aimakeall-mcp 0.14.3 → 0.14.4

package/README.md

@@ -5,6 +5,12 @@ Claude Code·Codex 같은 MCP 클라이언트에서 자연어로 AImakeAll 영
 - **클라우드 툴**: 기획 → 씬 이미지/영상 생성 → TTS/음악 → 타임라인 스티치 → YouTube 퍼블리시 (PAT 인증, aimakeall.com API)
 - **로컬 툴**: mp4 렌더 — **항상 이 PC의 AImakeAll 컴패니언(127.0.0.1:9876)에서 수행**됩니다. 서버는 렌더하지 않습니다.
 
+## 0.14.4 공유 실행 호환성 업데이트
+
+채널 실측 작업의 계정별 복구와 실제 발화 자막·음성 제작 스타일 보존을 추가했습니다.
+공유 실행은 서버가 지원을 명시한 경우에만 사용하며 기존 단일 서버와 호환됩니다.
+운영 PostgreSQL 전환이나 자동 확장이 이 패키지 게시만으로 활성화되지는 않습니다.
+
 ## 0.14.3 리뷰 분석 업데이트
 
 전편 분석의 서버 실행 방식 조회, 계정·서버별 체크포인트 고정, 알려진 작업의 읽기 전용
@@ -124,6 +130,14 @@ plan_shorts_video → (씬마다) generate_scene_image → get_generation_job(co
 - 성공 응답의 `provider`, `primaryProvider`, `providerFallback`, `accountCostEvents`로 실제 합성 공급자와 비용을 확인합니다. 폴백 후 새 `productionPath`에 실제 보이스를 저장하며 이전 제작 핸들은 바꾸지 않습니다. 항상 최신 핸들을 다음 단계에 넘기세요.
 - 제출 시간 초과·네트워크 단절·접수 후 결과 불명, 인증·입력·안전정책 오류에는 다른 유료 생성을 자동 실행하지 않습니다. 오류의 `fallbackStatus`, `fallbackReason`, `fallbackAvailable`, 접수된 비용을 확인하고 기존 작업부터 조회하세요. 실패했다고 비용이 없거나 환불되었다는 뜻은 아닙니다.
 - ElevenLabs의 정확한 문자별 타임스탬프를 선택한 요청은 추정 자막으로 대체하지 않습니다. 다른 공급자 일반 합성이 ElevenLabs로 전환되더라도 `timingSource:"estimated-from-audio-duration"`인 자막이 정밀 타임스탬프로 바뀌지는 않습니다. 사용자 PC의 Companion 직접 Edge TTS는 서버 폴백 체인 밖입니다.
+
+공유 실행용 `start_speech_generation`은 공급자 한 곳과 `requestId`를 고정합니다.
+ElevenLabs의 실제 자막은 `options.includeAlignment:true`로 오디오와 같은 작업에서
+요청하고, 원래 제작 핸들의 `productionProfile`을 `options.productionProfile`로 전달합니다.
+`get_generation_job` 완료 응답은 보호된 오디오 링크와 검증된 `subtitleLines`,
+`timingSource:"provider-character-alignment"`를 반환합니다. 응답이 끊겨도 같은 ID를
+조회하며 다른 공급자나 기존 동기 TTS로 다시 합성하지 않습니다. 이 비동기 도구가
+기존 `tts_narration_with_captions`의 로컬 파일·제작 핸들을 자동 갱신하는 것은 아닙니다.
 - 이미지·영상·LLM 폴백은 대응 서버가 지원하는 동일 기능/입력 경로에서만 동작합니다. SUNO, 음성 클로닝, 정밀 정렬 등 모든 독점 기능에 호환 대체가 있는 것은 아닙니다. 상태 조회만으로 미확인 유료 작업을 재생성하지 마세요.
 
 ## 장면 이미지 준비와 영상 표현 선택

package/lib/cloud-tools.mjs

@@ -1,3 +1,4 @@
+import { createChannelMeasurementClient } from "./durable-channel-client.mjs";
 
 import { createReadStream, readFileSync, statSync } from "node:fs";
 import path from "node:path";
@@ -262,7 +263,7 @@ export function registerCloudTools(server, config, api) {
 
   server.tool(
     "start_speech_generation",
-    "지정한 ElevenLabs/Typecast/Supertone 한 곳에 비동기 내레이션 작업을 접수합니다. 공유 실행 저장소가 필요합니다. requestId를 유지하고 get_generation_job으로 조회하세요. 대체 공급자·자동 재합성·기존 바이너리 TTS로 전환하지 않으며, 완료 오디오는 서버 소유 링크로 반환됩니다.",
+    "지정한 ElevenLabs/Typecast/Supertone 한 곳에 비동기 내레이션 작업을 접수합니다. 공유 실행 저장소가 필요합니다. ElevenLabs는 options.includeAlignment=true로 실제 발화 자막도 함께 생성하며 productionProfile로 원래 말투·스타일을 유지합니다. requestId를 유지하고 get_generation_job으로 조회하세요. 대체 공급자·자동 재합성·기존 바이너리 TTS로 전환하지 않으며, 완료 오디오는 서버 소유 링크로 반환됩니다.",
     durableSpeechToolSchema,
     wrapCloudHandler(config, async input => {
       const result = await submitDurableSpeech(api, input);
@@ -1713,6 +1714,10 @@ export function registerCloudTools(server, config, api) {
       videoUrls: z.array(z.string()).min(1).max(5).describe("표본 유튜브 URL 또는 11자 ID (조회수 상위 영상 권장)"),
     },
     wrapCloudHandler(config, async ({ videoUrls }) => {
+      const durable = createChannelMeasurementClient(config, api, videoUrls);
+      const restored = await durable.recover();
+      if (restored) return jsonResult({ fingerprint: restored.fingerprint, usage: restored.usage, accountCostEvents: restored.accountCostEvents, backgroundJobId: restored.backgroundJobId, recovered: true, paidReplayAllowed: false });
+      await durable.readCapability();
       const specs = [];
       const notes = [];
       // 라우드니스·무음은 여기서 재고 "숫자만" 보낸다. 오디오를 서버로 올리면 표본 3편만
@@ -1783,16 +1788,16 @@ export function registerCloudTools(server, config, api) {
       if (!specs.length) {
         return textResult(`표본 실측에 모두 실패했습니다. 컴패니언 앱 실행 여부를 확인하세요.\n${notes.join("\n")}`, { isError: true });
       }
-      const payload = await api.request("/api/tracker/gemini/channel-fingerprint", {
-        body: { measuredAt: new Date().toISOString(), videos: specs },
-        method: "POST",
-        timeoutMs: 300_000,
-      });
+      const payload = await durable.run({ measuredAt: new Date().toISOString(), videos: specs });
       if (payload?.ok === false || !payload?.fingerprint) {
         return textResult(`지문 집계 실패: ${payload?.error || "알 수 없는 오류"}`, { isError: true });
       }
       return jsonResult({
         fingerprint: payload.fingerprint,
+        usage: payload.usage,
+        accountCostEvents: payload.accountCostEvents,
+        backgroundJobId: payload.backgroundJobId,
+        ...(payload.kind === "durable-channel-v2" ? { paidReplayAllowed: false } : {}),
         next: "이 fingerprint 객체를 plan_shorts_video·stitch_timeline·write_script 의 channelFingerprint 로 그대로 넘기세요 — 길이·컷 리듬·말끝·자막 위치·BGM 이 이 규격을 따릅니다.",
         notes: notes.length ? notes : undefined,
         sampleCount: specs.length,

package/lib/config.mjs

@@ -2,7 +2,7 @@ import { homedir } from "node:os";
 import path from "node:path";
 
 // 프록시 버전 — 서버가 X-AImakeAll-MCP-Version 으로 하한을 강제(426)할 수 있다.
-export const MCP_PROXY_VERSION = "0.14.3";
+export const MCP_PROXY_VERSION = "0.14.4";
 
 export const DEFAULT_API_BASE = "https://aimakeall.com";
 export const DEFAULT_COMPANION_URL = "http://127.0.0.1:9876";

package/lib/durable-channel-client.mjs

@@ -0,0 +1,30 @@
+import { createHash, webcrypto } from 'node:crypto';
+import { createDurableChannelRequest } from './durable-channel-request.mjs';
+import { createChannelFileJournal } from './durable-channel-journal.mjs';
+import { canonicalYoutubeWatchUrl } from './payload-guard.mjs';
+import { matchesApiClientAuthority } from './api-client.mjs';
+import { MCP_PROXY_VERSION } from './config.mjs';
+const hash = value => createHash('sha256').update(value).digest('hex');
+export function createChannelMeasurementClient(config, api, videoUrls, { fetchImpl = globalThis.fetch, pollMs = 1000, timeoutMs = 240000 } = {}) {
+  const scope = new URL(config.apiBase).origin, pat = config.pat;
+  if (config.apiBase.replace(/\/$/u, '') !== scope || !['http:', 'https:'].includes(new URL(scope).protocol) || typeof pat !== 'string' || !pat) throw Error('DURABLE_CHANNEL_AUTHORITY_INVALID');
+  const urls = videoUrls.map(canonicalYoutubeWatchUrl);
+  if (!urls.length || urls.length > 5 || urls.some(url => !url)) throw Error('DURABLE_CHANNEL_VIDEO_URL_INVALID');
+  const fingerprint = hash(JSON.stringify([scope, pat])), projectId = `channel-measure:${hash(JSON.stringify(urls))}`, operation = 'channel-fingerprint', targetId = `durable-channel:${operation}:${projectId}`;
+  const assertCurrent = () => { if (config.pat !== pat || config.apiBase.replace(/\/$/u, '') !== scope || matchesApiClientAuthority(api, { apiBase: config.apiBase, pat }) === false) throw Error('DURABLE_CHANNEL_AUTHORITY_CHANGED'); return true; };
+  assertCurrent(); const journal = createChannelFileJournal({ stateDir: config.stateDir, authorityFingerprint: fingerprint });
+  const client = createDurableChannelRequest({ journal, apiOrigin: scope, fetchImpl, crypto: webcrypto, pollMs, timeoutMs,
+    getAuthority: () => { assertCurrent(); return { ownerUserId: fingerprint, sessionRevision: fingerprint }; },
+    getHeaders: () => { assertCurrent(); return { Authorization: `Bearer ${pat}`, 'X-AImakeAll-MCP-Version': MCP_PROXY_VERSION }; }, ensureSession: () => true });
+  const identity = { ownerUserId: fingerprint, apiOrigin: scope, projectId: `durable-channel:v1:${hash(JSON.stringify([operation, projectId, targetId]))}`, inputDigest: '0'.repeat(64) };
+  const options = { operation, projectId, targetId, assertCurrent, assertQueueReady: () => true,
+    applyResult: ({ recoveredPreviousRequest, ...result }) => journal.persistResult(identity, result, assertCurrent),
+    // The machine displays server receipts; it never increments a second ledger.
+    onAccountCost: result => { assertCurrent(); return result.accountingState === 'settled' && result.hasAccountCostEvents === true; } };
+  return Object.freeze({
+    recover: () => client.run(null, { ...options, recoveryOnly: true }),
+    readCapability: () => client.readCapability(options),
+    run: body => client.run({ ...body, operation, projectId, targetId }, { ...options,
+      legacy: () => { assertCurrent(); return api.request('/api/tracker/gemini/channel-fingerprint', { body, method: 'POST', timeoutMs: 300000 }); } }),
+  });
+}

package/lib/durable-channel-contract.mjs

@@ -0,0 +1,60 @@
+// Closed browser/worker channel-analysis contract. Never accepts a provider,
+// credential, arbitrary prompt, callback or model from the requester.
+export const DURABLE_CHANNEL_CONTRACT_VERSION = 1;
+export const DURABLE_CHANNEL_PATHS = Object.freeze({ 'channel-style': '/api/tracker/gemini/channel-style', 'channel-fingerprint': '/api/tracker/gemini/channel-fingerprint' });
+export const DURABLE_CHANNEL_TYPES = Object.freeze(Object.fromEntries(Object.keys(DURABLE_CHANNEL_PATHS).map(key => [key, `durable-channel:${key}`])));
+export const DURABLE_CHANNEL_MODEL = Object.freeze({ 'channel-style': 'gemini-2.5-flash-lite', 'channel-fingerprint': 'gemini-3-flash' });
+export const DURABLE_CHANNEL_LIMITS = Object.freeze({ maxInputBytes: 16 * 1024 * 1024, maxOutputBytes: 1024 * 1024, maxProjectId: 160, maxTargetId: 240, maxStages: 24, maxVideos: 12, maxFrames: 8 });
+export const DURABLE_CHANNEL_OUTPUT_FIELDS = Object.freeze(['operation', 'projectId', 'targetId', 'profile', 'analysis', 'fingerprint']);
+const encoder = new TextEncoder();
+function fail(output = false) { const code = `DURABLE_CHANNEL_${output ? 'OUTPUT' : 'INPUT'}_INVALID`; throw Object.assign(new Error(code), { code, statusCode: output ? 502 : 400 }); }
+function record(value) { if (!value || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) fail();
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  if (Reflect.ownKeys(descriptors).some(key => typeof key !== 'string' || ['__proto__', 'constructor', 'prototype'].includes(key) || !descriptors[key].enumerable || !('value' in descriptors[key]))) fail();
+  return Object.fromEntries(Object.entries(descriptors).map(([key, item]) => [key, item.value])); }
+function copy(value, state, depth = 0) { if (++state.nodes > 40000 || depth > 16) fail();
+  if (value === null || typeof value === 'boolean') return value;
+  if (typeof value === 'number') { if (!Number.isFinite(value) || Math.abs(value) > Number.MAX_SAFE_INTEGER) fail(); return value; }
+  if (typeof value === 'string') { if (!value.isWellFormed() || /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/u.test(value)) fail(); state.bytes += encoder.encode(value).byteLength; if (state.bytes > state.limit) fail(); return value; }
+  if (!value || typeof value !== 'object' || state.seen.has(value)) fail(); state.seen.add(value); let result;
+  if (Array.isArray(value)) { if (Object.getPrototypeOf(value) !== Array.prototype) fail(); const d = Object.getOwnPropertyDescriptors(value), size = d.length.value;
+    if (size > 2000 || Reflect.ownKeys(d).length !== size + 1) fail(); result = Array.from({ length: size }, (_, i) => { const item = d[i]; if (!item?.enumerable || !('value' in item)) fail(); return copy(item.value, state, depth + 1); });
+  } else result = Object.fromEntries(Object.entries(record(value)).map(([key, item]) => [key, copy(item, state, depth + 1)])); state.seen.delete(value); return Object.freeze(result); }
+function capture(value, fields, limit) { const raw = record(value); if (Object.keys(raw).some(key => !fields.includes(key))) fail();
+  const out = copy(raw, { nodes: 0, bytes: 0, limit, seen: new WeakSet() }); if (encoder.encode(JSON.stringify(out)).byteLength > limit) fail(); return out; }
+function identity(raw) { if (!Object.hasOwn(DURABLE_CHANNEL_TYPES, raw.operation)) fail();
+  for (const [key, max] of [['projectId', 160], ['targetId', 240]]) if (typeof raw[key] !== 'string' || !raw[key] || raw[key] !== raw[key].trim() || raw[key].length > max || /[\u0000-\u001f\u007f]/u.test(raw[key])) fail(); }
+const VIDEO_FIELDS = ['videoId', 'durationSec', 'cutCount', 'loudnessDbfs', 'silenceRatio', 'transcriptSegments', 'cpsSample', 'subtitleYPct', 'subtitleLines', 'endingStyle', 'endingExample', 'emphasisCount', 'hasBgm', 'first3sText', 'aiCutCountGuess', 'aiDurationGuessSec', 'audioBase64', 'frames'];
+const NUMBERS = ['durationSec', 'cutCount', 'loudnessDbfs', 'silenceRatio', 'cpsSample', 'subtitleYPct', 'subtitleLines', 'emphasisCount', 'aiCutCountGuess', 'aiDurationGuessSec'];
+function analysis(value) { if (!value || typeof value !== 'object' || Array.isArray(value) || typeof value.channel?.title !== 'string' || !value.channel.title.trim() || value.channel.title.length > 1000) fail();
+  for (const key of ['topKeywords', 'highlights', 'videos']) if (value[key] !== undefined && !Array.isArray(value[key])) fail();
+  if (value.topKeywords?.some(v => typeof v !== 'string') || value.highlights?.some(v => !v || typeof v !== 'object') || value.videos?.some(v => !v || typeof v !== 'object')) fail(); }
+export function captureDurableChannelInput(value) { const raw = record(value); identity(raw);
+  const body = capture(raw, ['operation', 'projectId', 'targetId', ...(raw.operation === 'channel-style' ? ['analysis'] : ['videos', 'measuredAt'])], DURABLE_CHANNEL_LIMITS.maxInputBytes);
+  if (body.operation === 'channel-style') { analysis(body.analysis); if (encoder.encode(JSON.stringify(body.analysis)).byteLength > 750000) fail(); }
+  else { if (!Array.isArray(body.videos) || !body.videos.length || body.videos.length > 12 || typeof body.measuredAt !== 'string' || !Number.isFinite(Date.parse(body.measuredAt)) || new Date(body.measuredAt).toISOString() !== body.measuredAt) fail();
+    for (const v of body.videos) { if (!v || Array.isArray(v) || Object.keys(v).some(k => !VIDEO_FIELDS.includes(k))) fail();
+      for (const k of NUMBERS) if (v[k] !== undefined && v[k] !== null && (typeof v[k] !== 'number' || Math.abs(v[k]) > 1e9)) fail();
+      for (const k of ['videoId', 'endingStyle', 'endingExample', 'first3sText']) if (v[k] != null && (typeof v[k] !== 'string' || v[k].length > 10000)) fail();
+      if (v.hasBgm != null && typeof v.hasBgm !== 'boolean') fail();
+      if (v.audioBase64 !== undefined && (typeof v.audioBase64 !== 'string' || v.audioBase64.length > 7000000 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u.test(v.audioBase64))) fail();
+      if (v.transcriptSegments !== undefined && (!Array.isArray(v.transcriptSegments) || v.transcriptSegments.some(s => !s || typeof s !== 'object' || Array.isArray(s)))) fail();
+      if (v.frames !== undefined && (!Array.isArray(v.frames) || v.frames.length > 8 || v.frames.some(f => typeof f !== 'string' || !/^data:image\/(?:png|jpeg|webp);base64,(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u.test(f) || f.endsWith(',')))) fail();
+    }
+  } return Object.freeze({ body, jobType: DURABLE_CHANNEL_TYPES[body.operation] }); }
+export function captureDurableChannelOutput(value) { try { const raw = capture(value, DURABLE_CHANNEL_OUTPUT_FIELDS, DURABLE_CHANNEL_LIMITS.maxOutputBytes); identity(raw);
+  if (raw.operation === 'channel-style') { analysis(raw.analysis); if (!raw.profile || Array.isArray(raw.profile) || raw.fingerprint !== undefined) fail(true);
+    const strings = ['channelTitle', 'introPattern', 'outroPattern', 'pacing', 'recommendedFormat', 'recommendedStyleId', 'structurePattern', 'summary', 'toneGuide', 'toneLabel'];
+    if (Object.keys(raw.profile).length !== strings.length + 2 || strings.some(k => typeof raw.profile[k] !== 'string') || !raw.profile.summary.trim()) fail(true);
+    for (const [k, max] of [['referenceKeywords', 6], ['scriptDirectives', 5]]) if (!Array.isArray(raw.profile[k]) || raw.profile[k].length > max || raw.profile[k].some(v => typeof v !== 'string')) fail(true);
+  } else {
+    const f = raw.fingerprint, numeric = ['durationTargetSec', 'durationIqrSec', 'cutIntervalSec', 'cutIntervalIqrSec', 'cutsPerMin', 'loudnessDbfs', 'silenceRatio', 'cpsTarget', 'subtitleYPct', 'subtitleYIqr', 'subtitleLines', 'emphasisCount', 'consistencyScore'];
+    const fields = ['sampleSize', 'measuredAt', 'schemaVersion', ...numeric, 'endingStyle', 'endingExamples', 'hasBgm', 'firstHooks', 'provenance', 'crossCheckFlags'];
+    if (!f || typeof f !== 'object' || Array.isArray(f) || raw.profile !== undefined || raw.analysis !== undefined || Object.keys(f).length !== fields.length || Object.keys(f).some(k => !fields.includes(k))
+      || f.schemaVersion !== 1 || !Number.isInteger(f.sampleSize) || f.sampleSize < 1 || f.sampleSize > 12 || typeof f.measuredAt !== 'string' || !Number.isFinite(Date.parse(f.measuredAt))
+      || numeric.some(k => f[k] !== null && typeof f[k] !== 'number') || f.endingStyle !== null && typeof f.endingStyle !== 'string' || f.hasBgm !== null && typeof f.hasBgm !== 'boolean'
+      || !Array.isArray(f.crossCheckFlags) || f.crossCheckFlags.length > 24 || !f.provenance || Array.isArray(f.provenance)) fail(true);
+    for (const key of ['endingExamples', 'firstHooks']) if (!Array.isArray(f[key]) || f[key].length > 3 || f[key].some(v => typeof v !== 'string')) fail(true);
+  }
+  return raw;
+} catch { fail(true); } }

package/lib/durable-channel-journal.mjs

@@ -0,0 +1,53 @@
+import { constants, openSync, closeSync, fstatSync, lstatSync, mkdirSync, readFileSync, writeFileSync, fsyncSync, readdirSync } from 'node:fs';
+import path from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+const hash = value => createHash('sha256').update(value).digest('hex');
+const fail = () => { throw Object.assign(new Error('채널 분석 기록을 확인하지 못했습니다. 자동 재제출하지 않습니다.'), { code: 'DURABLE_CHANNEL_JOURNAL_UNAVAILABLE', paidReplayAllowed: false }); };
+// Immutable files with exclusive creation. No truncation, overwrite, stale-lock
+// removal, expiry, TTL or ambiguous-write replay; never stores a PAT or media.
+export function createChannelFileJournal({ stateDir, authorityFingerprint }) {
+  if (typeof stateDir !== 'string' || !path.isAbsolute(stateDir) || !/^[a-f0-9]{64}$/u.test(authorityFingerprint || '')) fail();
+  const handles = new WeakMap(), root = path.join(stateDir, 'channel-analysis-v1');
+  function directory(dir, create = false, privateOnly = true) {
+    if (create) { try { mkdirSync(dir, { mode: 0o700 }); } catch (e) { if (e.code !== 'EEXIST') fail(); } }
+    const st = lstatSync(dir); if (!st.isDirectory() || st.isSymbolicLink() || st.uid !== process.getuid() || st.mode & (privateOnly ? 0o077 : 0o022)) fail();
+  }
+  // Older clients created the shared state directory with 0755. It contains
+  // no journal data directly and must be owner-only writable. The dedicated
+  // journal and every record remain strictly 0700, never symlink-followed.
+  try { directory(stateDir, true, false); directory(root, true); } catch { fail(); }
+  function read(file, max = 32768) { let fd; try { fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW); const st = fstatSync(fd);
+    if (!st.isFile() || st.nlink !== 1 || st.uid !== process.getuid() || st.mode & 0o077 || st.size > max || st.size < 2) fail();
+    return JSON.parse(readFileSync(fd, 'utf8')); } catch (e) { if (e.code === 'ENOENT') return null; fail(); } finally { if (fd !== undefined) closeSync(fd); } }
+  function exclusive(file, value, max = 32768) { const bytes = JSON.stringify(value); if (Buffer.byteLength(bytes) > max) fail(); let fd;
+    try { fd = openSync(file, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 0o600); writeFileSync(fd, bytes); fsyncSync(fd); }
+    catch (e) { if (e.code !== 'EEXIST') fail(); } finally { if (fd !== undefined) closeSync(fd); }
+    const parent = openSync(path.dirname(file), constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW); try { fsyncSync(parent); } finally { closeSync(parent); }
+    if (JSON.stringify(read(file, max)) !== bytes) fail();
+  }
+  function location(identity) { if (!identity || Object.keys(identity).sort().join(',') !== 'apiOrigin,inputDigest,ownerUserId,projectId' || !/^[a-f0-9]{64}$/u.test(identity.inputDigest) || typeof identity.projectId !== 'string') fail();
+    return path.join(root, hash(JSON.stringify([identity.apiOrigin, identity.projectId]))); }
+  function loaded(identity) { const dir = location(identity); let entry; try { directory(dir); entry = read(path.join(dir, 'intent.json')); } catch (e) { if (e.code === 'ENOENT') return null; throw e; }
+    if (!entry || entry.authorityFingerprint !== authorityFingerprint || entry.record?.version !== 1 || ['ownerUserId', 'apiOrigin', 'projectId'].some(k => entry.record[k] !== identity[k])) fail();
+    const accepted = read(path.join(dir, 'accepted.json')), terminal = read(path.join(dir, 'terminal.json'));
+    if (accepted && (!/^epoch-v2-[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u.test(accepted.jobId) || accepted.authorityFingerprint !== authorityFingerprint)) fail();
+    if (terminal && (!['completed', 'failed', 'unknown'].includes(terminal.state) || !accepted || terminal.jobId !== accepted.jobId)) fail();
+    return { dir, record: { ...entry.record, jobId: accepted?.jobId || '', state: terminal?.state || (accepted ? 'submitted' : 'unknown') } };
+  }
+  function envelope(value, check, canSubmit = false) { check(); const handle = Object.freeze({}); handles.set(handle, { ...value, check }); return { handle, record: value.record, canSubmit }; }
+  const state = handle => { const s = handles.get(handle); if (!s) fail(); s.check(); directory(root); directory(s.dir); return s; };
+  return Object.freeze({
+    async lookup(identity, { assertCurrent }) { assertCurrent(); directory(root); const value = loaded(identity); return value ? envelope(value, assertCurrent) : null; },
+    async claim(identity, { assertCurrent }) { assertCurrent(); directory(root); const existing = loaded(identity); if (existing) return envelope(existing, assertCurrent);
+      // A full journal is recoverable, never silently pruned to make room.
+      if (readdirSync(root).length >= 32) fail(); const dir = location(identity);
+      try { mkdirSync(dir, { mode: 0o700 }); } catch (e) { if (e.code !== 'EEXIST') fail(); const raced = loaded(identity); if (!raced) fail(); return envelope(raced, assertCurrent); }
+      if (readdirSync(root).length > 32) fail();
+      const record = { version: 1, ...identity, localSubmissionId: randomUUID(), createdAt: Date.now(), state: 'submitted', jobId: '' };
+      assertCurrent(); exclusive(path.join(dir, 'intent.json'), { authorityFingerprint, record }); assertCurrent(); return envelope({ dir, record }, assertCurrent, true);
+    },
+    async rememberJob(handle, jobId) { const s = state(handle); if (!/^epoch-v2-[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u.test(jobId || '')) fail(); exclusive(path.join(s.dir, 'accepted.json'), { authorityFingerprint, jobId }); s.record = { ...s.record, jobId }; s.check(); },
+    async markResult(handle, { state: status }) { const s = state(handle); if (!s.record.jobId || !['unknown', 'completed', 'failed'].includes(status)) fail(); exclusive(path.join(s.dir, 'terminal.json'), { jobId: s.record.jobId, state: status }); s.check(); },
+    async persistResult(identity, result, check) { check(); const value = loaded(identity); if (!value || value.record.jobId !== result.backgroundJobId) fail(); exclusive(path.join(value.dir, 'result.json'), result, 1200000); check(); return true; },
+  });
+}

package/lib/durable-channel-request.mjs

@@ -0,0 +1,375 @@
+import { captureDurableChannelInput, captureDurableChannelOutput, DURABLE_CHANNEL_CONTRACT_VERSION,
+  DURABLE_CHANNEL_MODEL, DURABLE_CHANNEL_LIMITS, DURABLE_CHANNEL_TYPES, DURABLE_CHANNEL_OUTPUT_FIELDS, DURABLE_CHANNEL_PATHS } from './durable-channel-contract.mjs';
+
+export const durableChannelPath = operation => DURABLE_CHANNEL_PATHS[operation];
+export const durableChannelCapabilityPath = operation => `${durableChannelPath(operation)}/execution-capability`;
+export const DURABLE_CHANNEL_REQUEST_LIMITS = Object.freeze({ maxResponseBytes: DURABLE_CHANNEL_LIMITS.maxOutputBytes + 65536, maxReadChunks: 65536 });
+const JOB = /^epoch-v2-[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u;
+const COST = /^bg-durable-channel-v1:[a-f0-9]{64}:(?:[1-9]|1[0-9]|2[0-4])$/u;
+const encoder = new TextEncoder(), failures = new WeakMap();
+const messages = Object.freeze({
+  INVALID: '채널 분석 요청을 안전하게 확인하지 못했습니다.',
+  AUTHORITY_CHANGED: '계정·프로젝트·입력이 변경되어 이전 채널 분석 작업을 중단했습니다.',
+  SESSION_REQUIRED: '로그인 후 채널 분석를 생성해 주세요.',
+  UNAVAILABLE: '현재 서버에서는 안전한 채널 분석 생성을 사용할 수 없습니다.',
+  RESPONSE_INVALID: '채널 분석 응답을 안전하게 확인하지 못했습니다. 자동 재생성하지 않습니다.',
+  JOURNAL_UNAVAILABLE: '제출 기록을 확인하지 못했습니다. 자동 재생성하지 않습니다.',
+  JOURNAL_FULL: '안전한 제출 기록 한도(계정당 32건)에 도달했습니다. 기존 작업 조회는 가능하지만 새 생성은 차단됩니다. 기록을 삭제하지 말고 고객지원에 문의해 주세요.',
+  UNRESOLVED: '이전 제출 결과가 확정되지 않았습니다. 자동 재생성하지 않습니다.',
+  MISSING: '이전 작업을 찾을 수 없습니다. 새 생성 요청을 보내지 않았습니다.',
+  WAIT_ABORTED: '기다리기를 중단했습니다. 생성 취소가 확인된 것은 아닙니다.',
+  WAIT_TIMEOUT: '대기 시간이 초과되었습니다. 기존 작업만 다시 조회할 수 있습니다.',
+  DIFFERENT_EDITOR: '이 프로젝트에 다른 제작 화면의 미확정 작업이 있습니다. 원래 화면에서 먼저 기존 작업을 조회해 주세요.',
+  APPLY_UNCONFIRMED: '작업 결과는 완료됐지만 프로젝트 저장을 확인하지 못했습니다. 다음에 기존 작업만 다시 조회합니다.',
+  ACTIVE: '채널 분석 작업이 이미 진행 중입니다.',
+});
+function failure(kind) {
+  const error = Object.assign(new Error(messages[kind] || messages.INVALID), {
+    code: `DURABLE_CHANNEL_${kind}`, paidReplayAllowed: false,
+  }); failures.set(error, kind); return error;
+}
+const fail = kind => { throw failure(kind); };
+const own = (value, key) => value && typeof value === 'object' ? Object.getOwnPropertyDescriptor(value, key)?.value : undefined;
+// Legacy transport already projects usage; copy only its bounded public fields.
+// Never copy an error message, request, headers, arbitrary object or credential.
+function legacyUsage(value, depth = 0) {
+  if (!value || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) return undefined;
+  const output = {};
+  for (const key of ['aiCalls', 'costUsd', 'inputTokens', 'outputTokens', 'totalTokens', 'credits', 'creditsConsumed']) {
+    const number = own(value, key);
+    if (typeof number === 'number' && Number.isFinite(number) && number >= 0 && number <= Number.MAX_SAFE_INTEGER) output[key] = number;
+  }
+  for (const key of ['model', 'provider', 'stage']) {
+    const item = own(value, key); if (text(item, 160)) output[key] = item;
+  }
+  const stages = own(value, 'stages');
+  if (depth === 0 && Array.isArray(stages) && stages.length > 0 && stages.length <= 24) {
+    output.stages = Array.from({ length: stages.length }, (_, i) => legacyUsage(own(stages, String(i)), 1)).filter(Boolean);
+    if (!output.stages.length) delete output.stages;
+  }
+  return Object.keys(output).length ? Object.freeze(output) : undefined;
+}
+function object(value) {
+  if (!value || typeof value !== 'object' || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) fail('RESPONSE_INVALID');
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  if (Reflect.ownKeys(descriptors).some(key => typeof key !== 'string' || !('value' in descriptors[key]) || !descriptors[key].enumerable)) fail('RESPONSE_INVALID');
+  return Object.fromEntries(Object.entries(descriptors).map(([key, item]) => [key, item.value]));
+}
+function text(value, maximum = 255) {
+  return typeof value === 'string' && value.length > 0 && value.length <= maximum && value.trim() === value
+    && value.isWellFormed() && !/[\u0000-\u001f\u007f]/u.test(value);
+}
+function origin(value) {
+  if (!text(value, 2048)) fail('INVALID');
+  let url; try { url = new URL(value); } catch { fail('INVALID'); }
+  if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash || url.pathname !== '/'
+    || ![url.origin, `${url.origin}/`].includes(value)) fail('INVALID');
+  return url.origin;
+}
+function authority(getAuthority) {
+  const value = getAuthority(), ownerUserId = own(value, 'ownerUserId'), sessionRevision = own(value, 'sessionRevision');
+  if (!text(ownerUserId) || ownerUserId.startsWith('deleted:')
+    || !(text(sessionRevision, 512) || Number.isSafeInteger(sessionRevision) && sessionRevision >= 0)) fail('SESSION_REQUIRED');
+  return Object.freeze({ ownerUserId, sessionRevision });
+}
+function synchronous(callback) {
+  const result = callback();
+  if (result && typeof result.then === 'function') { Promise.resolve(result).catch(() => {}); fail('AUTHORITY_CHANGED'); }
+  if (result === false) fail('AUTHORITY_CHANGED');
+}
+function exactConstants(value, expected) {
+  const captured = object(value), keys = Object.keys(expected);
+  if (Object.keys(captured).length !== keys.length || keys.some(key => captured[key] !== expected[key])) fail('RESPONSE_INVALID');
+}
+export function validateDurableChannelCapability(value, operation) {
+  const captured = object(value);
+  if (captured.version !== 1 || captured.contractVersion !== DURABLE_CHANNEL_CONTRACT_VERSION || captured.operation !== operation
+    || !['legacy-sync', 'queue-v2', 'unavailable'].includes(captured.mode)) fail('RESPONSE_INVALID');
+  exactConstants(captured.model, DURABLE_CHANNEL_MODEL); exactConstants(captured.limits, DURABLE_CHANNEL_LIMITS);
+  const allowed = ['version', 'contractVersion', 'operation', 'mode', 'model', 'limits', ...(captured.mode === 'queue-v2'
+    ? ['paidReplayAllowed', 'recovery'] : captured.mode === 'unavailable' ? ['reason'] : [])];
+  if (Object.keys(captured).some(key => !allowed.includes(key)) || captured.mode === 'queue-v2'
+    && (captured.paidReplayAllowed !== false || captured.recovery !== 'read-only-known-job')
+    || captured.reason !== undefined && !text(captured.reason, 128)) fail('RESPONSE_INVALID');
+  return captured.mode;
+}
+function captureUsage(value, provider, model, { total = false } = {}) {
+  const item = object(value);
+  if (item.aiCalls !== 1 || !Number.isSafeInteger(item.inputTokens) || item.inputTokens < 0
+    || !Number.isSafeInteger(item.outputTokens) || item.outputTokens < 0
+    || !Number.isSafeInteger(item.inputTokens + item.outputTokens)
+    || typeof item.costUsd !== 'number' || !Number.isFinite(item.costUsd) || item.costUsd < 0
+    || item.model !== undefined && item.model !== model
+    || item.provider !== undefined && item.provider !== provider
+    || (total || item.totalTokens !== undefined) && item.totalTokens !== item.inputTokens + item.outputTokens) fail('RESPONSE_INVALID');
+  return Object.freeze({ aiCalls: 1, inputTokens: item.inputTokens, outputTokens: item.outputTokens, costUsd: item.costUsd,
+    ...(item.totalTokens === undefined ? {} : { totalTokens: item.totalTokens }),
+    ...(item.model === undefined ? {} : { model: item.model }), ...(item.provider === undefined ? {} : { provider: item.provider }) });
+}
+export function validateCompletedDurableChannelJob(value, id) {
+  const job = object(value);
+  if (!JOB.test(id) || job.id !== id || !Object.values(DURABLE_CHANNEL_TYPES).includes(job.type) || job.status !== 'completed') fail('RESPONSE_INVALID');
+  const result = object(job.result), model = DURABLE_CHANNEL_MODEL[result.operation];
+  if (DURABLE_CHANNEL_TYPES[result.operation] !== job.type || result.kind !== 'durable-channel-v2'
+    || result.model !== model
+    || result.accountingState !== 'settled' || result.hasAccountCostEvents !== true
+    || !Array.isArray(result.accountCostEvents) || result.accountCostEvents.length > DURABLE_CHANNEL_LIMITS.maxStages) fail('RESPONSE_INVALID');
+  const count = result.accountCostEvents.length;
+  if (result.operation === 'channel-style' && (count < 1 || count > 2)
+    || count > 0 && result.provider !== 'evolink'
+    || (count ? result.provider !== 'evolink' : result.provider !== 'none')) fail('RESPONSE_INVALID');
+  let output; try { output = captureDurableChannelOutput(Object.fromEntries(DURABLE_CHANNEL_OUTPUT_FIELDS
+    .filter(key => result[key] !== undefined).map(key => [key, result[key]]))); } catch { fail('RESPONSE_INVALID'); }
+  const ids = new Set();
+  const receipts = result.accountCostEvents.map(raw => {
+    const event = object(raw), provider = event.provider;
+    const committed = event.accountCostRecorded === true && event.accountCostSuppressedByReset !== true;
+    const suppressed = event.accountCostRecorded === false && event.accountCostSuppressedByReset === true;
+    if (!COST.test(event.accountCostEventId || '') || ids.has(event.accountCostEventId) || !(committed || suppressed)
+      || event.accountCostSuppressedByReset !== undefined && typeof event.accountCostSuppressedByReset !== 'boolean'
+      || event.model !== model || provider !== result.provider || !Number.isSafeInteger(event.createdAt)
+      || event.createdAt <= 0 || event.createdAt > 253402300799999 || typeof event.costUsd !== 'number'
+      || !Number.isFinite(event.costUsd) || event.costUsd < 0) fail('RESPONSE_INVALID');
+    ids.add(event.accountCostEventId);
+    const usage = captureUsage(event.usage, provider, model);
+    if (usage.costUsd !== event.costUsd) fail('RESPONSE_INVALID');
+    return Object.freeze({ accountCostEventId: event.accountCostEventId, createdAt: event.createdAt,
+      provider, model, costUsd: event.costUsd, accountCostRecorded: committed,
+      ...(suppressed ? { accountCostSuppressedByReset: true } : {}), usage });
+  });
+  const total = object(result.usage), sum = key => receipts.reduce((n, item) => n + item.usage[key], 0);
+  if (total.aiCalls !== receipts.length || total.inputTokens !== sum('inputTokens') || total.outputTokens !== sum('outputTokens')
+    || total.totalTokens !== total.inputTokens + total.outputTokens || !Number.isSafeInteger(total.totalTokens)
+    || typeof total.costUsd !== 'number' || !Number.isFinite(total.costUsd) || total.costUsd < 0
+    || Math.abs(total.costUsd - sum('costUsd')) > 0.000001) fail('RESPONSE_INVALID');
+  const usage = Object.freeze({ aiCalls: total.aiCalls, inputTokens: total.inputTokens, outputTokens: total.outputTokens,
+    totalTokens: total.totalTokens, costUsd: total.costUsd });
+  return Object.freeze({ ...output, ok: true, kind: 'durable-channel-v2', model, provider: result.provider, usage, hasAccountCostEvents: true,
+    accountingState: 'settled', accountCostEvents: Object.freeze(receipts), backgroundJobId: id });
+}
+
+// Strict stream EOF, fatal UTF-8 and declared-byte checks. Abort starts reader
+// cancellation immediately, but does not detach an admitted read/cancel promise.
+async function readJson(response, { check, signal, url }) {
+  let reader, cancellation, complete = false;
+  const cancel = () => {
+    if (cancellation || complete) return;
+    try { cancellation = Promise.resolve(reader ? reader.cancel() : response?.body?.cancel()).catch(() => {}); }
+    catch { cancellation = Promise.resolve(); }
+  };
+  const abort = () => cancel();
+  try {
+    check();
+    if (!response || response.redirected || response.type === 'opaqueredirect' || response.type === 'opaque'
+      || response.url && response.url !== url
+      || !Number.isInteger(response.status) || typeof response.body?.getReader !== 'function') fail('RESPONSE_INVALID');
+    const mime = (response.headers.get('content-type') || '').split(';', 1)[0].trim().toLowerCase();
+    if (mime !== 'application/json') fail('RESPONSE_INVALID');
+    const length = response.headers.get('content-length'), encoding = response.headers.get('content-encoding');
+    if (length !== null && (!/^(0|[1-9][0-9]*)$/u.test(length) || !Number.isSafeInteger(Number(length))
+      || Number(length) > DURABLE_CHANNEL_REQUEST_LIMITS.maxResponseBytes)) fail('RESPONSE_INVALID');
+    reader = response.body.getReader(); signal.addEventListener('abort', abort, { once: true });
+    if (signal.aborted) { cancel(); check(); }
+    const decoder = new TextDecoder('utf-8', { fatal: true }), blocks = []; let bytes = 0, chunks = 0;
+    for (;;) {
+      check(); const part = await reader.read(); check();
+      if (part.done) break;
+      if (!(part.value instanceof Uint8Array) || ++chunks > DURABLE_CHANNEL_REQUEST_LIMITS.maxReadChunks
+        || (bytes += part.value.byteLength) > DURABLE_CHANNEL_REQUEST_LIMITS.maxResponseBytes) fail('RESPONSE_INVALID');
+      blocks.push(decoder.decode(part.value, { stream: true }));
+    }
+    if (!bytes || length !== null && (!encoding || encoding === 'identity') && Number(length) !== bytes) fail('RESPONSE_INVALID');
+    blocks.push(decoder.decode()); const value = JSON.parse(blocks.join('')); check(); complete = true;
+    return { status: response.status, body: value };
+  } catch (error) { cancel(); throw failures.has(error) ? error : failure('RESPONSE_INVALID'); }
+  finally { signal.removeEventListener('abort', abort); await cancellation; reader?.releaseLock(); }
+}
+
+/** A journal intent is consumed before the one paid POST. Restored intentions
+ * with an ID can only GET it; no ID, a missing job, failure or mode downgrade
+ * never permits another POST or the legacy callback. Browser storage loss is
+ * not server-side idempotency; this API offers no reset/new-intent escape. */
+export function createDurableChannelRequest({ journal, apiOrigin, fetchImpl = globalThis.fetch, getAuthority,
+  getHeaders, ensureSession, crypto = globalThis.crypto, pollMs = 1000, timeoutMs = 240000 } = {}) {
+  const base = origin(apiOrigin), digest = typeof crypto?.subtle?.digest === 'function' ? crypto.subtle.digest.bind(crypto.subtle) : null;
+  if ([fetchImpl, getAuthority, getHeaders, ensureSession, ...['lookup', 'claim', 'rememberJob', 'markResult'].map(key => journal?.[key])]
+    .some(fn => typeof fn !== 'function') || !digest || !Number.isSafeInteger(pollMs) || pollMs < 1 || pollMs > 10000
+    || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 900000) throw failure('INVALID');
+  const storage = Object.fromEntries(['lookup', 'claim', 'rememberJob', 'markResult'].map(key => [key, journal[key].bind(journal)]));
+  let active = false;
+  return Object.freeze({ async readCapability({ operation, assertCurrent, signal, assertQueueReady } = {}) {
+    if (!Object.hasOwn(DURABLE_CHANNEL_TYPES, operation) || typeof assertCurrent !== 'function'
+      || signal !== undefined && !(signal instanceof AbortSignal)) fail('INVALID');
+    const captured = authority(getAuthority), controller = new AbortController();
+    const abort = () => controller.abort(failure('WAIT_ABORTED'));
+    const timer = setTimeout(() => controller.abort(failure('WAIT_TIMEOUT')), Math.min(timeoutMs, 15000));
+    signal?.addEventListener('abort', abort, { once: true }); if (signal?.aborted) abort();
+    const check = () => { const current = authority(getAuthority); synchronous(assertCurrent);
+      if (current.ownerUserId !== captured.ownerUserId || current.sessionRevision !== captured.sessionRevision) fail('AUTHORITY_CHANGED');
+      if (controller.signal.aborted) throw controller.signal.reason;
+    };
+    try {
+      check(); if (await ensureSession() === false) fail('SESSION_REQUIRED'); check();
+      const headers = new Headers(await getHeaders()); headers.set('Accept', 'application/json'); check();
+      const url = `${base}${durableChannelCapabilityPath(operation)}`;
+      const response = await fetchImpl(url, { method: 'GET', headers, credentials: 'include', redirect: 'error', cache: 'no-store', signal: controller.signal });
+      const reply = await readJson(response, { check, signal: controller.signal, url }); check();
+      if (reply.status !== 200) fail('UNAVAILABLE');
+      const mode = validateDurableChannelCapability(reply.body, operation);
+      if (mode === 'unavailable') fail('UNAVAILABLE');
+      if (mode === 'queue-v2') {
+        if (typeof assertQueueReady !== 'function' || await assertQueueReady() !== true) fail('INVALID'); check();
+      }
+      return mode;
+    } catch (caught) { throw failures.has(caught) ? caught : failure('RESPONSE_INVALID'); }
+    finally { clearTimeout(timer); signal?.removeEventListener('abort', abort); }
+  }, async run(rawBody, { projectId, assertCurrent, signal, onState = () => {}, onAccountCost = () => {}, legacy,
+    recoveryOnly = false, operation, targetId, applyResult, assertQueueReady } = {}) {
+    if (active) throw failure('ACTIVE');
+    if (!Object.hasOwn(DURABLE_CHANNEL_TYPES, operation) || !text(targetId, 240) || !text(projectId, 160) || [assertCurrent, onState, onAccountCost].some(fn => typeof fn !== 'function')
+      || signal !== undefined && !(signal instanceof AbortSignal) || typeof recoveryOnly !== 'boolean') throw failure('INVALID');
+    let body;
+    // Legacy accepts its original inputs, which may exceed the new queue's
+    // bounded contract. Defer only this v2 validation error until transport
+    // selection; even invalid edited inputs must first recover pending work.
+    if (!recoveryOnly) { try { body = captureDurableChannelInput(rawBody).body; if (body.operation !== operation || body.targetId !== targetId || body.projectId !== projectId) body = undefined; } catch { body = undefined; } }
+    const captured = authority(getAuthority); active = true;
+    const controller = new AbortController(), deadline = performance.now() + timeoutMs;
+    const abort = () => controller.abort(failure('WAIT_ABORTED'));
+    const timer = setTimeout(() => controller.abort(failure('WAIT_TIMEOUT')), timeoutMs);
+    signal?.addEventListener('abort', abort, { once: true }); if (signal?.aborted) abort();
+    let jobId = null, status = 'checking', handle, claimStarted = false, legacyStarted = false, recovering = false;
+    const check = () => {
+      let current; try { current = authority(getAuthority); synchronous(assertCurrent); } catch { fail('AUTHORITY_CHANGED'); }
+      if (current.ownerUserId !== captured.ownerUserId || current.sessionRevision !== captured.sessionRevision) fail('AUTHORITY_CHANGED');
+      if (!controller.signal.aborted && performance.now() >= deadline) controller.abort(failure('WAIT_TIMEOUT'));
+      if (controller.signal.aborted) throw controller.signal.reason;
+    };
+    const checked = async operation => { check(); const value = await operation(); check(); return value; };
+    const publish = next => { check(); status = next; try { Promise.resolve(onState(Object.freeze({ version: 1, status,
+      jobId, recovering, paidReplayAllowed: false }))).catch(() => {}); } catch { /* UI cannot authorize a replay. */ } };
+    const persist = async operation => { try { return await checked(operation); } catch (error) {
+      check(); throw failures.has(error) ? error : failure(own(error, 'code') === 'UPLOAD_METADATA_JOURNAL_FULL' ? 'JOURNAL_FULL' : 'JOURNAL_UNAVAILABLE');
+    } };
+    async function request(path, method = 'GET') {
+      if (recoveryOnly && method !== 'GET') fail('INVALID');
+      const rawHeaders = await checked(() => getHeaders()), headers = new Headers(rawHeaders);
+      headers.set('Accept', 'application/json'); if (method === 'POST') headers.set('Content-Type', 'application/json');
+      let response;
+      try {
+        check(); response = await fetchImpl(`${base}${path}`, { method, headers, credentials: 'include', redirect: 'error',
+          cache: 'no-store', signal: controller.signal, ...(method === 'POST' ? { body: JSON.stringify(body) } : {}) });
+        return await readJson(response, { check, signal: controller.signal, url: `${base}${path}` });
+      } catch (error) { check(); throw failures.has(error) ? error : failure('RESPONSE_INVALID'); }
+    }
+    const envelope = (value, identity) => {
+      const item = object(value), record = object(item.record);
+      if (typeof item.canSubmit !== 'boolean' || !item.handle || typeof item.handle !== 'object'
+        || record.version !== 1 || ['ownerUserId', 'apiOrigin', 'projectId'].some(key => record[key] !== identity[key])
+        || typeof record.inputDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(record.inputDigest)
+        || item.canSubmit && record.inputDigest !== identity.inputDigest
+        || typeof record.jobId !== 'string' || record.jobId && !JOB.test(record.jobId)
+        || !['submitted', 'unknown', 'completed', 'failed'].includes(record.state)
+        || item.canSubmit && (record.jobId || record.state !== 'submitted')) fail('JOURNAL_UNAVAILABLE');
+      return { handle: item.handle, canSubmit: item.canSubmit, jobId: record.jobId || null };
+    };
+    const pause = () => checked(() => new Promise(resolve => {
+      let waiting;
+      const done = () => { clearTimeout(waiting); controller.signal.removeEventListener('abort', done); resolve(); };
+      waiting = setTimeout(done, pollMs); controller.signal.addEventListener('abort', done, { once: true });
+      if (controller.signal.aborted) done();
+    }));
+    try {
+      check(); publish('checking');
+      // A read-only pending-project probe has no input/body to persist. Its
+      // sentinel digest is never claimed, posted or used for legacy fallback.
+      const bytes = recoveryOnly || !body ? new Uint8Array(32)
+        : new Uint8Array(await checked(() => digest('SHA-256', encoder.encode(JSON.stringify(body)))));
+      if (bytes.byteLength !== 32) fail('INVALID');
+      const scopeBytes = new Uint8Array(await checked(() => digest('SHA-256', encoder.encode(JSON.stringify([operation, projectId, targetId])))));
+      if (scopeBytes.byteLength !== 32) fail('INVALID');
+      const identity = Object.freeze({ ownerUserId: captured.ownerUserId, apiOrigin: base, projectId: `durable-channel:v1:${Array.from(scopeBytes, byte => byte.toString(16).padStart(2, '0')).join('')}`,
+        inputDigest: Array.from(bytes, byte => byte.toString(16).padStart(2, '0')).join('') });
+      let found = await persist(() => storage.lookup(identity, { assertCurrent: check }));
+      if (!found && recoveryOnly) return null;
+      if (await checked(() => ensureSession()) === false) fail('SESSION_REQUIRED');
+      if (!found) {
+        const capability = await request(durableChannelCapabilityPath(operation));
+        if (capability.status !== 200) fail('UNAVAILABLE');
+        const mode = validateDurableChannelCapability(capability.body, operation);
+        // Re-observe after the capability await, including a deployment change.
+        found = await persist(() => storage.lookup(identity, { assertCurrent: check }));
+        if (!found && mode === 'legacy-sync') {
+          if (typeof legacy !== 'function') fail('UNAVAILABLE');
+          // This preserves the legacy callback; the journal does not provide
+          // atomic legacy/v2 exclusion during a mixed deployment mode switch.
+          publish('legacy-sync'); check(); legacyStarted = true;
+          return await checked(() => legacy(body || rawBody, { signal: controller.signal }));
+        }
+        if (!found && mode !== 'queue-v2') fail('UNAVAILABLE');
+        if (!found && !body) fail('INVALID');
+        if (!found) { if (typeof assertQueueReady !== 'function' || await checked(assertQueueReady) !== true) fail('INVALID'); claimStarted = true; found = await persist(() => storage.claim(identity, { assertCurrent: check })); }
+      }
+      const selected = envelope(found, identity); handle = selected.handle; jobId = selected.jobId;
+      recovering = !selected.canSubmit;
+      if (selected.canSubmit && !claimStarted) fail('JOURNAL_UNAVAILABLE');
+      if (selected.canSubmit) {
+        publish('submitting');
+        const reply = await request(`${durableChannelPath(operation)}/jobs`, 'POST'), value = object(reply.body);
+        const accepted = reply.status === 202 && value.ok === true && value.async === true;
+        const uncertain = reply.status === 503 && value.code === 'BACKGROUND_ENQUEUE_UNCONFIRMED';
+        const returnedId = accepted ? own(value.job, 'id') : uncertain ? value.jobId : undefined;
+        if (typeof returnedId !== 'string' || !JOB.test(returnedId)) fail('UNRESOLVED');
+        jobId = returnedId;
+        await persist(() => storage.rememberJob(handle, jobId));
+      }
+      if (!jobId) { publish('unknown'); fail('UNRESOLVED'); }
+      for (;;) {
+        publish('checking');
+        const reply = await request(`/api/tracker/channel-analysis/jobs/${jobId}`);
+        if (reply.status === 404) { publish('missing'); fail('MISSING'); }
+        const value = object(reply.body), job = object(value.job);
+        if (reply.status !== 200 || value.ok !== true || job.id !== jobId || !Object.values(DURABLE_CHANNEL_TYPES).includes(job.type)
+          || !['queued', 'running', 'completed', 'failed', 'cancelled', 'unknown'].includes(job.status)) fail('RESPONSE_INVALID');
+        if (job.type !== DURABLE_CHANNEL_TYPES[operation]) fail('DIFFERENT_EDITOR');
+        if (job.status === 'completed') {
+          const result = validateCompletedDurableChannelJob(job, jobId);
+          if (result.targetId !== targetId || result.projectId !== projectId || result.operation !== operation) fail('DIFFERENT_EDITOR');
+          // A provider-completed job is not a durably applied browser result.
+          // Keep its known ID pending through UI/storage failures or page exits.
+          if (typeof applyResult !== 'function') fail('APPLY_UNCONFIRMED');
+          try { if (await checked(() => applyResult(Object.freeze({ ...result, recoveredPreviousRequest: recovering }))) !== true) fail('APPLY_UNCONFIRMED'); }
+          catch (error) { check(); if (failures.has(error)) throw error; fail('APPLY_UNCONFIRMED'); }
+          try { if (await checked(() => onAccountCost(result)) !== true) fail('APPLY_UNCONFIRMED'); }
+          catch (error) { check(); if (failures.has(error)) throw error; fail('APPLY_UNCONFIRMED'); }
+          await persist(() => storage.markResult(handle, { state: 'completed' })); publish('completed');
+          check(); return Object.freeze({ ...result, recoveredPreviousRequest: recovering });
+        }
+        publish(job.status);
+        if (!['queued', 'running'].includes(job.status)) {
+          await persist(() => storage.markResult(handle, { state: job.status === 'unknown' ? 'unknown' : 'failed' }));
+          fail('UNRESOLVED');
+        }
+        await pause();
+      }
+    } catch (caught) {
+      controller.abort(caught);
+      // Do not persist after a stopped authority. A submitted record without an
+      // ID already restores UNKNOWN, even if the POST never left this browser.
+      let changed = false; try { const fresh = authority(getAuthority); synchronous(assertCurrent);
+        changed = fresh.ownerUserId !== captured.ownerUserId || fresh.sessionRevision !== captured.sessionRevision; } catch { changed = true; }
+      const error = failure(changed ? 'AUTHORITY_CHANGED' : failures.get(caught) || 'RESPONSE_INVALID');
+      if (legacyStarted && !changed) {
+        const usage = legacyUsage(own(caught, 'providerUsage'));
+        if (usage) {
+          error.providerUsage = usage;
+          const model = own(caught, 'providerModel'); if (text(model, 160)) error.providerModel = model;
+          error.partialProviderUsage = own(caught, 'partialProviderUsage') === true;
+        }
+      }
+      if (jobId) error.backgroundJobId = jobId;
+      error.submissionState = jobId ? status : handle || claimStarted || legacyStarted ? 'unknown' : 'not-submitted';
+      throw error;
+    } finally { clearTimeout(timer); signal?.removeEventListener('abort', abort); active = false; }
+  } });
+}

package/lib/durable-speech.mjs

@@ -1,11 +1,13 @@
 import { z } from "zod";
 import { DEFAULT_API_BASE } from "./config.mjs";
 import { GENERATION_JOB_PATH } from "./generation-jobs.mjs";
+import { captureTtsAlignment, buildSpeechSubtitleLines } from "./tts-alignment.mjs";
+import { captureSpeechProductionProfile } from "./speech-production-profile.mjs";
 
 const ID = /^[a-zA-Z0-9_-]{16,80}$/u, PROVIDERS = ["elevenlabs", "typecast", "supertone"];
 const MODELS = Object.freeze({ elevenlabs: "elevenlabs-multilingual-v2", typecast: "typecast-narration", supertone: "supertone-narration" });
-const common = ["voice", "voiceId", "modelId", "fileName", "speed"];
-const perProvider = Object.freeze({ elevenlabs: ["languageCode", "similarityBoost", "speakerBoost", "stability", "style"],
+const common = ["voice", "voiceId", "modelId", "fileName", "speed", "productionProfile"];
+const perProvider = Object.freeze({ elevenlabs: ["languageCode", "similarityBoost", "speakerBoost", "stability", "style", "includeAlignment"],
   typecast: ["language", "emotion", "pitch", "smartEmotion", "volume"], supertone: ["language", "lang", "style"] });
 const invalid = () => new Error("Invalid durable speech request or result.");
 const short = max => z.string().max(max);
@@ -14,6 +16,8 @@ const optionsSchema = z.object({ voice: short(320).optional(), voiceId: short(16
   speed: z.number().min(0.5).max(2).optional(), similarityBoost: z.number().min(0).max(1).optional(), stability: z.number().min(0).max(1).optional(),
   style: z.union([z.number().min(0).max(1), short(160)]).optional(), speakerBoost: z.boolean().optional(), smartEmotion: z.boolean().optional(),
   pitch: z.number().int().min(-12).max(12).optional(), volume: z.number().int().min(0).max(200).optional(),
+  includeAlignment: z.boolean().optional().describe("ElevenLabs 전용 실제 발화 자막. 동일 합성 1회에서 오디오와 문자 타이밍을 함께 저장합니다."),
+  productionProfile: z.unknown().transform(captureSpeechProductionProfile).optional().describe("제작 핸들의 원래 productionProfile. 말투·길이·자막 디자인 의도를 유지합니다."),
 }).strict();
 export const durableSpeechToolSchema = Object.freeze({
   requestId: z.string().regex(ID).describe("새 작업의 고유 ID. 응답이 끊겨도 이 ID를 유지하고 먼저 상태를 조회하세요."),
@@ -88,7 +92,17 @@ export function durableSpeechResult(job, { apiBase = DEFAULT_API_BASE } = {}) {
     || !(cost.accountCostRecorded === true && cost.accountCostSuppressedByReset !== true || cost.accountCostRecorded === false && cost.accountCostSuppressedByReset === true)) throw invalid();
   const receipt = { accountCostEventId: cost.accountCostEventId, model: cost.model, provider: cost.provider, createdAt: cost.createdAt,
     costUsd: cost.costUsd, accountCostRecorded: cost.accountCostRecorded, ...(cost.accountCostSuppressedByReset === true ? { accountCostSuppressedByReset: true } : {}) };
+  let captions = {};
+  if (["includeAlignment", "alignment", "normalizedAlignment", "alignedLines"].some(key => Object.hasOwn(payload, key))) {
+    if (payload.provider !== "elevenlabs" || payload.includeAlignment !== true) throw invalid();
+    const pair = captureTtsAlignment({ alignment: payload.alignment, normalizedAlignment: payload.normalizedAlignment });
+    const lines = buildSpeechSubtitleLines(pair);
+    if (!lines.length || !Array.isArray(payload.alignedLines) || JSON.stringify(lines) !== JSON.stringify(payload.alignedLines)) throw invalid();
+    captions = { includeAlignment: true, ...pair, alignedLines: lines, subtitleLines: lines, lineCount: lines.length,
+      durationSec: pair.alignment.character_end_times_seconds.at(-1), timingSource: "provider-character-alignment" };
+  }
   return { generationJobId: job.id, status: "completed", kind: "tts", provider: payload.provider, filename: payload.filename, contentType: payload.contentType,
     serverUrl: base.origin, assetPath: `${url.pathname}${url.search}`, assetUrl: url.href, ...receipt, hasAccountCostEvents: true, accountCostEvents: [receipt],
+    ...captions,
     guidance: "오디오가 서버의 계정 소유 자산으로 저장되었습니다. 이 링크를 사용하세요. 이 도구는 오디오를 다운로드하거나 PAT를 자산 요청에 전달하지 않습니다." };
 }

package/lib/speech-production-profile.mjs

@@ -0,0 +1,21 @@
+// Exact browser capture of the server's durable TTS profile contract. This is
+// creative intent, never receipt/state metadata or an arbitrary nested object.
+export function captureSpeechProductionProfile(value) {
+  const fail = () => { throw Object.assign(new Error("음성 제작 프로필을 확인해 주세요."), { code: "SPEECH_INPUT_INVALID", paidReplayAllowed: false }); };
+  const fields = ["version", "categoryId", "tone", "deliveryStyle", "targetDurationSec", "imageSourceMode", "visualMotionMode", "autoComposeEnabled", "subtitleStylePresetId", "titleStylePresetId"];
+  if (!value || typeof value !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) fail();
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  if (Reflect.ownKeys(descriptors).some(key => !fields.includes(key) || !Object.hasOwn(descriptors[key], "value"))) fail();
+  const copy = Object.fromEntries(Object.entries(descriptors).filter(([, item]) => item.value !== undefined).map(([key, item]) => [key, item.value]));
+  if (copy.version !== 1 || typeof copy.categoryId !== "string" || !/^[a-z][a-z0-9-]{0,63}$/u.test(copy.categoryId)
+    || !["casual-social", "standard", "news-briefing"].includes(copy.deliveryStyle)) fail();
+  const maxSeconds = ["community-shorts", "viral-shorts"].includes(copy.categoryId) ? 180 : 3600;
+  if (typeof copy.targetDurationSec !== "number" || !Number.isFinite(copy.targetDurationSec) || copy.targetDurationSec < 0.01 || copy.targetDurationSec > maxSeconds) fail();
+  if (copy.tone !== undefined && (typeof copy.tone !== "string" || !copy.tone.isWellFormed() || copy.tone.length > 300 || /[\u0000-\u001f\u007f]/u.test(copy.tone))) fail();
+  if (copy.imageSourceMode !== undefined && !["ai", "web", "mixed"].includes(copy.imageSourceMode)) fail();
+  if (copy.visualMotionMode !== undefined && !["image-motion", "i2v"].includes(copy.visualMotionMode)) fail();
+  if (copy.autoComposeEnabled !== undefined && typeof copy.autoComposeEnabled !== "boolean") fail();
+  for (const key of ["subtitleStylePresetId", "titleStylePresetId"]) if (copy[key] !== undefined
+    && (typeof copy[key] !== "string" || !/^[a-z][a-z0-9-]{0,63}$/u.test(copy[key]))) fail();
+  return Object.freeze(copy);
+}

package/lib/tts-alignment.mjs

@@ -0,0 +1,69 @@
+// Shared browser/server data contract. No provider, credentials, I/O or timing
+// repair here: a malformed alignment is not permission to synthesize again.
+// Two three-array alignments plus worst-case derived subtitle lines must fit
+// the durable job's 65,536-node capture bound, including cost/receipt metadata.
+export const TTS_ALIGNMENT_LIMITS = Object.freeze({ maxCharacters: 6000, maxDurationSeconds: 3600, maxJsonBytes: 1048576 });
+const fail = () => { throw Object.assign(new Error("TTS_ALIGNMENT_INVALID"), { code: "TTS_ALIGNMENT_INVALID", statusCode: 502, paidReplayAllowed: false }); };
+function record(value, names, required = names) {
+  if (!value || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) fail();
+  const fields = Object.getOwnPropertyDescriptors(value);
+  if (Reflect.ownKeys(fields).some(key => !names.includes(key) || !("value" in fields[key]))
+    || required.some(key => !Object.hasOwn(fields, key))) fail();
+  return Object.fromEntries(Object.entries(fields).map(([key, item]) => [key, item.value]));
+}
+function array(value) {
+  if (!Array.isArray(value) || !value.length || value.length > TTS_ALIGNMENT_LIMITS.maxCharacters) fail();
+  const fields = Object.getOwnPropertyDescriptors(value), keys = Reflect.ownKeys(fields);
+  if (keys.length !== value.length + 1 || keys.some(key => typeof key !== "string" || !("value" in fields[key])
+    || key !== "length" && !/^(?:0|[1-9][0-9]*)$/u.test(key))) fail();
+  return Array.from({ length: value.length }, (_, index) => {
+    if (!Object.hasOwn(fields, index)) fail(); return fields[index].value;
+  });
+}
+function alignment(value) {
+  const source = record(value, ["characters", "character_start_times_seconds", "character_end_times_seconds"]);
+  const characters = array(source.characters), starts = array(source.character_start_times_seconds), ends = array(source.character_end_times_seconds);
+  if (characters.length !== starts.length || starts.length !== ends.length) fail();
+  for (let index = 0; index < characters.length; index++) {
+    const character = characters[index], start = starts[index], end = ends[index];
+    if (typeof character !== "string" || !character || !character.isWellFormed() || character.length > 16 || Array.from(character).length > 8
+      || /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/u.test(character)
+      || typeof start !== "number" || typeof end !== "number" || !Number.isFinite(start) || !Number.isFinite(end)
+      || start < 0 || end < start || end > TTS_ALIGNMENT_LIMITS.maxDurationSeconds
+      || index > 0 && (start < starts[index - 1] || end < ends[index - 1])) fail();
+  }
+  return Object.freeze({ characters: Object.freeze(characters), character_start_times_seconds: Object.freeze(starts), character_end_times_seconds: Object.freeze(ends) });
+}
+export function captureTtsAlignment(value, { requireAlignment = true } = {}) {
+  if (typeof requireAlignment !== "boolean") fail();
+  const source = record(value, ["alignment", "normalizedAlignment"], []);
+  const primary = source.alignment == null ? null : alignment(source.alignment);
+  if (!primary && requireAlignment) fail();
+  const result = Object.freeze({ alignment: primary, normalizedAlignment: source.normalizedAlignment == null ? null : alignment(source.normalizedAlignment) });
+  if (new TextEncoder().encode(JSON.stringify(result)).byteLength > TTS_ALIGNMENT_LIMITS.maxJsonBytes) fail();
+  return result;
+}
+
+// Preserve the existing ElevenLabs subtitle splitting contract. This function
+// consumes a previously validated primary alignment; it never estimates time.
+export function buildSpeechSubtitleLines({ alignment: source, minChars = 6 } = {}) {
+  const value = alignment(source);
+  if (!Number.isSafeInteger(minChars) || minChars < 1 || minChars > 1000) fail();
+  const chars = value.characters, starts = value.character_start_times_seconds, ends = value.character_end_times_seconds;
+  const breakers = new Set([".", "?", "!", "\n", "\r"]), softBreakers = new Set([",", ";", "·"]);
+  const lines = []; let buffer = "", lineStart = -1;
+  function pushLine(endIndex) {
+    const trimmed = buffer.trim(); if (!trimmed) return;
+    const startSec = starts[Math.max(0, lineStart)], endSec = ends[endIndex];
+    if (lines.length && trimmed.length < minChars) {
+      const previous = lines[lines.length - 1]; previous.text = `${previous.text} ${trimmed}`.trim(); previous.endSec = Math.max(previous.endSec, endSec);
+    } else lines.push({ text: trimmed, startSec, endSec });
+    buffer = ""; lineStart = -1;
+  }
+  for (let index = 0; index < chars.length; index++) {
+    const character = chars[index]; if (lineStart === -1 && character.trim()) lineStart = index; buffer += character;
+    if (breakers.has(character) || softBreakers.has(character) && buffer.replace(/[,\s;·]+$/, "").length >= minChars * 2) pushLine(index);
+  }
+  if (buffer.trim()) pushLine(chars.length - 1);
+  return Object.freeze(lines.map(Object.freeze));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aimakeall-mcp",
-  "version": "0.14.3",
+  "version": "0.14.4",
   "description": "AImakeAll MCP 서버 — Claude Code/Codex에서 자연어로 영상 기획·생성·렌더·퍼블리시 (렌더는 로컬 컴패니언)",
   "type": "module",
   "bin": {