videodraft 0.0.0 → 0.1.0

package/dist/client.js

@@ -0,0 +1,870 @@
+// src/core/errors.ts
+var EXIT = {
+  OK: 0,
+  ERROR: 1,
+  USAGE: 2,
+  AUTH: 3,
+  CREDITS: 4
+};
+var CliError = class extends Error {
+  exitCode;
+  /** One-line remediation shown under the error (human mode only). */
+  hint;
+  constructor(message, exitCode = EXIT.ERROR, hint) {
+    super(message);
+    this.name = "CliError";
+    this.exitCode = exitCode;
+    this.hint = hint;
+  }
+};
+var AuthError = class extends CliError {
+  constructor(message = "Not authenticated.") {
+    super(
+      message,
+      EXIT.AUTH,
+      "Run `videodraft login` (or set VIDEODRAFT_API_KEY to a vd_mcp_... token from /mcp-keys)."
+    );
+    this.name = "AuthError";
+  }
+};
+var RpcError = class extends CliError {
+  code;
+  data;
+  constructor(code, message, data) {
+    super(`RPC error ${code}: ${message}`);
+    this.name = "RpcError";
+    this.code = code;
+    this.data = data;
+  }
+};
+var CREDIT_ERROR_RE = /insufficient credits|not enough credits|credit balance/i;
+var ToolError = class extends CliError {
+  toolName;
+  constructor(toolName, message) {
+    const isCredits = CREDIT_ERROR_RE.test(message);
+    super(
+      message,
+      isCredits ? EXIT.CREDITS : EXIT.ERROR,
+      isCredits ? "Check your balance with `videodraft credits` or top up at https://app.videodraft.ai/pricing" : void 0
+    );
+    this.name = "ToolError";
+    this.toolName = toolName;
+  }
+};
+var TimeoutError = class extends CliError {
+  constructor(message) {
+    super(message, EXIT.ERROR);
+    this.name = "TimeoutError";
+  }
+};
+
+// src/core/config.ts
+import fs from "fs";
+import path from "path";
+import os from "os";
+import crypto from "crypto";
+var DEFAULT_BASE_URL = "https://app.videodraft.ai";
+function configDir(env = process.env) {
+  if (env.VIDEODRAFT_CONFIG_DIR) return env.VIDEODRAFT_CONFIG_DIR;
+  const xdg = env.XDG_CONFIG_HOME;
+  return path.join(xdg && xdg.trim() !== "" ? xdg : path.join(os.homedir(), ".config"), "videodraft");
+}
+function configPath(env = process.env) {
+  return path.join(configDir(env), "config.json");
+}
+function emptyConfig() {
+  return { version: 1, active_profile: "default", profiles: {} };
+}
+function readConfig(env = process.env) {
+  try {
+    const raw = fs.readFileSync(configPath(env), "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || !parsed.profiles) return emptyConfig();
+    return parsed;
+  } catch {
+    return emptyConfig();
+  }
+}
+function writeConfig(config, env = process.env) {
+  const dir = configDir(env);
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  const file = configPath(env);
+  const tmp = path.join(dir, `.config.${process.pid}.${crypto.randomBytes(4).toString("hex")}.tmp`);
+  fs.writeFileSync(tmp, `${JSON.stringify(config, null, 2)}
+`, { mode: 384 });
+  fs.renameSync(tmp, file);
+  try {
+    fs.chmodSync(file, 384);
+  } catch {
+  }
+}
+function updateConfig(mutate, env = process.env) {
+  const config = readConfig(env);
+  mutate(config);
+  writeConfig(config, env);
+  return config;
+}
+function getProfile(name, env = process.env) {
+  const config = readConfig(env);
+  const profileName = name ?? config.active_profile ?? "default";
+  return { name: profileName, profile: config.profiles[profileName], config };
+}
+var LOCK_STALE_MS = 3e4;
+async function withLock(lockName, fn, env = process.env) {
+  const dir = configDir(env);
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  const lockPath = path.join(dir, `${lockName}.lock`);
+  const deadline = Date.now() + 15e3;
+  for (; ; ) {
+    try {
+      const fd = fs.openSync(lockPath, "wx");
+      fs.writeSync(fd, JSON.stringify({ pid: process.pid, at: Date.now() }));
+      fs.closeSync(fd);
+      break;
+    } catch {
+      try {
+        const stat = fs.statSync(lockPath);
+        if (Date.now() - stat.mtimeMs > LOCK_STALE_MS) {
+          fs.rmSync(lockPath, { force: true });
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      if (Date.now() > deadline) {
+        throw new Error(`Timed out waiting for lock ${lockName} (${lockPath})`);
+      }
+      await new Promise((r) => setTimeout(r, 100));
+    }
+  }
+  try {
+    return await fn();
+  } finally {
+    fs.rmSync(lockPath, { force: true });
+  }
+}
+
+// src/core/rpc.ts
+var VideoDraftClient = class {
+  baseUrl;
+  tokenProvider;
+  fetchImpl;
+  userAgent;
+  requestTimeoutMs;
+  nextId = 1;
+  constructor(options) {
+    this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, "");
+    this.tokenProvider = options.tokenProvider;
+    this.fetchImpl = options.fetchImpl ?? fetch;
+    this.userAgent = options.userAgent ?? "videodraft-cli";
+    this.requestTimeoutMs = options.requestTimeoutMs ?? 3e5;
+  }
+  get endpoint() {
+    return `${this.baseUrl}/api/mcp`;
+  }
+  async rpc(method, params) {
+    const token = await this.tokenProvider.getAccessToken();
+    let response = await this.post(method, params, token);
+    if (response.status === 401 && this.tokenProvider.onUnauthorized) {
+      const fresh = await this.tokenProvider.onUnauthorized();
+      if (fresh) response = await this.post(method, params, fresh);
+    }
+    if (response.status === 401) {
+      throw new AuthError("Token is invalid, expired, or revoked.");
+    }
+    if (!response.ok) {
+      let detail = "";
+      try {
+        const body2 = await response.json();
+        detail = body2?.error?.message ?? body2?.error ?? "";
+      } catch {
+      }
+      throw new RpcError(response.status, detail || `HTTP ${response.status} from ${this.endpoint}`);
+    }
+    let body;
+    try {
+      body = await response.json();
+    } catch {
+      throw new RpcError(0, `Server returned a non-JSON response (HTTP ${response.status}).`);
+    }
+    if (body?.error) {
+      throw new RpcError(body.error.code ?? -1, body.error.message ?? "Unknown RPC error", body.error.data);
+    }
+    return body?.result;
+  }
+  post(method, params, token) {
+    return this.fetchImpl(this.endpoint, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${token}`,
+        "user-agent": this.userAgent
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: this.nextId++,
+        method,
+        ...params === void 0 ? {} : { params }
+      }),
+      signal: AbortSignal.timeout(this.requestTimeoutMs)
+    });
+  }
+  /**
+   * Batch several JSON-RPC requests into ONE HTTP round trip (the server
+   * implements JSON-RPC 2.0 batching). With N concurrent jobs this turns N
+   * polling requests per tick into 1 — the difference between 50 waiting CLIs
+   * generating ~17 req/s and ~0.3 req/s against /api/mcp.
+   * Results are matched by id (order-independent per spec).
+   */
+  async rpcBatch(calls) {
+    if (calls.length === 0) return [];
+    const token = await this.tokenProvider.getAccessToken();
+    const ids = calls.map(() => this.nextId++);
+    const payload = calls.map((c, i) => ({
+      jsonrpc: "2.0",
+      id: ids[i],
+      method: c.method,
+      ...c.params === void 0 ? {} : { params: c.params }
+    }));
+    const post = (bearer) => this.fetchImpl(this.endpoint, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${bearer}`,
+        "user-agent": this.userAgent
+      },
+      body: JSON.stringify(payload),
+      signal: AbortSignal.timeout(this.requestTimeoutMs)
+    });
+    let response = await post(token);
+    if (response.status === 401 && this.tokenProvider.onUnauthorized) {
+      const fresh = await this.tokenProvider.onUnauthorized();
+      if (fresh) response = await post(fresh);
+    }
+    if (response.status === 401) throw new AuthError("Token is invalid, expired, or revoked.");
+    if (!response.ok) throw new RpcError(response.status, `HTTP ${response.status} from ${this.endpoint}`);
+    let body;
+    try {
+      body = await response.json();
+    } catch {
+      throw new RpcError(0, `Server returned a non-JSON response (HTTP ${response.status}).`);
+    }
+    const responses = Array.isArray(body) ? body : [body];
+    const byId = new Map(responses.map((r) => [r?.id, r]));
+    return ids.map((id) => {
+      const r = byId.get(id);
+      if (!r) throw new RpcError(-1, `Batch response missing id ${id}`);
+      if (r.error) throw new RpcError(r.error.code ?? -1, r.error.message ?? "Unknown RPC error", r.error.data);
+      return r.result;
+    });
+  }
+  /**
+   * Call several tools in one batched HTTP request. Per-item failures come
+   * back as { ok:false, error } instead of throwing, so one failed job can't
+   * abort polling of its siblings.
+   */
+  async callToolBatch(calls) {
+    const results = await this.rpcBatch(
+      calls.map((c) => ({ method: "tools/call", params: { name: c.name, arguments: c.args ?? {} } }))
+    );
+    return results.map((result) => {
+      const text = result?.content?.[0]?.text ?? "";
+      if (result?.isError) {
+        return { ok: false, error: text.replace(/^Error:\s*/, "") || "tool failed" };
+      }
+      try {
+        return { ok: true, result: JSON.parse(text) };
+      } catch {
+        return { ok: true, result: text };
+      }
+    });
+  }
+  /**
+   * Call an MCP tool and return its parsed result.
+   * The server wraps results as { content: [{type:"text", text}], isError } —
+   * text is JSON for successes and "Error: ..." for tool failures.
+   */
+  async callTool(name, args = {}) {
+    const result = await this.rpc(
+      "tools/call",
+      { name, arguments: args }
+    );
+    const text = result?.content?.[0]?.text ?? "";
+    if (result?.isError) {
+      throw new ToolError(name, text.replace(/^Error:\s*/, "") || `Tool ${name} failed`);
+    }
+    try {
+      return JSON.parse(text);
+    } catch {
+      return text;
+    }
+  }
+  async listTools() {
+    const result = await this.rpc("tools/list");
+    return result?.tools ?? [];
+  }
+  async ping() {
+    await this.rpc("ping");
+  }
+};
+function staticTokenProvider(token) {
+  return {
+    async getAccessToken() {
+      if (!token) throw new AuthError();
+      return token;
+    }
+  };
+}
+
+// src/auth/oauth.ts
+import http from "http";
+import crypto2 from "crypto";
+var STATIC_CLI_CLIENT_ID = "vd_client_cli";
+var OAUTH_SCOPE = "mcp";
+function b64url(buf) {
+  return buf.toString("base64url");
+}
+function createPkcePair() {
+  const verifier = b64url(crypto2.randomBytes(32));
+  const challenge = b64url(crypto2.createHash("sha256").update(verifier).digest());
+  return { verifier, challenge };
+}
+function buildAuthorizeUrl(params) {
+  const url = new URL("/api/oauth/authorize", params.baseUrl);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", params.clientId);
+  url.searchParams.set("redirect_uri", params.redirectUri);
+  url.searchParams.set("scope", OAUTH_SCOPE);
+  url.searchParams.set("state", params.state);
+  url.searchParams.set("code_challenge", params.codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("resource", `${params.baseUrl}/api/mcp`);
+  return url.toString();
+}
+async function probeClientId(baseUrl, clientId, redirectUri, fetchImpl = fetch) {
+  const { challenge } = createPkcePair();
+  const url = buildAuthorizeUrl({
+    baseUrl,
+    clientId,
+    redirectUri,
+    state: "probe",
+    codeChallenge: challenge
+  });
+  const res = await fetchImpl(url, { redirect: "manual", signal: AbortSignal.timeout(15e3) });
+  return res.status >= 300 && res.status < 400;
+}
+async function registerCliClient(baseUrl, fetchImpl = fetch) {
+  const res = await fetchImpl(new URL("/api/oauth/register", baseUrl), {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      client_name: "VideoDraft CLI",
+      redirect_uris: ["http://127.0.0.1/callback"],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none",
+      scope: OAUTH_SCOPE
+    }),
+    signal: AbortSignal.timeout(15e3)
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || !body?.client_id) {
+    throw new CliError(
+      `OAuth client registration failed: ${body?.error_description ?? body?.error ?? res.status}`
+    );
+  }
+  return body.client_id;
+}
+async function authorizeViaLoopback(params) {
+  const { verifier, challenge } = createPkcePair();
+  const state = b64url(crypto2.randomBytes(16));
+  const server = http.createServer();
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  const port = server.address().port;
+  const redirectUri = `http://127.0.0.1:${port}/callback`;
+  const codePromise = new Promise((resolve, reject) => {
+    const timeout = setTimeout(
+      () => reject(new CliError("Timed out waiting for the browser login (5 minutes).")),
+      params.timeoutMs ?? 3e5
+    );
+    timeout.unref();
+    server.on("request", (req, res) => {
+      const url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
+      if (url.pathname !== "/callback") {
+        res.writeHead(404).end();
+        return;
+      }
+      const err = url.searchParams.get("error");
+      const code = url.searchParams.get("code");
+      const gotState = url.searchParams.get("state");
+      const page = (title, body) => `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head><body style="font-family:system-ui,sans-serif;max-width:480px;margin:80px auto;padding:0 20px;text-align:center"><h1 style="font-size:20px">${title}</h1><p style="color:#555">${body}</p></body></html>`;
+      if (err) {
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+        res.end(page("Login failed", `${err}. You can close this tab and return to the terminal.`));
+        clearTimeout(timeout);
+        reject(new CliError(`Authorization failed: ${err}`));
+        return;
+      }
+      if (!code || gotState !== state) {
+        res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+        res.end(page("Login failed", "Missing code or state mismatch. Close this tab and retry."));
+        clearTimeout(timeout);
+        reject(new CliError("Authorization response missing code or state mismatch."));
+        return;
+      }
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+      res.end(page("You're logged in to VideoDraft", "You can close this tab and return to the terminal."));
+      clearTimeout(timeout);
+      resolve(code);
+    });
+  });
+  codePromise.catch(() => {
+  });
+  try {
+    const authorizeUrl = buildAuthorizeUrl({
+      baseUrl: params.baseUrl,
+      clientId: params.clientId,
+      redirectUri,
+      state,
+      codeChallenge: challenge
+    });
+    await params.onAuthorizeUrl(authorizeUrl);
+    const code = await codePromise;
+    return { code, redirectUri, verifier };
+  } finally {
+    server.close();
+  }
+}
+async function exchangeCode(params) {
+  const fetchImpl = params.fetchImpl ?? fetch;
+  const res = await fetchImpl(new URL("/api/oauth/token", params.baseUrl), {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      code: params.code,
+      redirect_uri: params.redirectUri,
+      client_id: params.clientId,
+      code_verifier: params.verifier
+    }).toString(),
+    signal: AbortSignal.timeout(3e4)
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || !body?.access_token) {
+    throw new CliError(
+      `Token exchange failed: ${body?.error_description ?? body?.error ?? `HTTP ${res.status}`}`
+    );
+  }
+  return body;
+}
+async function refreshAccessToken(params) {
+  const fetchImpl = params.fetchImpl ?? fetch;
+  const res = await fetchImpl(new URL("/api/oauth/token", params.baseUrl), {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: params.refreshToken,
+      client_id: params.clientId
+    }).toString(),
+    signal: AbortSignal.timeout(3e4)
+  });
+  if (!res.ok) return null;
+  const body = await res.json().catch(() => null);
+  return body?.access_token ? body : null;
+}
+async function revokeToken(baseUrl, token, fetchImpl = fetch) {
+  try {
+    await fetchImpl(new URL("/api/oauth/revoke", baseUrl), {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ token }).toString(),
+      signal: AbortSignal.timeout(1e4)
+    });
+  } catch {
+  }
+}
+
+// src/auth/token-provider.ts
+var EXPIRY_SKEW_MS = 6e4;
+function isExpiring(profile) {
+  if (!profile.expires_at) return false;
+  return new Date(profile.expires_at).getTime() - Date.now() < EXPIRY_SKEW_MS;
+}
+function saveRotatedTokens(profileName, tokens, env) {
+  updateConfig((config) => {
+    const profile = config.profiles[profileName];
+    if (!profile) return;
+    profile.access_token = tokens.access_token;
+    profile.refresh_token = tokens.refresh_token;
+    profile.expires_at = new Date(Date.now() + tokens.expires_in * 1e3).toISOString();
+  }, env);
+}
+async function refreshUnderLock(profileName, env) {
+  return withLock(
+    "oauth-refresh",
+    async () => {
+      const { profile } = getProfile(profileName, env);
+      if (!profile) return null;
+      if (profile.auth_kind !== "oauth") return profile.access_token;
+      if (!isExpiring(profile)) return profile.access_token;
+      if (!profile.refresh_token || !profile.client_id) return null;
+      const tokens = await refreshAccessToken({
+        baseUrl: profile.base_url || DEFAULT_BASE_URL,
+        clientId: profile.client_id,
+        refreshToken: profile.refresh_token
+      });
+      if (!tokens) return null;
+      saveRotatedTokens(profileName, tokens, env);
+      return tokens.access_token;
+    },
+    env
+  );
+}
+function profileTokenProvider(profileName, env = process.env) {
+  return {
+    async getAccessToken() {
+      const { profile } = getProfile(profileName, env);
+      if (!profile?.access_token) throw new AuthError();
+      if (profile.auth_kind === "oauth" && isExpiring(profile)) {
+        const fresh = await refreshUnderLock(profileName, env);
+        if (!fresh) throw new AuthError("Your session expired and could not be refreshed.");
+        return fresh;
+      }
+      return profile.access_token;
+    },
+    async onUnauthorized() {
+      const { profile } = getProfile(profileName, env);
+      if (profile?.auth_kind !== "oauth") return null;
+      updateConfig((config) => {
+        const p = config.profiles[profileName];
+        if (p) p.expires_at = (/* @__PURE__ */ new Date(0)).toISOString();
+      }, env);
+      return refreshUnderLock(profileName, env);
+    }
+  };
+}
+function resolveAuth(options) {
+  const env = options.env ?? process.env;
+  const envBase = env.VIDEODRAFT_BASE_URL;
+  if (options.token) {
+    return {
+      tokenProvider: { getAccessToken: async () => options.token },
+      baseUrl: options.baseUrl ?? envBase ?? DEFAULT_BASE_URL,
+      source: "flag"
+    };
+  }
+  if (env.VIDEODRAFT_API_KEY) {
+    return {
+      tokenProvider: { getAccessToken: async () => env.VIDEODRAFT_API_KEY },
+      baseUrl: options.baseUrl ?? envBase ?? DEFAULT_BASE_URL,
+      source: "env"
+    };
+  }
+  const { name, profile } = getProfile(options.profile, env);
+  return {
+    tokenProvider: profileTokenProvider(name, env),
+    baseUrl: options.baseUrl ?? envBase ?? profile?.base_url ?? DEFAULT_BASE_URL,
+    source: "profile",
+    profileName: name
+  };
+}
+
+// src/core/poll.ts
+function nextPollDelay(baseMs, elapsedMs, adaptive = true) {
+  if (!adaptive) return baseMs;
+  const factor = elapsedMs >= 18e4 ? 3 : elapsedMs >= 6e4 ? 2 : 1;
+  const scaled = Math.min(baseMs * factor, 15e3);
+  const jitter = scaled * 0.1 * (Math.random() * 2 - 1);
+  return Math.max(250, Math.round(scaled + jitter));
+}
+var GENERATION_TERMINAL = /* @__PURE__ */ new Set(["completed", "failed"]);
+var EXPORT_TERMINAL = /* @__PURE__ */ new Set(["finished", "failed"]);
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+function extractOutputUrls(payload) {
+  const urls = [];
+  const push = (value) => {
+    if (typeof value === "string" && /^https?:\/\//.test(value)) urls.push(value);
+  };
+  if (Array.isArray(payload?.outputUrls)) payload.outputUrls.forEach(push);
+  if (Array.isArray(payload?.output_urls)) payload.output_urls.forEach(push);
+  push(payload?.outputUrl);
+  push(payload?.output_url);
+  push(payload?.video_url);
+  push(payload?.videoUrl);
+  push(payload?.image_url);
+  push(payload?.imageUrl);
+  push(payload?.url);
+  push(payload?.audio_url);
+  push(payload?.audioUrl);
+  push(payload?.speech_url);
+  push(payload?.public_url);
+  return [...new Set(urls)];
+}
+async function pollGeneration(client, jobId, options = {}) {
+  const intervalMs = options.intervalMs ?? 3e3;
+  const timeoutMs = options.timeoutMs ?? 6e5;
+  const startedAt = Date.now();
+  const deadline = startedAt + timeoutMs;
+  for (; ; ) {
+    const payload = await client.callTool("check_generation_status", { job_id: jobId });
+    const status = String(payload?.status ?? "unknown");
+    options.onTick?.(status, payload);
+    if (GENERATION_TERMINAL.has(status)) {
+      return { status, outputUrls: extractOutputUrls(payload), payload };
+    }
+    if (Date.now() > deadline) {
+      throw new TimeoutError(
+        `Timed out after ${Math.round(timeoutMs / 1e3)}s waiting for job ${jobId} (last status: ${status}). It is still running server-side \u2014 check later with: videodraft status ${jobId}`
+      );
+    }
+    await sleep(nextPollDelay(intervalMs, Date.now() - startedAt, options.adaptive));
+  }
+}
+async function pollGenerationsBatch(client, jobIds, options = {}) {
+  const intervalMs = options.intervalMs ?? 3e3;
+  const timeoutMs = options.timeoutMs ?? 6e5;
+  const startedAt = Date.now();
+  const deadline = startedAt + timeoutMs;
+  const done = /* @__PURE__ */ new Map();
+  let pending = [...new Set(jobIds)];
+  const MAX_BATCH = 25;
+  while (pending.length > 0) {
+    const replies = [];
+    for (let at = 0; at < pending.length; at += MAX_BATCH) {
+      const chunk = pending.slice(at, at + MAX_BATCH);
+      replies.push(
+        ...await client.callToolBatch(
+          chunk.map((id) => ({ name: "check_generation_status", args: { job_id: id } }))
+        )
+      );
+    }
+    const still = [];
+    for (let i = 0; i < pending.length; i++) {
+      const jobId = pending[i];
+      const reply = replies[i];
+      if (!reply.ok) {
+        const result = {
+          status: "failed",
+          outputUrls: [],
+          payload: { error: reply.error }
+        };
+        done.set(jobId, result);
+        options.onJobDone?.(jobId, result);
+        continue;
+      }
+      const payload = reply.result;
+      const status = String(payload?.status ?? "unknown");
+      if (GENERATION_TERMINAL.has(status)) {
+        const result = { status, outputUrls: extractOutputUrls(payload), payload };
+        done.set(jobId, result);
+        options.onJobDone?.(jobId, result);
+      } else {
+        still.push(jobId);
+      }
+    }
+    pending = still;
+    options.onTick?.(`${done.size}/${jobIds.length} done`, { pending: pending.length });
+    if (pending.length === 0) break;
+    if (Date.now() > deadline) {
+      throw new TimeoutError(
+        `Timed out after ${Math.round(timeoutMs / 1e3)}s with ${pending.length} job(s) still running: ${pending.join(", ")}. They continue server-side \u2014 resume with: videodraft wait ${pending.join(" ")}`
+      );
+    }
+    await sleep(nextPollDelay(intervalMs, Date.now() - startedAt, options.adaptive));
+  }
+  return done;
+}
+async function pollExport(client, ref, options = {}) {
+  const intervalMs = options.intervalMs ?? 5e3;
+  const timeoutMs = options.timeoutMs ?? 12e5;
+  const startedAt = Date.now();
+  const deadline = startedAt + timeoutMs;
+  for (; ; ) {
+    const payload = await client.callTool("check_export_status", {
+      ...ref.exportId ? { export_id: ref.exportId } : {},
+      ...ref.projectId ? { project_id: ref.projectId } : {}
+    });
+    const status = String(payload?.status ?? "unknown");
+    options.onTick?.(status, payload);
+    if (EXPORT_TERMINAL.has(status)) {
+      return { status, videoUrl: payload?.video_url ?? payload?.videoUrl, payload };
+    }
+    if (Date.now() > deadline) {
+      throw new TimeoutError(
+        `Timed out waiting for export${ref.exportId ? ` ${ref.exportId}` : ""} (last status: ${status}).`
+      );
+    }
+    await sleep(nextPollDelay(intervalMs, Date.now() - startedAt, options.adaptive));
+  }
+}
+async function pollGenerations(client, jobIds, options = {}) {
+  return Promise.all(jobIds.map((id) => pollGeneration(client, id, options)));
+}
+
+// src/core/download.ts
+import fs2 from "fs";
+import path2 from "path";
+import { pipeline } from "stream/promises";
+import { Readable } from "stream";
+function extFromUrl(url, fallback = "bin") {
+  try {
+    const pathname = new URL(url).pathname;
+    const ext = path2.extname(pathname).replace(/^\./, "");
+    return ext || fallback;
+  } catch {
+    return fallback;
+  }
+}
+function renderTemplate(template, vars) {
+  const hasPlaceholders = /\{(job_id|index|ext|name)\}/.test(template);
+  if (!hasPlaceholders) {
+    const looksLikeFile = path2.extname(template) !== "";
+    if (looksLikeFile) {
+      if (vars.index > 0) {
+        const ext = path2.extname(template);
+        return `${template.slice(0, -ext.length)}_${vars.index}${ext}`;
+      }
+      return template;
+    }
+    return path2.join(template, `${vars.job_id ?? vars.name ?? "output"}_${vars.index}.${vars.ext}`);
+  }
+  return template.replaceAll("{job_id}", vars.job_id ?? "job").replaceAll("{index}", String(vars.index)).replaceAll("{ext}", vars.ext).replaceAll("{name}", vars.name ?? "output");
+}
+async function downloadUrl(url, destPath, fetchImpl = fetch) {
+  const res = await fetchImpl(url, { signal: AbortSignal.timeout(6e5) });
+  if (!res.ok || !res.body) {
+    throw new CliError(`Download failed (HTTP ${res.status}): ${url}`);
+  }
+  fs2.mkdirSync(path2.dirname(path2.resolve(destPath)), { recursive: true });
+  await pipeline(Readable.fromWeb(res.body), fs2.createWriteStream(destPath));
+  const bytes = fs2.statSync(destPath).size;
+  return { url, path: destPath, bytes };
+}
+async function downloadOutputs(urls, template, vars, fetchImpl = fetch) {
+  const files = [];
+  for (let i = 0; i < urls.length; i++) {
+    const url = urls[i];
+    const dest = renderTemplate(template, {
+      job_id: vars.job_id,
+      name: vars.name,
+      index: i,
+      ext: extFromUrl(url)
+    });
+    files.push(await downloadUrl(url, dest, fetchImpl));
+  }
+  return files;
+}
+
+// src/core/upload.ts
+import fs3 from "fs";
+import path3 from "path";
+var MIME_BY_EXT = {
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  webp: "image/webp",
+  gif: "image/gif",
+  heic: "image/heic",
+  mp4: "video/mp4",
+  mov: "video/quicktime",
+  webm: "video/webm",
+  m4v: "video/x-m4v",
+  mp3: "audio/mpeg",
+  wav: "audio/wav",
+  m4a: "audio/mp4",
+  aac: "audio/aac",
+  ogg: "audio/ogg",
+  flac: "audio/flac"
+};
+function guessContentType(filename) {
+  const ext = path3.extname(filename).replace(/^\./, "").toLowerCase();
+  return MIME_BY_EXT[ext];
+}
+async function uploadFile(client, localPath, options = {}) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const resolved = path3.resolve(localPath);
+  if (!fs3.existsSync(resolved)) {
+    throw new CliError(`File not found: ${resolved}`);
+  }
+  const filename = path3.basename(resolved);
+  const contentType = options.contentType ?? guessContentType(filename);
+  if (!contentType) {
+    throw new CliError(
+      `Cannot infer media type for "${filename}". Pass --content-type (image/*, video/* or audio/*).`
+    );
+  }
+  const created = await client.callTool("create_media_upload", {
+    filename,
+    content_type: contentType
+  });
+  const uploadUrl = created?.upload_url;
+  const filePath = created?.file_path;
+  if (!uploadUrl || !filePath) {
+    throw new CliError("create_media_upload did not return upload_url/file_path.");
+  }
+  const body = fs3.readFileSync(resolved);
+  const putRes = await fetchImpl(uploadUrl, {
+    method: "PUT",
+    headers: { "content-type": contentType },
+    body,
+    signal: AbortSignal.timeout(6e5)
+  });
+  if (!putRes.ok) {
+    throw new CliError(`Upload PUT failed (HTTP ${putRes.status}). The presigned URL may have expired \u2014 retry.`);
+  }
+  const finalized = await client.callTool("finalize_media_upload", {
+    file_path: filePath,
+    original_filename: filename
+  });
+  const url = finalized?.url ?? finalized?.cdn_url;
+  if (!url) {
+    throw new CliError("finalize_media_upload did not return a public url.");
+  }
+  return { ...finalized, url, file_path: filePath };
+}
+export {
+  AuthError,
+  CliError,
+  DEFAULT_BASE_URL,
+  EXIT,
+  RpcError,
+  STATIC_CLI_CLIENT_ID,
+  TimeoutError,
+  ToolError,
+  VideoDraftClient,
+  authorizeViaLoopback,
+  buildAuthorizeUrl,
+  configDir,
+  configPath,
+  createPkcePair,
+  downloadOutputs,
+  downloadUrl,
+  exchangeCode,
+  extFromUrl,
+  extractOutputUrls,
+  getProfile,
+  guessContentType,
+  nextPollDelay,
+  pollExport,
+  pollGeneration,
+  pollGenerations,
+  pollGenerationsBatch,
+  probeClientId,
+  profileTokenProvider,
+  readConfig,
+  refreshAccessToken,
+  registerCliClient,
+  renderTemplate,
+  resolveAuth,
+  revokeToken,
+  staticTokenProvider,
+  updateConfig,
+  uploadFile,
+  writeConfig
+};