를 중단했습니다. 생성 취소가 확인된 것은 아닙니다.',
+  WAIT_TIMEOUT: '대기 시간이 초과되었습니다. 기존 작업만 다시 조회할 수 있습니다.',
+  DIFFERENT_EDITOR: '이 프로젝트에 다른 제작 화면의 미확정 작업이 있습니다. 원래 화면에서 먼저 기존 작업을 조회해 주세요.',
+  APPLY_UNCONFIRMED: '작업 결과는 완료됐지만 프로젝트 저장을 확인하지 못했습니다. 다음에 기존 작업만 다시 조회합니다.',
+  ACTIVE: '채널 분석 작업이 이미 진행 중입니다.',
+});
+function failure(kind) {
+  const error = Object.assign(new Error(messages[kind] || messages.INVALID), {
+    code: `DURABLE_CHANNEL_${kind}`, paidReplayAllowed: false,
+  }); failures.set(error, kind); return error;
+}
+const fail = kind => { throw failure(kind); };
+const own = (value, key) => value && typeof value === 'object' ? Object.getOwnPropertyDescriptor(value, key)?.value : undefined;
+// Legacy transport already projects usage; copy only its bounded public fields.
+// Never copy an error message, request, headers, arbitrary object or credential.
+function legacyUsage(value, depth = 0) {
+  if (!value || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) return undefined;
+  const output = {};
+  for (const key of ['aiCalls', 'costUsd', 'inputTokens', 'outputTokens', 'totalTokens', 'credits', 'creditsConsumed']) {
+    const number = own(value, key);
+    if (typeof number === 'number' && Number.isFinite(number) && number >= 0 && number <= Number.MAX_SAFE_INTEGER) output[key] = number;
+  }
+  for (const key of ['model', 'provider', 'stage']) {
+    const item = own(value, key); if (text(item, 160)) output[key] = item;
+  }
+  const stages = own(value, 'stages');
+  if (depth === 0 && Array.isArray(stages) && stages.length > 0 && stages.length <= 24) {
+    output.stages = Array.from({ length: stages.length }, (_, i) => legacyUsage(own(stages, String(i)), 1)).filter(Boolean);
+    if (!output.stages.length) delete output.stages;
+  }
+  return Object.keys(output).length ? Object.freeze(output) : undefined;
+}
+function object(value) {
+  if (!value || typeof value !== 'object' || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) fail('RESPONSE_INVALID');
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  if (Reflect.ownKeys(descriptors).some(key => typeof key !== 'string' || !('value' in descriptors[key]) || !descriptors[key].enumerable)) fail('RESPONSE_INVALID');
+  return Object.fromEntries(Object.entries(descriptors).map(([key, item]) => [key, item.value]));
+}
+function text(value, maximum = 255) {
+  return typeof value === 'string' && value.length > 0 && value.length <= maximum && value.trim() === value
+    && value.isWellFormed() && !/[\u0000-\u001f\u007f]/u.test(value);
+}
+function origin(value) {
+  if (!text(value, 2048)) fail('INVALID');
+  let url; try { url = new URL(value); } catch { fail('INVALID'); }
+  if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash || url.pathname !== '/'
+    || ![url.origin, `${url.origin}/`].includes(value)) fail('INVALID');
+  return url.origin;
+}
+function authority(getAuthority) {
+  const value = getAuthority(), ownerUserId = own(value, 'ownerUserId'), sessionRevision = own(value, 'sessionRevision');
+  if (!text(ownerUserId) || ownerUserId.startsWith('deleted:')
+    || !(text(sessionRevision, 512) || Number.isSafeInteger(sessionRevision) && sessionRevision >= 0)) fail('SESSION_REQUIRED');
+  return Object.freeze({ ownerUserId, sessionRevision });
+}
+function synchronous(callback) {
+  const result = callback();
+  if (result && typeof result.then === 'function') { Promise.resolve(result).catch(() => {}); fail('AUTHORITY_CHANGED'); }
+  if (result === false) fail('AUTHORITY_CHANGED');
+}
+function exactConstants(value, expected) {
+  const captured = object(value), keys = Object.keys(expected);
+  if (Object.keys(captured).length !== keys.length || keys.some(key => captured[key] !== expected[key])) fail('RESPONSE_INVALID');
+}
+export function validateDurableChannelCapability(value, operation) {
+  const captured = object(value);
+  if (captured.version !== 1 || captured.contractVersion !== DURABLE_CHANNEL_CONTRACT_VERSION || captured.operation !== operation
+    || !['legacy-sync', 'queue-v2', 'unavailable'].includes(captured.mode)) fail('RESPONSE_INVALID');
+  exactConstants(captured.model, DURABLE_CHANNEL_MODEL); exactConstants(captured.limits, DURABLE_CHANNEL_LIMITS);
+  const allowed = ['version', 'contractVersion', 'operation', 'mode', 'model', 'limits', ...(captured.mode === 'queue-v2'
+    ? ['paidReplayAllowed', 'recovery'] : captured.mode === 'unavailable' ? ['reason'] : [])];
+  if (Object.keys(captured).some(key => !allowed.includes(key)) || captured.mode === 'queue-v2'
+    && (captured.paidReplayAllowed !== false || captured.recovery !== 'read-only-known-job')
+    || captured.reason !== undefined && !text(captured.reason, 128)) fail('RESPONSE_INVALID');
+  return captured.mode;
+}
+function captureUsage(value, provider, model, { total = false } = {}) {
+  const item = object(value);
+  if (item.aiCalls !== 1 || !Number.isSafeInteger(item.inputTokens) || item.inputTokens < 0
+    || !Number.isSafeInteger(item.outputTokens) || item.outputTokens < 0
+    || !Number.isSafeInteger(item.inputTokens + item.outputTokens)
+    || typeof item.costUsd !== 'number' || !Number.isFinite(item.costUsd) || item.costUsd < 0
+    || item.model !== undefined && item.model !== model
+    || item.provider !== undefined && item.provider !== provider
+    || (total || item.totalTokens !== undefined) && item.totalTokens !== item.inputTokens + item.outputTokens) fail('RESPONSE_INVALID');
+  return Object.freeze({ aiCalls: 1, inputTokens: item.inputTokens, outputTokens: item.outputTokens, costUsd: item.costUsd,
+    ...(item.totalTokens === undefined ? {} : { totalTokens: item.totalTokens }),
+    ...(item.model === undefined ? {} : { model: item.model }), ...(item.provider === undefined ? {} : { provider: item.provider }) });
+}
+export function validateCompletedDurableChannelJob(value, id) {
+  const job = object(value);
+  if (!JOB.test(id) || job.id !== id || !Object.values(DURABLE_CHANNEL_TYPES).includes(job.type) || job.status !== 'completed') fail('RESPONSE_INVALID');
+  const result = object(job.result), model = DURABLE_CHANNEL_MODEL[result.operation];
+  if (DURABLE_CHANNEL_TYPES[result.operation] !== job.type || result.kind !== 'durable-channel-v2'
+    || result.model !== model
+    || result.accountingState !== 'settled' || result.hasAccountCostEvents !== true
+    || !Array.isArray(result.accountCostEvents) || result.accountCostEvents.length > DURABLE_CHANNEL_LIMITS.maxStages) fail('RESPONSE_INVALID');
+  const count = result.accountCostEvents.length;
+  if (result.operation === 'channel-style' && (count < 1 || count > 2)
+    || count > 0 && result.provider !== 'evolink'
+    || (count ? result.provider !== 'evolink' : result.provider !== 'none')) fail('RESPONSE_INVALID');
+  let output; try { output = captureDurableChannelOutput(Object.fromEntries(DURABLE_CHANNEL_OUTPUT_FIELDS
+    .filter(key => result[key] !== undefined).map(key => [key, result[key]]))); } catch { fail('RESPONSE_INVALID'); }
+  const ids = new Set();
+  const receipts = result.accountCostEvents.map(raw => {
+    const event = object(raw), provider = event.provider;
+    const committed = event.accountCostRecorded === true && event.accountCostSuppressedByReset !== true;
+    const suppressed = event.accountCostRecorded === false && event.accountCostSuppressedByReset === true;
+    if (!COST.test(event.accountCostEventId || '') || ids.has(event.accountCostEventId) || !(committed || suppressed)
+      || event.accountCostSuppressedByReset !== undefined && typeof event.accountCostSuppressedByReset !== 'boolean'
+      || event.model !== model || provider !== result.provider || !Number.isSafeInteger(event.createdAt)
+      || event.createdAt <= 0 || event.createdAt > 253402300799999 || typeof event.costUsd !== 'number'
+      || !Number.isFinite(event.costUsd) || event.costUsd < 0) fail('RESPONSE_INVALID');
+    ids.add(event.accountCostEventId);
+    const usage = captureUsage(event.usage, provider, model);
+    if (usage.costUsd !== event.costUsd) fail('RESPONSE_INVALID');
+    return Object.freeze({ accountCostEventId: event.accountCostEventId, createdAt: event.createdAt,
+      provider, model, costUsd: event.costUsd, accountCostRecorded: committed,
+      ...(suppressed ? { accountCostSuppressedByReset: true } : {}), usage });
+  });
+  const total = object(result.usage), sum = key => receipts.reduce((n, item) => n + item.usage[key], 0);
+  if (total.aiCalls !== receipts.length || total.inputTokens !== sum('inputTokens') || total.outputTokens !== sum('outputTokens')
+    || total.totalTokens !== total.inputTokens + total.outputTokens || !Number.isSafeInteger(total.totalTokens)
+    || typeof total.costUsd !== 'number' || !Number.isFinite(total.costUsd) || total.costUsd < 0
+    || Math.abs(total.costUsd - sum('costUsd')) > 0.000001) fail('RESPONSE_INVALID');
+  const usage = Object.freeze({ aiCalls: total.aiCalls, inputTokens: total.inputTokens, outputTokens: total.outputTokens,
+    totalTokens: total.totalTokens, costUsd: total.costUsd });
+  return Object.freeze({ ...output, ok: true, kind: 'durable-channel-v2', model, provider: result.provider, usage, hasAccountCostEvents: true,
+    accountingState: 'settled', accountCostEvents: Object.freeze(receipts), backgroundJobId: id });
+}
+
+// Strict stream EOF, fatal UTF-8 and declared-byte checks. Abort starts reader
+// cancellation immediately, but does not detach an admitted read/cancel promise.
+async function readJson(response, { check, signal, url }) {
+  let reader, cancellation, complete = false;
+  const cancel = () => {
+    if (cancellation || complete) return;
+    try { cancellation = Promise.resolve(reader ? reader.cancel() : response?.body?.cancel()).catch(() => {}); }
+    catch { cancellation = Promise.resolve(); }
+  };
+  const abort = () => cancel();
+  try {
+    check();
+    if (!response || response.redirected || response.type === 'opaqueredirect' || response.type === 'opaque'
+      || response.url && response.url !== url
+      || !Number.isInteger(response.status) || typeof response.body?.getReader !== 'function') fail('RESPONSE_INVALID');
+    const mime = (response.headers.get('content-type') || '').split(';', 1)[0].trim().toLowerCase();
+    if (mime !== 'application/json') fail('RESPONSE_INVALID');
+    const length = response.headers.get('content-length'), encoding = response.headers.get('content-encoding');
+    if (length !== null && (!/^(0|[1-9][0-9]*)$/u.test(length) || !Number.isSafeInteger(Number(length))
+      || Number(length) > DURABLE_CHANNEL_REQUEST_LIMITS.maxResponseBytes)) fail('RESPONSE_INVALID');
+    reader = response.body.getReader(); signal.addEventListener('abort', abort, { once: true });
+    if (signal.aborted) { cancel(); check(); }
+    const decoder = new TextDecoder('utf-8', { fatal: true }), blocks = []; let bytes = 0, chunks = 0;
+    for (;;) {
+      check(); const part = await reader.read(); check();
+      if (part.done) break;
+      if (!(part.value instanceof Uint8Array) || ++chunks > DURABLE_CHANNEL_REQUEST_LIMITS.maxReadChunks
+        || (bytes += part.value.byteLength) > DURABLE_CHANNEL_REQUEST_LIMITS.maxResponseBytes) fail('RESPONSE_INVALID');
+      blocks.push(decoder.decode(part.value, { stream: true }));
+    }
+    if (!bytes || length !== null && (!encoding || encoding === 'identity') && Number(length) !== bytes) fail('RESPONSE_INVALID');
+    blocks.push(decoder.decode()); const value = JSON.parse(blocks.join('')); check(); complete = true;
+    return { status: response.status, body: value };
+  } catch (error) { cancel(); throw failures.has(error) ? error : failure('RESPONSE_INVALID'); }
+  finally { signal.removeEventListener('abort', abort); await cancellation; reader?.releaseLock(); }
+}
+
+/** A journal intent is consumed before the one paid POST. Restored intentions
+ * with an ID can only GET it; no ID, a missing job, failure or mode downgrade
+ * never permits another POST or the legacy callback. Browser storage loss is
+ * not server-side idempotency; this API offers no reset/new-intent escape. */
+export function createDurableChannelRequest({ journal, apiOrigin, fetchImpl = globalThis.fetch, getAuthority,
+  getHeaders, ensureSession, crypto = globalThis.crypto, pollMs = 1000, timeoutMs = 240000 } = {}) {
+  const base = origin(apiOrigin), digest = typeof crypto?.subtle?.digest === 'function' ? crypto.subtle.digest.bind(crypto.subtle) : null;
+  if ([fetchImpl, getAuthority, getHeaders, ensureSession, ...['lookup', 'claim', 'rememberJob', 'markResult'].map(key => journal?.[key])]
+    .some(fn => typeof fn !== 'function') || !digest || !Number.isSafeInteger(pollMs) || pollMs < 1 || pollMs > 10000
+    || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 900000) throw failure('INVALID');
+  const storage = Object.fromEntries(['lookup', 'claim', 'rememberJob', 'markResult'].map(key => [key, journal[key].bind(journal)]));
+  let active = false;
+  return Object.freeze({ async readCapability({ operation, assertCurrent, signal, assertQueueReady } = {}) {
+    if (!Object.hasOwn(DURABLE_CHANNEL_TYPES, operation) || typeof assertCurrent !== 'function'
+      || signal !== undefined && !(signal instanceof AbortSignal)) fail('INVALID');
+    const captured = authority(getAuthority), controller = new AbortController();
+    const abort = () => controller.abort(failure('WAIT_ABORTED'));
+    const timer = setTimeout(() => controller.abort(failure('WAIT_TIMEOUT')), Math.min(timeoutMs, 15000));
+    signal?.addEventListener('abort', abort, { once: true }); if (signal?.aborted) abort();
+    const check = () => { const current = authority(getAuthority); synchronous(assertCurrent);
+      if (current.ownerUserId !== captured.ownerUserId || current.sessionRevision !== captured.sessionRevision) fail('AUTHORITY_CHANGED');
+      if (controller.signal.aborted) throw controller.signal.reason;
+    };
+    try {
+      check(); if (await ensureSession() === false) fail('SESSION_REQUIRED'); check();
+      const headers = new Headers(await getHeaders()); headers.set('Accept', 'application/json'); check();
+      const url = `${base}${durableChannelCapabilityPath(operation)}`;
+      const response = await fetchImpl(url, { method: 'GET', headers, credentials: 'include', redirect: 'error', cache: 'no-store', signal: controller.signal });
+      const reply = await readJson(response, { check, signal: controller.signal, url }); check();
+      if (reply.status !== 200) fail('UNAVAILABLE');
+      const mode = validateDurableChannelCapability(reply.body, operation);
+      if (mode === 'unavailable') fail('UNAVAILABLE');
+      if (mode === 'queue-v2') {
+        if (typeof assertQueueReady !== 'function' || await assertQueueReady() !== true) fail('INVALID'); check();
+      }
+      return mode;
+    } catch (caught) { throw failures.has(caught) ? caught : failure('RESPONSE_INVALID'); }
+    finally { clearTimeout(timer); signal?.removeEventListener('abort', abort); }
+  }, async run(rawBody, { projectId, assertCurrent, signal, onState = () => {}, onAccountCost = () => {}, legacy,
+    recoveryOnly = false, operation, targetId, applyResult, assertQueueReady } = {}) {
+    if (active) throw failure('ACTIVE');
+    if (!Object.hasOwn(DURABLE_CHANNEL_TYPES, operation) || !text(targetId, 240) || !text(projectId, 160) || [assertCurrent, onState, onAccountCost].some(fn => typeof fn !== 'function')
+      || signal !== undefined && !(signal instanceof AbortSignal) || typeof recoveryOnly !== 'boolean') throw failure('INVALID');
+    let body;
+    // Legacy accepts its original inputs, which may exceed the new queue's
+    // bounded contract. Defer only this v2 validation error until transport
+    // selection; even invalid edited inputs must first recover pending work.
+    if (!recoveryOnly) { try { body = captureDurableChannelInput(rawBody).body; if (body.operation !== operation || body.targetId !== targetId || body.projectId !== projectId) body = undefined; } catch { body = undefined; } }
+    const captured = authority(getAuthority); active = true;
+    const controller = new AbortController(), deadline = performance.now() + timeoutMs;
+    const abort = () => controller.abort(failure('WAIT_ABORTED'));
+    const timer = setTimeout(() => controller.abort(failure('WAIT_TIMEOUT')), timeoutMs);
+    signal?.addEventListener('abort', abort, { once: true }); if (signal?.aborted) abort();
+    let jobId = null, status = 'checking', handle, claimStarted = false, legacyStarted = false, recovering = false;
+    const check = () => {
+      let current; try { current = authority(getAuthority); synchronous(assertCurrent); } catch { fail('AUTHORITY_CHANGED'); }
+      if (current.ownerUserId !== captured.ownerUserId || current.sessionRevision !== captured.sessionRevision) fail('AUTHORITY_CHANGED');
+      if (!controller.signal.aborted && performance.now() >= deadline) controller.abort(failure('WAIT_TIMEOUT'));
+      if (controller.signal.aborted) throw controller.signal.reason;
+    };
+    const checked = async operation => { check(); const value = await operation(); check(); return value; };
+    const publish = next => { check(); status = next; try { Promise.resolve(onState(Object.freeze({ version: 1, status,
+      jobId, recovering, paidReplayAllowed: false }))).catch(() => {}); } catch { /* UI cannot authorize a replay. */ } };
+    const persist = async operation => { try { return await checked(operation); } catch (error) {
+      check(); throw failures.has(error) ? error : failure(own(error, 'code') === 'UPLOAD_METADATA_JOURNAL_FULL' ? 'JOURNAL_FULL' : 'JOURNAL_UNAVAILABLE');
+    } };
+    async function request(path, method = 'GET') {
+      if (recoveryOnly && method !== 'GET') fail('INVALID');
+      const rawHeaders = await checked(() => getHeaders()), headers = new Headers(rawHeaders);
+      headers.set('Accept', 'application/json'); if (method === 'POST') headers.set('Content-Type', 'application/json');
+      let response;
+      try {
+        check(); response = await fetchImpl(`${base}${path}`, { method, headers, credentials: 'include', redirect: 'error',
+          cache: 'no-store', signal: controller.signal, ...(method === 'POST' ? { body: JSON.stringify(body) } : {}) });
+        return await readJson(response, { check, signal: controller.signal, url: `${base}${path}` });
+      } catch (error) { check(); throw failures.has(error) ? error : failure('RESPONSE_INVALID'); }
+    }
+    const envelope = (value, identity) => {
+      const item = object(value), record = object(item.record);
+      if (typeof item.canSubmit !== 'boolean' || !item.handle || typeof item.handle !== 'object'
+        || record.version !== 1 || ['ownerUserId', 'apiOrigin', 'projectId'].some(key => record[key] !== identity[key])
+        || typeof record.inputDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(record.inputDigest)
+        || item.canSubmit && record.inputDigest !== identity.inputDigest
+        || typeof record.jobId !== 'string' || record.jobId && !JOB.test(record.jobId)
+        || !['submitted', 'unknown', 'completed', 'failed'].includes(record.state)
+        || item.canSubmit && (record.jobId || record.state !== 'submitted')) fail('JOURNAL_UNAVAILABLE');
+      return { handle: item.handle, canSubmit: item.canSubmit, jobId: record.jobId || null };
+    };
+    const pause = () => checked(() => new Promise(resolve => {
+      let waiting;
+      const done = () => { clearTimeout(waiting); controller.signal.removeEventListener('abort', done); resolve(); };
+      waiting = setTimeout(done, pollMs); controller.signal.addEventListener('abort', done, { once: true });
+      if (controller.signal.aborted) done();
+    }));
+    try {
+      check(); publish('checking');
+      // A read-only pending-project probe has no input/body to persist. Its
+      // sentinel digest is never claimed, posted or used for legacy fallback.
+      const bytes = recoveryOnly || !body ? new Uint8Array(32)
+        : new Uint8Array(await checked(() => digest('SHA-256', encoder.encode(JSON.stringify(body)))));
+      if (bytes.byteLength !== 32) fail('INVALID');
+      const scopeBytes = new Uint8Array(await checked(() => digest('SHA-256', encoder.encode(JSON.stringify([operation, projectId, targetId])))));
+      if (scopeBytes.byteLength !== 32) fail('INVALID');
+      const identity = Object.freeze({ ownerUserId: captured.ownerUserId, apiOrigin: base, projectId: `durable-channel:v1:${Array.from(scopeBytes, byte => byte.toString(16).padStart(2, '0')).join('')}`,
+        inputDigest: Array.from(bytes, byte => byte.toString(16).padStart(2, '0')).join('') });
+      let found = await persist(() => storage.lookup(identity, { assertCurrent: check }));
+      if (!found && recoveryOnly) return null;
+      if (await checked(() => ensureSession()) === false) fail('SESSION_REQUIRED');
+      if (!found) {
+        const capability = await request(durableChannelCapabilityPath(operation));
+        if (capability.status !== 200) fail('UNAVAILABLE');
+        const mode = validateDurableChannelCapability(capability.body, operation);
+        // Re-observe after the capability await, including a deployment change.
+        found = await persist(() => storage.lookup(identity, { assertCurrent: check }));
+        if (!found && mode === 'legacy-sync') {
+          if (typeof legacy !== 'function') fail('UNAVAILABLE');
+          // This preserves the legacy callback; the journal does not provide
+          // atomic legacy/v2 exclusion during a mixed deployment mode switch.
+          publish('legacy-sync'); check(); legacyStarted = true;
+          return await checked(() => legacy(body || rawBody, { signal: controller.signal }));
+        }
+        if (!found && mode !== 'queue-v2') fail('UNAVAILABLE');
+        if (!found && !body) fail('INVALID');
+        if (!found) { if (typeof assertQueueReady !== 'function' || await checked(assertQueueReady) !== true) fail('INVALID'); claimStarted = true; found = await persist(() => storage.claim(identity, { assertCurrent: check })); }
+      }
+      const selected = envelope(found, identity); handle = selected.handle; jobId = selected.jobId;
+      recovering = !selected.canSubmit;
+      if (selected.canSubmit && !claimStarted) fail('JOURNAL_UNAVAILABLE');
+      if (selected.canSubmit) {
+        publish('submitting');
+        const reply = await request(`${durableChannelPath(operation)}/jobs`, 'POST'), value = object(reply.body);
+        const accepted = reply.status === 202 && value.ok === true && value.async === true;
+        const uncertain = reply.status === 503 && value.code === 'BACKGROUND_ENQUEUE_UNCONFIRMED';
+        const returnedId = accepted ? own(value.job, 'id') : uncertain ? value.jobId : undefined;
+        if (typeof returnedId !== 'string' || !JOB.test(returnedId)) fail('UNRESOLVED');
+        jobId = returnedId;
+        await persist(() => storage.rememberJob(handle, jobId));
+      }
+      if (!jobId) { publish('unknown'); fail('UNRESOLVED'); }
+      for (;;) {
+        publish('checking');
+        const reply = await request(`/api/tracker/channel-analysis/jobs/${jobId}`);
+        if (reply.status === 404) { publish('missing'); fail('MISSING'); }
+        const value = object(reply.body), job = object(value.job);
+        if (reply.status !== 200 || value.ok !== true || job.id !== jobId || !Object.values(DURABLE_CHANNEL_TYPES).includes(job.type)
+          || !['queued', 'running', 'completed', 'failed', 'cancelled', 'unknown'].includes(job.status)) fail('RESPONSE_INVALID');
+        if (job.type !== DURABLE_CHANNEL_TYPES[operation]) fail('DIFFERENT_EDITOR');
+        if (job.status === 'completed') {
+          const result = validateCompletedDurableChannelJob(job, jobId);
+          if (result.targetId !== targetId || result.projectId !== projectId || result.operation !== operation) fail('DIFFERENT_EDITOR');
+          // A provider-completed job is not a durably applied browser result.
+          // Keep its known ID pending through UI/storage failures or page exits.
+          if (typeof applyResult !== 'function') fail('APPLY_UNCONFIRMED');
+          try { if (await checked(() => applyResult(Object.freeze({ ...result, recoveredPreviousRequest: recovering }))) !== true) fail('APPLY_UNCONFIRMED'); }
+          catch (error) { check(); if (failures.has(error)) throw error; fail('APPLY_UNCONFIRMED'); }
+          try { if (await checked(() => onAccountCost(result)) !== true) fail('APPLY_UNCONFIRMED'); }
+          catch (error) { check(); if (failures.has(error)) throw error; fail('APPLY_UNCONFIRMED'); }
+          await persist(() => storage.markResult(handle, { state: 'completed' })); publish('completed');
+          check(); return Object.freeze({ ...result, recoveredPreviousRequest: recovering });
+        }
+        publish(job.status);
+        if (!['queued', 'running'].includes(job.status)) {
+          await persist(() => storage.markResult(handle, { state: job.status === 'unknown' ? 'unknown' : 'failed' }));
+          fail('UNRESOLVED');
+        }
+        await pause();
+      }
+    } catch (caught) {
+      controller.abort(caught);
+      // Do not persist after a stopped authority. A submitted record without an
+      // ID already restores UNKNOWN, even if the POST never left this browser.
+      let changed = false; try { const fresh = authority(getAuthority); synchronous(assertCurrent);
+        changed = fresh.ownerUserId !== captured.ownerUserId || fresh.sessionRevision !== captured.sessionRevision; } catch { changed = true; }
+      const error = failure(changed ? 'AUTHORITY_CHANGED' : failures.get(caught) || 'RESPONSE_INVALID');
+      if (legacyStarted && !changed) {
+        const usage = legacyUsage(own(caught, 'providerUsage'));
+        if (usage) {
+          error.providerUsage = usage;
+          const model = own(caught, 'providerModel'); if (text(model, 160)) error.providerModel = model;
+          error.partialProviderUsage = own(caught, 'partialProviderUsage') === true;
+        }
+      }
+      if (jobId) error.backgroundJobId = jobId;
+      error.submissionState = jobId ? status : handle || claimStarted || legacyStarted ? 'unknown' : 'not-submitted';
+      throw error;
+    } finally { clearTimeout(timer); signal?.removeEventListener('abort', abort); active = false; }
+  } });
+}

package/lib/durable-speech.mjs

@@ -1,11 +1,13 @@
 import { z } from "zod";
 import { DEFAULT_API_BASE } from "./config.mjs";
 import { GENERATION_JOB_PATH } from "./generation-jobs.mjs";
+import { captureTtsAlignment, buildSpeechSubtitleLines } from "./tts-alignment.mjs";
+import { captureSpeechProductionProfile } from "./speech-production-profile.mjs";
 
 const ID = /^[a-zA-Z0-9_-]{16,80}$/u, PROVIDERS = ["elevenlabs", "typecast", "supertone"];
 const MODELS = Object.freeze({ elevenlabs: "elevenlabs-multilingual-v2", typecast: "typecast-narration", supertone: "supertone-narration" });
-const common = ["voice", "voiceId", "modelId", "fileName", "speed"];
-const perProvider = Object.freeze({ elevenlabs: ["languageCode", "similarityBoost", "speakerBoost", "stability", "style"],
+const common = ["voice", "voiceId", "modelId", "fileName", "speed", "productionProfile"];
+const perProvider = Object.freeze({ elevenlabs: ["languageCode", "similarityBoost", "speakerBoost", "stability", "style", "includeAlignment"],
   typecast: ["language", "emotion", "pitch", "smartEmotion", "volume"], supertone: ["language", "lang", "style"] });
 const invalid = () => new Error("Invalid durable speech request or result.");
 const short = max => z.string().max(max);
@@ -14,6 +16,8 @@ const optionsSchema = z.object({ voice: short(320).optional(), voiceId: short(16
   speed: z.number().min(0.5).max(2).optional(), similarityBoost: z.number().min(0).max(1).optional(), stability: z.number().min(0).max(1).optional(),
   style: z.union([z.number().min(0).max(1), short(160)]).optional(), speakerBoost: z.boolean().optional(), smartEmotion: z.boolean().optional(),
   pitch: z.number().int().min(-12).max(12).optional(), volume: z.number().int().min(0).max(200).optional(),
+  includeAlignment: z.boolean().optional().describe("ElevenLabs 전용 실제 발화 자막. 동일 합성 1회에서 오디오와 문자 타이밍을 함께 저장합니다."),
+  productionProfile: z.unknown().transform(captureSpeechProductionProfile).optional().describe("제작 핸들의 원래 productionProfile. 말투·길이·자막 디자인 의도를 유지합니다."),
 }).strict();
 export const durableSpeechToolSchema = Object.freeze({
   requestId: z.string().regex(ID).describe("새 작업의 고유 ID. 응답이 끊겨도 이 ID를 유지하고 먼저 상태를 조회하세요."),
@@ -88,7 +92,17 @@ export function durableSpeechResult(job, { apiBase = DEFAULT_API_BASE } = {}) {
     || !(cost.accountCostRecorded === true && cost.accountCostSuppressedByReset !== true || cost.accountCostRecorded === false && cost.accountCostSuppressedByReset === true)) throw invalid();
   const receipt = { accountCostEventId: cost.accountCostEventId, model: cost.model, provider: cost.provider, createdAt: cost.createdAt,
     costUsd: cost.costUsd, accountCostRecorded: cost.accountCostRecorded, ...(cost.accountCostSuppressedByReset === true ? { accountCostSuppressedByReset: true } : {}) };
+  let captions = {};
+  if (["includeAlignment", "alignment", "normalizedAlignment", "alignedLines"].some(key => Object.hasOwn(payload, key))) {
+    if (payload.provider !== "elevenlabs" || payload.includeAlignment !== true) throw invalid();
+    const pair = captureTtsAlignment({ alignment: payload.alignment, normalizedAlignment: payload.normalizedAlignment });
+    const lines = buildSpeechSubtitleLines(pair);
+    if (!lines.length || !Array.isArray(payload.alignedLines) || JSON.stringify(lines) !== JSON.stringify(payload.alignedLines)) throw invalid();
+    captions = { includeAlignment: true, ...pair, alignedLines: lines, subtitleLines: lines, lineCount: lines.length,
+      durationSec: pair.alignment.character_end_times_seconds.at(-1), timingSource: "provider-character-alignment" };
+  }
   return { generationJobId: job.id, status: "completed", kind: "tts", provider: payload.provider, filename: payload.filename, contentType: payload.contentType,
     serverUrl: base.origin, assetPath: `${url.pathname}${url.search}`, assetUrl: url.href, ...receipt, hasAccountCostEvents: true, accountCostEvents: [receipt],
+    ...captions,
     guidance: "오디오가 서버의 계정 소유 자산으로 저장되었습니다. 이 링크를 사용하세요. 이 도구는 오디오를 다운로드하거나 PAT를 자산 요청에 전달하지 않습니다." };
 }