aimakeall-mcp 0.14.2 → 0.14.4

package/lib/review-native-job-request.mjs

@@ -0,0 +1,329 @@
+// Shared browser/MCP one-way native-media transport. A stored attempt is never
+// permission to upload again; a submitted paid request is only ever read again.
+export const REVIEW_NATIVE_TRANSPORT = "review-native-queue-v2";
+export const REVIEW_NATIVE_CAPABILITY = "/api/tracker/review/native-execution";
+export const REVIEW_NATIVE_ATTEMPTS = "/api/tracker/review/media-attempts";
+export const REVIEW_NATIVE_CHUNK_JOBS = "/api/tracker/review/chunk-jobs";
+export const REVIEW_NATIVE_EVIDENCE_JOBS = "/api/tracker/review/evidence-jobs";
+const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u;
+const ASSET = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-8][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u;
+const HASH = /^[a-f0-9]{64}$/u, JOB = /^epoch-v2-[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u;
+const MAX_VIDEO = 10 * 1024 * 1024, MAX_TEXT = 4 * 1024 * 1024;
+const encoder = new TextEncoder(), knownFailures = new WeakMap();
+// Native ingress admits one request per owner. Serialize actual I/O (not whole
+// queued jobs) across client instances. An adapter ignoring AbortSignal keeps
+// its slot until it truly settles; a timed-out waiter never dispatches later.
+const requestLanes = new Map();
+function serializedRequest(scope, authority, check, callback) {
+  let owners = requestLanes.get(scope);
+  if (!owners) { owners = new Map(); requestLanes.set(scope, owners); }
+  const previous = owners.get(authority) || Promise.resolve();
+  const work = previous.then(() => { check(); return callback(); });
+  const settled = work.then(() => {}, () => {}).finally(() => {
+    if (owners.get(authority) === settled) owners.delete(authority);
+    if (!owners.size && requestLanes.get(scope) === owners) requestLanes.delete(scope);
+  });
+  owners.set(authority, settled); return work;
+}
+const stages = Object.freeze({ analyzing: { path: REVIEW_NATIVE_CHUNK_JOBS, type: "review:analyze-chunk", kind: "review-chunk", field: "chunkAnalysis", legacy: "analyze-chunk" },
+  verifying: { path: REVIEW_NATIVE_EVIDENCE_JOBS, type: "review:verify-evidence", kind: "review-evidence", field: "verification", legacy: "verify-evidence" } });
+const object = value => value !== null && typeof value === "object" && !Array.isArray(value);
+const failure = (code, message = "원본 분석 기록을 안전하게 확인하지 못했습니다. 자동으로 다시 생성하지 않습니다.") => Object.assign(new Error(message), { code, paidReplayAllowed: false, automaticUploadRetryAllowed: false });
+function freeze(value) { if (value && typeof value === "object") { for (const child of Object.values(value)) freeze(child); Object.freeze(value); } return value; }
+function fields(value, allowed, required = []) {
+  if (!value || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) throw failure("REVIEW_NATIVE_INPUT_INVALID");
+  const descriptors = Object.getOwnPropertyDescriptors(value), keys = Reflect.ownKeys(descriptors);
+  if (keys.some(key => !allowed.includes(key) || !("value" in descriptors[key]) || !descriptors[key].enumerable)
+    || required.some(key => !Object.hasOwn(descriptors, key))) throw failure("REVIEW_NATIVE_INPUT_INVALID");
+  return Object.fromEntries(keys.map(key => [key, descriptors[key].value]));
+}
+function capture(value, maximum = MAX_TEXT) {
+  let nodes = 0, bytes = 0; const ancestors = new Set();
+  const add = size => { if ((bytes += size) > maximum) throw failure("REVIEW_NATIVE_INPUT_LIMIT"); };
+  function copy(item, depth) {
+    if (++nodes > 400000 || depth > 24) throw failure("REVIEW_NATIVE_INPUT_LIMIT");
+    if (item === null || typeof item === "boolean") { add(JSON.stringify(item).length); return item; }
+    if (typeof item === "number" && Number.isFinite(item)) { add(JSON.stringify(item).length); return item; }
+    if (typeof item === "string") {
+      if (item.length > maximum || !item.isWellFormed()) throw failure("REVIEW_NATIVE_INPUT_LIMIT");
+      add(encoder.encode(JSON.stringify(item)).length); return item;
+    }
+    if (!item || typeof item !== "object" || ancestors.has(item)) throw failure("REVIEW_NATIVE_INPUT_INVALID");
+    const array = Array.isArray(item), descriptors = Object.getOwnPropertyDescriptors(item), keys = Reflect.ownKeys(descriptors);
+    if (array ? Object.getPrototypeOf(item) !== Array.prototype : ![Object.prototype, null].includes(Object.getPrototypeOf(item))) throw failure("REVIEW_NATIVE_INPUT_INVALID");
+    if (keys.some(key => typeof key !== "string" || !("value" in descriptors[key]) || key.length > 128 || ["__proto__", "prototype", "constructor", "toJSON"].includes(key)
+      || key !== "length" && !descriptors[key].enumerable)) throw failure("REVIEW_NATIVE_INPUT_INVALID");
+    ancestors.add(item); add(2); let result;
+    if (array) {
+      if (item.length > 60000 || keys.length !== item.length + 1) throw failure("REVIEW_NATIVE_INPUT_INVALID");
+      result = Array.from({ length: item.length }, (_, index) => { if (!Object.hasOwn(descriptors, index)) throw failure("REVIEW_NATIVE_INPUT_INVALID"); if (index) add(1); return copy(descriptors[index].value, depth + 1); });
+    } else result = Object.fromEntries(keys.map((key, index) => { add(encoder.encode(JSON.stringify(key)).length + 1 + (index ? 1 : 0)); return [key, copy(descriptors[key].value, depth + 1)]; }));
+    ancestors.delete(item); return result;
+  }
+  return freeze(copy(value, 0));
+}
+function scopeOf(value) {
+  let parsed; try { parsed = new URL(value); } catch { throw failure("REVIEW_NATIVE_SCOPE_INVALID"); }
+  if (!["https:", "http:"].includes(parsed.protocol) || parsed.username || parsed.password || parsed.search || parsed.hash) throw failure("REVIEW_NATIVE_SCOPE_INVALID");
+  return parsed.href.replace(/\/$/u, "");
+}
+const text = (value, maximum, empty = true) => {
+  if (typeof value !== "string" || value.length > maximum || !value.isWellFormed() || (!empty && !value.trim()) || /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/u.test(value)) throw failure("REVIEW_NATIVE_INPUT_INVALID");
+  return value;
+};
+function metadata(value) {
+  const keys = ["version", "sourceId", "chunkId", "startMs", "endMs", "sourceDurationMs", "hasAudio", "videoId", "workTitle", "mimeType", "actualDurationSec"];
+  const raw = fields(value, keys, keys.filter(key => key !== "actualDurationSec"));
+  if (raw.version !== 1 || raw.mimeType !== "video/mp4" || typeof raw.sourceId !== "string" || !/^[A-Za-z0-9_.:-]{1,90}$/u.test(raw.sourceId)
+    || !Number.isSafeInteger(raw.sourceDurationMs) || raw.sourceDurationMs < 1 || raw.sourceDurationMs > 86400000
+    || !Number.isSafeInteger(raw.startMs) || !Number.isSafeInteger(raw.endMs) || raw.startMs < 0 || raw.endMs <= raw.startMs || raw.endMs > raw.sourceDurationMs
+    || raw.endMs - raw.startMs > 300000 || raw.chunkId !== `${raw.sourceId}:${raw.startMs}-${raw.endMs}` || typeof raw.hasAudio !== "boolean"
+    || typeof raw.videoId !== "string" || raw.videoId !== "" && !/^[A-Za-z0-9_-]{11}$/u.test(raw.videoId)
+    || text(raw.workTitle, 200) !== raw.workTitle.trim() || raw.actualDurationSec !== undefined && (!Number.isFinite(raw.actualDurationSec) || raw.actualDurationSec <= 0 || Math.abs(raw.actualDurationSec * 1000 - raw.endMs + raw.startMs) > 250)) throw failure("REVIEW_NATIVE_MEDIA_INVALID");
+  return freeze(Object.fromEntries(keys.filter(key => Object.hasOwn(raw, key)).map(key => [key, raw[key]])));
+}
+function mediaIdentity(value, reference = false) {
+  const keys = reference ? ["assetId", "namespace", "metadata", "sha256", "byteLength", "inputHash", "expiresAt"] : ["attemptId", "metadata", "sha256", "byteLength", "inputHash"];
+  const raw = fields(value, keys, keys);
+  if (!HASH.test(raw.sha256 || "") || !HASH.test(raw.inputHash || "") || !Number.isSafeInteger(raw.byteLength) || raw.byteLength < 16 || raw.byteLength > MAX_VIDEO
+    || reference && (!ASSET.test(raw.assetId || "") || !HASH.test(raw.namespace || "") || !Number.isSafeInteger(raw.expiresAt) || raw.expiresAt <= 0)
+    || !reference && !UUID.test(raw.attemptId || "")) throw failure("REVIEW_NATIVE_MEDIA_INVALID");
+  return freeze({ ...raw, metadata: metadata(raw.metadata) });
+}
+/** Compact allowlist suitable for IndexedDB/MCP checkpoint files. No tokens,
+ * paths, source handles, source URL, raw media or server-owned keys are allowed. */
+export function captureReviewNativeCheckpoint(value) {
+  const raw = fields(value, ["transport", "apiScope", "mediaAttempt", "mediaReference", "submissionAttempted", "requestBinding", "jobId"]);
+  if (raw.transport !== undefined && raw.transport !== REVIEW_NATIVE_TRANSPORT || raw.submissionAttempted !== undefined && typeof raw.submissionAttempted !== "boolean"
+    || raw.requestBinding !== undefined && !HASH.test(raw.requestBinding) || raw.jobId !== undefined && !JOB.test(raw.jobId)) throw failure("REVIEW_NATIVE_CHECKPOINT_INVALID");
+  return freeze({ ...raw, ...(raw.apiScope === undefined ? {} : { apiScope: scopeOf(raw.apiScope) }),
+    ...(raw.mediaAttempt === undefined ? {} : { mediaAttempt: mediaIdentity(raw.mediaAttempt) }),
+    ...(raw.mediaReference === undefined ? {} : { mediaReference: mediaIdentity(raw.mediaReference, true) }) });
+}
+const digest = async value => [...new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", typeof value === "string" ? encoder.encode(value) : value))].map(byte => byte.toString(16).padStart(2, "0")).join("");
+async function checkIdentity(identity) {
+  if (await digest(JSON.stringify({ version: 1, metadata: identity.metadata, sha256: identity.sha256, byteLength: identity.byteLength })) !== identity.inputHash) throw failure("REVIEW_NATIVE_MEDIA_MISMATCH");
+}
+function uploadShape(value) {
+  const raw = fields(value, ["source", "chunk", "workTitle", "priorContext"], ["source", "chunk"]);
+  const source = fields(raw.source, ["id", "videoId", "kind", "title", "durationSec", "hasAudio"], ["id", "durationSec"]);
+  const chunk = fields(raw.chunk, ["chunkId", "sourceId", "startMs", "endMs", "mimeType", "videoBase64", "sha256", "hasAudio", "actualDurationSec"], ["chunkId", "startMs", "endMs", "mimeType", "videoBase64", "sha256", "hasAudio"]);
+  if (!Number.isFinite(source.durationSec) || source.durationSec <= 0 || source.durationSec > 86400 || source.kind !== undefined && !["local", "youtube"].includes(source.kind)
+    || chunk.sourceId !== undefined && chunk.sourceId !== source.id || source.hasAudio !== undefined && source.hasAudio !== chunk.hasAudio) throw failure("REVIEW_NATIVE_MEDIA_INVALID");
+  if (source.title !== undefined) text(source.title, 200);
+  const meta = metadata({ version: 1, sourceId: source.id, chunkId: chunk.chunkId, startMs: chunk.startMs, endMs: chunk.endMs,
+    sourceDurationMs: Math.round(source.durationSec * 1000), hasAudio: chunk.hasAudio, videoId: (source.videoId ?? "").trim(),
+    workTitle: text(raw.workTitle ?? source.title ?? "", 200).trim(), mimeType: chunk.mimeType,
+    ...(chunk.actualDurationSec === undefined ? {} : { actualDurationSec: chunk.actualDurationSec }) });
+  if (typeof chunk.videoBase64 !== "string" || chunk.videoBase64.length > 4 * Math.ceil(MAX_VIDEO / 3) || !chunk.videoBase64.length || chunk.videoBase64.length % 4 || !/^[A-Za-z0-9+/]+={0,2}$/u.test(chunk.videoBase64) || !HASH.test(chunk.sha256 || "")) throw failure("REVIEW_NATIVE_MEDIA_INVALID");
+  let bytes; try { const binary = atob(chunk.videoBase64); if (btoa(binary) !== chunk.videoBase64) throw new Error(); bytes = Uint8Array.from(binary, char => char.charCodeAt(0)); } catch { throw failure("REVIEW_NATIVE_MEDIA_INVALID"); }
+  if (bytes.length < 16 || bytes.length > MAX_VIDEO || new TextDecoder().decode(bytes.slice(4, 8)) !== "ftyp") throw failure("REVIEW_NATIVE_MEDIA_INVALID");
+  return { input: { source, chunk, ...(raw.workTitle === undefined ? {} : { workTitle: raw.workTitle }) }, metadata: meta, bytes, sha256: chunk.sha256, priorContext: text(raw.priorContext ?? "", 12000).trim() };
+}
+function safeReferences(value) {
+  if (Array.isArray(value)) { for (const item of value) safeReferences(item); return; }
+  if (!object(value)) { if (typeof value === "string" && /^\s*(?:data|blob|file):/iu.test(value)) throw failure("REVIEW_NATIVE_INPUT_INVALID"); return; }
+  for (const [key, child] of Object.entries(value)) {
+    if (/^(?:owneruserid|ownerid|userid|inputhash|namespace|assetid|localpath|filepath|path|filename|url|asseturl|objectkey|bucket|videobase64|audiobase64|base64data|dataurl|buffer|credentials|cookie|sessionid|sessiontoken|token|secret|byok)$/u.test(key.replace(/[^a-z0-9]/giu, "").toLowerCase())
+      || /apikey|authorization|accesstoken|refreshtoken|clientsecret|password|privatekey/iu.test(key)) throw failure("REVIEW_NATIVE_INPUT_INVALID");
+    safeReferences(child);
+  }
+}
+function logicalInput(stage, body, identity) {
+  if (body === null) return null;
+  if (stage === "analyzing") {
+    fields(body, ["source", "chunk", "workTitle", "priorContext"]);
+    return { priorContext: text(body.priorContext ?? "", 12000).trim() };
+  }
+  const raw = fields(body, ["chunk", "chunkId", "chunks", "story"], ["chunks", "story"]);
+  const chunkId = raw.chunkId ?? raw.chunk?.chunk?.chunkId ?? raw.chunk?.chunkId;
+  if (chunkId !== identity.metadata.chunkId || !Array.isArray(raw.chunks) || raw.chunks.length < 1 || raw.chunks.length > 500 || !object(raw.story)) throw failure("REVIEW_NATIVE_INPUT_INVALID");
+  safeReferences({ chunks: raw.chunks, story: raw.story });
+  const matches = raw.chunks.filter(item => item?.chunkId === chunkId), receipt = matches[0];
+  if (matches.length !== 1 || receipt.sha256 !== identity.sha256 || ["sourceId", "startMs", "endMs", "sourceDurationMs", "hasAudio", "videoId", "workTitle"].some(key => receipt[key] !== identity.metadata[key])) throw failure("REVIEW_NATIVE_MEDIA_MISMATCH");
+  if (encoder.encode(JSON.stringify({ chunks: raw.chunks, story: raw.story })).length > MAX_TEXT) throw failure("REVIEW_NATIVE_INPUT_LIMIT");
+  return { chunkId, chunks: raw.chunks, story: raw.story };
+}
+/** Only the actual HTTP adapters attach typed unknown-submission metadata. */
+export function attachReviewNativeJobFailureMetadata(error, payload) {
+  if (!object(error) || !object(payload) || payload.submissionState !== "unknown" || payload.retryAllowed !== false || payload.paidReplayAllowed !== false
+    || !UUID.test(payload.requestId || "") || !JOB.test(payload.jobId || "") || payload.recoveryAction !== "read-known-job") return false;
+  const stage = Object.keys(stages).find(key => payload.statusPath === `${stages[key].path}/${payload.jobId}`);
+  if (!stage) return false;
+  knownFailures.set(error, { stage, requestId: payload.requestId, jobId: payload.jobId }); return true;
+}
+function jobFrom(payload, stage, requestId, jobId) {
+  const raw = capture(payload, 8 * 1024 * 1024 + 4096), job = raw.job;
+  if (raw.ok !== true || raw.async !== true || raw.requestId !== requestId || !object(job) || !JOB.test(job.id || "") || jobId && jobId !== job.id
+    || job.type !== stages[stage].type || !["queued", "pending", "running", "completed", "failed", "cancelled", "unknown", "interrupted", "cancel_requested"].includes(job.status)
+    || job.workflow?.paidReplayAllowed !== false || job.workflow?.recovery !== "read-only-known-job") throw failure("REVIEW_NATIVE_RESPONSE_INVALID");
+  return job;
+}
+export function unwrapReviewNativeJobResult(stage, value, suppliedReference) {
+  if (!stages[stage]) throw failure("REVIEW_NATIVE_STAGE_INVALID");
+  const ref = mediaIdentity(suppliedReference, true), result = capture(value, 8 * 1024 * 1024), native = result[stages[stage].field];
+  if (result.kind !== stages[stage].kind || result.assetId !== ref.assetId || result.namespace !== ref.namespace || result.mediaInputHash !== ref.inputHash
+    || result.accountingState !== "settled" || result.paidReplayAllowed !== false || result.hasAccountCostEvents !== true || !object(native)
+    || native.chunkId !== ref.metadata.chunkId || !Array.isArray(result.accountCostEvents) || !result.accountCostEvents.length
+    || !Array.isArray(result.acceptedTaskCosts) || !object(result.usage) || !Number.isFinite(result.costUsd) || result.costUsd < 0
+    || typeof result.operationId !== "string" || !new RegExp(`^bg-review-${stage === "analyzing" ? "chunk" : "evidence"}-v1:[a-f0-9]{64}$`, "u").test(result.operationId)
+    || result.accountCostEvents.some((event, index) => event.accountCostEventId !== `${result.operationId}:${index + 1}` || event.accountCostRecorded !== true && event.accountCostSuppressedByReset !== true)) throw failure("REVIEW_NATIVE_RESULT_INVALID");
+  if (stage === "analyzing" && (native.sha256 !== ref.sha256 || ["sourceId", "startMs", "endMs", "sourceDurationMs", "hasAudio", "videoId", "workTitle"].some(key => native[key] !== ref.metadata[key]))) throw failure("REVIEW_NATIVE_RESULT_MISMATCH");
+  if (stage === "verifying" && (native.verificationKind !== "native-video-audio-recheck" || native.coverage?.startMs !== ref.metadata.startMs || native.coverage?.endMs !== ref.metadata.endMs
+    || native.coverage?.nativeAudioSubmitted !== ref.metadata.hasAudio || native.selectedSourceIds?.length !== 1 || native.selectedSourceIds[0] !== ref.metadata.sourceId)) throw failure("REVIEW_NATIVE_RESULT_MISMATCH");
+  return freeze({ ...native, ...Object.fromEntries(["operationId", "accountCostEvents", "acceptedTaskCosts", "hasAccountCostEvents", "accountingState", "costUsd", "usage", "model", "provider", "generatedAt", "paidReplayAllowed", "requiresHumanReview"].filter(key => result[key] !== undefined).map(key => [key, result[key]])) });
+}
+
+export function createReviewNativeJobClient({ request, getAuthority, apiScope, pollMs = 1000, readTimeoutMs = 30000,
+  now = Date.now, uuid = () => globalThis.crypto.randomUUID(), setTimer = setTimeout, clearTimer = clearTimeout } = {}) {
+  if (typeof request !== "function" || typeof getAuthority !== "function" || !Number.isSafeInteger(pollMs) || pollMs < 1 || pollMs > 10000
+    || !Number.isSafeInteger(readTimeoutMs) || readTimeoutMs < 1 || readTimeoutMs > 60000) throw new TypeError("Native review transport dependencies required");
+  const scope = scopeOf(apiScope);
+  async function run(stage, body, options = {}) {
+    if (!stages[stage]) throw failure("REVIEW_NATIVE_STAGE_INVALID");
+    // Capture descriptors and all input values before the first await, including
+    // before crypto hashing, capability discovery or journal persistence.
+    const captured = body == null ? null : capture(body, 4 * Math.ceil(MAX_VIDEO / 3) + MAX_TEXT + 32768);
+    const checkpoint = captureReviewNativeCheckpoint(Object.fromEntries(["transport", "apiScope", "mediaAttempt", "mediaReference", "submissionAttempted", "requestBinding", "jobId"].filter(key => options[key] !== undefined && options[key] !== "").map(key => [key, options[key]])));
+    const { requestId, onCheckpoint, signal } = options, authority = getAuthority();
+    if (!authority) throw failure("REVIEW_NATIVE_AUTHORITY_REQUIRED");
+    if (!UUID.test(requestId || "")) throw failure("REVIEW_NATIVE_ID_INVALID");
+    const recovering = checkpoint.transport !== undefined || checkpoint.mediaAttempt !== undefined || checkpoint.submissionAttempted !== undefined || checkpoint.jobId !== undefined;
+    if (recovering && (checkpoint.transport !== REVIEW_NATIVE_TRANSPORT || !checkpoint.apiScope || checkpoint.submissionAttempted === undefined
+      || !checkpoint.requestBinding || !checkpoint.mediaAttempt && !checkpoint.mediaReference)) throw failure("REVIEW_NATIVE_CHECKPOINT_INVALID");
+    if (checkpoint.mediaReference && !checkpoint.apiScope) throw failure("REVIEW_NATIVE_SCOPE_INVALID");
+    if (checkpoint.apiScope && checkpoint.apiScope !== scope) throw failure("REVIEW_NATIVE_SCOPE_CHANGED");
+    if (checkpoint.jobId && checkpoint.submissionAttempted !== true || checkpoint.submissionAttempted === true && !checkpoint.mediaReference) throw failure("REVIEW_NATIVE_CHECKPOINT_INVALID");
+    let state = { ...checkpoint }, lastJob, uploadStatus, uploadInput, logical;
+    const timeoutMs = options.timeoutMs ?? 600000;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 900000) throw new TypeError("Invalid native review deadline");
+    const deadline = now() + timeoutMs;
+    const check = () => {
+      if (getAuthority() !== authority) throw failure("REVIEW_NATIVE_OWNER_CHANGED");
+      if (signal?.aborted) throw failure("REVIEW_NATIVE_WAIT_ABORTED");
+      if (now() >= deadline) throw failure("REVIEW_NATIVE_WAIT_TIMEOUT");
+    };
+    async function bounded(callback, maximum = readTimeoutMs) {
+      check(); const controller = new AbortController(); let timer, listener;
+      const stop = new Promise((_, reject) => {
+        listener = () => { const error = failure("REVIEW_NATIVE_WAIT_ABORTED"); controller.abort(error); reject(error); };
+        signal?.addEventListener("abort", listener, { once: true });
+        timer = setTimer(() => { const error = failure("REVIEW_NATIVE_WAIT_TIMEOUT"); controller.abort(error); reject(error); }, Math.min(maximum, deadline - now()));
+      });
+      try { const value = await Promise.race([Promise.resolve().then(() => { check(); return callback(controller.signal); }), stop]); check(); return value; }
+      finally { clearTimer(timer); signal?.removeEventListener("abort", listener); }
+    }
+    const call = (path, init, maximum) => bounded(signal => serializedRequest(scope, authority, check,
+      () => { if (signal.aborted) throw signal.reason || failure("REVIEW_NATIVE_WAIT_ABORTED");
+        return request(path, { ...init, cache: "no-store", signal, timeoutMs: maximum || readTimeoutMs }); }), maximum);
+    // Durable writes are awaited to completion, never raced against timeout.
+    const persist = async patch => {
+      check(); state = captureReviewNativeCheckpoint({ ...state, ...patch });
+      if (typeof onCheckpoint !== "function") throw failure("REVIEW_NATIVE_JOURNAL_REQUIRED");
+      await onCheckpoint(state); check();
+    };
+    async function readUpload(value) {
+      const raw = capture(value, 16384), attempt = state.mediaAttempt;
+      if (!attempt || raw.attemptId !== attempt.attemptId || raw.automaticUploadRetryAllowed !== false
+        || !["ready", "reserved", "unconfirmed", "not_found", "deleting", "deleted"].includes(raw.status)) throw failure("REVIEW_NATIVE_UPLOAD_RESPONSE_INVALID");
+      if (raw.status === "ready") {
+        if (raw.ok !== true) throw failure("REVIEW_NATIVE_UPLOAD_RESPONSE_INVALID");
+        const reference = mediaIdentity(raw.reference, true); await checkIdentity(reference); check();
+        if (reference.inputHash !== attempt.inputHash || reference.sha256 !== attempt.sha256 || reference.byteLength !== attempt.byteLength
+          || raw.assetId !== reference.assetId || raw.namespace !== reference.namespace || raw.inputHash !== reference.inputHash
+          || state.mediaReference && JSON.stringify(state.mediaReference) !== JSON.stringify(reference)) throw failure("REVIEW_NATIVE_MEDIA_MISMATCH");
+        await persist({ mediaReference: reference });
+      } else if (raw.status !== "not_found" && (raw.inputHash !== attempt.inputHash || !ASSET.test(raw.assetId || "") || !HASH.test(raw.namespace || ""))) throw failure("REVIEW_NATIVE_MEDIA_MISMATCH");
+      return raw;
+    }
+    try {
+      check();
+      if (state.mediaAttempt) { await checkIdentity(state.mediaAttempt); check(); }
+      if (state.mediaReference) { await checkIdentity(state.mediaReference); check(); }
+      if (state.mediaAttempt && state.mediaReference && state.mediaAttempt.inputHash !== state.mediaReference.inputHash) throw failure("REVIEW_NATIVE_MEDIA_MISMATCH");
+      const suppliedMedia = stage === "analyzing" && (captured?.source || captured?.chunk) ? captured : stage === "verifying" ? captured?.chunk : null;
+      const existingIdentity = state.mediaReference || state.mediaAttempt;
+      if (suppliedMedia && existingIdentity) {
+        const media = uploadShape(suppliedMedia);
+        const hash = await digest(JSON.stringify({ version: 1, metadata: media.metadata, sha256: media.sha256, byteLength: media.bytes.length })); check();
+        if (hash !== existingIdentity.inputHash || await digest(media.bytes) !== existingIdentity.sha256) throw failure("REVIEW_NATIVE_MEDIA_MISMATCH"); check();
+      }
+      if (state.submissionAttempted === true && !state.jobId) throw failure("REVIEW_NATIVE_ACCEPTANCE_UNKNOWN");
+      if (!recovering && options.readOnly !== true) {
+        const cap = await call(REVIEW_NATIVE_CAPABILITY, { method: "GET" });
+        if (cap?.ok !== true || cap.kind !== "review-native" || cap.version !== 2 || cap.automaticUploadRetryAllowed !== false || cap.paidReplayAllowed !== false || !["queue-v2", "legacy-sync", "unavailable"].includes(cap.mode)) throw failure("REVIEW_NATIVE_CAPABILITY_INVALID");
+        if (cap.mode === "legacy-sync") {
+          if (state.mediaReference) throw failure("REVIEW_NATIVE_CAPABILITY_CHANGED");
+          if (!captured) throw failure("REVIEW_NATIVE_INPUT_REQUIRED");
+          let legacy = captured;
+          if (stage === "verifying" && !captured.chunk) {
+            if (typeof options.getLegacyMedia !== "function") throw failure("REVIEW_NATIVE_INPUT_REQUIRED");
+            const media = capture(await bounded(() => options.getLegacyMedia()), 4 * Math.ceil(MAX_VIDEO / 3) + 16384);
+            legacy = { chunks: captured.chunks, story: captured.story, chunk: media };
+          }
+          return await call(`/api/tracker/review/${stages[stage].legacy}`, { method: "POST", body: JSON.stringify({ ...legacy, costEventId: requestId }) }, timeoutMs);
+        }
+        if (cap.mode === "unavailable") throw failure("REVIEW_NATIVE_UNAVAILABLE");
+        if (!Array.isArray(cap.jobTypes) || !cap.jobTypes.includes(stages[stage].type)) throw failure("REVIEW_NATIVE_UNAVAILABLE");
+      }
+      if (!state.mediaReference && !state.mediaAttempt) {
+        if (options.readOnly === true || !captured) throw failure("REVIEW_NATIVE_INPUT_REQUIRED");
+        uploadInput = uploadShape(stage === "analyzing" ? captured : captured.chunk);
+        if (await digest(uploadInput.bytes) !== uploadInput.sha256) throw failure("REVIEW_NATIVE_MEDIA_MISMATCH"); check();
+        const base = { metadata: uploadInput.metadata, sha256: uploadInput.sha256, byteLength: uploadInput.bytes.length };
+        const mediaAttempt = mediaIdentity({ attemptId: uuid(), ...base, inputHash: await digest(JSON.stringify({ version: 1, ...base })) }); check();
+        logical = logicalInput(stage, captured, mediaAttempt);
+        const requestBinding = await digest(JSON.stringify({ requestId, stage, mediaInputHash: mediaAttempt.inputHash, ...logical })); check();
+        await persist({ transport: REVIEW_NATIVE_TRANSPORT, apiScope: scope, mediaAttempt, submissionAttempted: false, requestBinding });
+        uploadStatus = await readUpload(await call(REVIEW_NATIVE_ATTEMPTS, { method: "POST", body: JSON.stringify({ attemptId: mediaAttempt.attemptId, input: uploadInput.input, consent: true }) }));
+      }
+      if (!state.mediaReference && state.mediaAttempt) {
+        uploadStatus = await readUpload(await call(`${REVIEW_NATIVE_ATTEMPTS}/${state.mediaAttempt.attemptId}`, { method: "GET" }));
+        if (uploadStatus.status === "unconfirmed") uploadStatus = await readUpload(await call(`${REVIEW_NATIVE_ATTEMPTS}/${state.mediaAttempt.attemptId}/reconcile`, { method: "POST" }));
+        if (options.readOnly === true) return freeze({ kind: "review-media-attempt", ...uploadStatus });
+        if (!state.mediaReference) throw failure("REVIEW_NATIVE_UPLOAD_UNCONFIRMED");
+      }
+      if (!state.mediaReference) throw failure("REVIEW_NATIVE_MEDIA_REQUIRED");
+      logical ??= logicalInput(stage, captured, state.mediaReference);
+      if (logical) {
+        const binding = await digest(JSON.stringify({ requestId, stage, mediaInputHash: state.mediaReference.inputHash, ...logical })); check();
+        if (state.requestBinding && state.requestBinding !== binding) throw failure("REVIEW_NATIVE_INPUT_CHANGED");
+        if (!state.requestBinding) state.requestBinding = binding;
+      }
+      if (!state.jobId) {
+        if (options.readOnly === true) return freeze({ kind: "review-media-attempt", ...(uploadStatus || { status: "ready", reference: state.mediaReference, automaticUploadRetryAllowed: false }) });
+        if (!logical) throw failure("REVIEW_NATIVE_INPUT_REQUIRED");
+        if (state.mediaReference.expiresAt <= now()) throw failure("REVIEW_NATIVE_MEDIA_EXPIRED");
+        const ref = state.mediaReference, input = { assetId: ref.assetId, namespace: ref.namespace, mediaInputHash: ref.inputHash, ...logical };
+        if (encoder.encode(JSON.stringify(input)).length > (stage === "analyzing" ? 65536 : MAX_TEXT)) throw failure("REVIEW_NATIVE_INPUT_LIMIT");
+        await persist({ transport: REVIEW_NATIVE_TRANSPORT, apiScope: scope, submissionAttempted: true, requestBinding: state.requestBinding });
+        lastJob = jobFrom(await call(stages[stage].path, { method: "POST", body: JSON.stringify({ requestId, input, consent: true }) }), stage, requestId);
+        await persist({ jobId: lastJob.id });
+      }
+      for (;;) {
+        if (!lastJob) lastJob = jobFrom(await call(`${stages[stage].path}/${state.jobId}`, { method: "GET" }), stage, requestId, state.jobId);
+        if (options.readOnly === true) return lastJob;
+        if (lastJob.status === "completed") return unwrapReviewNativeJobResult(stage, lastJob.result, state.mediaReference);
+        if (!["queued", "pending", "running"].includes(lastJob.status)) throw failure("REVIEW_NATIVE_JOB_STOPPED", typeof lastJob.error === "string" && lastJob.error ? lastJob.error.slice(0, 1000) : undefined);
+        let timer; try { await bounded(() => new Promise(resolve => { timer = setTimer(resolve, pollMs); }), pollMs + readTimeoutMs); }
+        finally { if (timer !== undefined) clearTimer(timer); }
+        lastJob = null;
+      }
+    } catch (caught) {
+      if (getAuthority() !== authority) throw failure("REVIEW_NATIVE_OWNER_CHANGED");
+      let error = caught instanceof Error ? caught : failure("REVIEW_NATIVE_REQUEST_FAILED");
+      const known = knownFailures.get(error);
+      if (state.submissionAttempted === true && !state.jobId && known?.stage === stage && known.requestId === requestId) {
+        try { await persist({ jobId: known.jobId }); } catch (storageError) { error = storageError; }
+        if (getAuthority() !== authority) throw failure("REVIEW_NATIVE_OWNER_CHANGED");
+      }
+      if (!(error instanceof Error)) error = failure("REVIEW_NATIVE_REQUEST_FAILED");
+      // Raw error.jobId is not a recovery capability. Only an accepted response
+      // or adapter-branded, matching typed failure can populate this identity.
+      if (!state.jobId) delete error.jobId;
+      if (state.transport) Object.assign(error, state, { requestId, reconciliationRequired: true, paidReplayAllowed: false, automaticUploadRetryAllowed: false });
+      throw error;
+    }
+  }
+  return Object.freeze({ run, read: (stage, options = {}) => run(stage, null, { ...options, readOnly: true }) });
+}

package/lib/review-story-job-request.mjs

@@ -0,0 +1,131 @@
+// Shared browser/MCP transport. No credentials, paid retries or server failover.
+export const REVIEW_STORY_TRANSPORT = "review-story-queue-v1";
+export const REVIEW_STORY_JOBS = "/api/tracker/review/story-jobs";
+export const REVIEW_STORY_CAPABILITY = "/api/tracker/review/story-execution";
+const UUID = "[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}";
+const ID = new RegExp(`^${UUID}$`, "u"), JOB_ID = new RegExp(`^epoch-v2-${UUID}$`, "u");
+const statuses = new Set(["queued", "pending", "running", "completed", "failed", "interrupted", "unknown", "cancelled", "cancel_requested"]);
+const object = value => value !== null && typeof value === "object" && !Array.isArray(value);
+const knownErrorJobs = new WeakMap();
+// Only HTTP adapters call this with the typed server failure body. A copied
+// public jobId/error property alone never becomes a trusted recovery handle.
+export function attachReviewStoryJobFailureMetadata(error, payload) {
+  if (!error || typeof error !== "object" || !object(payload) || payload.submissionState !== "unknown"
+      || payload.retryAllowed !== false || payload.paidReplayAllowed !== false || !ID.test(payload.requestId || "")
+      || !JOB_ID.test(payload.jobId || "") || payload.statusPath !== `${REVIEW_STORY_JOBS}/${payload.jobId}`
+      || payload.recoveryAction !== "read-known-job") return false;
+  const identity = { requestId: payload.requestId, jobId: payload.jobId, statusPath: payload.statusPath };
+  knownErrorJobs.set(error, identity);
+  Object.assign(error, identity, { paidReplayAllowed: false, retryAllowed: false, reconciliationRequired: true });
+  return true;
+}
+const failure = (code, message) => Object.assign(new Error(message), { code, paidReplayAllowed: false });
+const validScope = value => {
+  let url; try { url = new URL(value); } catch { throw failure("REVIEW_STORY_SCOPE_INVALID", "분석 서버를 확인할 수 없습니다."); }
+  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) throw failure("REVIEW_STORY_SCOPE_INVALID", "분석 서버를 확인할 수 없습니다.");
+  return url.href.replace(/\/$/u, "");
+};
+function jobFrom(payload, requestId, expectedId) {
+  const job = payload?.job;
+  if (payload?.ok !== true || payload.async !== true || payload.requestId !== requestId || !object(job)
+      || !JOB_ID.test(job.id || "") || (expectedId && job.id !== expectedId)
+      || job.type !== "review:synthesize-story" || !statuses.has(job.status)) {
+    throw failure("REVIEW_STORY_RESPONSE_INVALID", "저장된 줄거리 작업을 안전하게 확인하지 못했습니다.");
+  }
+  if (job.result !== null && job.result !== undefined && new TextEncoder().encode(JSON.stringify(job.result)).length > 8 * 1024 * 1024) {
+    throw failure("REVIEW_STORY_RESULT_LIMIT", "저장된 줄거리 결과가 크기 한도를 초과했습니다.");
+  }
+  return job;
+}
+function captureInput(input) {
+  if (!object(input) || Object.keys(input).some(key => !["workTitle", "sources", "chunks"].includes(key))
+      || !Array.isArray(input.sources) || !Array.isArray(input.chunks)) throw failure("REVIEW_STORY_INPUT_INVALID", "전체 줄거리 분석 입력을 확인해 주세요.");
+  const json = JSON.stringify(input);
+  if (new TextEncoder().encode(json).length > 4 * 1024 * 1024) throw failure("REVIEW_STORY_INPUT_LIMIT", "전체 분석 자료가 4MiB를 초과했습니다.");
+  return JSON.parse(json);
+}
+export function createReviewStoryJobClient({ request, getAuthority, apiScope, pollMs = 1000, readTimeoutMs = 30000,
+  now = Date.now, setTimer = setTimeout, clearTimer = clearTimeout } = {}) {
+  if (typeof request !== "function" || typeof getAuthority !== "function" || !Number.isSafeInteger(pollMs) || pollMs < 1 || pollMs > 10000
+      || !Number.isSafeInteger(readTimeoutMs) || readTimeoutMs < 1 || readTimeoutMs > 60000) throw new TypeError("Review story transport dependencies required");
+  const scope = validScope(apiScope);
+  async function run(input, options = {}) {
+    const { requestId, onSubmissionAttempt, onJobAccepted, signal } = options;
+    const authority = getAuthority();
+    let jobId = options.jobId || "", attempted = options.transport === REVIEW_STORY_TRANSPORT || Boolean(jobId), lastJob;
+    if (!authority) throw failure("REVIEW_STORY_AUTHORITY_REQUIRED", "로그인 후 줄거리 분석을 이용해 주세요.");
+    if (!ID.test(requestId || "") || (jobId && !JOB_ID.test(jobId))) throw failure("REVIEW_STORY_ID_INVALID", "저장된 줄거리 작업 ID를 확인해 주세요.");
+    if ((options.transport && options.transport !== REVIEW_STORY_TRANSPORT) || (attempted && !options.apiScope)) throw failure("REVIEW_STORY_SCOPE_INVALID", "기존 작업의 서버 기록이 없습니다. 다시 제출하지 않습니다.");
+    if (options.apiScope && validScope(options.apiScope) !== scope) throw failure("REVIEW_STORY_SCOPE_CHANGED", "원래 분석 서버에서 기존 작업을 확인해 주세요.");
+    const timeoutMs = options.timeoutMs ?? 600000;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 900000) throw new TypeError("Invalid review waiting deadline");
+    const deadline = now() + timeoutMs;
+    const check = () => {
+      if (getAuthority() !== authority) throw failure("REVIEW_STORY_OWNER_CHANGED", "로그인 상태가 변경되어 이전 분석 조회를 중단했습니다.");
+      if (signal?.aborted) throw failure("REVIEW_STORY_WAIT_ABORTED", "분석 기다리기를 중단했습니다. 서버 작업을 취소하거나 재생성하지 않습니다.");
+      if (now() >= deadline) throw failure("REVIEW_STORY_WAIT_TIMEOUT", "분석 대기 시간이 초과되었습니다. 기존 작업만 조회하세요.");
+    };
+    async function bounded(callback, maximum = readTimeoutMs) {
+      check();
+      const controller = new AbortController(); let timer, listener;
+      const stop = new Promise((_, reject) => {
+        listener = () => { const error = failure("REVIEW_STORY_WAIT_ABORTED", "분석 기다리기를 중단했습니다."); controller.abort(error); reject(error); };
+        signal?.addEventListener("abort", listener, { once: true });
+        timer = setTimer(() => { const error = failure("REVIEW_STORY_WAIT_TIMEOUT", "분석 대기 시간이 초과되었습니다. 기존 작업만 조회하세요."); controller.abort(error); reject(error); }, Math.min(maximum, deadline - now()));
+      });
+      try {
+        const value = await Promise.race([Promise.resolve().then(() => { check(); return callback(controller.signal); }), stop]);
+        check(); return value;
+      } finally { clearTimer(timer); signal?.removeEventListener("abort", listener); }
+    }
+    const call = (path, init, maximum) => bounded(signal => request(path, { ...init, cache: "no-store", signal, timeoutMs: maximum || readTimeoutMs }), maximum);
+    // Persistence is deliberately awaited, not raced against abort/deadline.
+    const persist = async (callback, value) => { check(); await callback(value); check(); };
+    try {
+      if (attempted && !jobId) throw failure("REVIEW_STORY_ACCEPTANCE_UNKNOWN", "접수 응답에서 작업 ID를 받지 못했습니다. 유료 단계를 다시 제출하지 않습니다.");
+      if (!jobId) {
+        const captured = captureInput(input);
+        const capability = await call(REVIEW_STORY_CAPABILITY, { method: "GET" });
+        if (capability?.version !== 1 || capability.kind !== "review-story" || capability.recovery !== "read-only-known-job"
+            || capability.paidReplayAllowed !== false || !["legacy-sync", "queue-v2", "unavailable"].includes(capability.mode)) throw failure("REVIEW_STORY_CAPABILITY_INVALID", "줄거리 실행 방식이 확인되지 않아 생성을 시작하지 않았습니다.");
+        if (capability.mode === "unavailable") throw failure("REVIEW_STORY_UNAVAILABLE", "이 서버에서 줄거리 작업을 실행할 수 없습니다.");
+        if (capability.mode === "legacy-sync") return await call("/api/tracker/review/synthesize-story", { method: "POST", body: JSON.stringify(captured) }, timeoutMs);
+        if (typeof onSubmissionAttempt !== "function" || typeof onJobAccepted !== "function") throw failure("REVIEW_STORY_JOURNAL_REQUIRED", "작업 기록을 저장할 수 없어 분석을 시작하지 않았습니다.");
+        attempted = true;
+        await persist(onSubmissionAttempt, { transport: REVIEW_STORY_TRANSPORT, apiScope: scope });
+        lastJob = jobFrom(await call(REVIEW_STORY_JOBS, { method: "POST", body: JSON.stringify({ requestId, input: captured }) }), requestId);
+        jobId = lastJob.id;
+        await persist(onJobAccepted, { jobId, requestId, transport: REVIEW_STORY_TRANSPORT, apiScope: scope });
+      }
+      for (;;) {
+        if (!lastJob) lastJob = jobFrom(await call(`${REVIEW_STORY_JOBS}/${jobId}`, { method: "GET" }), requestId, jobId);
+        if (options.readOnly === true) return lastJob;
+        if (lastJob.status === "completed") {
+          if (!object(lastJob.result)) throw failure("REVIEW_STORY_RESULT_MISSING", "저장된 분석 결과를 확인하지 못했습니다.");
+          return lastJob.result;
+        }
+        if (!["queued", "pending", "running"].includes(lastJob.status)) throw failure("REVIEW_STORY_JOB_STOPPED", typeof lastJob.error === "string" ? lastJob.error.slice(0, 1000) : "기존 줄거리 작업을 확인해야 합니다. 다시 생성하지 않습니다.");
+        let timer;
+        try { await bounded(() => new Promise(resolve => { timer = setTimer(resolve, pollMs); }), pollMs + readTimeoutMs); }
+        finally { if (timer !== undefined) clearTimer(timer); }
+        lastJob = null;
+      }
+    } catch (caught) {
+      if (getAuthority() !== authority) throw failure("REVIEW_STORY_OWNER_CHANGED", "로그인 상태가 변경되어 이전 분석 조회를 중단했습니다.");
+      let error = caught instanceof Error ? caught : failure("REVIEW_STORY_REQUEST_FAILED", "분석 상태를 확인할 수 없습니다.");
+      const known = knownErrorJobs.get(error);
+      if (attempted && !jobId && known?.requestId === requestId) {
+        jobId = known.jobId;
+        try { await persist(onJobAccepted, { jobId, requestId, transport: REVIEW_STORY_TRANSPORT, apiScope: scope }); }
+        catch (storageError) { error = storageError; }
+        if (getAuthority() !== authority) throw failure("REVIEW_STORY_OWNER_CHANGED", "로그인 상태가 변경되어 이전 분석 조회를 중단했습니다.");
+      }
+      if (attempted) Object.assign(error, { requestId, jobId, transport: REVIEW_STORY_TRANSPORT, apiScope: scope, reconciliationRequired: true, paidReplayAllowed: false });
+      if (object(lastJob?.result)) for (const key of ["operationId", "accountCostEvents", "acceptedTaskCosts", "costUsd", "usage", "model", "partialProviderUsage"]) {
+        if (lastJob.result[key] !== undefined) error[key] = lastJob.result[key];
+      }
+      throw error;
+    }
+  }
+  return Object.freeze({ run, read: (jobId, options = {}) => run(null, { ...options, jobId, readOnly: true }) });
+}

package/lib/review-tools.mjs

@@ -9,7 +9,7 @@ import { wavDurationSec } from "./audio-duration.mjs";
 import { mp3DurationSec } from "./mp3-duration.mjs";
 import { createUsageEventId } from "./usage-event.mjs";
 import { assertReviewBudget, bindReviewRenderSources, inspectReviewLocalFile, readReviewHandle, REVIEW_MAX_FRAMES, reviewPublicSources, validateReviewSources } from "./review-sources.mjs";
-import { fullReviewStatus, runFullReviewAnalysis, selectReviewPlanningCatalog } from "./review-full-analysis.mjs";
+import { refreshFullReviewStatus, runFullReviewAnalysis, selectReviewPlanningCatalog } from "./review-full-analysis.mjs";
 
 const spoiler = z.enum(["none", "limited", "full", "unknown"]);
 const interval = z.object({ startMs: z.number().int().min(0), endMs: z.number().int().positive(),
@@ -96,10 +96,10 @@ export function registerReviewTools(server, config, api, { wrap = handler => han
     }
   });
   server.tool("analyze_review_sources",
-    "영화·드라마 전체 영상+오디오를 Gemini 3.8로 분석하고 서사와 원본 근거를 재검증합니다. 기본 full은 모든 구간을 최대300초 MP4로 압축하여 클라우드에 전송하므로 사용자 업로드·과금 동의 후 allowCloudVideoUpload:true 필수. 첫 호출은 무료 원본 검사/범위 준비만, 이후 resumePath로 기본1단계씩 계속하세요. 완료된 청크는 재과금하지 않으며 실패 재시도는 명시 승인 필요. 대표 프레임 점검만 원하면 analysisScope:'sample'을 명시하세요(전체 이해가 아님).",
+    "영화·드라마 전체 영상+오디오를 Gemini 3.8로 분석하고 서사와 원본 근거를 재검증합니다. 기본 full은 모든 구간을 최대300초 MP4로 압축하여 클라우드에 전송하므로 사용자 업로드·과금 동의 후 allowCloudVideoUpload:true 필수. 첫 호출은 무료 원본 검사/범위 준비만, 이후 resumePath로 기본1단계씩 계속하세요. 지원 서버에서는 영상 업로드·구간 분석·줄거리·원본 검증을 영속 작업으로 기록합니다. 기존 작업은 조회/업로드 확인만 하며 접수 미확정 유료 요청이나 업로드를 재전송하지 않습니다. 완료된 청크는 재과금하지 않습니다. 명시된 기존 동기 방식의 실패 재시도만 승인 후 가능합니다. 모순/근거 부족 판정은 저장하고 사람 검토를 기다립니다. 대표 프레임 점검만 원하면 analysisScope:'sample'을 명시하세요(전체 이해가 아님).",
     { sources: z.array(sourceInput).min(1).max(5).optional(), analysisScope: z.enum(["full", "sample"]).optional(),
       allowCloudVideoUpload: z.boolean().optional(), resumePath: z.string().optional(), workTitle: z.string().max(200).optional(),
-      maxSteps: z.number().int().min(1).max(4).optional(), retryFailedStage: z.boolean().optional(),
+      maxSteps: z.number().int().min(1).max(4).optional(), retryFailedStage: z.boolean().optional().describe("기존 동기 실패 단계만 추가 과금 재시도 승인. 업로드/구간/줄거리/검증 큐의 접수 미확정 작업과 이미 받은 결과는 재전송하지 않습니다. 모순·근거 부족 판정도 재과금하지 않습니다."),
       maxFrames: z.number().int().min(3).max(REVIEW_MAX_FRAMES).optional() },
     wrapReview(async (args, extra) => {
       if (args.analysisScope !== "sample") return result(await runFullReviewAnalysis({ config, api, args, companionJson,
@@ -194,7 +194,7 @@ export function registerReviewTools(server, config, api, { wrap = handler => han
     }));
 
   server.tool("review_analysis_status", "전체 원작 분석의 최신 진행률·청크 완료·원본 검증·누적 비용을 조회합니다. 유료 API를 호출하지 않습니다. 오래된 resumePath도 최신 체크포인트를 찾아 반환합니다.",
-    { resumePath: z.string() }, wrapReview(async ({ resumePath }) => result(fullReviewStatus(config, resumePath))));
+    { resumePath: z.string() }, wrapReview(async ({ resumePath }) => result(await refreshFullReviewStatus(config, api, resumePath))));
 
   server.tool("plan_review_video",
     "검토한 영화·드라마 원본 카탈로그로 60~900초 리뷰를 기획합니다. 원작 사실·해석·가상해석을 구분하며 spoilerPolicy를 지킵니다. reviewSourcePath는 analyze_review_sources 결과. 영화 전체를 봤다고 가정하지 않으며 기획에 분석 과금이 발생할 수 있습니다. 반환 productionPath를 보이스 추천·리뷰 편집에 전달하세요.",

package/lib/speech-production-profile.mjs

@@ -0,0 +1,21 @@
+// Exact browser capture of the server's durable TTS profile contract. This is
+// creative intent, never receipt/state metadata or an arbitrary nested object.
+export function captureSpeechProductionProfile(value) {
+  const fail = () => { throw Object.assign(new Error("음성 제작 프로필을 확인해 주세요."), { code: "SPEECH_INPUT_INVALID", paidReplayAllowed: false }); };
+  const fields = ["version", "categoryId", "tone", "deliveryStyle", "targetDurationSec", "imageSourceMode", "visualMotionMode", "autoComposeEnabled", "subtitleStylePresetId", "titleStylePresetId"];
+  if (!value || typeof value !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) fail();
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  if (Reflect.ownKeys(descriptors).some(key => !fields.includes(key) || !Object.hasOwn(descriptors[key], "value"))) fail();
+  const copy = Object.fromEntries(Object.entries(descriptors).filter(([, item]) => item.value !== undefined).map(([key, item]) => [key, item.value]));
+  if (copy.version !== 1 || typeof copy.categoryId !== "string" || !/^[a-z][a-z0-9-]{0,63}$/u.test(copy.categoryId)
+    || !["casual-social", "standard", "news-briefing"].includes(copy.deliveryStyle)) fail();
+  const maxSeconds = ["community-shorts", "viral-shorts"].includes(copy.categoryId) ? 180 : 3600;
+  if (typeof copy.targetDurationSec !== "number" || !Number.isFinite(copy.targetDurationSec) || copy.targetDurationSec < 0.01 || copy.targetDurationSec > maxSeconds) fail();
+  if (copy.tone !== undefined && (typeof copy.tone !== "string" || !copy.tone.isWellFormed() || copy.tone.length > 300 || /[\u0000-\u001f\u007f]/u.test(copy.tone))) fail();
+  if (copy.imageSourceMode !== undefined && !["ai", "web", "mixed"].includes(copy.imageSourceMode)) fail();
+  if (copy.visualMotionMode !== undefined && !["image-motion", "i2v"].includes(copy.visualMotionMode)) fail();
+  if (copy.autoComposeEnabled !== undefined && typeof copy.autoComposeEnabled !== "boolean") fail();
+  for (const key of ["subtitleStylePresetId", "titleStylePresetId"]) if (copy[key] !== undefined
+    && (typeof copy[key] !== "string" || !/^[a-z][a-z0-9-]{0,63}$/u.test(copy[key]))) fail();
+  return Object.freeze(copy);
+}

package/lib/tts-alignment.mjs

@@ -0,0 +1,69 @@
+// Shared browser/server data contract. No provider, credentials, I/O or timing
+// repair here: a malformed alignment is not permission to synthesize again.
+// Two three-array alignments plus worst-case derived subtitle lines must fit
+// the durable job's 65,536-node capture bound, including cost/receipt metadata.
+export const TTS_ALIGNMENT_LIMITS = Object.freeze({ maxCharacters: 6000, maxDurationSeconds: 3600, maxJsonBytes: 1048576 });
+const fail = () => { throw Object.assign(new Error("TTS_ALIGNMENT_INVALID"), { code: "TTS_ALIGNMENT_INVALID", statusCode: 502, paidReplayAllowed: false }); };
+function record(value, names, required = names) {
+  if (!value || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) fail();
+  const fields = Object.getOwnPropertyDescriptors(value);
+  if (Reflect.ownKeys(fields).some(key => !names.includes(key) || !("value" in fields[key]))
+    || required.some(key => !Object.hasOwn(fields, key))) fail();
+  return Object.fromEntries(Object.entries(fields).map(([key, item]) => [key, item.value]));
+}
+function array(value) {
+  if (!Array.isArray(value) || !value.length || value.length > TTS_ALIGNMENT_LIMITS.maxCharacters) fail();
+  const fields = Object.getOwnPropertyDescriptors(value), keys = Reflect.ownKeys(fields);
+  if (keys.length !== value.length + 1 || keys.some(key => typeof key !== "string" || !("value" in fields[key])
+    || key !== "length" && !/^(?:0|[1-9][0-9]*)$/u.test(key))) fail();
+  return Array.from({ length: value.length }, (_, index) => {
+    if (!Object.hasOwn(fields, index)) fail(); return fields[index].value;
+  });
+}
+function alignment(value) {
+  const source = record(value, ["characters", "character_start_times_seconds", "character_end_times_seconds"]);
+  const characters = array(source.characters), starts = array(source.character_start_times_seconds), ends = array(source.character_end_times_seconds);
+  if (characters.length !== starts.length || starts.length !== ends.length) fail();
+  for (let index = 0; index < characters.length; index++) {
+    const character = characters[index], start = starts[index], end = ends[index];
+    if (typeof character !== "string" || !character || !character.isWellFormed() || character.length > 16 || Array.from(character).length > 8
+      || /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/u.test(character)
+      || typeof start !== "number" || typeof end !== "number" || !Number.isFinite(start) || !Number.isFinite(end)
+      || start < 0 || end < start || end > TTS_ALIGNMENT_LIMITS.maxDurationSeconds
+      || index > 0 && (start < starts[index - 1] || end < ends[index - 1])) fail();
+  }
+  return Object.freeze({ characters: Object.freeze(characters), character_start_times_seconds: Object.freeze(starts), character_end_times_seconds: Object.freeze(ends) });
+}
+export function captureTtsAlignment(value, { requireAlignment = true } = {}) {
+  if (typeof requireAlignment !== "boolean") fail();
+  const source = record(value, ["alignment", "normalizedAlignment"], []);
+  const primary = source.alignment == null ? null : alignment(source.alignment);
+  if (!primary && requireAlignment) fail();
+  const result = Object.freeze({ alignment: primary, normalizedAlignment: source.normalizedAlignment == null ? null : alignment(source.normalizedAlignment) });
+  if (new TextEncoder().encode(JSON.stringify(result)).byteLength > TTS_ALIGNMENT_LIMITS.maxJsonBytes) fail();
+  return result;
+}
+
+// Preserve the existing ElevenLabs subtitle splitting contract. This function
+// consumes a previously validated primary alignment; it never estimates time.
+export function buildSpeechSubtitleLines({ alignment: source, minChars = 6 } = {}) {
+  const value = alignment(source);
+  if (!Number.isSafeInteger(minChars) || minChars < 1 || minChars > 1000) fail();
+  const chars = value.characters, starts = value.character_start_times_seconds, ends = value.character_end_times_seconds;
+  const breakers = new Set([".", "?", "!", "\n", "\r"]), softBreakers = new Set([",", ";", "·"]);
+  const lines = []; let buffer = "", lineStart = -1;
+  function pushLine(endIndex) {
+    const trimmed = buffer.trim(); if (!trimmed) return;
+    const startSec = starts[Math.max(0, lineStart)], endSec = ends[endIndex];
+    if (lines.length && trimmed.length < minChars) {
+      const previous = lines[lines.length - 1]; previous.text = `${previous.text} ${trimmed}`.trim(); previous.endSec = Math.max(previous.endSec, endSec);
+    } else lines.push({ text: trimmed, startSec, endSec });
+    buffer = ""; lineStart = -1;
+  }
+  for (let index = 0; index < chars.length; index++) {
+    const character = chars[index]; if (lineStart === -1 && character.trim()) lineStart = index; buffer += character;
+    if (breakers.has(character) || softBreakers.has(character) && buffer.replace(/[,\s;·]+$/, "").length >= minChars * 2) pushLine(index);
+  }
+  if (buffer.trim()) pushLine(chars.length - 1);
+  return Object.freeze(lines.map(Object.freeze));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aimakeall-mcp",
-  "version": "0.14.2",
+  "version": "0.14.4",
   "description": "AImakeAll MCP 서버 — Claude Code/Codex에서 자연어로 영상 기획·생성·렌더·퍼블리시 (렌더는 로컬 컴패니언)",
   "type": "module",
   "bin": {