aimakeall-mcp 0.14.4 → 0.14.6

package/lib/durable-channel-journal.mjs

@@ -5,9 +5,14 @@ const hash = value => createHash('sha256').update(value).digest('hex');
 const fail = () => { throw Object.assign(new Error('채널 분석 기록을 확인하지 못했습니다. 자동 재제출하지 않습니다.'), { code: 'DURABLE_CHANNEL_JOURNAL_UNAVAILABLE', paidReplayAllowed: false }); };
 // Immutable files with exclusive creation. No truncation, overwrite, stale-lock
 // removal, expiry, TTL or ambiguous-write replay; never stores a PAT or media.
-export function createChannelFileJournal({ stateDir, authorityFingerprint }) {
+export function createChannelFileJournal({ stateDir, authorityFingerprint, namespace = 'channel-analysis-v1' }) {
   if (typeof stateDir !== 'string' || !path.isAbsolute(stateDir) || !/^[a-f0-9]{64}$/u.test(authorityFingerprint || '')) fail();
-  const handles = new WeakMap(), root = path.join(stateDir, 'channel-analysis-v1');
+  if (!['channel-analysis-v1', 'voice-recommendation-v1', 'review-plan-v1', 'studio-plan-v1'].includes(namespace)) fail();
+  const handles = new WeakMap(), root = path.join(stateDir, namespace);
+  const maxEntries = namespace === 'voice-recommendation-v1' ? 4096 : 32;
+  // Review output includes full source evidence (16 MiB artifact budget).
+  // Keep the original channel/voice bounds; never trim evidence to fit them.
+  const maxResultBytes = namespace === 'review-plan-v1' ? 20 * 1024 * 1024 : namespace === 'studio-plan-v1' ? 10 * 1024 * 1024 : namespace === 'voice-recommendation-v1' ? 65536 : 1200000;
   function directory(dir, create = false, privateOnly = true) {
     if (create) { try { mkdirSync(dir, { mode: 0o700 }); } catch (e) { if (e.code !== 'EEXIST') fail(); } }
     const st = lstatSync(dir); if (!st.isDirectory() || st.isSymbolicLink() || st.uid !== process.getuid() || st.mode & (privateOnly ? 0o077 : 0o022)) fail();
@@ -40,14 +45,14 @@ export function createChannelFileJournal({ stateDir, authorityFingerprint }) {
     async lookup(identity, { assertCurrent }) { assertCurrent(); directory(root); const value = loaded(identity); return value ? envelope(value, assertCurrent) : null; },
     async claim(identity, { assertCurrent }) { assertCurrent(); directory(root); const existing = loaded(identity); if (existing) return envelope(existing, assertCurrent);
       // A full journal is recoverable, never silently pruned to make room.
-      if (readdirSync(root).length >= 32) fail(); const dir = location(identity);
+      if (readdirSync(root).length >= maxEntries) fail(); const dir = location(identity);
       try { mkdirSync(dir, { mode: 0o700 }); } catch (e) { if (e.code !== 'EEXIST') fail(); const raced = loaded(identity); if (!raced) fail(); return envelope(raced, assertCurrent); }
-      if (readdirSync(root).length > 32) fail();
+      if (readdirSync(root).length > maxEntries) fail();
       const record = { version: 1, ...identity, localSubmissionId: randomUUID(), createdAt: Date.now(), state: 'submitted', jobId: '' };
       assertCurrent(); exclusive(path.join(dir, 'intent.json'), { authorityFingerprint, record }); assertCurrent(); return envelope({ dir, record }, assertCurrent, true);
     },
     async rememberJob(handle, jobId) { const s = state(handle); if (!/^epoch-v2-[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u.test(jobId || '')) fail(); exclusive(path.join(s.dir, 'accepted.json'), { authorityFingerprint, jobId }); s.record = { ...s.record, jobId }; s.check(); },
     async markResult(handle, { state: status }) { const s = state(handle); if (!s.record.jobId || !['unknown', 'completed', 'failed'].includes(status)) fail(); exclusive(path.join(s.dir, 'terminal.json'), { jobId: s.record.jobId, state: status }); s.check(); },
-    async persistResult(identity, result, check) { check(); const value = loaded(identity); if (!value || value.record.jobId !== result.backgroundJobId) fail(); exclusive(path.join(value.dir, 'result.json'), result, 1200000); check(); return true; },
+    async persistResult(identity, result, check) { check(); const value = loaded(identity); if (!value || value.record.jobId !== result.backgroundJobId) fail(); exclusive(path.join(value.dir, 'result.json'), result, maxResultBytes); check(); return true; },
   });
 }

package/lib/durable-channel-request.mjs

@@ -1,5 +1,5 @@
 import { captureDurableChannelInput, captureDurableChannelOutput, DURABLE_CHANNEL_CONTRACT_VERSION,
-  DURABLE_CHANNEL_MODEL, DURABLE_CHANNEL_LIMITS, DURABLE_CHANNEL_TYPES, DURABLE_CHANNEL_OUTPUT_FIELDS, DURABLE_CHANNEL_PATHS } from './durable-channel-contract.mjs';
+  DURABLE_CHANNEL_MODEL, durableChannelCapabilityModels, DURABLE_CHANNEL_LIMITS, DURABLE_CHANNEL_TYPES, DURABLE_CHANNEL_OUTPUT_FIELDS, DURABLE_CHANNEL_PATHS } from './durable-channel-contract.mjs';
 
 export const durableChannelPath = operation => DURABLE_CHANNEL_PATHS[operation];
 export const durableChannelCapabilityPath = operation => `${durableChannelPath(operation)}/execution-capability`;
@@ -85,7 +85,7 @@ export function validateDurableChannelCapability(value, operation) {
   const captured = object(value);
   if (captured.version !== 1 || captured.contractVersion !== DURABLE_CHANNEL_CONTRACT_VERSION || captured.operation !== operation
     || !['legacy-sync', 'queue-v2', 'unavailable'].includes(captured.mode)) fail('RESPONSE_INVALID');
-  exactConstants(captured.model, DURABLE_CHANNEL_MODEL); exactConstants(captured.limits, DURABLE_CHANNEL_LIMITS);
+  exactConstants(captured.model, durableChannelCapabilityModels(operation)); exactConstants(captured.limits, DURABLE_CHANNEL_LIMITS);
   const allowed = ['version', 'contractVersion', 'operation', 'mode', 'model', 'limits', ...(captured.mode === 'queue-v2'
     ? ['paidReplayAllowed', 'recovery'] : captured.mode === 'unavailable' ? ['reason'] : [])];
   if (Object.keys(captured).some(key => !allowed.includes(key)) || captured.mode === 'queue-v2'
@@ -116,8 +116,8 @@ export function validateCompletedDurableChannelJob(value, id) {
     || !Array.isArray(result.accountCostEvents) || result.accountCostEvents.length > DURABLE_CHANNEL_LIMITS.maxStages) fail('RESPONSE_INVALID');
   const count = result.accountCostEvents.length;
   if (result.operation === 'channel-style' && (count < 1 || count > 2)
-    || count > 0 && result.provider !== 'evolink'
-    || (count ? result.provider !== 'evolink' : result.provider !== 'none')) fail('RESPONSE_INVALID');
+    || result.operation === 'voice-recommend' && (count > 2 || count === 0 && (!['edge', 'supertonic2'].includes(result.voiceRecommendation?.ttsProvider) || result.voiceRecommendation?.sampleVoiceProfile !== null))
+    || (count ? !(result.operation === 'voice-recommend' ? ['evolink', 'kie'] : ['evolink']).includes(result.provider) : result.provider !== 'none')) fail('RESPONSE_INVALID');
   let output; try { output = captureDurableChannelOutput(Object.fromEntries(DURABLE_CHANNEL_OUTPUT_FIELDS
     .filter(key => result[key] !== undefined).map(key => [key, result[key]]))); } catch { fail('RESPONSE_INVALID'); }
   const ids = new Set();

package/lib/durable-remake-contract.mjs

@@ -0,0 +1,88 @@
+// Native cut/review planning only; media analysis, TTS and rendering are separate.
+import { normalizeReviewProductionInput, validateReviewProductionPlan } from './review-production-contract.mjs';
+export const DURABLE_REMAKE_CONTRACT_VERSION = 1;
+export const DURABLE_REMAKE_PATHS = Object.freeze({ 'remake-versions': '/api/tracker/gemini/remake-versions', 'review-plan': '/api/tracker/review/plan' });
+export const DURABLE_REMAKE_TYPES = Object.freeze({ 'remake-versions': 'durable-remake:versions', 'review-plan': 'durable-remake:review-plan' });
+export const DURABLE_REMAKE_MODEL = Object.freeze({ 'remake-versions': 'gemini-3-flash', 'review-plan': 'gemini-3.8-flash' });
+const legacyModels = Object.freeze({ 'remake-versions': 'gemini-3-flash' });
+// Already-installed remake clients compare the complete capability map.
+export const durableRemakeCapabilityModels = operation => operation === 'remake-versions' ? legacyModels : DURABLE_REMAKE_MODEL;
+export const DURABLE_REMAKE_LIMITS = Object.freeze({ maxInputBytes: 25 * 1024 * 1024, maxOutputBytes: 16 * 1024 * 1024, maxProjectId: 160, maxTargetId: 240, maxStages: 66 });
+export const DURABLE_REMAKE_OUTPUT_FIELDS = Object.freeze(['operation','projectId','targetId','analysisId','inputKey','presetId','preserveOrder','rerollCount','targetTime','versionCount','promptFrameworks','summaryBody','summaryHeadline','sourceVideos','versions','reviewPlan']);
+const inputFields = ['operation','projectId','targetId','analysisId','inputKey','analysis','presetId','preserveOrder','rerollCount','targetTime','versionCount'];
+const presets = ['tikitaka','snack','recap','deep','shopping','tts','tutorial','highlight','cinema'];
+const invalid = output => Object.assign(new Error(`DURABLE_REMAKE_${output ? 'OUTPUT' : 'INPUT'}_INVALID`), { code: `DURABLE_REMAKE_${output ? 'OUTPUT' : 'INPUT'}_INVALID`, statusCode: output ? 502 : 400 });
+function reject() { throw invalid(false); }
+function clone(value, state, depth = 0) {
+  if (++state.nodes > 1_500_000 || depth > 40) reject();
+  if (value === null || typeof value === 'boolean') return value;
+  if (typeof value === 'number') { if (!Number.isFinite(value)) reject(); return value; }
+  if (typeof value === 'string') { if (!value.isWellFormed() || /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/u.test(value)) reject(); return value; }
+  if (!value || typeof value !== 'object' || state.seen.has(value)) reject();
+  state.seen.add(value); const d = Object.getOwnPropertyDescriptors(value); let out;
+  if (Array.isArray(value)) {
+    const n = d.length.value;
+    if (Object.getPrototypeOf(value) !== Array.prototype || n > 100000 || Reflect.ownKeys(d).length !== n + 1) reject();
+    out = Array.from({ length: n }, (_, i) => { if (!d[i]?.enumerable || !('value' in d[i])) reject(); return clone(d[i].value, state, depth + 1); });
+  } else {
+    if (![Object.prototype, null].includes(Object.getPrototypeOf(value)) || Reflect.ownKeys(d).some(k => typeof k !== 'string' || ['__proto__','constructor','prototype'].includes(k) || !d[k].enumerable || !('value' in d[k]))) reject();
+    out = Object.fromEntries(Object.entries(d).map(([key, field]) => [key, clone(field.value, state, depth + 1)]));
+  }
+  state.seen.delete(value); return Object.freeze(out);
+}
+function capture(value, fields, maxBytes) {
+  const body = clone(value, { nodes: 0, seen: new WeakSet() });
+  if (!body || Array.isArray(body) || typeof body !== 'object' || Object.keys(body).some(k => !fields.includes(k)) || new TextEncoder().encode(JSON.stringify(body)).byteLength > maxBytes) reject();
+  return body;
+}
+function text(value, limit, empty = false) { if (typeof value !== 'string' || value.length > limit || !empty && !value.trim()) reject(); }
+function identity(body) {
+  if (!Object.hasOwn(DURABLE_REMAKE_TYPES, body.operation)) reject();
+  for (const [key, limit] of [['projectId',160],['targetId',240], ...(body.operation === 'review-plan' ? [] : [['analysisId',240],['inputKey',4096]])]) {
+    text(body[key], limit); if (body[key].trim() !== body[key] || /[\u0000-\u001f\u007f]/u.test(body[key])) reject();
+  }
+  if (body.operation === 'review-plan') return;
+  if (!presets.includes(body.presetId) || typeof body.preserveOrder !== 'boolean' || !Number.isSafeInteger(body.rerollCount) || body.rerollCount < 0 || body.rerollCount > 1e6) reject();
+  text(body.targetTime, 32); text(body.versionCount, 16);
+  if (!/^(?:original|[1-9][0-9]{0,4}(?:s|m)?)$/u.test(body.targetTime) || !/^(?:[1-9]|10)(?:개)?$/u.test(body.versionCount)) reject();
+}
+export function captureDurableRemakeInput(value) {
+  const body = capture(value, [...inputFields, 'reviewInput'], DURABLE_REMAKE_LIMITS.maxInputBytes); identity(body);
+  if (body.operation === 'review-plan') {
+    if (Object.keys(body).some(key => !['operation','projectId','targetId','reviewInput'].includes(key)) || !body.reviewInput
+      || Object.keys(body.reviewInput).some(key => !['version','workType','workTitle','episode','targetDurationSec','spoilerPolicy','deliveryStyle','reviewAngle','sourceCatalog','globalStory','fullTranscriptSegments'].includes(key))) reject();
+    normalizeReviewProductionInput(body.reviewInput);
+    return Object.freeze({ body, jobType: DURABLE_REMAKE_TYPES[body.operation] });
+  }
+  if (Object.hasOwn(body, 'reviewInput')) reject();
+  if (!body.analysis || !Array.isArray(body.analysis.videos) || !body.analysis.videos.length || body.analysis.videos.length > 5) reject();
+  return Object.freeze({ body, jobType: DURABLE_REMAKE_TYPES[body.operation] });
+}
+export function captureDurableRemakeOutput(value) {
+  try {
+    const out = capture(value, DURABLE_REMAKE_OUTPUT_FIELDS, DURABLE_REMAKE_LIMITS.maxOutputBytes); identity(out);
+    if (out.operation === 'review-plan') {
+      if (Object.keys(out).some(key => !['operation','projectId','targetId','reviewPlan'].includes(key)) || !out.reviewPlan) reject();
+      const plan = out.reviewPlan;
+      const normalized = validateReviewProductionPlan({ ...plan.reviewProfile, sourceCatalog: plan.sourceCatalog,
+        ...(plan.globalStory === undefined ? {} : { globalStory: plan.globalStory, fullTranscriptSegments: plan.fullTranscriptSegments }) }, plan.version);
+      // Closed, canonical result: no provider-injected identity, file, URL or
+      // hidden result fields. Validation is shared with the original service.
+      const canonical = item => JSON.stringify(item, (_key, child) => child && !Array.isArray(child) && typeof child === 'object'
+        ? Object.fromEntries(Object.keys(child).sort().map(key => [key, child[key]])) : child);
+      if (canonical(plan) !== canonical(normalized)) reject();
+      return out;
+    }
+    if (Object.hasOwn(out, 'reviewPlan')) reject();
+    if (!Array.isArray(out.sourceVideos) || !out.sourceVideos.length || out.sourceVideos.length > 5 || !Array.isArray(out.versions) || !out.versions.length || out.versions.length > 10
+      || !Array.isArray(out.promptFrameworks) || out.promptFrameworks.length !== 2 || out.promptFrameworks[0] !== '티키타카 편집점' || out.promptFrameworks[1] !== '바이럴 마스터 PD') reject();
+    text(out.summaryBody, 64000, true); text(out.summaryHeadline, 16000, true);
+    const ids = new Set();
+    for (const version of out.versions) {
+      text(version.id, 240); if (ids.has(version.id) || Object.hasOwn(version, 'sourceVideos') || !Array.isArray(version.rows) || version.rows.length > 1000) reject();
+      ids.add(version.id);
+      for (const row of version.rows) if (!['N','S','A','SN'].includes(row.mode) || !Number.isFinite(row.durationSec) || row.durationSec <= 0 || !Array.isArray(row.clipRefs)) reject();
+    }
+    return out;
+  } catch { throw invalid(true); }
+}

package/lib/durable-remake-request.mjs

@@ -0,0 +1,375 @@
+import { captureDurableRemakeInput, captureDurableRemakeOutput, DURABLE_REMAKE_CONTRACT_VERSION,
+  DURABLE_REMAKE_MODEL, DURABLE_REMAKE_LIMITS, DURABLE_REMAKE_TYPES, DURABLE_REMAKE_OUTPUT_FIELDS, DURABLE_REMAKE_PATHS, durableRemakeCapabilityModels } from './durable-remake-contract.mjs';
+
+export const durableRemakePath = operation => DURABLE_REMAKE_PATHS[operation];
+export const durableRemakeCapabilityPath = operation => `${durableRemakePath(operation)}/execution-capability`;
+export const DURABLE_REMAKE_REQUEST_LIMITS = Object.freeze({ maxResponseBytes: DURABLE_REMAKE_LIMITS.maxOutputBytes + 262144, maxReadChunks: 65536 });
+const JOB = /^epoch-v2-[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/u;
+const COST = /^bg-durable-remake-v1:[a-f0-9]{64}:(?:[1-9]|[1-5][0-9]|6[0-6])$/u;
+const encoder = new TextEncoder(), failures = new WeakMap();
+const messages = Object.freeze({
+  INVALID: '리뷰 기획 요청을 안전하게 확인하지 못했습니다.',
+  AUTHORITY_CHANGED: '계정·프로젝트·입력이 변경되어 이전 리뷰 기획 작업을 중단했습니다.',
+  SESSION_REQUIRED: '로그인 후 리뷰 기획를 생성해 주세요.',
+  UNAVAILABLE: '현재 서버에서는 안전한 리뷰 기획 생성을 사용할 수 없습니다.',
+  RESPONSE_INVALID: '리뷰 기획 응답을 안전하게 확인하지 못했습니다. 자동 재생성하지 않습니다.',
+  JOURNAL_UNAVAILABLE: '제출 기록을 확인하지 못했습니다. 자동 재생성하지 않습니다.',
+  JOURNAL_FULL: '안전한 제출 기록 한도(계정당 32건)에 도달했습니다. 기존 작업 조회는 가능하지만 새 생성은 차단됩니다. 기록을 삭제하지 말고 고객지원에 문의해 주세요.',
+  UNRESOLVED: '이전 제출 결과가 확정되지 않았습니다. 자동 재생성하지 않습니다.',
+  MISSING: '이전 작업을 찾을 수 없습니다. 새 생성 요청을 보내지 않았습니다.',
+  WAIT_ABORTED: '기다리기를 중단했습니다. 생성 취소가 확인된 것은 아닙니다.',
+  WAIT_TIMEOUT: '대기 시간이 초과되었습니다. 기존 작업만 다시 조회할 수 있습니다.',
+  DIFFERENT_EDITOR: '이 프로젝트에 다른 제작 화면의 미확정 작업이 있습니다. 원래 화면에서 먼저 기존 작업을 조회해 주세요.',
+  APPLY_UNCONFIRMED: '작업 결과는 완료됐지만 프로젝트 저장을 확인하지 못했습니다. 다음에 기존 작업만 다시 조회합니다.',
+  STORAGE_BUDGET: '리메이크 결과 저장 한도(결과당 20 MiB·계정 전체 48 MiB)에 도달했습니다. 기존 결과와 제출 기록은 보존하며 자동 재생성하지 않습니다. 고객지원에 문의해 주세요.',
+  ACTIVE: '리뷰 기획 작업이 이미 진행 중입니다.',
+});
+function failure(kind) {
+  const error = Object.assign(new Error(messages[kind] || messages.INVALID), {
+    code: `DURABLE_REMAKE_${kind}`, paidReplayAllowed: false,
+  }); failures.set(error, kind); return error;
+}
+const fail = kind => { throw failure(kind); };
+const own = (value, key) => value && typeof value === 'object' ? Object.getOwnPropertyDescriptor(value, key)?.value : undefined;
+// Legacy transport already projects usage; copy only its bounded public fields.
+// Never copy an error message, request, headers, arbitrary object or credential.
+function legacyUsage(value, depth = 0) {
+  if (!value || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) return undefined;
+  const output = {};
+  for (const key of ['aiCalls', 'costUsd', 'inputTokens', 'outputTokens', 'totalTokens', 'credits', 'creditsConsumed']) {
+    const number = own(value, key);
+    if (typeof number === 'number' && Number.isFinite(number) && number >= 0 && number <= Number.MAX_SAFE_INTEGER) output[key] = number;
+  }
+  for (const key of ['model', 'provider', 'stage']) {
+    const item = own(value, key); if (text(item, 160)) output[key] = item;
+  }
+  const stages = own(value, 'stages');
+  if (depth === 0 && Array.isArray(stages) && stages.length > 0 && stages.length <= 66) {
+    output.stages = Array.from({ length: stages.length }, (_, i) => legacyUsage(own(stages, String(i)), 1)).filter(Boolean);
+    if (!output.stages.length) delete output.stages;
+  }
+  return Object.keys(output).length ? Object.freeze(output) : undefined;
+}
+function object(value) {
+  if (!value || typeof value !== 'object' || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) fail('RESPONSE_INVALID');
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  if (Reflect.ownKeys(descriptors).some(key => typeof key !== 'string' || !('value' in descriptors[key]) || !descriptors[key].enumerable)) fail('RESPONSE_INVALID');
+  return Object.fromEntries(Object.entries(descriptors).map(([key, item]) => [key, item.value]));
+}
+function text(value, maximum = 255) {
+  return typeof value === 'string' && value.length > 0 && value.length <= maximum && value.trim() === value
+    && value.isWellFormed() && !/[\u0000-\u001f\u007f]/u.test(value);
+}
+function origin(value) {
+  if (!text(value, 2048)) fail('INVALID');
+  let url; try { url = new URL(value); } catch { fail('INVALID'); }
+  if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash || url.pathname !== '/'
+    || ![url.origin, `${url.origin}/`].includes(value)) fail('INVALID');
+  return url.origin;
+}
+function authority(getAuthority) {
+  const value = getAuthority(), ownerUserId = own(value, 'ownerUserId'), sessionRevision = own(value, 'sessionRevision');
+  if (!text(ownerUserId) || ownerUserId.startsWith('deleted:')
+    || !(text(sessionRevision, 512) || Number.isSafeInteger(sessionRevision) && sessionRevision >= 0)) fail('SESSION_REQUIRED');
+  return Object.freeze({ ownerUserId, sessionRevision });
+}
+function synchronous(callback) {
+  const result = callback();
+  if (result && typeof result.then === 'function') { Promise.resolve(result).catch(() => {}); fail('AUTHORITY_CHANGED'); }
+  if (result === false) fail('AUTHORITY_CHANGED');
+}
+function exactConstants(value, expected) {
+  const captured = object(value), keys = Object.keys(expected);
+  if (Object.keys(captured).length !== keys.length || keys.some(key => captured[key] !== expected[key])) fail('RESPONSE_INVALID');
+}
+export function validateDurableRemakeCapability(value, operation) {
+  const captured = object(value);
+  if (captured.version !== 1 || captured.contractVersion !== DURABLE_REMAKE_CONTRACT_VERSION || captured.operation !== operation
+    || !['legacy-sync', 'queue-v2', 'unavailable'].includes(captured.mode)) fail('RESPONSE_INVALID');
+  exactConstants(captured.model, durableRemakeCapabilityModels(operation)); exactConstants(captured.limits, DURABLE_REMAKE_LIMITS);
+  const allowed = ['version', 'contractVersion', 'operation', 'mode', 'model', 'limits', ...(captured.mode === 'queue-v2'
+    ? ['paidReplayAllowed', 'recovery'] : captured.mode === 'unavailable' ? ['reason'] : [])];
+  if (Object.keys(captured).some(key => !allowed.includes(key)) || captured.mode === 'queue-v2'
+    && (captured.paidReplayAllowed !== false || captured.recovery !== 'read-only-known-job')
+    || captured.reason !== undefined && !text(captured.reason, 128)) fail('RESPONSE_INVALID');
+  return captured.mode;
+}
+function captureUsage(value, provider, model, { total = false } = {}) {
+  const item = object(value);
+  if (item.aiCalls !== 1 || !Number.isSafeInteger(item.inputTokens) || item.inputTokens < 0
+    || !Number.isSafeInteger(item.outputTokens) || item.outputTokens < 0
+    || !Number.isSafeInteger(item.inputTokens + item.outputTokens)
+    || typeof item.costUsd !== 'number' || !Number.isFinite(item.costUsd) || item.costUsd < 0
+    || item.model !== undefined && item.model !== model
+    || item.provider !== undefined && item.provider !== provider
+    || (total || item.totalTokens !== undefined) && item.totalTokens !== item.inputTokens + item.outputTokens) fail('RESPONSE_INVALID');
+  return Object.freeze({ aiCalls: 1, inputTokens: item.inputTokens, outputTokens: item.outputTokens, costUsd: item.costUsd,
+    ...(item.totalTokens === undefined ? {} : { totalTokens: item.totalTokens }),
+    ...(item.model === undefined ? {} : { model: item.model }), ...(item.provider === undefined ? {} : { provider: item.provider }) });
+}
+export function validateCompletedDurableRemakeJob(value, id) {
+  const job = object(value);
+  if (!JOB.test(id) || job.id !== id || !Object.values(DURABLE_REMAKE_TYPES).includes(job.type) || job.status !== 'completed') fail('RESPONSE_INVALID');
+  const result = object(job.result), model = DURABLE_REMAKE_MODEL[result.operation];
+  if (DURABLE_REMAKE_TYPES[result.operation] !== job.type || result.kind !== 'durable-remake-v2'
+    || result.model !== model
+    || result.accountingState !== 'settled' || result.hasAccountCostEvents !== true
+    || !Array.isArray(result.accountCostEvents) || result.accountCostEvents.length > DURABLE_REMAKE_LIMITS.maxStages) fail('RESPONSE_INVALID');
+  const count = result.accountCostEvents.length;
+  if (result.operation === 'review-plan' && count !== 1) fail('RESPONSE_INVALID');
+  if (count < 1 || count > 66 || !['evolink','kie'].includes(result.provider)) fail('RESPONSE_INVALID');
+  let output; try { output = captureDurableRemakeOutput(Object.fromEntries(DURABLE_REMAKE_OUTPUT_FIELDS
+    .filter(key => result[key] !== undefined).map(key => [key, result[key]]))); } catch { fail('RESPONSE_INVALID'); }
+  const ids = new Set();
+  const receipts = result.accountCostEvents.map(raw => {
+    const event = object(raw), provider = event.provider;
+    const committed = event.accountCostRecorded === true && event.accountCostSuppressedByReset !== true;
+    const suppressed = event.accountCostRecorded === false && event.accountCostSuppressedByReset === true;
+    if (!COST.test(event.accountCostEventId || '') || ids.has(event.accountCostEventId) || !(committed || suppressed)
+      || event.accountCostSuppressedByReset !== undefined && typeof event.accountCostSuppressedByReset !== 'boolean'
+      || event.model !== model || provider !== result.provider || !Number.isSafeInteger(event.createdAt)
+      || event.createdAt <= 0 || event.createdAt > 253402300799999 || typeof event.costUsd !== 'number'
+      || !Number.isFinite(event.costUsd) || event.costUsd < 0) fail('RESPONSE_INVALID');
+    ids.add(event.accountCostEventId);
+    const usage = captureUsage(event.usage, provider, model);
+    if (usage.costUsd !== event.costUsd) fail('RESPONSE_INVALID');
+    return Object.freeze({ accountCostEventId: event.accountCostEventId, createdAt: event.createdAt,
+      provider, model, costUsd: event.costUsd, accountCostRecorded: committed,
+      ...(suppressed ? { accountCostSuppressedByReset: true } : {}), usage });
+  });
+  const total = object(result.usage), sum = key => receipts.reduce((n, item) => n + item.usage[key], 0);
+  if (total.aiCalls !== receipts.length || total.inputTokens !== sum('inputTokens') || total.outputTokens !== sum('outputTokens')
+    || total.totalTokens !== total.inputTokens + total.outputTokens || !Number.isSafeInteger(total.totalTokens)
+    || typeof total.costUsd !== 'number' || !Number.isFinite(total.costUsd) || total.costUsd < 0
+    || Math.abs(total.costUsd - sum('costUsd')) > 0.000001) fail('RESPONSE_INVALID');
+  const usage = Object.freeze({ aiCalls: total.aiCalls, inputTokens: total.inputTokens, outputTokens: total.outputTokens,
+    totalTokens: total.totalTokens, costUsd: total.costUsd });
+  return Object.freeze({ ...output, ok: true, kind: 'durable-remake-v2', model, provider: result.provider, usage, hasAccountCostEvents: true,
+    accountingState: 'settled', accountCostEvents: Object.freeze(receipts), backgroundJobId: id });
+}
+
+// Strict stream EOF, fatal UTF-8 and declared-byte checks. Abort starts reader
+// cancellation immediately, but does not detach an admitted read/cancel promise.
+async function readJson(response, { check, signal, url }) {
+  let reader, cancellation, complete = false;
+  const cancel = () => {
+    if (cancellation || complete) return;
+    try { cancellation = Promise.resolve(reader ? reader.cancel() : response?.body?.cancel()).catch(() => {}); }
+    catch { cancellation = Promise.resolve(); }
+  };
+  const abort = () => cancel();
+  try {
+    check();
+    if (!response || response.redirected || response.type === 'opaqueredirect' || response.type === 'opaque'
+      || response.url && response.url !== url
+      || !Number.isInteger(response.status) || typeof response.body?.getReader !== 'function') fail('RESPONSE_INVALID');
+    const mime = (response.headers.get('content-type') || '').split(';', 1)[0].trim().toLowerCase();
+    if (mime !== 'application/json') fail('RESPONSE_INVALID');
+    const length = response.headers.get('content-length'), encoding = response.headers.get('content-encoding');
+    if (length !== null && (!/^(0|[1-9][0-9]*)$/u.test(length) || !Number.isSafeInteger(Number(length))
+      || Number(length) > DURABLE_REMAKE_REQUEST_LIMITS.maxResponseBytes)) fail('RESPONSE_INVALID');
+    reader = response.body.getReader(); signal.addEventListener('abort', abort, { once: true });
+    if (signal.aborted) { cancel(); check(); }
+    const decoder = new TextDecoder('utf-8', { fatal: true }), blocks = []; let bytes = 0, chunks = 0;
+    for (;;) {
+      check(); const part = await reader.read(); check();
+      if (part.done) break;
+      if (!(part.value instanceof Uint8Array) || ++chunks > DURABLE_REMAKE_REQUEST_LIMITS.maxReadChunks
+        || (bytes += part.value.byteLength) > DURABLE_REMAKE_REQUEST_LIMITS.maxResponseBytes) fail('RESPONSE_INVALID');
+      blocks.push(decoder.decode(part.value, { stream: true }));
+    }
+    if (!bytes || length !== null && (!encoding || encoding === 'identity') && Number(length) !== bytes) fail('RESPONSE_INVALID');
+    blocks.push(decoder.decode()); const value = JSON.parse(blocks.join('')); check(); complete = true;
+    return { status: response.status, body: value };
+  } catch (error) { cancel(); throw failures.has(error) ? error : failure('RESPONSE_INVALID'); }
+  finally { signal.removeEventListener('abort', abort); await cancellation; reader?.releaseLock(); }
+}
+
+/** A journal intent is consumed before the one paid POST. Restored intentions
+ * with an ID can only GET it; no ID, a missing job, failure or mode downgrade
+ * never permits another POST or the legacy callback. Browser storage loss is
+ * not server-side idempotency; this API offers no reset/new-intent escape. */
+export function createDurableRemakeRequest({ journal, apiOrigin, fetchImpl = globalThis.fetch, getAuthority,
+  getHeaders, ensureSession, crypto = globalThis.crypto, pollMs = 1000, timeoutMs = 240000 } = {}) {
+  const base = origin(apiOrigin), digest = typeof crypto?.subtle?.digest === 'function' ? crypto.subtle.digest.bind(crypto.subtle) : null;
+  if ([fetchImpl, getAuthority, getHeaders, ensureSession, ...['lookup', 'claim', 'rememberJob', 'markResult'].map(key => journal?.[key])]
+    .some(fn => typeof fn !== 'function') || !digest || !Number.isSafeInteger(pollMs) || pollMs < 1 || pollMs > 10000
+    || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 900000) throw failure('INVALID');
+  const storage = Object.fromEntries(['lookup', 'claim', 'rememberJob', 'markResult'].map(key => [key, journal[key].bind(journal)]));
+  let active = false;
+  return Object.freeze({ async readCapability({ operation, assertCurrent, signal, assertQueueReady } = {}) {
+    if (!Object.hasOwn(DURABLE_REMAKE_TYPES, operation) || typeof assertCurrent !== 'function'
+      || signal !== undefined && !(signal instanceof AbortSignal)) fail('INVALID');
+    const captured = authority(getAuthority), controller = new AbortController();
+    const abort = () => controller.abort(failure('WAIT_ABORTED'));
+    const timer = setTimeout(() => controller.abort(failure('WAIT_TIMEOUT')), Math.min(timeoutMs, 15000));
+    signal?.addEventListener('abort', abort, { once: true }); if (signal?.aborted) abort();
+    const check = () => { const current = authority(getAuthority); synchronous(assertCurrent);
+      if (current.ownerUserId !== captured.ownerUserId || current.sessionRevision !== captured.sessionRevision) fail('AUTHORITY_CHANGED');
+      if (controller.signal.aborted) throw controller.signal.reason;
+    };
+    try {
+      check(); if (await ensureSession() === false) fail('SESSION_REQUIRED'); check();
+      const headers = new Headers(await getHeaders()); headers.set('Accept', 'application/json'); check();
+      const url = `${base}${durableRemakeCapabilityPath(operation)}`;
+      const response = await fetchImpl(url, { method: 'GET', headers, credentials: 'include', redirect: 'error', cache: 'no-store', signal: controller.signal });
+      const reply = await readJson(response, { check, signal: controller.signal, url }); check();
+      if (reply.status !== 200) fail('UNAVAILABLE');
+      const mode = validateDurableRemakeCapability(reply.body, operation);
+      if (mode === 'unavailable') fail('UNAVAILABLE');
+      if (mode === 'queue-v2') {
+        if (typeof assertQueueReady !== 'function' || await assertQueueReady() !== true) fail('INVALID'); check();
+      }
+      return mode;
+    } catch (caught) { if (own(caught, 'code') === 'DURABLE_REMAKE_STORAGE_BUDGET_EXCEEDED') fail('STORAGE_BUDGET'); throw failures.has(caught) ? caught : failure('RESPONSE_INVALID'); }
+    finally { clearTimeout(timer); signal?.removeEventListener('abort', abort); }
+  }, async run(rawBody, { projectId, assertCurrent, signal, onState = () => {}, onAccountCost = () => {}, legacy,
+    recoveryOnly = false, operation, targetId, applyResult, assertQueueReady } = {}) {
+    if (active) throw failure('ACTIVE');
+    if (!Object.hasOwn(DURABLE_REMAKE_TYPES, operation) || !text(targetId, 240) || !text(projectId, 160) || [assertCurrent, onState, onAccountCost].some(fn => typeof fn !== 'function')
+      || signal !== undefined && !(signal instanceof AbortSignal) || typeof recoveryOnly !== 'boolean') throw failure('INVALID');
+    let body;
+    // Legacy accepts its original inputs, which may exceed the new queue's
+    // bounded contract. Defer only this v2 validation error until transport
+    // selection; even invalid edited inputs must first recover pending work.
+    if (!recoveryOnly) { try { body = captureDurableRemakeInput(rawBody).body; if (body.operation !== operation || body.targetId !== targetId || body.projectId !== projectId) body = undefined; } catch { body = undefined; } }
+    const captured = authority(getAuthority); active = true;
+    const controller = new AbortController(), deadline = performance.now() + timeoutMs;
+    const abort = () => controller.abort(failure('WAIT_ABORTED'));
+    const timer = setTimeout(() => controller.abort(failure('WAIT_TIMEOUT')), timeoutMs);
+    signal?.addEventListener('abort', abort, { once: true }); if (signal?.aborted) abort();
+    let jobId = null, status = 'checking', handle, claimStarted = false, legacyStarted = false, recovering = false;
+    const check = () => {
+      let current; try { current = authority(getAuthority); synchronous(assertCurrent); } catch { fail('AUTHORITY_CHANGED'); }
+      if (current.ownerUserId !== captured.ownerUserId || current.sessionRevision !== captured.sessionRevision) fail('AUTHORITY_CHANGED');
+      if (!controller.signal.aborted && performance.now() >= deadline) controller.abort(failure('WAIT_TIMEOUT'));
+      if (controller.signal.aborted) throw controller.signal.reason;
+    };
+    const checked = async operation => { check(); const value = await operation(); check(); return value; };
+    const publish = next => { check(); status = next; try { Promise.resolve(onState(Object.freeze({ version: 1, status,
+      jobId, recovering, paidReplayAllowed: false }))).catch(() => {}); } catch { /* UI cannot authorize a replay. */ } };
+    const persist = async operation => { try { return await checked(operation); } catch (error) {
+      check(); throw failures.has(error) ? error : failure(own(error, 'code') === 'UPLOAD_METADATA_JOURNAL_FULL' ? 'JOURNAL_FULL' : 'JOURNAL_UNAVAILABLE');
+    } };
+    async function request(path, method = 'GET') {
+      if (recoveryOnly && method !== 'GET') fail('INVALID');
+      const rawHeaders = await checked(() => getHeaders()), headers = new Headers(rawHeaders);
+      headers.set('Accept', 'application/json'); if (method === 'POST') headers.set('Content-Type', 'application/json');
+      let response;
+      try {
+        check(); response = await fetchImpl(`${base}${path}`, { method, headers, credentials: 'include', redirect: 'error',
+          cache: 'no-store', signal: controller.signal, ...(method === 'POST' ? { body: JSON.stringify(body) } : {}) });
+        return await readJson(response, { check, signal: controller.signal, url: `${base}${path}` });
+      } catch (error) { check(); throw failures.has(error) ? error : failure('RESPONSE_INVALID'); }
+    }
+    const envelope = (value, identity) => {
+      const item = object(value), record = object(item.record);
+      if (typeof item.canSubmit !== 'boolean' || !item.handle || typeof item.handle !== 'object'
+        || record.version !== 1 || ['ownerUserId', 'apiOrigin', 'projectId'].some(key => record[key] !== identity[key])
+        || typeof record.inputDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(record.inputDigest)
+        || item.canSubmit && record.inputDigest !== identity.inputDigest
+        || typeof record.jobId !== 'string' || record.jobId && !JOB.test(record.jobId)
+        || !['submitted', 'unknown', 'completed', 'failed'].includes(record.state)
+        || item.canSubmit && (record.jobId || record.state !== 'submitted')) fail('JOURNAL_UNAVAILABLE');
+      return { handle: item.handle, canSubmit: item.canSubmit, jobId: record.jobId || null };
+    };
+    const pause = () => checked(() => new Promise(resolve => {
+      let waiting;
+      const done = () => { clearTimeout(waiting); controller.signal.removeEventListener('abort', done); resolve(); };
+      waiting = setTimeout(done, pollMs); controller.signal.addEventListener('abort', done, { once: true });
+      if (controller.signal.aborted) done();
+    }));
+    try {
+      check(); publish('checking');
+      // A read-only pending-project probe has no input/body to persist. Its
+      // sentinel digest is never claimed, posted or used for legacy fallback.
+      const bytes = recoveryOnly || !body ? new Uint8Array(32)
+        : new Uint8Array(await checked(() => digest('SHA-256', encoder.encode(JSON.stringify(body)))));
+      if (bytes.byteLength !== 32) fail('INVALID');
+      const scopeBytes = new Uint8Array(await checked(() => digest('SHA-256', encoder.encode(JSON.stringify([operation, projectId, targetId])))));
+      if (scopeBytes.byteLength !== 32) fail('INVALID');
+      const identity = Object.freeze({ ownerUserId: captured.ownerUserId, apiOrigin: base, projectId: `durable-remake:v1:${Array.from(scopeBytes, byte => byte.toString(16).padStart(2, '0')).join('')}`,
+        inputDigest: Array.from(bytes, byte => byte.toString(16).padStart(2, '0')).join('') });
+      let found = await persist(() => storage.lookup(identity, { assertCurrent: check }));
+      if (!found && recoveryOnly) return null;
+      if (await checked(() => ensureSession()) === false) fail('SESSION_REQUIRED');
+      if (!found) {
+        const capability = await request(durableRemakeCapabilityPath(operation));
+        if (capability.status !== 200) fail('UNAVAILABLE');
+        const mode = validateDurableRemakeCapability(capability.body, operation);
+        // Re-observe after the capability await, including a deployment change.
+        found = await persist(() => storage.lookup(identity, { assertCurrent: check }));
+        if (!found && mode === 'legacy-sync') {
+          if (typeof legacy !== 'function') fail('UNAVAILABLE');
+          // This preserves the legacy callback; the journal does not provide
+          // atomic legacy/v2 exclusion during a mixed deployment mode switch.
+          publish('legacy-sync'); check(); legacyStarted = true;
+          return await checked(() => legacy(body || rawBody, { signal: controller.signal }));
+        }
+        if (!found && mode !== 'queue-v2') fail('UNAVAILABLE');
+        if (!found && !body) fail('INVALID');
+        if (!found) { if (typeof assertQueueReady !== 'function' || await checked(assertQueueReady) !== true) fail('INVALID'); claimStarted = true; found = await persist(() => storage.claim(identity, { assertCurrent: check })); }
+      }
+      const selected = envelope(found, identity); handle = selected.handle; jobId = selected.jobId;
+      recovering = !selected.canSubmit;
+      if (selected.canSubmit && !claimStarted) fail('JOURNAL_UNAVAILABLE');
+      if (selected.canSubmit) {
+        publish('submitting');
+        const reply = await request(`${durableRemakePath(operation)}/jobs`, 'POST'), value = object(reply.body);
+        const accepted = reply.status === 202 && value.ok === true && value.async === true;
+        const uncertain = reply.status === 503 && value.code === 'BACKGROUND_ENQUEUE_UNCONFIRMED';
+        const returnedId = accepted ? own(value.job, 'id') : uncertain ? value.jobId : undefined;
+        if (typeof returnedId !== 'string' || !JOB.test(returnedId)) fail('UNRESOLVED');
+        jobId = returnedId;
+        await persist(() => storage.rememberJob(handle, jobId));
+      }
+      if (!jobId) { publish('unknown'); fail('UNRESOLVED'); }
+      for (;;) {
+        publish('checking');
+        const reply = await request(`/api/tracker/review/plan/jobs/${jobId}`);
+        if (reply.status === 404) { publish('missing'); fail('MISSING'); }
+        const value = object(reply.body), job = object(value.job);
+        if (reply.status !== 200 || value.ok !== true || job.id !== jobId || !Object.values(DURABLE_REMAKE_TYPES).includes(job.type)
+          || !['queued', 'running', 'completed', 'failed', 'cancelled', 'unknown'].includes(job.status)) fail('RESPONSE_INVALID');
+        if (job.type !== DURABLE_REMAKE_TYPES[operation]) fail('DIFFERENT_EDITOR');
+        if (job.status === 'completed') {
+          const result = validateCompletedDurableRemakeJob(job, jobId);
+          if (result.targetId !== targetId || result.projectId !== projectId || result.operation !== operation) fail('DIFFERENT_EDITOR');
+          // A provider-completed job is not a durably applied browser result.
+          // Keep its known ID pending through UI/storage failures or page exits.
+          if (typeof applyResult !== 'function') fail('APPLY_UNCONFIRMED');
+          try { if (await checked(() => applyResult(Object.freeze({ ...result, recoveredPreviousRequest: recovering }))) !== true) fail('APPLY_UNCONFIRMED'); }
+          catch (error) { check(); if (own(error, 'code') === 'DURABLE_REMAKE_STORAGE_BUDGET_EXCEEDED') fail('STORAGE_BUDGET'); if (failures.has(error)) throw error; fail('APPLY_UNCONFIRMED'); }
+          try { if (await checked(() => onAccountCost(result)) !== true) fail('APPLY_UNCONFIRMED'); }
+          catch (error) { check(); if (own(error, 'code') === 'DURABLE_REMAKE_STORAGE_BUDGET_EXCEEDED') fail('STORAGE_BUDGET'); if (failures.has(error)) throw error; fail('APPLY_UNCONFIRMED'); }
+          await persist(() => storage.markResult(handle, { state: 'completed' })); publish('completed');
+          check(); return Object.freeze({ ...result, recoveredPreviousRequest: recovering });
+        }
+        publish(job.status);
+        if (!['queued', 'running'].includes(job.status)) {
+          await persist(() => storage.markResult(handle, { state: job.status === 'unknown' ? 'unknown' : 'failed' }));
+          fail('UNRESOLVED');
+        }
+        await pause();
+      }
+    } catch (caught) {
+      controller.abort(caught);
+      // Do not persist after a stopped authority. A submitted record without an
+      // ID already restores UNKNOWN, even if the POST never left this browser.
+      let changed = false; try { const fresh = authority(getAuthority); synchronous(assertCurrent);
+        changed = fresh.ownerUserId !== captured.ownerUserId || fresh.sessionRevision !== captured.sessionRevision; } catch { changed = true; }
+      const error = failure(changed ? 'AUTHORITY_CHANGED' : failures.get(caught) || 'RESPONSE_INVALID');
+      if (legacyStarted && !changed) {
+        const usage = legacyUsage(own(caught, 'providerUsage'));
+        if (usage) {
+          error.providerUsage = usage;
+          const model = own(caught, 'providerModel'); if (text(model, 160)) error.providerModel = model;
+          error.partialProviderUsage = own(caught, 'partialProviderUsage') === true;
+        }
+      }
+      if (jobId) error.backgroundJobId = jobId;
+      error.submissionState = jobId ? status : handle || claimStarted || legacyStarted ? 'unknown' : 'not-submitted';
+      throw error;
+    } finally { clearTimeout(timer); signal?.removeEventListener('abort', abort); active = false; }
+  } });
+}

package/lib/durable-speech.mjs

@@ -25,7 +25,7 @@ export const durableSpeechToolSchema = Object.freeze({
   text: z.string().min(1).max(10000).describe("전체 내레이션. 최대 5,000자, Supertone은 300자"),
   options: optionsSchema.optional().describe("해당 공급자의 보이스·모델·언어·속도 옵션. 비용 이벤트/실행 상태는 전달하지 마세요."),
 });
-function capture(value) {
+export function captureDurableSpeechInput(value) {
   if (!value || typeof value !== "object" || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) throw invalid();
   const props = Object.getOwnPropertyDescriptors(value);
   if (Reflect.ownKeys(props).some(key => !["requestId", "provider", "text", "options"].includes(key) || !Object.hasOwn(props[key], "value"))) throw invalid();
@@ -50,7 +50,7 @@ function capture(value) {
 /** One JSON submit only. Neither errors nor a missing shared backend may invoke
  * the legacy binary tool, switch provider, or create a replacement request ID. */
 export async function submitDurableSpeech(api, value) {
-  const { requestId, input } = capture(value), base = { generationJobId: requestId, kind: "tts", paidReplayAllowed: false, nextTool: "get_generation_job" };
+  const { requestId, input } = captureDurableSpeechInput(value), base = { generationJobId: requestId, kind: "tts", paidReplayAllowed: false, nextTool: "get_generation_job" };
   try {
     const response = await api.request(GENERATION_JOB_PATH, { method: "POST", timeoutMs: 30000, body: { id: requestId, kind: "tts", input, includePreview: false } });
     if (response?.job?.id !== requestId || response.job.kind !== "tts" || !["pending", "running", "completed", "failed", "interrupted", "cancel_requested", "cancelled"].includes(response.job.status)) throw invalid();

package/lib/durable-voice-contract.mjs

@@ -0,0 +1,62 @@
+// Called only after the enclosing durable contract has made an immutable,
+// bounded plain-JSON snapshot. Catalogs are observations, never credentials.
+export const VOICE_INPUT_FIELDS = Object.freeze(['ttsProvider', 'voiceCatalog', 'topic', 'scriptExcerpt', 'sampleVoiceHints', 'sampleAudioBase64', 'productionProfile']);
+const PROVIDERS = ['typecast', 'elevenlabs', 'supertone', 'edge', 'supertonic2'];
+const PROFILE_FIELDS = ['version', 'categoryId', 'tone', 'deliveryStyle', 'targetDurationSec', 'imageSourceMode', 'visualMotionMode', 'autoComposeEnabled', 'subtitleStylePresetId', 'titleStylePresetId'];
+const invalid = () => { throw new Error('DURABLE_VOICE_CONTRACT_INVALID'); };
+function fields(value, allowed) {
+  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).some(k => !allowed.includes(k))) invalid();
+}
+function text(value, max, required = false) {
+  if (typeof value !== 'string' || value.length > max || required && !value.trim()) invalid();
+}
+export function validateVoiceRecommendationInput(body) {
+  if (!PROVIDERS.includes(body.ttsProvider)) invalid();
+  for (const [key, max] of [['topic', 500], ['scriptExcerpt', 2000], ['sampleVoiceHints', 500]]) if (body[key] !== undefined) text(body[key], max);
+  const audio = body.sampleAudioBase64;
+  if (audio !== undefined && (typeof audio !== 'string' || audio.length > 11_000_000 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u.test(audio))) invalid();
+  if (![body.topic, body.scriptExcerpt, body.sampleVoiceHints, audio].some(v => v?.trim())) invalid();
+  const catalog = body.voiceCatalog;
+  if (!Array.isArray(catalog) || !catalog.length || catalog.length > 250) invalid();
+  const ids = new Set();
+  for (const voice of catalog) {
+    fields(voice, ['voiceId', 'name', 'nameKo', 'age', 'gender', 'language', 'tags']);
+    text(voice.voiceId, 160, true);
+    if (voice.voiceId.trim() !== voice.voiceId || /[\u0000-\u0020\u007f]/u.test(voice.voiceId) || ids.has(voice.voiceId)) invalid();
+    ids.add(voice.voiceId);
+    for (const [key, max] of [['name', 60], ['nameKo', 60], ['age', 24], ['gender', 16], ['language', 24]]) text(voice[key], max);
+    if (!voice.name.trim() && !voice.nameKo.trim() || !Array.isArray(voice.tags) || voice.tags.length > 4) invalid();
+    voice.tags.forEach(tag => text(tag, 40, true));
+  }
+  const profile = body.productionProfile;
+  if (profile != null) {
+    fields(profile, PROFILE_FIELDS);
+    if (profile.version !== 1 || !/^[a-z][a-z0-9-]{0,63}$/u.test(profile.categoryId) || !['casual-social', 'standard', 'news-briefing'].includes(profile.deliveryStyle)
+      || !Number.isFinite(profile.targetDurationSec) || profile.targetDurationSec <= 0 || profile.targetDurationSec > (['community-shorts', 'viral-shorts'].includes(profile.categoryId) ? 180 : 3600)) invalid();
+    if (profile.tone !== undefined) text(profile.tone, 300);
+    if (profile.imageSourceMode !== undefined && !['web', 'ai', 'mixed'].includes(profile.imageSourceMode)
+      || profile.visualMotionMode !== undefined && !['image-motion', 'i2v'].includes(profile.visualMotionMode)
+      || profile.autoComposeEnabled !== undefined && typeof profile.autoComposeEnabled !== 'boolean') invalid();
+    for (const key of ['subtitleStylePresetId', 'titleStylePresetId']) if (profile[key] !== undefined && !/^[a-z][a-z0-9-]{0,63}$/u.test(profile[key])) invalid();
+  }
+}
+export function validateVoiceRecommendationOutput(value) {
+  fields(value, ['ttsProvider', 'recommendations', 'sampleVoiceProfile', 'notes']);
+  if (!PROVIDERS.includes(value.ttsProvider) || !Array.isArray(value.recommendations) || !value.recommendations.length || value.recommendations.length > 3
+    || !Array.isArray(value.notes) || value.notes.length > 5) invalid();
+  value.notes.forEach(note => text(note, 500, true));
+  const ids = new Set();
+  for (const rec of value.recommendations) {
+    fields(rec, ['voiceId', 'name', 'nameKo', 'age', 'gender', 'reason']);
+    for (const [key, max] of [['voiceId', 160], ['name', 60], ['nameKo', 60], ['age', 24], ['gender', 16], ['reason', 300]]) text(rec[key], max, key === 'voiceId');
+    if (ids.has(rec.voiceId)) invalid(); ids.add(rec.voiceId);
+  }
+  const p = value.sampleVoiceProfile;
+  if (p !== null) {
+    const strings = ['ageImpression', 'energy', 'gender', 'mood', 'pace', 'styleSummary', 'tone'];
+    fields(p, [...strings, 'syntheticLikely']);
+    if (Object.keys(p).length !== 8) invalid();
+    for (const key of strings) if (p[key] !== null) text(p[key], 80, true);
+    if (p.syntheticLikely !== null && typeof p.syntheticLikely !== 'boolean') invalid();
+  }
+}